Move the nightly mechanism into an app-owned operating contract

[miljanm]

Problem

The reflection skill is agent-editable by design — app updates never touch it, so the nightly agent can evolve its own judgment. But that same property makes it the wrong home for mechanism: any operational rule written there (who sends the morning push, where the brief and state.json go, the question-carrier format) drifts the moment the app updates. That drift is not hypothetical: the skill's old "send the morning notification" rule survived the wrapper taking over the send, and both fired on 2026-07-28 — the duplicate push #13 then guarded against. By that point the "exactly one push per brief" invariant was defended by four stacked layers (the wrapper send, a skill-text warning, the runner's tool denylist, and the #13 dedupe guard) — a structural smell, not four independent bugs.

Change

Make the split structural — one rule, one home:

• operating-contract.md (new) holds the mechanism: the storage-vs-source split and canonical settings path, brief path + template + hand-written fallback, the state.json shape (also the push body), push ownership, the question-carrier format, and the commit helper. It ships beside the runner, so it updates atomically with every app update.
• reflection_runner.py appends the contract to the system prompt after the skill each run (build_system_prompt()), failing loudly when the contract is missing — the same posture as a missing skill. skill_text parameters are renamed system_prompt to match what now flows through.

The skill keeps judgment only. Migration is self-serve: the contract's preamble instructs the nightly agent to delete stale mechanical duplicates from its own evolved skill, so existing instances converge without a forced notebook rewrite — and the authoritative statement always reads last in the composed prompt either way.

Auditing for this bug class found a second live instance: the skill still pointed at the legacy /data/apps/reflection/settings.json path after the runner canonicalized settings to numeric storage. The contract now states the canonical path.

Kept deliberately

The runner's tool denylist (one cheap line) and the #13 dedupe guard (delivery over a network should be idempotent as a property) stay — they are correct on their own merits, not compensations for skill drift. The skill-text warnings are the layer this removes.

Follow-up (separate)

The seed skill in the platform image (seed-skills/reflection.md) still carries the old mechanical text; trimming it to judgment-only belongs in a mobius-os/mobius PR once this lands. Until then a fresh install sees the mechanics twice (skill + contract) with the contract authoritative — harmless and self-correcting via the preamble.

Testing

• python3 -m py_compile reflection_runner.py
• Composition dry-run: build_system_prompt() returns skill + contract, the contract resolves beside the runner, and every mechanic removed from a judgment-trimmed skill is still present in the composed prompt.
• Installed on my instance with the local skill trimmed to judgment-only; tonight's run is the first live pass of the composed prompt.

🤖 Generated with Claude Code