fix(bridges): the bot congratulated "them" on the owner's own store

[dshakes]

A friend forwarded the owner's own announcement back and said "congratulations". The bot replied "congrats to them, that's exciting" — then asked the friend whether a store was opening near him.

Not a reasoning failure. The fact was unrepresentable.

1. No bucket for a public fact

## Facts is typed (spouse, kids, key dates) and private-by-default — contacts get "never confirm, never deny". The 12 lines that did mention Brambleton live in ## Private, sealed from contacts by design.

So the bot had nowhere to hold "I am opening a store" — and had it been in Facts, the model would have been told not to confirm it.

Added ## Public (aliases: ## Announced, ## What I'm up to, ## Shareable). Parsed into publicFacts, kept out of prose like Facts, injected into the persona for both audiences with the opposite framing: the one kind of fact the model may openly confirm. A congratulations about it is about the owner — thank them as the person it happened to, never as an outsider, never ask if it's happening near them.

2. "Brambleton, VA" was French

The scorer accepted any single token hit. The French list contains va (also ma, ce, tu). "Brambleton, VA" → French 0.95; "see you in MA next week" → Bengali. A foreign-language reply mode engaged on the owner's English announcement.

Single hit now requires ≥3 chars. Not 4 — "ela unnav" is a real greeting whose only hit is the 3-letter ela; a stricter first cut regressed it and the test caught it.

3. The owner's own Telugu wasn't in the detector

CLAUDE.md documents the owner's short forms — vasta, cheptha, matladtham. None were in the lexicon, so the owner's own dialect scored as English on the original code. Added, with inflections. Pre-existing; found while verifying (2).

Observed, not fixed

The contact had no relationship entry → confidence fired with zero signals (MEDIUM ()). The bot discussed the owner's biggest news with someone it knew nothing about.

Verification

• 1506/1506 bridge-core · 57/57 imessage-bridge · both bridges typecheck clean
• Verified against the real profile: fact parses, doesn't leak into prose/Facts/vault, persona rule lands
• First typecheck pass hid a TS2322 (double comma → undefined in the array) behind a pipe; caught on the re-run with real exit codes

[github-actions]

🔎 Codex cross-audit (agent:audit)

Blocking

• packages/bridge-core/src/owner-profile.ts now treats ## News / ## Public / ## What I'm up to as typed public facts and removes them from prose(), but only the contact reply call sites pass publicBlock() into prompts. Owner self-chat/Jarvis paths still only inject prose() plus facts/vault, e.g. services/whatsapp-bridge/src/session.ts and services/imessage-bridge/src/session.ts. So existing profile sections named ## News stop being visible to owner-facing queries, and new ## Public facts are not available when the owner asks their own assistant about them. Either pass ownerProfileStore.publicBlock() into all owner-self prompts too, or don’t remove broad headings like ## News from prose unless every prompt path gets the typed block.

Verification

• Tried npm test in packages/bridge-core; it could not run because local dependency tsx is not installed (ERR_MODULE_NOT_FOUND).

[github-actions]

🔷 Gemini cross-audit (agent:audit-gemini)

Audit Report: Unified PR Patch Analysis

Verdict: APPROVED (Green) — Zero blocking correctness, security, or regression issues. The diff is extremely high-quality, elegant, and robust.

---

Key Strengths & Solved Issues

1. Robust Language Classification (packages/bridge-core/src/language.ts)

   • The Problem: Single 2-letter tokens like "VA" (Brambleton, VA) or "MA" (see you in MA) matched French ("va") or Bengali ("ma"), causing English announcements to engage foreign-language reply modes.
   • The Fix: Successfully introduces bestHitLen. Single-token matches must now be $\ge 3$ characters (e.g., "ela", "vasta", "bonjour"). Multiple matching tokens ($\ge 2$) bypass this length restriction, preserving reliable multi-word detection while eliminating single-token US state/postal code false positives.
   • Telangana Dialect Parity: Adding colloquial short forms ("vasta", "cheptha", "matladtham", etc.) directly into LEX.telugu resolves a major dialect mismatch where the owner's own messages were erroneously classified as English.

2. Factual Polarity Correction (packages/bridge-core/src/owner-profile.ts & natural.ts)

   • The Problem: The existing system kept all biographical facts in ## Facts (private-by-default, triggering deflect/non-disclosure rules). The agent had no way to know an announcement was the owner's own news, leading to the highly uncanny "congrats to them" response to friends.
   • The Fix: Introduces ## Public (with alias support for Announced, What I'm up to, and Shareable). This separates private facts from proud public announcements. The prompt instructions in agentPersonaPrompt are explicitly crafted to handle congratulations, thank senders warmly as the subject of the news, and strictly avoid outsider deflection.
   • Leakage Prevention: Public facts are correctly parsed into a dedicated publicFactLines array and kept completely out of the free-form prose block, eliminating duplicate injection risks.

3. High-Fidelity Regression Test Coverage (owner-public-facts.test.ts)

   • Incorporates a solid test suite with comprehensive assertions validating parsing logic, header alias matching, contact-facing persona prompt construction, single 2-letter postal code exclusions, and colloquial Telugu detection.

---

Non-Blocking Edge-Case Analysis

• Token Collision Order: If a message contains multiple single-token hits across different languages (e.g., one 2-letter token in Bengali, one 2-letter token in French), the tie-breaker behaves deterministically by favoring the first language defined in LEX_SET order. This maintains parity with the original codebase behavior.
• Nested Indented Bullets: Bullet sub-lists inside the ## Public section will be split into individual strings, which is perfectly acceptable as they are compiled with semicolons in publicBlock().

[github-actions]

🛡️ Vuln scan — ❌ vulnerable dependency found

cd services/control-plane && govulncheck ./...
=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 1 vulnerability in packages you import and 18
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
cd services/gateway && cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1239 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (272 crate dependencies)
cd services/model-router && cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1239 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (251 crate dependencies)
cd services/runtime-manager && cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1239 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (480 crate dependencies)
Crate:     wasmtime
Version:   46.0.2
Title:     Guest controlled-size host heap allocation through WASIp3 streams
Date:      2026-08-20
ID:        RUSTSEC-2026-0268
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0268
Severity:  6.9 (medium)
Solution:  Upgrade to >=46.0.3, <47.0.0 OR >=47.0.4

Crate:     wasmtime
Version:   46.0.2
Title:     Filesystem sandbox escape when paths or symlinks contain trailing slashes
Date:      2026-08-20
ID:        RUSTSEC-2026-0269
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0269
Severity:  8.8 (high)
Solution:  Upgrade to >=24.0.13, <25.0.0 OR >=36.0.14, <37.0.0 OR >=46.0.3, <47.0.0 OR >=47.0.4

Crate:     chacha20
Version:   0.10.0
Warning:   yanked

error: 2 vulnerabilities found!
warning: 1 allowed warning found
make: *** [Makefile:270: audit] Error 1