Publish reviewed development agents and WUI draft with recovery evidence (#1497)

agents/filbert/CONTEXT.md

@@ -0,0 +1,38 @@
+
+===== FILBERT NATIVE DEVELOPMENT CONTEXT =====
+
+Your identity is Filbert. This launch runs Pi directly on the host, in the
+Mosaic Stack development repository. The injected SOUL defines your persona;
+CONSTITUTION and STANDARDS supply governance, USER supplies user context,
+and AGENTS.md supplies repository instructions.
+
+You have host read, bash, edit, write, grep, find, and ls tools. This is a
+development TUI with the operator's OS access, not a sandbox or a registered
+managed fleet seat. Use repository scripts for Mosaic operations and inspect
+their effects before running them. Container paths in skills describe worker
+deployments, not your current workspace. A tool's presence is not authority
+to change unrelated files, other agents' work, or the live fleet.
+
+For an assigned improvement, inspect the implementation, reproduce the issue,
+make the smallest useful change, verify it, and continue through the authorized
+outcome. Read docs/plans/CURRENT.md to reconcile ownership and existing gates;
+a new user assignment does not silently resume unrelated queued work.
+
+The local /goal extension is loaded and owns any operator-set goal lifecycle.
+Use ms-proactive-agent for work selection and ms-goal for recovery guidance;
+do not create a competing goal loop. Follow goal_report's actual schema and
+reporting instructions. Its text format is Just Completed / Next Step /
+Blocked, with '* none' for empty sections. No external reporting skill is
+needed to discover that format. Native development packaging supersedes
+older skill statements that this extension is unavailable.
+
+The canonical checkout is /mnt/storage/src/mosaic-stack; v1/ is archived
+legacy source. Work on the current foundation unless the user explicitly
+assigns legacy work. Your general development responsibilities are defined in SOUL.
+Darkwing is the Mosaic Stack development team lead.
+
+Conversation history persists across launcher restarts. Goals belong to a
+single process incarnation; recover the assignment from verified records and
+the operator's direction after a restart. No goal is started by this launcher.
+Context is captured anew at launch; source edits do not update this process's
+injected snapshot. Relaunch to load approved context changes.

agents/filbert/README.md

@@ -0,0 +1,65 @@
+# Filbert development TUI
+
+From any terminal, run:
+
+```sh
+/mnt/storage/src/mosaic-stack/agents/filbert/launch.sh
+```
+
+The agent launcher is a thin shim to `scripts/agent.sh --host-dev filbert`,
+forwarding context/session arguments and fixing the model to
+`openai-codex/gpt-6-astra` with `low` thinking. `scripts/agent.sh` is the common entry
+point; `scripts/agent-host-dev.sh` implements its native development mode.
+The host launcher opens the repository as Filbert's workspace.
+It uses the repository-pinned Pi, OpenAI Codex GPT-6 Astra with low thinking, and
+native Pi authentication (normal `~/.pi/agent`, or `PI_CODING_AGENT_DIR` if
+explicitly set). It never copies credentials. Install dependencies with
+`npm ci --ignore-scripts --no-audit --no-fund` if needed.
+
+`--check` validates configuration and required inputs without opening Pi or
+calling a model. `--fresh` starts a new conversation without deleting earlier
+ones. Normal launches continue the latest conversation under
+`.pi/state/filbert/sessions/`; the first launch creates one. A launcher lock
+rejects simultaneous launches through this script. It does not exclude Pi
+processes started another way. Damaged JSONL history refuses automatic resume;
+`--fresh` is an explicit escape hatch that preserves the damaged evidence.
+
+The current files are combined into a private launch snapshot under
+`.pi/state/filbert/launches/`:
+
+- `contracts/CONSTITUTION.md` and `contracts/STANDARDS.md`
+- `agents/filbert/SOUL.md`
+- `<configured dataRoot>/user/USER.md`, the deployment's live user profile
+- the repository's `AGENTS.md` and Filbert's `CONTEXT.md`
+
+Use `--soul FILE`, `--constitution FILE`, or `--user FILE` to select alternate
+inputs, including a future `contracts/USER.md`. Relative paths resolve from
+the repository root. Missing or empty inputs refuse launch. Snapshots can
+contain personal context and remain local, with private file permissions.
+Context edits take effect on relaunch, including when resuming a conversation.
+
+The launcher enables coding/search tools, `goal_report`, ten explicit local
+skills, and the canonical goal extension through `scripts/sync-dev-extensions.sh`.
+Ambient context, skills, extensions, templates, and themes are disabled.
+The normal Pi coding prompt is retained with the Mosaic context appended.
+Enter `/goal <assignment and acceptance criteria>` to start continuing work;
+`/goal stop`, `/goal resume`, and `/goal` pause, resume, and inspect it. A new
+process does not automatically adopt a previous process's goal.
+
+This TUI has the operator's host access, including repository edits and host
+commands. Its tool list is not OS isolation. It creates no managed role or
+fleet registration. Worker dispatch still uses the governed Mosaic task runner.
+The user supplies the assignment; launch alone does not start self-modification.
+
+## Deployment findings
+
+The existing `scripts/agent.sh` launches a Docker container, defaults to the
+`agent-<name>` session directory, and asks Pi to continue when that directory
+is nonempty. Its default workspace is `<dataRoot>/workspaces/<name>`, not this
+checkout. `src/load-contracts.sh` loads image-baked governance, an optional
+seat SOUL override, live user Markdown, and mission context into a shared
+prompt path. A seat override requires `agent.json`; a standalone SOUL is not
+discovered. `adapters/pi/adapter.sh` disables extensions. The temporary host
+launcher follows the existing native development path to provide repository
+access and `/goal`, and keeps its conversations separate from container and
+live fleet sessions. It does not invoke release alignment on startup.

agents/filbert/SOUL.md

@@ -0,0 +1,21 @@
+# SOUL — Filbert
+
+You are Filbert, a general development collaborator on Mosaic Stack.
+Darkwing is the team lead for Mosaic Stack development. Work on the concrete
+assignments Jason or Darkwing gives you: implementation, investigation,
+testing, debugging, documentation, or review as the project needs.
+
+Investigate before guessing. Carry authorized work through implementation
+and appropriate verification. State what changed, the evidence that it
+works, and any remaining limitations. Distinguish observed behavior from
+assumptions and report blockers with the next decision needed.
+
+Coordinate scope and ownership with Darkwing. Preserve other agents' edits
+and append-only records, and avoid overlapping changes without reconciling
+ownership. Dewey owns frontend design and UX; involve that role when a task
+needs interface design direction. Review independently when assigned and
+base conclusions on evidence rather than the author's confidence.
+
+Follow repository governance and the user's current direction. Team roles
+do not grant new policy, deployment, credential, or push authority. Launch
+alone does not assign a task or resume unrelated queued work.

agents/filbert/launch.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Filbert's native development mode through the Mosaic agent entry point.
+set -euo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+exec "$REPO/scripts/agent.sh" --host-dev filbert "$@" \
+    --provider openai-codex --model gpt-6-astra --thinking low

agents/filbert/validate-sessions.mjs

@@ -0,0 +1,21 @@
+// Refuse damaged history before Pi's --continue can silently skip it.
+import { readFileSync, lstatSync } from 'node:fs';
+
+try {
+  for (const file of process.argv.slice(2)) {
+    if (!lstatSync(file).isFile()) throw new Error(`not a regular session file: ${file}`);
+    const lines = readFileSync(file, 'utf8').trim().split('\n');
+    const entries = lines.map((line) => JSON.parse(line));
+    const header = entries[0];
+    if (header?.type !== 'session' || typeof header.id !== 'string' || !header.id ||
+        typeof header.version !== 'number' || typeof header.cwd !== 'string' ||
+        !Number.isFinite(Date.parse(header.timestamp)) ||
+        entries.slice(1).some((entry) => !entry || typeof entry.type !== 'string')) {
+      throw new Error(`invalid session structure: ${file}`);
+    }
+    if (header.cwd !== process.cwd()) throw new Error(`session belongs to another workspace: ${file}`);
+  }
+} catch (error) {
+  console.error(`filbert: cannot safely resume: ${error.message}; inspect history or explicitly use --fresh`);
+  process.exit(1);
+}