sh1nj1 · sh1nj1 · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026
diff --git a/db/schema.rb b/db/schema.rb
diff --git a/engines/collavre/app/controllers/concerns/collavre/users_controller/ai_user_management.rb b/engines/collavre/app/controllers/concerns/collavre/users_controller/ai_user_management.rb
@@ -43,6 +43,7 @@ def create_ai
       @user.agent_conf = params[:agent_conf] if @user.respond_to?(:agent_conf=) && params[:agent_conf].present?
 
       if @user.save
+        @user.sync_profile_system_prompt!
         Collavre::Contact.ensure(user: Current.user, contact_user: @user)
         share_ai_agent_to_creative(@user, params[:creative_id])
         redirect_to user_path(Current.user, tab: "contacts"), notice: I18n.t("collavre.users.create_ai.success")
@@ -61,6 +62,7 @@ def update_ai
       ai_params = params.require(:user).permit(:name, :system_prompt, :llm_vendor, :llm_model, :llm_api_key, :gateway_url, :searchable, :routing_expression, :agent_conf, tools: [])
 
       if @user.update(ai_params)
+        @user.sync_profile_system_prompt!
         redirect_to edit_ai_user_path(@user), notice: I18n.t("collavre.users.update_ai.success")
       else
         @available_tools = load_available_tools

diff --git a/engines/collavre/app/models/collavre/creative.rb b/engines/collavre/app/models/collavre/creative.rb
@@ -8,8 +8,11 @@ class Creative < ApplicationRecord
     # ---------------------------------------------------------------------------
     # Reserved metadata key registry — engines register their own namespaces so
     # `update_metadata` preserves them without core naming vendor-specific keys.
+    # "kind" is the discriminator (`inbox`/`profile`/`skill`) that scopes like
+    # `profiles` query on (`data->>'kind'`); it must be preserved or a metadata
+    # save that omits it makes the row undiscoverable and a duplicate is created.
     # ---------------------------------------------------------------------------
-    BUILTIN_RESERVED_METADATA_KEYS = %w[markdown_source content_type editor].freeze
+    BUILTIN_RESERVED_METADATA_KEYS = %w[markdown_source content_type editor kind].freeze
 
     class << self
       def registered_reserved_metadata_keys
@@ -69,6 +72,12 @@ def to_partial_path
     # --- Inbox ---
     scope :inboxes, -> { where("data->>'kind' = 'inbox'") }
 
+    # --- Profile ---
+    PROFILE_KIND = "profile"
+    SKILL_KIND = "skill"
+
+    scope :profiles, -> { where("data->>'kind' = ?", PROFILE_KIND) }
+
     SYSTEM_TOPIC_NAME = "System"
     MAIN_TOPIC_NAME = "Main"
     CONTENT_TOPIC_NAME = "Content"
@@ -135,6 +144,20 @@ def self.inbox_for(user)
       )
     end
 
+    # Find or create the profile creative for a given user.
+    # Places it as a root creative (no parent) owned by the user.
+    def self.profile_for(user)
+      existing = profiles.where(user: user).first
+      return existing if existing
+
+      create!(
+        description: user.name.to_s,
+        data: { "kind" => PROFILE_KIND },
+        user: user,
+        progress: 0.0
+      )
+    end
+
     attr_accessor :filtered_progress
 
     belongs_to :user, class_name: Collavre.configuration.user_class_name, optional: true

diff --git a/engines/collavre/app/models/collavre/user.rb b/engines/collavre/app/models/collavre/user.rb
@@ -3,6 +3,7 @@ class User < ApplicationRecord
     self.table_name = "users"
 
     include HasInboxCreative
+    include HasProfileCreative
 
     has_many :user_themes, class_name: "Collavre::UserTheme", dependent: :destroy
 
@@ -207,6 +208,41 @@ def ai_user?
       llm_vendor.present?
     end
 
+    # Mirror the agent's system prompt into its profile creative as Markdown,
+    # so the raw prompt lands losslessly in data["markdown_source"] — the
+    # canonical home for the prompt. Writing the prompt straight into
+    # `description` would run it through the HTML sanitizer (Describable), which
+    # strips <thinking>/<tool_call> tags and entity-escapes < > &, corrupting
+    # every prompt; the derived `description` is only a rendered display view.
+    # The system_prompt column is legacy, pending removal.
+    # No-op for humans and for prompt-less agents (profile keeps its name seed).
+    def sync_profile_system_prompt!
+      return unless ai_user?
+      creative = profile_creative
+      if system_prompt.present?
+        return if creative.data&.dig("markdown_source") == system_prompt
+        creative.update!(content_type_input: "markdown", markdown_source: system_prompt)
+      elsif creative.data&.dig("markdown_source").present?
+        # The prompt was cleared. Demote out of markdown mode so the stale
+        # markdown_source is dropped and render falls back to the (now-blank)
+        # column — matching the pre-profile behavior where blanking the prompt
+        # took effect immediately. Also reseed `description` back to the name
+        # seed so the old rendered prompt doesn't stay visible/searchable on the
+        # owned profile root. Without this, the old prompt stays authoritative.
+        creative.update!(content_type_input: "html", description: name.to_s)
+      end
+    end
+
+    # The effective system prompt for all read consumers. The canonical prompt
+    # lives in the profile creative's data["markdown_source"]; the legacy
+    # `system_prompt` column is the fallback for rows not yet backfilled. Every
+    # prompt reader (orchestration matching, type classification, typo agent,
+    # admin view) must route here so that editing the profile creative directly
+    # takes effect everywhere, not just in AiAgentService.
+    def effective_system_prompt
+      profile_creative&.data&.dig("markdown_source").presence || system_prompt
+    end
+
     def claude_channel_agent?
       llm_model == "claude-code"
     end

diff --git a/engines/collavre/app/models/concerns/collavre/has_profile_creative.rb b/engines/collavre/app/models/concerns/collavre/has_profile_creative.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Collavre
+  module HasProfileCreative
+    extend ActiveSupport::Concern
+
+    included do
+      after_create_commit :create_profile_creative
+    end
+
+    # Returns the user's profile creative, creating one if it doesn't exist.
+    def profile_creative
+      Collavre::Creative.profile_for(self)
+    end
+
+    private
+
+    def create_profile_creative
+      Collavre::Creative.profile_for(self)
+    rescue StandardError => e
+      Rails.logger.error("[HasProfileCreative] Failed to create profile for user #{id}: #{e.message}")
+    end
+  end
+end
diff --git a/engines/collavre/app/services/collavre/agent_type_classifier.rb b/engines/collavre/app/services/collavre/agent_type_classifier.rb
@@ -8,7 +8,7 @@ module AgentTypeClassifier
     # Returns the agent type string ("developer", "pm", "qa", "researcher",
     # "marketer", "planner") or "agent" as the default when nothing matches.
     def classify(user)
-      prompt = user.system_prompt.to_s.downcase
+      prompt = user.effective_system_prompt.to_s.downcase
       case prompt
       when /developer|개발/ then "developer"
       when /pm|project.?manager|프로젝트/ then "pm"

diff --git a/engines/collavre/app/services/collavre/ai_agent_service.rb b/engines/collavre/app/services/collavre/ai_agent_service.rb
@@ -136,8 +136,13 @@ def prepare_rendering_context
     end
 
     def render_system_prompt(rendering_context)
+      # The prompt lives losslessly in the profile creative's markdown_source
+      # (data["markdown_source"]); `description` is the sanitized rendered view
+      # and would corrupt tags/angle-brackets, so never read it here. Fall back
+      # to the legacy system_prompt column for rows not yet backfilled.
+      template = @agent.effective_system_prompt
       rendered = AiSystemPromptRenderer.new(
-        template: @agent.system_prompt,
+        template: template,
         context: rendering_context
       ).render
 

diff --git a/engines/collavre/app/services/collavre/orchestration/arbiter.rb b/engines/collavre/app/services/collavre/orchestration/arbiter.rb
@@ -208,12 +208,15 @@ def calculate_keyword_score(agent, message_text)
       def extract_expertise_text(agent)
         texts = []
 
-        # From agent's system_prompt (primary source for AI agents)
-        texts << agent.system_prompt if agent.respond_to?(:system_prompt) && agent.system_prompt.present?
+        # From agent's system_prompt (primary source for AI agents). Route
+        # through effective_system_prompt so a directly-edited profile creative
+        # is matched on, falling back to the legacy column for other agent types.
+        texts << agent.effective_system_prompt if agent.respond_to?(:effective_system_prompt) && agent.effective_system_prompt.present?
+        texts << agent.system_prompt if !agent.respond_to?(:effective_system_prompt) && agent.respond_to?(:system_prompt) && agent.system_prompt.present?
 
         # From AI agent profile (for nested ai_agent association)
         if agent.respond_to?(:ai_agent) && agent.ai_agent.present?
-          texts << agent.ai_agent.system_prompt if agent.ai_agent.respond_to?(:system_prompt)
+          texts << agent.ai_agent.effective_system_prompt if agent.ai_agent.respond_to?(:effective_system_prompt)
           texts << agent.ai_agent.description if agent.ai_agent.respond_to?(:description)
         end
 

diff --git a/engines/collavre/app/services/collavre/typo_corrector.rb b/engines/collavre/app/services/collavre/typo_corrector.rb
@@ -49,7 +49,7 @@ def build_client
       AiClient.new(
         vendor: agent&.llm_vendor.presence || ENV.fetch("COLLAVRE_DEFAULT_LLM_VENDOR", "gemini"),
         model: agent&.llm_model.presence || ENV.fetch("COLLAVRE_DEFAULT_LLM_MODEL", "gemini-3.1-flash-lite"),
-        system_prompt: agent&.system_prompt.presence || FALLBACK_SYSTEM_PROMPT,
+        system_prompt: agent&.effective_system_prompt.presence || FALLBACK_SYSTEM_PROMPT,
         llm_api_key: agent&.llm_api_key,
         gateway_url: agent&.gateway_url,
         # Vendor adapters (e.g. OpenClaw) resolve the gateway/key from the context

diff --git a/engines/collavre/app/views/collavre/users/show.html.erb b/engines/collavre/app/views/collavre/users/show.html.erb
@@ -33,7 +33,7 @@
           <dd class="col-sm-9"><%= @user.llm_model %></dd>
 
           <dt class="col-sm-3"><%= t('collavre.users.new_ai.system_prompt_label') %></dt>
-          <dd class="col-sm-9"><pre><%= @user.system_prompt %></pre></dd>
+          <dd class="col-sm-9"><pre><%= @user.effective_system_prompt %></pre></dd>
         </dl>
       </div>
     <% else %>

diff --git a/engines/collavre/db/migrate/20260721000000_backfill_profile_creatives.rb b/engines/collavre/db/migrate/20260721000000_backfill_profile_creatives.rb
@@ -0,0 +1,15 @@
+class BackfillProfileCreatives < ActiveRecord::Migration[8.1]
+  disable_ddl_transaction!
+
+  def up
+    Collavre::User.find_each(batch_size: 200) do |user|
+      Collavre::Creative.profile_for(user)
+    rescue => e
+      Rails.logger.error("[BackfillProfileCreatives] user #{user.id}: #{e.message}")
+    end
+  end
+
+  def down
+    # No-op: profiles are idempotent and safe to keep.
+  end
+end
diff --git a/engines/collavre/db/migrate/20260721000001_backfill_profile_descriptions.rb b/engines/collavre/db/migrate/20260721000001_backfill_profile_descriptions.rb
@@ -0,0 +1,15 @@
+class BackfillProfileDescriptions < ActiveRecord::Migration[8.1]
+  disable_ddl_transaction!
+
+  def up
+    Collavre::User.find_each(batch_size: 200) do |user|
+      user.sync_profile_system_prompt!
+    rescue => e
+      Rails.logger.error("[BackfillProfileDescriptions] user #{user.id}: #{e.message}")
+    end
+  end
+
+  def down
+    # No-op: descriptions are safe to keep.
+  end
+end
diff --git a/engines/collavre/test/fixtures/topics.yml b/engines/collavre/test/fixtures/topics.yml
@@ -0,0 +1,10 @@
+_fixture:
+  model_class: Collavre::Topic
+
+# Intentionally empty. Registering the topics table as fixture-managed makes
+# Rails DELETE FROM topics during fixture loading, before the whole-DB
+# foreign-key check runs. Non-transactional (system) tests can create a user
+# whose profile creative (Collavre::HasProfileCreative) is committed together
+# with a main topic; the raw fixture DELETE of creatives bypasses
+# dependent: :destroy and would otherwise leave that topic orphaned, tripping
+# check_all_foreign_keys_valid! for every subsequent fixture load.
diff --git a/engines/collavre/test/models/collavre/creative_profile_test.rb b/engines/collavre/test/models/collavre/creative_profile_test.rb
@@ -0,0 +1,43 @@
+# engines/collavre/test/models/collavre/creative_profile_test.rb
+require "test_helper"
+
+module Collavre
+  class CreativeProfileTest < ActiveSupport::TestCase
+    setup { @user = Collavre::User.create!(name: "Ann", email: "ann@example.com", password: "password123") }
+
+    test "profile_for creates a profile creative owned by the user" do
+      profile = Collavre::Creative.profile_for(@user)
+      assert_equal "profile", profile.data["kind"]
+      assert_equal @user.id, profile.user_id
+    end
+
+    test "profile_for is idempotent" do
+      first = Collavre::Creative.profile_for(@user)
+      assert_no_difference -> { Collavre::Creative.profiles.where(user: @user).count } do
+        assert_equal first.id, Collavre::Creative.profile_for(@user).id
+      end
+    end
+
+    test "kind discriminator is a reserved metadata key" do
+      # `kind` scopes profile/inbox/skill discovery; it must survive a metadata
+      # save that omits it, or the profile becomes undiscoverable and duplicates.
+      assert_includes Collavre::Creative.reserved_metadata_keys, "kind"
+    end
+
+    test "preserving reserved keys keeps a profile discoverable after a metadata save" do
+      profile = Collavre::Creative.profile_for(@user)
+      # Simulate update_metadata's preservation loop with a payload omitting kind.
+      incoming = { "theme" => "dark" }
+      Collavre::Creative.reserved_metadata_keys.each do |key|
+        if profile.data.key?(key)
+          incoming[key] = profile.data[key]
+        else
+          incoming.delete(key)
+        end
+      end
+      profile.update!(data: incoming)
+      assert_equal profile.id, Collavre::Creative.profile_for(@user).id
+      assert_equal "profile", profile.reload.data["kind"]
+    end
+  end
+end
diff --git a/engines/collavre/test/models/collavre/user_profile_creative_test.rb b/engines/collavre/test/models/collavre/user_profile_creative_test.rb
@@ -0,0 +1,16 @@
+require "test_helper"
+
+module Collavre
+  class UserProfileCreativeTest < ActiveSupport::TestCase
+    test "human user gets a profile creative on create" do
+      u = Collavre::User.create!(name: "Human", email: "h@example.com", password: "password123")
+      assert_equal "profile", u.profile_creative.data["kind"]
+    end
+
+    test "AI agent also gets a profile creative on create" do
+      a = Collavre::User.create!(name: "Bot", email: "bot@example.com", password: "password123", llm_vendor: "google")
+      assert a.ai_user?
+      assert_equal "profile", a.profile_creative.data["kind"]
+    end
+  end
+end
diff --git a/engines/collavre/test/models/collavre/user_profile_system_prompt_test.rb b/engines/collavre/test/models/collavre/user_profile_system_prompt_test.rb
@@ -0,0 +1,87 @@
+require "test_helper"
+
+module Collavre
+  class UserProfileSystemPromptTest < ActiveSupport::TestCase
+    test "sync mirrors the agent system prompt into the profile markdown_source" do
+      agent = Collavre::User.create!(name: "NamedBot", email: "syncbot1@ai.local",
+                                     password: "password123", llm_vendor: "google",
+                                     system_prompt: "REAL PROMPT")
+      # after_create seeds the profile description with the name — the bug we fix.
+      assert_equal "NamedBot", agent.profile_creative.description
+      agent.sync_profile_system_prompt!
+      assert_equal "REAL PROMPT", agent.profile_creative.reload.data["markdown_source"]
+    end
+
+    test "sync stores prompts with tags and angle brackets losslessly" do
+      # Prompts routinely contain <thinking>, tool tags, and < > &. These MUST
+      # survive verbatim in markdown_source; the sanitized `description` would
+      # strip/entity-escape them, which is exactly why the prompt is NOT stored
+      # in description.
+      prompt = "Wrap reasoning in <thinking>...</thinking>. " \
+               "When count < 5 and result > 3 emit <tool_call>x</tool_call>. Use JSON & XML."
+      agent = Collavre::User.create!(name: "TagBot", email: "tagbot@ai.local",
+                                     password: "password123", llm_vendor: "google",
+                                     system_prompt: prompt)
+      agent.sync_profile_system_prompt!
+      assert_equal prompt, agent.profile_creative.reload.data["markdown_source"]
+    end
+
+    test "sync is idempotent and does not re-write an unchanged prompt" do
+      agent = Collavre::User.create!(name: "IdemBot", email: "idembot@ai.local",
+                                     password: "password123", llm_vendor: "google",
+                                     system_prompt: "STABLE PROMPT")
+      agent.sync_profile_system_prompt!
+      before = agent.profile_creative.reload.updated_at
+      agent.sync_profile_system_prompt!
+      assert_equal before, agent.profile_creative.reload.updated_at
+    end
+
+    test "clearing the system prompt drops the stale markdown_source" do
+      agent = Collavre::User.create!(name: "ClearBot", email: "clearbot@ai.local",
+                                     password: "password123", llm_vendor: "google",
+                                     system_prompt: "FIRST PROMPT")
+      agent.sync_profile_system_prompt!
+      assert_equal "FIRST PROMPT", agent.profile_creative.reload.data["markdown_source"]
+
+      # Admin blanks the prompt textarea — the old prompt must NOT stay authoritative.
+      agent.update!(system_prompt: "")
+      agent.sync_profile_system_prompt!
+      assert_nil agent.profile_creative.reload.data&.dig("markdown_source")
+
+      # The old rendered prompt must not linger as the visible profile description;
+      # it is reseeded back to the name so it isn't searchable/shown on the root.
+      assert_equal "ClearBot", agent.profile_creative.reload.description
+
+      svc = Collavre::AiAgentService.allocate
+      svc.instance_variable_set(:@agent, agent)
+      svc.instance_variable_set(:@creative, nil)
+      refute_includes svc.send(:render_system_prompt, {}), "FIRST PROMPT"
+    end
+
+    test "effective_system_prompt prefers profile markdown_source over the legacy column" do
+      agent = Collavre::User.create!(name: "EffBot", email: "effbot@ai.local",
+                                     password: "password123", llm_vendor: "google",
+                                     system_prompt: "LEGACY COLUMN")
+      # Before sync the column is the only source.
+      assert_equal "LEGACY COLUMN", agent.effective_system_prompt
+      # A direct profile edit (no column write) must take effect for all readers.
+      agent.profile_creative.update!(content_type_input: "markdown", markdown_source: "EDITED IN PROFILE")
+      assert_equal "EDITED IN PROFILE", agent.reload.effective_system_prompt
+    end
+
+    test "sync is a no-op for human users" do
+      human = Collavre::User.create!(name: "Human", email: "human1@example.com", password: "password123")
+      human.sync_profile_system_prompt!
+      assert_nil human.profile_creative.data&.dig("markdown_source")
+      assert_equal "Human", human.profile_creative.description
+    end
+
+    test "sync is a no-op when the agent has no system prompt" do
+      agent = Collavre::User.create!(name: "Blanky", email: "syncbot2@ai.local",
+                                     password: "password123", llm_vendor: "google")
+      agent.sync_profile_system_prompt!
+      assert_nil agent.profile_creative.data&.dig("markdown_source")
+      assert_equal "Blanky", agent.profile_creative.description
+    end
+  end
+end