Persona profiles: prompt fragment + skill allowlist + tool/secret scope

[mattmezza]

Summary

Introduce a first-class Profile (persona) primitive so the agent can take on distinct
identities/specialties (e.g. a fitness coach, a personal-finance assistant) without bespoke code
per persona.

Motivation

Identity is currently fixed via character.md + personalia.md, composed once in
core/agent.py::_build_system_prompt. A persona is the same idea made swappable, and it becomes
the shared building block for per-chat personas, subagents, and per-persona secret access.

Definition

A Profile is exactly four things:

• a system-prompt fragment (tone / role / specialty),
• a skill allowlist (which skills it may load),
• a tool/permission scope (which tools and permission rules apply),
• a secret scope (which vault namespaces it may read/write — see the secrets-vault issue).

Proposed approach

• Add a personas/ directory that mirrors the existing skills pipeline: markdown files with
  frontmatter, seeded into SQLite at startup, editable in the admin UI, lazily referenced. Reuses
  the core/skills.py machinery rather than adding a new subsystem.
• Frontmatter carries the skill allowlist, tool/permission scope, and secret scope.
• _build_system_prompt selects the active persona's fragment + allowlisted skills.

UX & product

• Admin UI: a Personas page mirroring the skills editor — persona cards (name, role, emoji/
  avatar) with create / edit / delete. Default to a guided form (name, role, tone, skill
  checkboxes, scope toggles); raw-markdown view for power users. Ship a starter gallery (fitness
  coach, finance assistant, travel planner, …) the user clones in one tap, so a useful persona
  exists without writing anything. The page is responsive and touch-friendly — usable at phone
  width, collapsible nav, no horizontal scroll — and reuses consistent form/card/toggle components.
• On the go (Telegram): /personas lists with inline-button selection; "create a persona" runs
  as a guided chat flow where the agent asks for name/role/style and writes the file itself — no web
  UI needed to get started. Standard inline-keyboard + progress conventions.
• Mobile-first: the guided form (not markdown) is the default precisely because markdown editing
  on a phone is painful; create and switch personas entirely from Telegram on the go.

Setup & onboarding

• A default persona ships enabled so first-run behaviour is unchanged (works out of the box).
• Contributes a setup-wizard step — pick a starting persona or keep the default — skippable in
  a tap.

Acceptance criteria

• A persona can be defined entirely in a markdown file and hot-loaded without code changes.
• The active persona constrains which skills/tools are advertised to the model.
• A new user can get a working specialty persona from the starter gallery or a guided Telegram flow
  without writing markdown.
• The Personas page and persona switching are fully usable at phone width and from Telegram.
• A default persona preserves today's behaviour when none is selected.

Related

• Underpins: per-chat personas, subagents, secrets-vault ACL.