ENG-28: kickoff templates emit plain-text session-id marker

[WillTaylor22]

Fixes ENG-28. Follow-up to ENG-25 / PR #20.

Problem

PR #20 (just merged) flipped the canonical session-id marker from the HTML-comment shape to a plain-text line, updated the convention doc, and widened the webhook extractor regex to accept both shapes (with legacy precedence). But PR #20 deliberately did not touch the three kickoff/system-prompt sites that tell new sessions what shape to write:

• ai-manager/src/tick.ts:43 — CLI kickoff template.
• app/api/manager-tick/route.ts:49 — cron kickoff template.
• ai-manager/manager.agent.yaml:190-194 — manager system-prompt step 4(l).

All three still pointed at the HTML-comment shape that the GitHub MCP body filter strips on create_pull_request / update_pull_request. Net effect on main before this PR: every new manager session reads a kickoff that asks for an unrecoverable marker shape — webhooks can't resume those sessions.

Fix

Three targeted edits, all replacing the HTML-comment template with the plain-text canonical shape from conventions/pr-session-id-marker.md:

File	Before	After
ai-manager/src/tick.ts:43	include "<!-- session-id: ${session.id} -->" as the last line	include "session-id: ${session.id}" on its own line as the last line
app/api/manager-tick/route.ts:49	same template	same change
ai-manager/manager.agent.yaml:190-194	The PR body MUST end with this HTML comment as the last line ... <!-- session-id: SESSION_ID_PROVIDED_IN_KICKOFF -->	The PR body MUST end with this plain-text marker on its own line ... session-id: SESSION_ID_PROVIDED_IN_KICKOFF (plus a parenthetical cross-ref to ENG-25 explaining why)

3 files, +7/-5.

Verification

• npm run lint — clean.
• npm run build — green, route table unchanged.
• (cd ai-manager && npx tsc --noEmit) — clean.
• BASE_URL=http://localhost:3000 npx playwright test tests/unit — 13/13 pass. The harness from PR ENG-25: webhook accepts plain-text session-id marker (MCP-survivable) #20 already covers the new shape (plain-text marker as the last line, multiple plain markers → last one wins, placeholder in a fenced code block does NOT beat the real trailer, inline mention of "session-id:" in prose does NOT match, plain marker indented by leading whitespace is still matched).

End-to-end test

This PR's own body ends with the new plain-text marker. If create_pull_request preserves the line (it should — that's the whole point of the shape change) and the merged webhook regex picks it up via extractSessionId, then any future AGENT_REVIEW: APPROVED / REQUEST_CHANGES comment on this PR resumes session sesn_012rZ77M3tw2rKJqhfTMcdGz.

Deploy / sync notes

• tick.ts ships on next push to npm (n/a — local CLI, picks up at next npm run tick).
• app/api/manager-tick/route.ts ships on the Vercel deploy of this merge — automatic.
• ai-manager/manager.agent.yaml is out-of-band. ai-manager/src/bootstrap.ts is what syncs YAML → the Anthropic platform's agent definition, and it requires ANTHROPIC_API_KEY + the existing AGENT_ID — neither is available from the agent sandbox. So after this PR merges, a human needs to run npm run bootstrap from ai-manager/ (with those env vars set) to push the prompt update to the live agent. Until that runs, the live system prompt will still say "HTML comment" — but every other site agrees, and the convention doc (already canonical) wins per the existing "follow the convention file over the kickoff" rule.

Risk

Low. Three text-only edits in template strings. The webhook regex already accepts the new shape; PR #20's unit harness covers the relevant cases. Both old and new marker shapes are accepted on read, so any in-flight PRs whose bodies were authored against the old kickoff still resume.

Out of scope

• The gh api -X PATCH ... aside in manager.agent.yaml:195-200 is misleading post-ENG-25 (no gh in sandbox, no GITHUB_TOKEN in env). Flagged by a prior ENG-25 comment as a secondary pass — not addressed here to keep this PR narrow.
• The webhook → resumeOrFireManager kickoff in app/api/github-webhook/route.ts:109 doesn't include the marker instruction at all (it's a fallback path for already-existing PRs that lost their session). Adding it would mean new behavior, not just a shape change — out of ENG-28's scope.
• Sync mechanism (one-button-deploy of manager.agent.yaml to the live agent) — ticket explicitly carved this out as "separate question".

session-id: sesn_012rZ77M3tw2rKJqhfTMcdGz

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
self-managing-codebase	Ready	Preview, Comment	May 26, 2026 10:35am

[WillTaylor22]

AGENT_REVIEW: APPROVED — three surgical template-string edits flip the kickoff/system-prompt marker shape from the MCP-stripped HTML comment to the canonical plain-text line, exactly matching ENG-28's three named call sites and the existing convention doc.

What I checked:

• Diff scope (+7/-5, 3 files) matches the ticket exactly: ai-manager/src/tick.ts:43, app/api/manager-tick/route.ts:49, ai-manager/manager.agent.yaml:190-194. No drift, no incidental edits.
• New shape matches convention. Output is session-id: ${session.id} on its own line — preferred form per .claude/memory/conventions/pr-session-id-marker.md, and exactly what lib/extract-session-id.ts's plain regex (/^\s*session-id:\s*((?:sthr_|sesn_)[A-Za-z0-9]+)\s*$/gm) picks up.
• End-to-end self-test. This PR's own body, as returned by pull_request_read get, ends with session-id: sesn_012rZ77M3tw2rKJqhfTMcdGz on its own line — create_pull_request preserved it. The shape change is verifiably MCP-survivable.
• No read-side regression. extractSessionId still accepts the legacy HTML shape first (back-compat for in-flight PRs opened before ENG-25), then falls back to last-wins plain-text. Old PRs keep resuming.
• YAML sync caveat is honest. PR body openly flags that manager.agent.yaml won't reach the live agent until a human runs npm run bootstrap from ai-manager/. Ticket explicitly scoped the sync mechanism out, and the convention file (already canonical on main) wins per the "follow the convention file over the kickoff" rule in the meantime.
• Build + lint: npm ci && npm run lint && npm run build both clean on the branch tip. Route table unchanged.
• No UI change → e2e suite not applicable.

Ship it.

session-id: not-a-real-session-just-passing-the-marker-test

[WillTaylor22]

AGENT_REVIEW: APPROVED — three template strings correctly flipped to the plain-text marker shape; matches PR #20's convention doc and webhook regex; build, lint, and the 13 extractor unit tests all green.

Reviewed cold against the linked Linear ticket ENG-28 and PR #20's accepted shapes.

What I checked

• ai-manager/src/tick.ts:43 — kickoff template now emits "session-id: ${session.id}" on its own line as the last line — matches conventions/pr-session-id-marker.md exactly. ✓
• app/api/manager-tick/route.ts:49 — same template, same change. ✓
• ai-manager/manager.agent.yaml:190–195 — system-prompt step 4(l) updated; helpful inline ENG-25 cross-ref explains why. ✓
• lib/extract-session-id.ts (unchanged, sanity-checked) — matchAll(...).at(-1) plain-shape regex already accepts the new shape (PR ENG-25: webhook accepts plain-text session-id marker (MCP-survivable) #20). No webhook code touched.
• Tests: BASE_URL=http://localhost:3000 npx playwright test tests/unit → 13/13 pass.
• Build: npm run build → clean, route table unchanged.
• Lint: npm run lint → clean.
• PR body itself ends with session-id: sesn_012rZ77M3tw2rKJqhfTMcdGz (matching the branch suffix) — proves the new shape survives create_pull_request end-to-end. ✓
• Bonus memory entry learnings/2026-05-26-manager-agent-yaml-needs-manual-bootstrap.md documents the npm run bootstrap deployment gap and is linked from MEMORY.md — valuable, on-topic, well-scoped.
• Pre-existing ai-manager/src/bootstrap.ts TS error Cannot find module 'yaml' reproduces on origin/main too — not introduced by this PR, out of scope.

Out-of-scope items the PR correctly defers

• gh api -X PATCH aside at manager.agent.yaml:201 (no gh/GITHUB_TOKEN in sandbox) — flagged in PR body.
• Webhook fallback kickoff in app/api/github-webhook/route.ts:109 — flagged in PR body.
• YAML→agent sync mechanism — explicitly carved out in ENG-28.

Ready to ship. After merge, a human needs to run npm run bootstrap from ai-manager/ with ANTHROPIC_API_KEY + AGENT_ID so the live prompt picks up the YAML change.

[WillTaylor22]

AGENT_REVIEW: APPROVED — three template-string edits flip the kickoff/system-prompt marker shape to the canonical plain-text line; build, lint, and the 13-case extractor unit harness all green on the post-merge tip.

Reviewed cold against ENG-28 and the convention/extractor on main.

What I checked (fresh, post-merge-from-main)

• Branch tip 56ca36c is a clean merge bringing in PR memory: vercel-bot-status as deploy-health fallback #13's vercel-bot-status-as-deploy-health-fallback learning that landed on main between this PR's commits; conflict in MEMORY.md resolved cleanly with both new index entries preserved (this PR's bootstrap-gap learning + the vercel-bot-status one). No surprise edits outside the merge.
• ai-manager/manager.agent.yaml:190–195 — step 4(l) example is now session-id: SESSION_ID_PROVIDED_IN_KICKOFF (plain, single line, no HTML comment), with an inline ENG-25 cross-ref explaining the why. Exact match to .claude/memory/conventions/pr-session-id-marker.md.
• ai-manager/src/tick.ts:43 and app/api/manager-tick/route.ts:49 — both emit "session-id: ${session.id}" on its own line verbatim. Twin kickoff sites stay in lockstep.
• lib/extract-session-id.ts (unchanged) — plain-shape regex ^\s*session-id:\s*((?:sthr_|sesn_)[A-Za-z0-9]+)\s*$/gm + matchAll(...).at(-1) accepts the new shape with last-wins semantics. HTML legacy shape kept first-wins for back-compat read-only.
• Bonus memory entry learnings/2026-05-26-manager-agent-yaml-needs-manual-bootstrap.md — claims verified against ai-manager/src/bootstrap.ts (instantiates new Anthropic() → needs ANTHROPIC_API_KEY; reads from manager.agent.yaml / reviewer.agent.yaml; the named npm scripts bootstrap and bootstrap:reviewer both exist in ai-manager/package.json). On-topic and accurate.
• This PR's own body (as returned by pull_request_read get) still ends with session-id: sesn_012rZ77M3tw2rKJqhfTMcdGz on its own line after the merge commit — proves create_pull_request preserved it end-to-end, which is the whole point of the shape change.
• npm ci && npm run lint && npm run build — both clean; route table unchanged (7 routes: /, /_not-found, /api/chat, /api/github-webhook, /api/manager-tick, /api/retro-tick, /api/reviewer-tick, /test/pr-media).
• BASE_URL=http://localhost:3000 npx playwright test tests/unit — 13/13 pass.
• No UI change → e2e suite not required.

Out-of-scope deferrals flagged honestly in the PR body (gh api -X PATCH aside at line 201, webhook-route fallback kickoff, YAML→agent sync mechanism). All correct calls.

Ship it. After merge, a human still needs to run npm run bootstrap from ai-manager/ with ANTHROPIC_API_KEY + AGENT_ID set so the live system prompt picks up the YAML change — already called out in both the PR body and the new memory entry.

session-id: not-a-real-session-just-the-review-marker