Story-2864 Walkthrough

Change: Mira gains a third intent, map_command — counsel's ask is mapped to a REGISTERED command from a CLOSED static command registry v1 (first command: frame-edit), per RFD-AGT-013 D10 (the founder's fire-and-forget model). Mira emits the mapped command for the broker's command path; she never executes it. Anything unregistered — a different action, a near-miss, an injection-flavored ask — is refused, and the refusal tells counsel what she CAN do. A refusal is a PASS outcome: a normal completed turn, never a run failure.

The fire-and-forget flow

counsel: "make the issues crisper — one line each"
  → broker invokes Mira { intent: "map_command", input: { matter_id, message } }
  → command_mapper seat maps the ask against the registry (closed world)
  → CODE disposes the model's proposal (validate_mapping — never the model's word)
  → turn.completed carries the typed command_resolution:

  registered: { kind: "registered",
                command: { name: "frame-edit",
                           parameters: { scope: "issues", instruction: "make the issues crisper — one line each" } },
                reason: null, registry_version: "command_registry.v1" }
  refused:    { kind: "refused", command: null,
                reason: "unregistered_command" | "invalid_parameters" | "no_registered_command",
                registry_version: "command_registry.v1" }

  → the broker's command path (T2b-b) owns what happens to a registered command next.

The registry is the single source of truth (agents/mira/command_registry.py)

v1 has exactly one entry, skill-shaped (name + description + parameters):

- frame-edit — Edit the matter frame — reshape, tighten, or rewrite one frame field
    (e.g. 'make the issues crisper'). The result is always a proposal counsel confirms in the
    app; Mira never applies it herself.
  parameters:
    scope       — the single frame field to edit, or 'brief' (validated ∈ FRAME_SCOPES, in code)
    instruction — what to do to that field, in counsel's own words

The same entries render twice — registry_prompt_block() (the mapper prompt's closed world, baked into the byte-stable cached instructions prefix) and capabilities_markdown() (the counsel-facing "what I can do" list appended to every refusal IN CODE) — so the model's world and counsel's capability list can never drift.

Fail-closed is the product, and it is CODE, not prompt hope

The compromised-model gate is proven RED-capable offline: tests/test_map_command.py scripts a credulous seat that fully obeys the injection and asserts the wire still carries refused. The live eval suite grades mapping quality on real models — it does not re-prove the gate (the doctrine justification rides in the eval module docstring).

The seat (config-driven, streamed, cache-first)

• New config role command_mapper in llm.yaml — same interactive chain as converse (kimi-coding:k3 → google-flash-lite → openai:gpt-5.6-luna); seat_chain_for validates it as interactive like converse. No model id in Python.
• STREAMED run_stream per the founder's hard rule (slow is not dead), with the __cause__-narrowed output-validation retry vendored from indigo (Bug-2892).
• Caching-first: instructions + registry block are the byte-stable prefix; the fenced counsel message (seeded HMAC nonce per matter) is the only volatile tail. Refusal capability lists are registry-rendered — deterministic, cache-safe.
• Fresh settings_for("command_mapper", …) per call (a model_settings object is single-use); the seat's cache policy is designed, ttl 5m in llm.yaml.

Verification

uv run ruff check agents/mira                       # All checks passed
cd agents/mira && uv run pytest tests -x -q         # 224 passed (25 new map_command tests)
uv run pytest tests -q                                 # repo governance suite — green
cd agents/mira && uv run python -c "import evals.map_command"   # live suite imports

Run the LIVE golden eval (real keys, non-blocking):

uv run python agents/mira/evals/run.py map_command
# 5 golden cases: reshape-issues, tighten-theory (registered); delete-matter,
# edit-document (near-miss), inject-delete (refused)

Doctrine freshness landed in this PR: root AGENTS.md Mira row, docs/notes/agent-registry.md, agents/mira/SOUL.md, agents/mira/llm.yaml seat comments, and the runtime/main docstrings all name the third intent.