feat: agent/user profile Creatives + system prompt sourced from profile (Subsystem A)

engines/collavre/app/controllers/concerns/collavre/users_controller/ai_user_management.rb

@@ -43,6 +43,7 @@ def create_ai
       @user.agent_conf = params[:agent_conf] if @user.respond_to?(:agent_conf=) && params[:agent_conf].present?
 
       if @user.save
+        @user.sync_profile_system_prompt!
         Collavre::Contact.ensure(user: Current.user, contact_user: @user)
         share_ai_agent_to_creative(@user, params[:creative_id])
         redirect_to user_path(Current.user, tab: "contacts"), notice: I18n.t("collavre.users.create_ai.success")
@@ -61,6 +62,12 @@ def update_ai
       ai_params = params.require(:user).permit(:name, :system_prompt, :llm_vendor, :llm_model, :llm_api_key, :gateway_url, :searchable, :routing_expression, :agent_conf, tools: [])
 
       if @user.update(ai_params)
+        # Only mirror the column into the canonical profile prompt when the form
+        # actually submitted system_prompt. A partial PATCH (e.g. routing_expression
+        # only) leaves the legacy column at its stored value, which may be stale
+        # relative to a directly-edited profile; syncing it would clobber the
+        # canonical data["markdown_source"].
+        @user.sync_profile_system_prompt! if ai_params.key?(:system_prompt)
         redirect_to edit_ai_user_path(@user), notice: I18n.t("collavre.users.update_ai.success")
       else
         @available_tools = load_available_tools

engines/collavre/app/models/collavre/creative.rb

@@ -8,8 +8,11 @@ class Creative < ApplicationRecord
     # ---------------------------------------------------------------------------
     # Reserved metadata key registry — engines register their own namespaces so
     # `update_metadata` preserves them without core naming vendor-specific keys.
+    # "kind" is the discriminator (`inbox`/`profile`/`skill`) that scopes like
+    # `profiles` query on (`data->>'kind'`); it must be preserved or a metadata
+    # save that omits it makes the row undiscoverable and a duplicate is created.
     # ---------------------------------------------------------------------------
-    BUILTIN_RESERVED_METADATA_KEYS = %w[markdown_source content_type editor].freeze
+    BUILTIN_RESERVED_METADATA_KEYS = %w[markdown_source content_type editor kind].freeze
 
     class << self
       def registered_reserved_metadata_keys
@@ -69,6 +72,12 @@ def to_partial_path
     # --- Inbox ---
     scope :inboxes, -> { where("data->>'kind' = 'inbox'") }
 
+    # --- Profile ---
+    PROFILE_KIND = "profile"
+    SKILL_KIND = "skill"
+
+    scope :profiles, -> { where("data->>'kind' = ?", PROFILE_KIND) }
+
     SYSTEM_TOPIC_NAME = "System"
     MAIN_TOPIC_NAME = "Main"
     CONTENT_TOPIC_NAME = "Content"
@@ -135,6 +144,28 @@ def self.inbox_for(user)
       )
     end
 
+    # Find or create the profile creative for a given user.
+    # Places it as a root creative (no parent) owned by the user.
+    #
+    # Selection is ordered by id so that reads and writes always converge on the
+    # same (oldest) profile. A hard DB uniqueness constraint is not used: the
+    # discriminator lives in the `data` json column, and on Postgres `json ->>`
+    # is STABLE (not IMMUTABLE), so a partial-unique index on
+    # (user_id) WHERE data->>'kind' = 'profile' is rejected during schema load.
+    # Deterministic ordering keeps a transient race-created duplicate harmless
+    # (never a split brain) rather than guaranteeing single-row creation.
+    def self.profile_for(user)
+      existing = profiles.where(user: user).order(:id).first
+      return existing if existing
+
+      create!(
+        description: user.name.to_s,
+        data: { "kind" => PROFILE_KIND },
+        user: user,
+        progress: 0.0
+      )
+    end
+
     attr_accessor :filtered_progress
 
     belongs_to :user, class_name: Collavre.configuration.user_class_name, optional: true

engines/collavre/app/models/collavre/user.rb

@@ -3,6 +3,7 @@ class User < ApplicationRecord
     self.table_name = "users"
 
     include HasInboxCreative
+    include HasProfileCreative
 
     has_many :user_themes, class_name: "Collavre::UserTheme", dependent: :destroy
 
@@ -207,6 +208,41 @@ def ai_user?
       llm_vendor.present?
     end
 
+    # Mirror the agent's system prompt into its profile creative as Markdown,
+    # so the raw prompt lands losslessly in data["markdown_source"] — the
+    # canonical home for the prompt. Writing the prompt straight into
+    # `description` would run it through the HTML sanitizer (Describable), which
+    # strips <thinking>/<tool_call> tags and entity-escapes < > &, corrupting
+    # every prompt; the derived `description` is only a rendered display view.
+    # The system_prompt column is legacy, pending removal.
+    # No-op for humans and for prompt-less agents (profile keeps its name seed).
+    def sync_profile_system_prompt!
+      return unless ai_user?
+      creative = profile_creative
+      if system_prompt.present?
+        return if creative.data&.dig("markdown_source") == system_prompt
+        creative.update!(content_type_input: "markdown", markdown_source: system_prompt)
+      elsif creative.data&.dig("markdown_source").present?
+        # The prompt was cleared. Demote out of markdown mode so the stale
+        # markdown_source is dropped and render falls back to the (now-blank)
+        # column — matching the pre-profile behavior where blanking the prompt
+        # took effect immediately. Also reseed `description` back to the name
+        # seed so the old rendered prompt doesn't stay visible/searchable on the
+        # owned profile root. Without this, the old prompt stays authoritative.
+        creative.update!(content_type_input: "html", description: name.to_s)
+      end
+    end
+
+    # The effective system prompt for all read consumers. The canonical prompt
+    # lives in the profile creative's data["markdown_source"]; the legacy
+    # `system_prompt` column is the fallback for rows not yet backfilled. Every
+    # prompt reader (orchestration matching, type classification, typo agent,
+    # admin view) must route here so that editing the profile creative directly
+    # takes effect everywhere, not just in AiAgentService.
+    def effective_system_prompt
+      profile_creative_if_present&.data&.dig("markdown_source").presence || system_prompt
+    end
+
     def claude_channel_agent?
       llm_model == "claude-code"
     end

engines/collavre/app/models/concerns/collavre/has_profile_creative.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Collavre
+  module HasProfileCreative
+    extend ActiveSupport::Concern
+
+    included do
+      after_create_commit :create_profile_creative
+    end
+
+    # Returns the user's profile creative, creating one if it doesn't exist.
+    # Use only from write paths (e.g. sync_profile_system_prompt!) — never from
+    # a hot read path, since creating a profile creative also creates a Topic.
+    def profile_creative
+      Collavre::Creative.profile_for(self)
+    end
+
+    # Read-only lookup: the existing profile creative or nil, never creating one.
+    # Read paths (effective_system_prompt) must use this so a hot-path read never
+    # writes, and so rendering never fails when the in-memory user is invalid
+    # (e.g. re-rendering the AI form after a failed save leaves name blank).
+    def profile_creative_if_present
+      return nil unless persisted?
+
+      # order(:id) matches profile_for's write-path selection so a read never
+      # diverges from the profile a write targets, even if a race created a dup.
+      Collavre::Creative.profiles.where(user: self).order(:id).first
+    end
+
+    private
+
+    def create_profile_creative
+      Collavre::Creative.profile_for(self)
+    rescue StandardError => e
+      Rails.logger.error("[HasProfileCreative] Failed to create profile for user #{id}: #{e.message}")
+    end
+  end
+end

engines/collavre/app/services/collavre/agent_type_classifier.rb

@@ -8,7 +8,7 @@ module AgentTypeClassifier
     # Returns the agent type string ("developer", "pm", "qa", "researcher",
     # "marketer", "planner") or "agent" as the default when nothing matches.
     def classify(user)
-      prompt = user.system_prompt.to_s.downcase
+      prompt = user.effective_system_prompt.to_s.downcase
       case prompt
       when /developer|개발/ then "developer"
       when /pm|project.?manager|프로젝트/ then "pm"

engines/collavre/app/services/collavre/ai_agent_service.rb

@@ -136,8 +136,13 @@ def prepare_rendering_context
     end
 
     def render_system_prompt(rendering_context)
+      # The prompt lives losslessly in the profile creative's markdown_source
+      # (data["markdown_source"]); `description` is the sanitized rendered view
+      # and would corrupt tags/angle-brackets, so never read it here. Fall back
+      # to the legacy system_prompt column for rows not yet backfilled.
+      template = @agent.effective_system_prompt
       rendered = AiSystemPromptRenderer.new(
-        template: @agent.system_prompt,
+        template: template,
         context: rendering_context
       ).render
 

engines/collavre/app/services/collavre/orchestration/arbiter.rb

@@ -208,12 +208,15 @@ def calculate_keyword_score(agent, message_text)
       def extract_expertise_text(agent)
         texts = []
 
-        # From agent's system_prompt (primary source for AI agents)
-        texts << agent.system_prompt if agent.respond_to?(:system_prompt) && agent.system_prompt.present?
+        # From agent's system_prompt (primary source for AI agents). Route
+        # through effective_system_prompt so a directly-edited profile creative
+        # is matched on, falling back to the legacy column for other agent types.
+        texts << agent.effective_system_prompt if agent.respond_to?(:effective_system_prompt) && agent.effective_system_prompt.present?
+        texts << agent.system_prompt if !agent.respond_to?(:effective_system_prompt) && agent.respond_to?(:system_prompt) && agent.system_prompt.present?
 
         # From AI agent profile (for nested ai_agent association)
         if agent.respond_to?(:ai_agent) && agent.ai_agent.present?
-          texts << agent.ai_agent.system_prompt if agent.ai_agent.respond_to?(:system_prompt)
+          texts << agent.ai_agent.effective_system_prompt if agent.ai_agent.respond_to?(:effective_system_prompt)
           texts << agent.ai_agent.description if agent.ai_agent.respond_to?(:description)
         end
 

engines/collavre/app/services/collavre/typo_corrector.rb

@@ -49,7 +49,7 @@ def build_client
       AiClient.new(
         vendor: agent&.llm_vendor.presence || ENV.fetch("COLLAVRE_DEFAULT_LLM_VENDOR", "gemini"),
         model: agent&.llm_model.presence || ENV.fetch("COLLAVRE_DEFAULT_LLM_MODEL", "gemini-3.1-flash-lite"),
-        system_prompt: agent&.system_prompt.presence || FALLBACK_SYSTEM_PROMPT,
+        system_prompt: agent&.effective_system_prompt.presence || FALLBACK_SYSTEM_PROMPT,
         llm_api_key: agent&.llm_api_key,
         gateway_url: agent&.gateway_url,
         # Vendor adapters (e.g. OpenClaw) resolve the gateway/key from the context

engines/collavre/app/views/collavre/users/edit_ai.html.erb

@@ -9,7 +9,13 @@
 
   <div class="form-group">
     <%= form.label :system_prompt, t('collavre.users.new_ai.system_prompt_label') %>
-    <%= form.text_area :system_prompt, required: true, class: "stacked-form-control", rows: 5 %>
+    <%# Pre-fill from the canonical prompt (profile creative's markdown_source),
+        not the legacy system_prompt column. If the profile creative was edited
+        directly, the column is stale; posting it back through update_ai's sync
+        would silently clobber the profile-authored prompt on any unrelated
+        setting change. Rendering the effective value makes a no-touch save a
+        no-op on the prompt. %>
+    <%= form.text_area :system_prompt, value: @user.effective_system_prompt, required: true, class: "stacked-form-control", rows: 5 %>
   </div>
 
   <%= render "collavre/users/trigger_field", form: form, routing_expression: @user.routing_expression %>

engines/collavre/app/views/collavre/users/show.html.erb

@@ -33,7 +33,7 @@
           <dd class="col-sm-9"><%= @user.llm_model %></dd>
 
           <dt class="col-sm-3"><%= t('collavre.users.new_ai.system_prompt_label') %></dt>
-          <dd class="col-sm-9"><pre><%= @user.system_prompt %></pre></dd>
+          <dd class="col-sm-9"><pre><%= @user.effective_system_prompt %></pre></dd>
         </dl>
       </div>
     <% else %>

engines/collavre/db/migrate/20260721000000_backfill_profile_creatives.rb

@@ -0,0 +1,15 @@
+class BackfillProfileCreatives < ActiveRecord::Migration[8.1]
+  disable_ddl_transaction!
+
+  def up
+    Collavre::User.find_each(batch_size: 200) do |user|
+      Collavre::Creative.profile_for(user)
+    rescue => e
+      Rails.logger.error("[BackfillProfileCreatives] user #{user.id}: #{e.message}")
+    end
+  end
+
+  def down
+    # No-op: profiles are idempotent and safe to keep.
+  end
+end

engines/collavre/db/migrate/20260721000001_backfill_profile_descriptions.rb

@@ -0,0 +1,15 @@
+class BackfillProfileDescriptions < ActiveRecord::Migration[8.1]
+  disable_ddl_transaction!
+
+  def up
+    Collavre::User.find_each(batch_size: 200) do |user|
+      user.sync_profile_system_prompt!
+    rescue => e
+      Rails.logger.error("[BackfillProfileDescriptions] user #{user.id}: #{e.message}")
+    end
+  end
+
+  def down
+    # No-op: descriptions are safe to keep.
+  end
+end

engines/collavre/test/controllers/users_controller_ai_test.rb

@@ -118,4 +118,59 @@ class UsersControllerAiTest < ActionDispatch::IntegrationTest
     assert_equal "Name can't be blank", flash[:alert]
     assert_select "form[action=?]", update_ai_user_path(@ai_user)
   end
+
+  # Regression: the edit form must pre-fill the prompt from the canonical
+  # profile creative (data["markdown_source"]), not the legacy system_prompt
+  # column. If the profile creative was edited directly, the column is stale;
+  # rendering it would post it back and update_ai's sync would clobber the
+  # profile-authored prompt on any unrelated setting change.
+  test "edit_ai pre-fills the prompt from the canonical profile creative, not the stale column" do
+    @ai_user.update_column(:system_prompt, "STALE COLUMN PROMPT")
+    @ai_user.profile_creative.update!(content_type_input: "markdown", markdown_source: "CANONICAL EDITED PROMPT")
+
+    get edit_ai_user_url(@ai_user)
+    assert_response :success
+    assert_select "textarea#user_system_prompt", text: /CANONICAL EDITED PROMPT/
+    assert_select "textarea#user_system_prompt", text: /STALE COLUMN PROMPT/, count: 0
+  end
+
+  # Regression: with the form now posting the effective value, an unrelated
+  # setting change (model) re-posts the canonical prompt and must not erase a
+  # directly-edited profile prompt.
+  test "update_ai preserves a directly-edited profile prompt when re-posting the effective value" do
+    @ai_user.update_column(:system_prompt, "STALE COLUMN PROMPT")
+    @ai_user.profile_creative.update!(content_type_input: "markdown", markdown_source: "CANONICAL EDITED PROMPT")
+
+    patch update_ai_user_url(@ai_user), params: {
+      user: {
+        system_prompt: @ai_user.effective_system_prompt, # what the fixed form posts
+        llm_model: "gemini-1.5-pro"
+      }
+    }
+    assert_redirected_to edit_ai_user_path(@ai_user)
+    @ai_user.reload
+    assert_equal "gemini-1.5-pro", @ai_user.llm_model
+    assert_equal "CANONICAL EDITED PROMPT", @ai_user.effective_system_prompt
+    assert_equal "CANONICAL EDITED PROMPT", @ai_user.profile_creative.data["markdown_source"]
+  end
+
+  # Regression: a partial settings update that omits system_prompt entirely
+  # (e.g. a routing_expression-only PATCH) must not run the prompt sync at all.
+  # Otherwise the stale legacy column is copied back over the canonical
+  # profile-authored prompt, silently erasing a directly-edited prompt.
+  test "update_ai does not clobber the canonical prompt on a PATCH that omits system_prompt" do
+    @ai_user.update_column(:system_prompt, "STALE COLUMN PROMPT")
+    @ai_user.profile_creative.update!(content_type_input: "markdown", markdown_source: "CANONICAL EDITED PROMPT")
+
+    patch update_ai_user_url(@ai_user), params: {
+      user: {
+        routing_expression: 'event_name == "comment_created"'
+      }
+    }
+    assert_redirected_to edit_ai_user_path(@ai_user)
+    @ai_user.reload
+    assert_equal 'event_name == "comment_created"', @ai_user.routing_expression
+    assert_equal "CANONICAL EDITED PROMPT", @ai_user.profile_creative.data["markdown_source"]
+    assert_equal "CANONICAL EDITED PROMPT", @ai_user.effective_system_prompt
+  end
 end

engines/collavre/test/fixtures/topics.yml

@@ -0,0 +1,10 @@
+_fixture:
+  model_class: Collavre::Topic
+
+# Intentionally empty. Registering the topics table as fixture-managed makes
+# Rails DELETE FROM topics during fixture loading, before the whole-DB
+# foreign-key check runs. Non-transactional (system) tests can create a user
+# whose profile creative (Collavre::HasProfileCreative) is committed together
+# with a main topic; the raw fixture DELETE of creatives bypasses
+# dependent: :destroy and would otherwise leave that topic orphaned, tripping
+# check_all_foreign_keys_valid! for every subsequent fixture load.