passepartout: v0.4.1 Design Cleanup

- Remove system-prompt-augment mechanism, introduce *standing-mandates*
- Fix false token-overhead claims in DESIGN_DECISIONS + ROADMAP
- Update security vector count 9-10 across all docs and dispatcher docstring
- Rewrite README with agent section, soften aspirational claims
- Register 10 cognitive tools in programming-tools.org with test suite
- Enforce NO-HARDCODED-CONSTANTS in .env.example
- ROADMAP: mark v0.3.x patches DONE, add LOGBOOKs, mark releases
- AGENTS.md: rewrite compact (180 to 50 lines), move refs to CONTRIBUTING
- Normalize org tangle directives to file-level PROPERTY inheritance

org/core-loop-reason.org

@@ -195,9 +195,9 @@ This is the main entry point for the probabilistic engine. Every cognitive cycle
 The function handles several cases:
 - If a triggered skill provides a probabilistic prompt generator, that replaces the raw user input
 - If the previous proposal was rejected, the rejection trace is injected into the LLM's context so it can self-correct
-- Skills can augment the system prompt with domain-specific mandates via the ~system-prompt-augment~ mechanism
+- Standing mandates from ~*standing-mandates*~ are injected into the IDENTITY section of the system prompt
 
-The system prompt assembly order — identity, tools, context, logs, mandates — is intentional: the most dynamic content (mandates from skills) comes last so it has the most influence on the LLM's output.
+The system prompt assembly order — identity (including mandates), tools, context, logs — is intentional: standing mandates appear early in IDENTITY so they set the behavioral frame before the model processes tools, context, and logs.
 
 ;; REPL-VERIFIED: 2026-05-03T13:00:00
 #+begin_src lisp
@@ -216,19 +216,18 @@ The system prompt assembly order — identity, tools, context, logs, mandates
          (reflection-feedback (if rejection-trace
                                   (format nil "~%~%PREVIOUS PROPOSAL REJECTED: ~a" rejection-trace)
                                   ""))
-         (skill-augments (let ((augments ""))
-                           (maphash (lambda (name skill)
-                                      (declare (ignore name))
-                                      (let ((aug-fn (skill-system-prompt-augment skill)))
-                                        (when aug-fn
-                                          (let ((aug-text (ignore-errors (funcall aug-fn context))))
-                                            (when (and aug-text (stringp aug-text) (> (length aug-text) 0))
-                                              (setf augments (concatenate 'string augments aug-text (string #\Newline))))))))
-                                    *skill-registry*)
-                           (when (> (length augments) 0) augments)))
-         (system-prompt (format nil "IDENTITY: ~a~a~%~%TOOLS:~%~a~%~%CONTEXT:~%~a~%~%LOGS:~%~a~%~a" 
-                                assistant-name reflection-feedback tool-belt global-context system-logs
-                                (or skill-augments ""))))
+         (standing-mandates-text (let ((out ""))
+                                   (dolist (fn *standing-mandates*)
+                                     (let ((text (ignore-errors (funcall fn context))))
+                                       (when (and text (stringp text) (> (length text) 0))
+                                         (setf out (concatenate 'string out text (string #\Newline))))))
+                                   (when (> (length out) 0) out)))
+         (system-prompt (format nil "IDENTITY: ~a~a~a~%~%TOOLS:~%~a~%~%CONTEXT:~%~a~%~%LOGS:~%~a"
+                                assistant-name reflection-feedback
+                                (if standing-mandates-text
+                                    (concatenate 'string (string #\Newline) standing-mandates-text)
+                                    "")
+                                tool-belt global-context system-logs)))
     (let* ((thought (backend-cascade-call raw-prompt :system-prompt system-prompt :context context))
            (cleaned (if (and (listp thought) (getf thought :type))
                         (format nil "~a" (getf (getf thought :payload) :text))
@@ -375,7 +374,7 @@ uses the old name can call this alias. New code should call
 
 * Test Suite
 Verifies that the deterministic engine correctly rejects unsafe actions (like ~rm -rf /~) while allowing safe ones.
-#+begin_src lisp :tangle ../lisp/core-loop-reason.lisp
+#+begin_src lisp
 (eval-when (:compile-toplevel :load-toplevel :execute)
   (ql:quickload :fiveam :silent t))