arch(ws-15): add prompt context assembly

[henrypark133]

Context

Prompt/identity context assembly branch. It adds the host-side identity-context source needed by planned loops while preserving prompt authority in the host.

Master spec: docs/reborn/agent-loop-skeleton.md
Workstream brief: docs/reborn/agent-loop-briefs/prompt-context-assembly.md
Stack base: arch/ws-8

Latest stack maintenance on 2026-05-14:

• Rebased this branch onto its current stack base after the WS0 prompt-authority fix and the follow-up WS8/WS14-parent/WS16/WS17 conflict resolutions.
• Pushed the updated branch with force-with-lease where the remote already existed, or published it as a new branch where it did not.
• Verified the final ancestry chain from origin/reborn-integration through WS17 before publishing the PR descriptions.

What landed

• Host identity context source trait and support wiring.
• Prompt bundle assembly updates so identity messages flow through LoopContextBundle rather than strategy-owned file loading.
• Prompt authority tests around identity context materialization and sanitized summary behavior.
• Integration with existing skill/transcript context sources without duplicating their responsibilities.
• Export/wiring fixes needed by the integrated WS14-parent branch.

Reviewer focus

• Identity file/content loading should stay host-owned; strategies only request prompt shape.
• Summary-only rows must use safe summaries and deterministic refs where required.
• The branch should not let product/runtime code bypass the prompt port contract.

Non-goals / deferred work

• WS0 owns base prompt-bundle field additions.
• WS7/WS8 own planned-driver integration tests.
• WS17 owns product-live proof.

Validation

• git diff --check
• Included in arch/ws-14-parent validation: multi-crate cargo check with ironclaw_agent_loop/test-support.
• Prompt authority was rechecked through the WS0 and WS8 targeted suites after the stack rebase.

Stack position

[#3550 ws-0] state/checkpoint foundation -> reborn-integration
   |-- #3551 ws-1 strategy alpha -> ws-0
   |-- #3552 ws-2 strategy beta -> ws-0
   |-- #3553 ws-3 strategy gamma -> ws-0
   |-- #3643 ws-3.5 loop family registry -> ws-0
   '-- #3554 level1-merged -> ws-0
         |-- #3555 ws-4 planner facade -> level1
         |-- #3556 ws-5 default strategies -> level1
         '-- #3557 level2-merged -> level1
               '-- #3596 ws-6a canonical executor -> level2
                     '-- #3597 ws-7 PlannedDriver adapter -> ws-6a
                           '-- #3598 ws-8 integration/test support -> ws-7
                                 |-- #3644 ws-9 capability host wiring -> ws-8
                                 |-- #3645 ws-10 checkpoint load/resume -> ws-8
                                 |-- #3646 ws-11 input port -> ws-8
                                 |-- #3647 ws-12 progress port -> ws-8
                                 |-- #3648 ws-13 cancellation accessor -> ws-8
                                 |-- #3649 ws-15 prompt/identity context -> ws-8
                                 '-- #3650 ws-14-parent integrated host ports -> ws-8
                                       '-- #3651 ws-14 planned default registration -> ws-14-parent
                                             '-- #3652 ws-16 live runtime wiring -> ws-14
                                                   '-- #3653 ws-17 product live cutover -> ws-16

[gemini-code-assist]

Code Review

This pull request introduces a framework for managing identity context within the agent loop, allowing system-level instructions from files like AGENTS.md or SOUL.md to be injected into model prompts. It includes the core logic in ironclaw_loop_support, integration into the loop driver host, and a workspace-specific implementation. Feedback from the review highlights a critical mismatch in protected paths that will cause runtime failures, an underestimation of token costs in the budget logic for trusted files, and potential caching issues when switching prompt modes. Additionally, an optimization was suggested to replace the inefficient linear search used during identity message resolution with an indexed approach.

[zmanian]

Review notes — WS15 prompt context assembly

Compliant with the files-not-Rust prompt rule: identity content lives in workspace files read via Workspace::read_primary, not inlined Rust strings. LLM data is never deleted — budget overflow drops trailing candidates but content stays in workspace and refs re-resolve on demand. Two items to track.

Per-lookup O(N files × IO) on identity resolution

WorkspaceIdentityContextSource::resolve_identity_message_content re-reads every stable path on every call and recomputes hashes to find the match. With model-port resolution happening per turn this thrashes the workspace store. Two options:

1. Memoize alongside the existing OnceCell on the context port — build a ref → (name, content) map once per run, drop when the run completes.
2. Index by content hash at workspace-write time so resolution is O(1).

(1) is the smaller change.

Dead IdentityApplicability::OnTextOnly

The variant is defined and tested in isolation but never produced by WorkspaceIdentityContextSource. Either remove it or document the intended emitter (WS16/17?) so it doesn't ossify as load-bearing dead code.

Minor

• FNV-1a is fine for content addressing within a run — a one-line comment ("non-cryptographic, collision-safe enough for content addressing") would prevent future "shouldn't this be sha?" review churn.
• "system" role is a string literal in build_identity_messages_from_candidates; consider a const matching the role enforced on the model side.
• _request helper marked #[allow(dead_code)] in tests — drop it.
• LoopContextRequest::mode adds #[serde(default)] for wire-compat, but every internal call site had to be updated, slightly contradicting "pure additive change." Consider making the field non-Option and removing the default once the stack lands.
• Error message "identity message ref is unavailable" appears twice — distinguish them for log triage.

Fail-closed posture on the model port (identity ref without configured source → InvalidInvocation; non-system role on identity ref → rejected) is correct.

[serrrfirat]

Summary

Reviewed WS15 PR #3649 only.
Base cbdd70890afb200cdfe47076b23a885f0c70cd8c → head 784388fb8338712c1c4da3a460e32e60d471799d.

Prompt context assembly currently upgrades user/profile-derived workspace files into trusted raw system prompt content and ignores run context policy for personal files.

Validation:

• cargo check -p ironclaw_reborn ✅

Findings

#	Sev	Category	File:Line	Issue	Fix suggestion
1	High	Security / Prompt authority	src/workspace/reborn_identity_context.rs:15-23, src/workspace/reborn_identity_context.rs:52-71, src/workspace/mod.rs:1982-1992	WorkspaceIdentityContextSource marks every stable path as HostIdentityContextCandidate::new_trusted(...), including USER.md and context/assistant-directives.md. Those files are written from profile/user-derived content, so user-influenced bytes now enter model as trusted system prompt content.	Split trust by path/provenance. Keep only host-owned identity docs trusted; downgrade USER.md and assistant directives to summary-only or lower-trust lane. Add prompt-build/model-resolution test proving profile content cannot become trusted raw system text.
2	High	Privacy / Correctness	src/workspace/reborn_identity_context.rs:77-88, src/workspace/reborn_identity_context.rs:91-111, docs/reborn/contracts/memory.md:255-258	Contract says group-chat contexts exclude personal memory/profile/directives unless policy allows them, but load_identity_candidates and resolve_identity_message_content ignore run_context and unconditionally include/resolve USER.md and assistant directives for every run.	Gate personal/profile/directive files on explicit run-context policy. Add group/shared-thread negative test proving those files are omitted.

Security/data-flow notes

• New path: workspace files → trusted identity candidates → LoopContextBundle.identity_messages → host prompt → raw system content.
• Trust and privacy boundaries need per-source policy.

Missing tests

• USER.md / assistant directives not promoted to trusted raw system prompt content.
• Group/shared run excludes personal/profile/directive files unless explicitly allowed.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[henrypark133]

Rebased onto current reborn-integration and pushed 2a307ec5b.

Addressed the valid WS-15 review feedback:

• protected identity paths now include the WS-15 stable identity files;
• trusted identity budget is charged against model-visible content size, with caller-level coverage through ThreadBackedLoopContextPort;
• identity candidate caching is per PromptMode;
• workspace identity refs resolve from loaded content snapshots instead of mutable re-reads;
• USER.md and context/assistant-directives.md are excluded from WS-15 identity candidates until explicit run-context privacy policy exists;
• the WS-15 brief now marks heartbeat-specific volatile context injection as a follow-up instead of claiming this PR wires it without a run-kind signal;
• added Reborn factory coverage proving the identity source is threaded through prompt build and model streaming.

Local verification passed:

• cargo fmt --check
• git diff --check
• cargo test -p ironclaw_loop_support identity
• cargo test -p ironclaw_loop_support --test thread_loop_support_contract
• cargo test -p ironclaw_turns --test agent_loop_host_contract
• cargo test -p ironclaw_reborn --test loop_driver_host identity
• cargo test --features libsql workspace_identity_context
• cargo clippy --all-targets --all-features -- -D warnings

Final review pass found no remaining verified security/privacy findings. GitHub currently reports the branch as mergeable; CI is still running.