[maksymhryzodub-prog]

Stacked on #26 (guardrails) → #25 (foundation) → #24 (spec). US2 of specs/001-ecc-agent-principles, tasks T029–T044, plus the fixes from the background security review of US1.

What

• Rules survive the cut — truncateKeepingRules drops reference sections of SOUL.md before any line under ## Rules; if the rules alone exceed memory.limits.soul they are kept and start-up logs over. .agent.example/SOUL.md now uses the ## Rules heading.
• Skills on demand — the model calls skill_load when a catalogue description fits. The body goes into the history ahead of the conversation (as a tagged summary event), not the system prompt, so the 1h prompt-cache prefix is untouched; it stays for skills.retainTurns turns (refreshed each turn, extended on reuse) and is never persisted. requires.env / requires.bins unmet → (unavailable: missing env X) in the catalogue and a refused load. Keyword selection kept behind skills.selection: "keyword" for one release.
• Tool catalogue budget — tools outside tools.coreCatalogue are one-line stubs (first sentence ≤ 80 chars) with a pointer to tool_describe, which returns description, JSON schema, effect, adminOnly. Provider schemas are unchanged.
• Accounting — on-demand loads (skills carried over, skill_load, tool_describe) land in the turn's IPromptBreakdown; /context (admin) renders sections vs contextBudget with over markers; agent_status.context carries the same.
• Shared wording — SKILL_CATALOGUE_INSTRUCTIONS is used by the prompt builder and by the eval, so what is measured is what ships.

Security-review fixes (US1)

• Streamed replies: chunks are redacted as accumulated text and a tail that looks like the start of a credential is held back until the pattern completes (redactStreaming); the streamer's final text is redacted too.
• Thinking-step detail and the bridle debug payload text are redacted.
• Matcher: each text is also tried dequoted (', ", backslash escapes removed) and with .. segments normalised, so cat 'data/sec'rets/key and cat workspace/../data/secrets/key match. Globs and $VAR expansion are not simulated — documented.

Tests / evals

• bun test: 254 pass (+24: truncation 5, skill service 10, tool catalogue 4, loop skill_load 1, streaming redaction 3, matcher 1), 1 pre-existing Windows-only failure.
• bun run eval: guardrails 31/31; skill-selection 96/100 (SC-003 ≥ 90 %), 0 false loads over the 5 % cap — run live against the configured model. Without LLM_API_KEY the set reports pending.
• tsc --noEmit: clean apart from the pre-existing bridleAttachments.spec.ts.

Note

The ranch admin agent's 12k-char SOUL.md lives in the platform template, not in this repo — moving its endpoint table into the ranch skill (quickstart §US2 step 2) is a ranch-side follow-up; the runtime now protects its ## Rules either way.

Jira: https://dreamvention.atlassian.net/browse/CLEAN-153

🤖 Generated with Claude Code