[ranxianglei]

What

Opens the kernel's 4 load-bearing compression rules for host override, behind an acknowledgeRisk gate — the foundation for customizable prompts across acp-kernel and its downstreams (billion-context-pi, opencode-acp, …). Tracks dog/billion-context-pi#27 (design discussion → approved → reviewed).

Pure additive: default wording is byte-identical, and renderNudgeText stays one-arg backward-compatible. No downstream change required to keep current behavior.

Why staged this way

Prompt text is split into load-bearing (the compression rules — tuned over months, quality-critical for retrieval) vs surface (headers, chrome, descriptions). Layer 0 opens only the load-bearing rules, gated so overrides can't happen by accident. Full rationale + the 4-layer roadmap (override interface → prompt-set format → adapter plumbing → third-party packs) is in DESIGN-prompts.md.

Changes (5 files, +451/−11)

• src/prompts.ts (new) — the public override surface:
  • interface Prompts { compressPhilosophy; howToCompressRules; tier2DistillRules; tier3CondenseRules: string }
  • defaultPrompts — Object.freezed singleton (review R2: callers can't corrupt the shared default).
  • resolvePrompts(overrides?, { acknowledgeRisk? }) — non-string values are dropped (review R1: {compressPhilosophy: undefined} no longer clobbers the good default); throws on any override without acknowledgement, naming the offending keys. Mirrors the existing compress-tool dangerous/acknowledgeRisk pattern.
• src/nudge-text.ts — renderNudgeText(decision, prompts = defaultPrompts); an override now flows into every nudge tier (gentle / emergency / tier-2 / tier-3). EFFICIENCY_NOTE/EMERGENCY_HEADER became helper functions of prompts.
• src/index.ts — export defaultPrompts, resolvePrompts, Prompts, ResolvePromptsOptions.
• tests/prompts.test.ts (new, 20 tests) — defaults mirror the verbatim constants; empty override no-op; override without ack throws + lists keys; override with ack merges; renderNudgeText reflects custom text across all four modes; non-clobber (undefined/null/number dropped); no-aliasing/mutation; frozen assertion; one-arg vs two-arg byte-identity.
• DESIGN-prompts.md (new) — load-bearing/surface classification, host usage, non-goals, Layers 1–3 design intent, risk table.

Verification

• npm run typecheck ✅
• npm test ✅ — 244 pass / 0 fail (224 baseline + 20 new)
• npm run build ✅ — dist/index.js + .d.ts emit the new exports

Dual-agent review

Two oracle agents reviewed for regressions (per issue #27). Verdict: ship-with-fixes. Two real issues found and fixed (R1 non-string clobber, R2 mutable singleton — both above). Non-blocking observations documented in DESIGN-prompts.md.

Publishing

Rebased onto current master (v0.0.20, 13a345e). Note: 0.0.21 already shipped for an unrelated nudge fix (#64) and does NOT include Layer 0. When this PR merges, Layer 0 lands in the next publish (0.0.22). Downstream billion-context-pi#128 is blocked on that.

Non-goals (deliberately deferred)

Surface text (summary header, status-report headers, tool descriptions) and inline validation errors stay fixed for now — see DESIGN-prompts.md §Non-goals. No Config/defaultConfig change; the host holds the resolved Prompts object and passes it explicitly.

🤖 Merge is human-only — I will not merge this PR.