Add immutable additive host instructions for fresh Freebuff conversations

[nikhilachale]

Code changes: +106 -5
Tests: +155 -0
Others: +88 -2

Freebuff discovers nested knowledge files but its bundled system prompt deliberately includes only root project rules. Embedding hosts currently cannot supply additive per-conversation instructions without editing project/home rules or replacing the native agent. This adds a dedicated creation-time snapshot through the existing knowledge-aware prompt composition, preserving default agent, project/user rules, tools, and permissions.

FREEBUFF_APPEND_INSTRUCTIONS_FILE accepts a bounded UTF-8 regular file on Linux/macOS and caches success/failure once per process. SDK appendInstructions validates runtime input. Existing history retains its snapshot; changing or retrofitting instructions fails before inference. Configuration errors redact paths/content and the CLI identifies them independently of authentication. Runtime failure prompt/history payloads are omitted when configured. Ordinary local history and optional traces still retain context; this is not a secret store. Custom agents without the knowledge placeholder are explicitly out of scope.

Regression coverage exercises the real client/run/native bundled prompt/provider-request boundary, subsequent turns, compaction, legacy/default state, invalid input and process caching. Public CI builds SDK and Linux binary and uploads an exact-head prerelease artifact. No provider credentials enter CI. Tests/builds run only in GitHub Actions under the authorized execution policy; exact-head public prerelease native proof and real Electron standalone screenshots are attached below; this PR remains draft because the full SDK declaration check is failing and upstream CI needs maintainer approval. This public source is not private npm 0.2.26 source and does not claim that release repaired.

Related stock failure and unregistered AO integration: OrchestratorInc/agent-orchestrator#6553. Public contributions are ported by maintainers into the private source tree; no merge or release is requested as an automated action.

Inherited SDK declaration failure is independently reproduced on public main in run https://github.com/CodebuffAI/freebuff/actions/runs/38207948117 (SharedV4ProviderOptions/ProviderMetadata mismatch). CI preserves that failure while running focused regressions and producing a runtime-only binary with the existing SDK --no-types option; the CLI does not consume declarations. No full green build claim.

Build prerequisites discovered while qualifying this public tree: the existing picocolors import was undeclared (pinned1.1.1 dependency added), and public endpoint defaults had to be present during binary compilation. Current-head fork CI passes5/5 focused regressions, original-run.ts negative control, Linux runtime build and binary smoke; the inherited declaration check is still explicitly failing. Native artifact qualification and curated actual Electron evidence are being attached separately, with exact tested source hashes.

Concrete Freebuff native implementation is upstream PR1505, exact source5712d04bc916125d17da46548874a0388dcc526e. Immutable curated native/AO evidence records5/5 focused CI, stock-source negative control, Linux runtime build/smoke, exact-head ordinary task/private instructions/second snapshot/armed Escape/continuation and standalone runtime-close controls. Stock0.2.26 remains unqualified. AO6553 stays unregistered/draft; screenshots show the existing AO standalone terminal, not manager/session Kill/restore/Chat. Full native SDK declarationsFAIL on unchanged public main; upstream Public CIACTION_REQUIRED. Eight inspected PNGs in this update; actual net PR binary file count0. Runner SHA8887aa2e... unchanged.

[nikhilachale]

Implemented and published native Freebuff fix PR1505. This is actual public source and regression tests, not the previous unapplied patch. Exact head5712d04bc916125d17da46548874a0388dcc526e; CI-built Linux0.0.0-ci binary SHA 5071e80f5eec7dd7a80d055e0ca0641b17470c7da44067d5ba8f032af9108822. No stock npm0.2.26 repair or registered AO harness claim.

The explicit creation-time FREEBUFF_APPEND_INSTRUCTIONS_FILE/SDK appendInstructions snapshot preserves native/project/user defaults. Existing constructor forwarding works. SDK validates type/Unicode/bounds; POSIX file errors are fail-closed and sanitized. Subsequent turns retain the snapshot; changed/retrofitted history fails before inference. Cached compaction prompts are not falsely refreshed. Ordinary native history/traces retain context; custom agents without the knowledge placeholder and Windows file input are outside qualified scope.

Exact-head fork CI:5/5 focused regressions PASS, real constructor→run→native prompt→provider composition, original-run.ts negative control PASS, Linux runtime build and binary smoke PASS. Full SDK declaration checkFAIL, independently reproduced on unmodified main; final CI step explicitly preserves the failure. Upstream Public CIACTION_REQUIRED needs maintainer approval. Both native1505 and AO6553 remain draft. No routine local suites/install/builds were run; CI owns validation.

Actual exact-head native proof ran in the real AO Electron standalone terminal on the VPS: ordinary leading-dash task once, workspace edit, independent private/project receipts, AGENTS preservation, second turn after deleting the private receipt and changing the source file, retained creation snapshot, armed Escape with executing PID/kernel witness and no delayed effect, same native identity and third turn, then independent AO terminal close204. Escape5/5 and close7/7 controlsPASS. This is not registered manager/session Kill or native restore/Chat/auth/catalog conformance.

Immutable detailed report and curated receipts. All8 image URLs downloaded and SHAverified after publication, inspected for credentials. AO backend/UI fb60bd4097ebd4109bbe7ee68e908f722e6ee03f, clean VCS; actual servingPID994173/kernel83308714/executable SHA b30f2dfa7b1f1c796c5772cb96d7d5c32b4bfb53c39f2c4ff7ca669f2cca8ded before/after capture. Runfile ~/.ao/audits/native-harness-fixes-20261012/reports/codebuff/ao-shell-001/running.json. Runtime handleptyhost-v1:shellterm-46b259221d611db5, native leader997948/start83420715, modelGLM-5.3-Flash/Z.ai. Native identity digest 98a00a64ba65da215f59b2d0d2daa7490a0a07bb64fd3955a47c6d85489b4723; standalone shells have no managed agent launch generation. Images are scrot captures on the actual owned Electron/Xvfb display.

UTC2026-10-12T07:03:36Z, initial ordinary task settled, PNG SHA 0863bf0efda301a34b1ff1ea94c5aa06108d1a7261a26a76e8301c4acf8a44b3:

UTC2026-10-12T07:13:39Z, same native identity and third turn after Escape, PNG SHA bfdb7b8bf171dbd44e9fc02431e0468573b5b5747487cb87b4c23002e0b2e38b:

Escape childPID999673/kernel83474776, marker2026-10-12T07:09:55.107636+00:00, Escape2026-10-12T07:09:55.948115+00:00, absentwithin5s/after25s, no delayed artifact, unrelated controlPID994833/start83338796/heartbeat continued. Independent close204 at2026-10-12T07:15:45.615164+00:00 reaped native leader997948 and child1000643, no delayed artifact. Actual pre-Escape execution screen and pre-close execution screen have full capture records in the report.

Failures retained separately: stock nested knowledge exclusion; nonUUID audit fixture before provider; automated evidence driver143 with origin unestablished; grouped paste left an exact owned draft; secondary-before-primary color detection; and manual25s cancel window missed, original late artifact preserved (failed screen). Later armed control kept the same delay/timeout/absence assertions. No global strict auditPASS inferred. Original stock AO screenshot unavailable because admission never created a session.

Cleanup: native/runtime/control closes204, list200/empty, daemon shutdown202; exact owned native/control/PTY hosts and Electron main993952 stopped, mux helpers stopped, compute lock released. Production625660/ao-self-hosted and source/sharedgit/profiles/credentials/prior evidence untouched. Only a verified regenerable old CI artifact was reclaimed after its native PID was absent. Runner SHA8887aa2e... unchanged; current6509 evidence-head CI is tracked separately. No merge, release, deployment, signup or billing change.

Final evidence CI: exact6509 head384c80e5d483fb7edd345148c9ca0cbdbf53fc17 is 5/5SUCCESS, including 150/150fixtures (fixture run, frontend/mac-helper run). Runner SHA8887aa2e... remains unchanged. AO6553 headfcdc3db remains20/20green and draft/unregistered. Native1505 full SDK declarations stillFAIL and upstream Public CIACTION_REQUIRED; no native full-green/released-support claim. Stage result is implemented/native-qualified but blocked on those external prerequisites.