feat(pilot): add portable constrained Core research pilot

.superpowers/sdd/2026-08-02-core-pilot/task-2-report.md

@@ -0,0 +1,34 @@
+# Task 2 report: trusted ACP output publishing
+
+Implementation commit: `1ab0721481bcc4d3ac19bcb8aab65ddacb0a3a1a`
+
+## RED evidence
+
+- `cargo test -p buzz-acp config::tests::publish_agent_output_is_off_by_default_and_trigger_reply_is_opt_in -- --exact` failed because `CliArgs` had no `publish_agent_output` field and `PublishAgentOutput` did not exist.
+- `cargo test -p buzz-acp acp::tests::agent_output_capture_accumulates_messages_and_fails_closed -- --exact` failed because the capture/reset/take API did not exist.
+- Targeting and terminal-policy tests likewise failed before their helpers were introduced.
+
+## GREEN evidence
+
+- Round-1 review fix: `cargo test -p buzz-acp --lib` — 673 unit tests passed.
+- `cargo fmt --check` passed.
+- `cargo clippy -p buzz-acp --all-targets -- -D warnings` passed.
+
+## Changed files
+
+- `crates/buzz-acp/src/config.rs` — public opt-in policy, CLI/env parsing, and fail-closed pilot invariant validation.
+- `crates/buzz-acp/src/acp.rs` — bounded per-prompt agent-message capture and invalidation.
+- `crates/buzz-acp/src/pool.rs` — trusted batch-last targeting, signing, terminal gating, exact-ID confirmation/retry, and one pending event.
+- `crates/buzz-acp/src/lib.rs` — public policy re-export and runtime wiring.
+- `crates/buzz-acp/src/relay.rs` — single-attempt durable submission, preventing an unconfirmed transport retry.
+
+## Round-1 review fixes
+
+- Only the exact configured owner may provide a trusted trigger; sibling-agent events are rejected even though inbound owner-only policy permits them.
+- Trigger-reply startup now rejects an owner value that cannot parse as a Nostr public key.
+- `accepted: false` is terminal: it is neither confirmed nor retried and never occupies the pending slot. Ambiguous responses are confirmed by exact ID before identical-ID retry; the regression test observes the same event ID on both writes.
+
+## Concerns
+
+- Publishing is intentionally local-pilot-only: one pending signed event is retained in memory, so it is not durable across process restart.
+- The single-attempt durable submission is unit-tested; full relay behavior remains unexercised against a production relay in this task.

config/core-pilot/core-pilot.env.example

@@ -0,0 +1,38 @@
+# The bootstrap script copies this outside Git and replaces the inert sample
+# channel/owner with stable generated Core Lab state. Do not run this template
+# directly. Secrets belong only in ~/.config/core-buzz/agent.env.
+BUZZ_RELAY_URL=ws://127.0.0.1:3000
+BUZZ_BIND_ADDR=127.0.0.1:3000
+DATABASE_URL=postgres://buzz:buzz_dev@127.0.0.1:15432/buzz
+REDIS_URL=redis://127.0.0.1:6379
+BUZZ_REQUIRE_AUTH_TOKEN=false
+BUZZ_REQUIRE_RELAY_MEMBERSHIP=true
+BUZZ_GIT_ENABLED=false
+
+BUZZ_AGENT_PROVIDER=openai
+BUZZ_AGENT_MODEL=gpt-5.6-terra
+OPENAI_COMPAT_API=responses
+OPENAI_COMPAT_BASE_URL=https://api.openai.com/v1
+OPENAI_COMPAT_MODEL=gpt-5.6-terra
+BUZZ_AGENT_THINKING_EFFORT=medium
+BUZZ_AGENT_WEB_SEARCH=1
+BUZZ_AGENT_NO_HINTS=1
+BUZZ_AGENT_REQUIRE_REPLY=0
+
+BUZZ_ACP_SYSTEM_PROMPT_FILE=config/core-pilot/core-research-partner.md
+BUZZ_ACP_NO_BASE_PROMPT=1
+BUZZ_ACP_NO_MEMORY=1
+BUZZ_ACP_AGENT_COMMAND=buzz-agent
+BUZZ_ACP_AGENT_ARGS=acp
+BUZZ_ACP_MODEL=gpt-5.6-terra
+BUZZ_ACP_MCP_COMMAND=
+BUZZ_ACP_PUBLISH_AGENT_OUTPUT=trigger-reply
+BUZZ_ACP_AGENTS=1
+BUZZ_ACP_HEARTBEAT_INTERVAL=0
+BUZZ_ACP_SUBSCRIBE=all
+BUZZ_ACP_KINDS=9
+BUZZ_ACP_CHANNELS=11111111-1111-4111-8111-111111111111
+BUZZ_ACP_RESPOND_TO=owner-only
+BUZZ_ACP_AGENT_OWNER=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+BUZZ_ACP_DEDUP=queue
+BUZZ_ACP_MULTIPLE_EVENT_HANDLING=queue

config/core-pilot/core-research-partner.md

@@ -0,0 +1,41 @@
+# Core Research Partner
+
+You are Core's ambient research-and-drafting partner for investment-banking
+work. Your role is deliberately narrow: make a single, useful contribution
+only when a banker message clearly calls for it.
+
+## Response discipline
+
+- Be selective. Stay silent for thanks, acknowledgements, greetings, chatter,
+  duplicate requests, and messages that do not need substantive help.
+- If any message asks you not to respond, to stay silent, or otherwise requests
+  no reply, remain silent regardless of the message's other content.
+- Produce at most one response to each banker message. Do not send progress
+  updates, acknowledgements, or follow-up nudges.
+- Work only from public information or clearly labelled synthetic examples. If a
+  message contains a client identifier, live deal detail, MNPI, PII, or any
+  other non-public information, refuse briefly and ask for a sanitized,
+  public/synthetic version of the request.
+- For research, prefer primary public sources: SEC filings, regulators, and
+  issuer investor-relations materials. Use the provided web-search citations;
+  never invent a source, URL, quote, or numerical result.
+
+## Deliverable standard
+
+- Clearly separate **Facts**, **Inference**, **Assumptions**, and **Draft
+  language**. State uncertainty and the effective date for market-sensitive
+  facts.
+- Verify arithmetic shown in a response. Do not present estimated figures as
+  reported results.
+- Mark any email, message, or outreach copy exactly as `DRAFT — NOT SENT`.
+- Keep the answer concise, decision-useful, and suitable for banker review.
+
+## Hard boundaries
+
+- You have no MCP command, shell, filesystem, internal-system access, or
+  ability to send email, modify records, contact third parties, or perform any
+  external side effect. The managed, citation-bearing public web search is the
+  only permitted research capability.
+- Do not claim to have completed a task outside this reply.
+- Never choose a destination, channel, recipient, author identity, event tags,
+  or delivery semantics. The trusted harness controls any permitted reply.

config/core-pilot/docker-compose.lock.yml

@@ -0,0 +1,21 @@
+# Core's local pilot uses immutable infrastructure images and loopback-only
+# published ports. Keep this as an override of the upstream development stack.
+services:
+  postgres:
+    image: postgres@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
+    ports: !override
+      - "127.0.0.1:15432:5432"
+
+  redis:
+    image: redis@sha256:e7723ff73d963f5cc6d9c4643ea3d989527a402a319239054e9472a7fb9219a2
+    ports: !override
+      - "127.0.0.1:6379:6379"
+
+  minio:
+    image: minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
+    ports: !override
+      - "127.0.0.1:9000:9000"
+      - "127.0.0.1:9001:9001"
+
+  minio-init:
+    image: minio/mc@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727