diff --git a/examples/plan-acp-agent/cordis.yml b/examples/plan-acp-agent/cordis.yml
index f130cd5b37..1dae845488 100644
--- a/examples/plan-acp-agent/cordis.yml
+++ b/examples/plan-acp-agent/cordis.yml
@@ -28,6 +28,9 @@
   name: '@deepseek-ai/dsh-acp-demo'
   config:
     model: deepseek-v4-flash
+    # Keep this example's prompt fixed to its explicit persona; workspace
+    # instructions are demonstrated by a separate composition.
+    workspaceContext: false
     # Persistence root: $DSH_SNAPSHOT_SESSIONS_ROOT when the snapshot harness
     # sets it (so a record run's logs land where the harness harvests them),
     # else the local ./.sessions default.
diff --git a/examples/plan-acp-agent/tests/snapshots/plan-mode/tool-schemas.golden.json b/examples/plan-acp-agent/tests/snapshots/plan-mode/tool-schemas.golden.json
index 2cc789b9af..fc81051250 100644
--- a/examples/plan-acp-agent/tests/snapshots/plan-mode/tool-schemas.golden.json
+++ b/examples/plan-acp-agent/tests/snapshots/plan-mode/tool-schemas.golden.json
@@ -63,7 +63,7 @@
     },
     {
       "name": "bash",
-      "description": "Execute a bash command (`bash -c`) and return its stdout/stderr. Each call runs in a fresh shell: no state (cwd, variables, functions) persists between calls — pass `workdir` instead of using `cd`. Non-zero exits are reported as `[exit code: N]`. Commands may run under a file sandbox; a blocked file operation is reported as `[sandbox: file access denied under <mode> mode]` — a policy denial, not a bug in the command; do not retry another way. Long output is truncated to its tail; the full output is saved to a file whose path is reported when available. Set `run_in_background: true` for long-running commands: the call returns a task id immediately; read its output with `task_output` and stop it with `task_kill`. Attempting a command the sandbox may deny is safe and expected: run it and read the marker rather than assuming the denial. When a command is denied and a wider mode would let it succeed, escalate immediately in the same turn — the one sanctioned exception to a denial: retry the exact same command once with `sandbox_permissions` (the narrowest wider mode that suffices) plus a one-sentence `justification`. Do not detour through chat to ask permission first — the approval prompt raised by that retry is how the user consents. If the session states approval prompts are disabled, there is no exception: a denial is final — do not set `sandbox_permissions`. Never escalate speculatively: ground the request in a real denial — normally the one this command just hit; escalating up front is fine only when this session already denied the same access. A rejected escalation is final for that command — stop and explain, never work around it — but it does not forbid attempting or escalating other commands later.",
+      "description": "Execute a bash command (`bash -c`) and return its stdout/stderr. Each call runs in a fresh shell: no state (cwd, variables, functions) persists between calls — pass `workdir` instead of using `cd`. Non-zero exits are reported as `[exit code: N]`. Current harness environment facts are exposed through managed `$DSH_*` variables; inspect them when needed. Commands may run under a file sandbox; a blocked file operation is reported as `[sandbox: file access denied under <mode> mode]` — a policy denial, not a bug in the command; do not retry another way. Long output is truncated to its tail; the full output is saved to a file whose path is reported when available. Set `run_in_background: true` for long-running commands: the call returns a task id immediately; read its output with `task_output` and stop it with `task_kill`. Attempting a command the sandbox may deny is safe and expected: run it and read the marker rather than assuming the denial. When a command is denied and a wider mode would let it succeed, escalate immediately in the same turn — the one sanctioned exception to a denial: retry the exact same command once with `sandbox_permissions` (the narrowest wider mode that suffices) plus a one-sentence `justification`. Do not detour through chat to ask permission first — the approval prompt raised by that retry is how the user consents. If the session states approval prompts are disabled, there is no exception: a denial is final — do not set `sandbox_permissions`. Never escalate speculatively: ground the request in a real denial — normally the one this command just hit; escalating up front is fine only when this session already denied the same access. A rejected escalation is final for that command — stop and explain, never work around it — but it does not forbid attempting or escalating other commands later.",
       "parameters": {
         "type": "object",
         "properties": {