fix: the two things the re-run left as decisions

[vicenteliu]

#207 closed with two items filed as posture questions rather than defects.
Chasing them turned one into a bug and settled the other.

C — propose_actions never reached the model

Filed as "the feature is finished, nobody opts in." The interesting half is what
turned up on the way to fixing that: opting in would not have worked.

ticket_summary appended _PROPOSE_ACTIONS_PROMPT to the system prompt before
the prefetch branch, and _do_prefetch returns pb.system_prompt + addendum —
rebuilt from the playbook, so the opt-in was discarded. Every playbook in the
repo is mode: "prefetch" except pb_vendor_doc_en, which is a vendor-doc
summariser and would never propose a diagnostic.

The behaviour gate has a case for exactly this behaviour and it passes, because
it builds the system prompt by hand from _PROPOSE_ACTIONS_PROMPT. It proved
the prompt works; nothing proved the prompt arrives. That is the same seam
#201–#207 kept finding, one layer up: the gate covers what the model does with
an instruction, not whether the instruction is still there by the time the model
sees it.

The opt-in now applies after the branch. The new test asserts it against the
trace — which records the system prompt actually fed to the model —
parametrised over both retrieval modes; it fails on prefetch before this
change and passes after.

The default stays off. A proposal is a command somebody reads at 2am and the
approval gate behind it is a heuristic denylist that says so in its own
docstring — shipping it on is a posture change nobody asked for, and ADR-0028
says existing playbooks are unaffected. What was actually wrong is that the key
was named nowhere an operator would look, so the two incident playbooks now
carry it commented out with the reason beside it:

# Read-only diagnostics the Session may propose for a human to run (ADR-0028).
# Off by default: a proposal is a command someone will read at 2am, and the
# approval gate behind it is a heuristic denylist, not a proof. Uncomment to
# opt this playbook in — `intent` is a schema `const`, so nothing that mutates
# can be expressed either way.
# propose_actions: true

Checked that the admin model-list editor still round-trips both files
byte-identically — #204 fixed comment loss in that path, and this adds comments
to files it rewrites.

D — one human on one machine got two names

opspilot workingset status said "No working set open" while the web UI had one
open for the same person. The CLI writes cli:<osuser>, the loopback API writes
local-dev, and a Working set is per-owner by construction.

It reaches past the Working set: a Memory entry admitted from the CLI carried a
different actor than the same person's entry from the UI, and actor is the
field ADR-0030 leans on to say who decided what.

Both names are deliberate and both docstrings explain themselves. The split
between them was not. The CLI now answers local-dev under exactly the
condition auth.deps falls back on — no user account, no service token — with a
missing users table counting as no users, and the check is a read-only query
so asking does not create the schema. With a user or a token configured it goes
back to cli:<osuser>: then it genuinely has no auth context and should not
borrow a name it cannot prove.

Verified against a running server:

API  POST /api/working-set        → ws_0724248c
CLI  opspilot workingset status   → ws_0724248c — pods in staging keep restarting
CLI  opspilot workingset close    → closed
API  GET  /api/working-set        → {"working_set": null}
CLI  opspilot memory add …        → mem_a2bd3979
API  GET  /api/memory             → actor = local-dev

Verification

Full suite 1357 passed — 7 new. ruff, ruff format, mypy(154) clean. The one local
failure is test_providers_ollama.py::TestIntegration::test_chat_smoke, which
wants gemma4:e4b from a local Ollama that does not have it; CI deselects it.

behaviour-gate: 6 passed — memory injection 3/3, conflict reported 3/3, distillation keeps dead ends 3/3, proposals stay read-only 3/3, memory proposal 3/3, memory proposal restraint 3/3

🤖 Generated with Claude Code