Per-agent custom instructions for public & channel chats (Sharing tab)

[vybe]

Summary

Add a per-agent "Additional instructions" field on the Sharing tab of the Agent Detail page that injects a custom fragment into the system prompt for public-facing conversations only — public links, Slack/Telegram/WhatsApp channels, and x402 paid chat. This lets owners tailor an agent's persona, guardrails, disclaimers, or scope for outside audiences without changing how the agent behaves in their own authenticated chats, scheduled work, or agent-to-agent calls.

Context

The Sharing tab is where an owner configures every outward-facing surface: public links, channel bindings (Slack/Telegram/WhatsApp), email access policy, and file sharing. Today there is no way to give the agent extra instructions that apply specifically to those public/channel conversations — e.g. "you're talking to an external customer, never reveal internal project names," "always answer in the visitor's language," or a required legal disclaimer.

The only workaround is to bake such rules into the agent's CLAUDE.md, which also affects the owner's own private/authenticated chats and scheduled executions — the wrong blast radius.

Trinity already has the exact precedent: the per-agent voice_system_prompt (GET/PUT /api/agents/{name}/voice/prompt) injects a custom prompt fragment into voice sessions only. This feature is the text-surface counterpart of that pattern, scoped to the surfaces governed by the Sharing tab.

Acceptance Criteria

• New per-agent field (e.g. public_channel_system_prompt) editable from the Sharing tab, with save/clear and a sensible character limit.
• When set, the fragment is appended to the assembled system prompt for: public links, all channel messages routed through the channel message router (Slack/Telegram/WhatsApp), and x402 paid chat.
• The fragment is NOT applied to the owner's authenticated web Chat/Session tabs, scheduled executions, loops, or agent-to-agent calls.
• Composes correctly with the existing MEM-001 per-user memory block (both folded into the caller_prompt path of compose_system_prompt).
• GET/PUT REST endpoints mirroring the voice-prompt pattern, owner-only auth.
• Empty/unset value is a strict no-op — zero behavior change for existing agents.
• Group-chat behavior is explicit (decide during grooming; proposed default: apply to groups too, since group channels are public-facing).

Technical Notes

Mirror the existing voice_system_prompt implementation end to end:

• Schema / migration: add a public_channel_system_prompt TEXT column to agent_ownership (DDL in src/backend/db/schema.py, versioned migration in src/backend/db/migrations.py per Invariant Feature/vector log retention #3). Precedent column: voice_system_prompt.
• DB layer: getter/setter alongside the existing get_voice_system_prompt/set_voice_system_prompt (Invariant Feature/gemini runtime support #2 prefers a db/agent_settings/ mixin for new agent settings).
• Models: request/response models in src/backend/models.py (Invariant Add internal health route, without which main didn't start #14).
• Router: GET/PUT /api/agents/{name}/public-prompt mirroring src/backend/routers/voice.py /voice/prompt.
• Injection points — fetch the fragment and fold it into the string already passed as system_prompt:
  • src/backend/adapters/message_router.py _run_agent_task() — same assembly site where the MEM-001 memory_system_prompt is built before execute_task(system_prompt=...).
  • src/backend/routers/public.py — public chat sync + async paths.
  • src/backend/routers/paid.py — x402 paid chat path.
  • All three flow into task_execution_service.execute_task(system_prompt=...) → platform_prompt_service.compose_system_prompt(caller_prompt=...), which appends the caller fragment after the platform base + execution-context block — so the composer itself needs no change.
• Frontend: new section in src/frontend/src/components/SharingPanel.vue; API methods via the agents store (src/frontend/src/stores/agents.js) and the single Axios client (Invariants Feature/process engine #6/security: Fix token logging and add HTML reports to gitignore #7).
• No MCP change: channel + public chats don't traverse the MCP server, so no MCP tool update is required (Invariant feat: SMARTS trading pipeline with Telegram notifications and Miro visualization #13 N/A here).
• Voice already covered: the existing voice_system_prompt is the equivalent for voice/VoIP, so those surfaces are out of scope for this issue.