feat(prompts): add scope-owned prompt management

[Teingi]

Which issue or RFC does this PR close?

Closes #1465.

Implements the Scope-owned prompt management design in #1468.

Rationale for this change

Agents and users need different memory extraction rules without bypassing PowerContext's Scope isolation. The same requirement applies to other built-in generation and reranking operations. This change makes operational prompts Scope-owned, versioned Artifacts while preserving server-owned schemas, evidence checks, model settings, and authority boundaries.

What changes are included in this PR?

• Register the prompt Artifact family for memory.extract, memory.rerank, experience.incubate, experience.generate, skill.generate, and handoff.generate.

• Support Auto/custom modes and strict content containing schema_version, mode, instructions, and ordered typed demonstrations with input and expected_output. Validate operation-specific reference and output semantics as well as JSON structure.

• Reuse existing Artifact storage and conditional writes: no new database tables. Provide signed, Scope-bound revision-history pagination; restoring an old revision creates a new revision rather than moving the head backward.

• Resolve and freeze the effective prompt for an operation and its retries, including before coarse memory retrieval. Preserve injected-component interfaces and expose supported/disabled/injected capabilities.

• Record bounded prompt identity and digest metadata without adding prompt bodies to tracing. Preserve exact configuration lineage on generated Artifacts, and use signed generation receipts for Handoff prepare/finalize/commit attribution. Prompt configuration is not factual evidence.

• Add the /prompts Dashboard with Scope selection, instructions, positive/negative case groups, unsaved case generation, version history, restore, and ETag conflict handling.

• Update OpenAPI, generated Python models/operations, the HTTP client, and integration operation tables. The only two new HTTP operations are:

  • GET /v1/scopes/{scope_id}/artifacts/{family}/{artifact_id}/revisions
  • POST /v1/scopes/{scope_id}/prompts/{prompt_key}/demonstrations

• Include two fixes exercised by real-provider acceptance: use SQLite lastrowid instead of unsupported INSERT ... RETURNING on older SQLite, and validate generated Skill package constraints inside the existing bounded LLM retry loop.

Are there any user-facing changes?

• Prompt customization is available through existing Artifact CRUD, the two operations above, and the Dashboard. Agent/user ownership continues to resolve through existing Scope bindings; there is no separate ownership or precedence model.
• Prompt creation adds a required top-level prompt_key for family=prompt. Existing families retain their request shapes; replacement remains path-selected and accepts content.
• Positive/negative case grouping is a UI concern, not a second persisted schema. Generated demonstrations remain unsaved until explicitly saved.
• Existing Auto behavior and manual Handoff creation remain supported. Customization cannot override server-enforced output schemas, evidence integrity, or execution authority.
• No database schema migration or dependency change is required. Handoff receipt verification also accepts a bounded list of retained signing secrets for key rotation.

How was this change tested?

Local validation used Python 3.11.13 and Node 22.22.3. These are local results, not a claim that remote CI has passed.

Passed:

• Final focused regression: 105 passed, 1 skipped:

  UV_PYTHON=3.11 uv run --locked python -m pytest \
    tests/builtin/artifacts/prompt tests/builtin/artifacts/handoff \
    tests/builtin/artifacts/skill/test_generation.py \
    tests/builtin/persistence/test_prompt_records.py \
    tests/e2e/test_prompt_management_api.py \
    tests/e2e/test_handoff_prompt_provenance_api.py \
    tests/e2e/test_candidate_review.py tests/e2e/test_observability.py \
    tests/test_dashboard.py -q --tb=short

• UV_PYTHON=3.11 make contract-test: 38 passed, including generated-code freshness checks.

• UV_PYTHON=3.11 uv run --locked ty check src tests: passed.

• Formatting/lint and the non-type pre-commit hooks: passed; git diff --check: passed.

• DSH build and full plugin tests: 75 passed. Pi tests: 48 passed with --testTimeout=30000; Pi TypeScript checking passed.

• Built the wheel and verified that the prompt modules and Dashboard assets are packaged.

• Real LLM and embeddings with both the configured OceanBase database and SQLite: 2 passed:

  UV_PYTHON=3.11 uv run --locked python -m pytest \
    tests/e2e/test_prompt_management_live.py --run-real-e2e -q -s

  The opt-in test reads local .env configuration, creates isolated Scopes, exercises all six operations, checks isolation/version restore/lineage, and cleans up only its own Scopes and derived indexes. No credentials or local configuration are included in this PR.

• Real browser checks covered generated cases remaining unsaved, saving, Auto mode, restoring a historical revision, Scope isolation, unsupported operations, stale-ETag conflict handling that preserves edits, Chinese UI, and a narrow mobile viewport.

Known validation limitations:

• The broad Python run, excluding tests/e2e/test_opencode_plugin_host.py, finished with 1379 passed, 1 failed, 19 skipped. The failure was the 10-second subprocess startup timeout in test_recorded_virtualenv_python_can_import_service_launcher. That test also failed in the clean-master comparison; the complete current tests/test_service.py module passed separately (90 passed, 1 skipped).
• Repository-wide ty check reports three existing scripts.scope_binding import errors in the Codex hooks. They were reproduced on clean master; implementation and test type checking passes. Only that known failing type hook is skipped for the commit.
• OpenCode's existing queryString reference error and the real-host failure were also reproduced on clean master. They are not changed by this PR; its generated source operation table is updated, without an unrelated bundle rebuild.
• The full supported-Python-version tox matrix and documentation-site build were not run.

AI usage statement

OpenAI Codex assisted with implementation, regression tests, real-provider and browser validation, and preparation of this PR. The changes require maintainer review; AI assistance is not a substitute for review or CI.

[Teingi]