@aitne-sh/aitne 0.1.4 → 0.1.6

package/agent-assets/skills/wiki/wiki-ask/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: wiki-ask
+description: Load for wiki.ask. Answers a question from the wiki and records the answer under 30_outputs.
+allowed-tools:
+  - Bash(curl *)
+  - Bash(jq *)
+---
+
+# Wiki Ask
+
+You run under process key `wiki.ask`.
+
+Read `<wiki_command>` for the user's `question`. Search and read relevant `20_wiki/` notes first; read `10_raw/` only when the wiki notes need source verification.
+
+Write the answer to:
+
+```
+POST /api/wiki/{{workspace_name}}/files/30_outputs/<YYYY-MM-DD>-<slug>.md
+x-process-key: wiki.ask
+```
+
+The output must include the question, short answer, evidence, source links, and follow-up gaps. If the wiki does not contain enough evidence, say that directly and list what is missing.
+
+### Completion message (mandatory)
+
+End the turn with a short final assistant message that the daemon forwards back to the channel the bang command came from. This is what the user actually reads on their phone — make it the answer in plain prose:
+
+- Lead with the answer in one short paragraph (3–5 lines max).
+- Cite the wiki pages you drew from inline (`see [[<slug>]]`).
+- End with `Full answer: 30_outputs/<YYYY-MM-DD>-<slug>.md` so the user can dig deeper.
+- On insufficient evidence: `Wiki has no entry for <topic>. Missing: <one-line gap>.` and skip the file pointer.
+

package/agent-assets/skills/wiki/wiki-compile/SKILL.md

@@ -0,0 +1,126 @@
+---
+name: wiki-compile
+description: Load for wiki.compile. Synthesizes 10_raw notes into 20_wiki notes via the daemon Wiki API and updates the wiki index.
+allowed-tools:
+  - Bash(curl *)
+  - Bash(jq *)
+---
+
+# Wiki Compile
+
+You run under process key `wiki.compile` in workspace `{{workspace_name}}` (vault `{{vault_path}}`). The event payload's `data.mode` is either `"incremental"` (compile only raws touched since the last compile) or `"full"` (compile every raw). Read `<wiki_command>` for the mode and any caller-supplied filters.
+
+Your job: read `10_raw/` source notes through the daemon Wiki API and emit synthesized `20_wiki/<slug>.md` articles. Never invent sources, never edit existing raws, never collapse multiple conflicting sources into a single uncited paragraph.
+
+## The success contract (read this first)
+
+A run is "successful" only when the daemon's Wiki API has returned `{"ok":true,"path":"20_wiki/<slug>.md"}` (or the corresponding `_index.md` / `log.md` path) to each `curl POST` / `PATCH`. There is no other definition of success — the vault is on disk, you cannot write it any other way.
+
+Therefore:
+
+- Every wiki note you claim to have created MUST be the `path` field of a `200 {"ok":true,...}` response you observed. Never fabricate a path.
+- After all writes, the final tool call before your completion DM SHOULD be a successful PATCH to `log.md` summarising what was compiled.
+- If any planned write fails (4xx/5xx, missing `ok` field, no body, `PA_API_ERROR` on stderr), classify the overall run as **partial** or **failure** in the completion DM — never as success.
+
+## Allowed endpoints (the entire surface for this skill)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET`   | `/api/wiki/{{workspace_name}}/index` | List every file in the workspace with `path`/`mtime`/`sizeBytes`. Primary enumeration tool. |
+| `GET`   | `/api/wiki/{{workspace_name}}/search?q=<query>` | Body-substring search for duplicate detection. |
+| `GET`   | `/api/wiki/{{workspace_name}}/files/<path>` | Read raw notes, existing wiki notes, taxonomy, log. |
+| `POST`  | `/api/wiki/{{workspace_name}}/files/20_wiki/<slug>.md` | Create a new wiki note. |
+| `PATCH` | `/api/wiki/{{workspace_name}}/files/20_wiki/<slug>.md` | Rewrite an existing wiki note (`mode: "replace"`). |
+| `PATCH` | `/api/wiki/{{workspace_name}}/files/20_wiki/_index.md` | Append a new wiki note's entry (`mode: "append"`). |
+| `PATCH` | `/api/wiki/{{workspace_name}}/files/log.md` | Append the per-run summary (`mode: "append"`). |
+
+Every request must include `-H 'x-process-key: wiki.compile'`. The `wiki-vault-rules` skill carries the body-quoting cheat-sheet, the `PA_API_ERROR` shape, and the full set of error codes.
+
+## Procedure
+
+1. **Determine the baseline** (incremental mode only).
+   - Read `20_wiki/_index.md` (or `log.md`'s last `wiki.compile` entry) to recover the prior `compiled_at` ISO timestamp.
+   - If the workspace has never been compiled, fall back to "compile every raw" (i.e. treat the baseline as the empty string — the `jq` filter then admits every `10_raw/*` row).
+2. **Enumerate raw notes** to compile.
+   - `GET /api/wiki/{{workspace_name}}/index` returns `{ files: [{ path, mtime, sizeBytes }, ...] }`.
+   - Filter with `jq` for `path` under `10_raw/` and (incremental) `mtime > <baseline>`. Do NOT walk `{{vault_path}}` from disk; `Bash(find ...)`, `Bash(ls ...)`, etc. are silently denied.
+3. **Read existing wiki + taxonomy** so synthesis can de-duplicate and use canonical slugs.
+   - `GET /api/wiki/{{workspace_name}}/files/20_wiki/_index.md`
+   - `GET /api/wiki/{{workspace_name}}/files/90_meta/taxonomy.md`
+4. **Read each candidate raw note** via `GET /api/wiki/{{workspace_name}}/files/10_raw/<slug>.md`.
+5. **Synthesize root-level `20_wiki/<slug>.md`** notes:
+   - One note per coherent topic — merge multiple raws when they cover the same thing; split a single raw across multiple notes only when the raw genuinely spans unrelated topics.
+   - Use `90_meta/taxonomy.md` for canonical slugs.
+   - Preserve source URLs and quoted passages verbatim. Mark conflicts and unknowns explicitly.
+   - Each note's frontmatter MUST list every source raw under a `sources:` array and the synthesis date under `compiled_at:`.
+   - Write via `POST` (new slug) or `PATCH mode: "replace"` (existing slug). Read-before-write any slug you `PATCH`-replace so you preserve material that the new raws didn't cover.
+6. **Append `20_wiki/_index.md`** with one bullet per newly created or modified wiki note (`PATCH mode: "append"`). Skip notes that were unchanged.
+7. **Append `log.md`** with one operational line summarising the run: `[<ISO>] wiki.compile (<mode>): compiled <N> notes from <M> raws — added <A>, updated <B>, unchanged <C>`.
+
+## Canonical curl shapes
+
+The `wiki-vault-rules` skill has the full reference. The shapes you'll use most:
+
+```bash
+# 1) Enumerate (and incremental-filter) raw notes since the last compile
+curl http://localhost:8321/api/wiki/{{workspace_name}}/index \
+  -H 'x-process-key: wiki.compile' \
+  | jq -r --arg since '<YYYY-MM-DDTHH:MM:SSZ>' \
+      '.files[] | select(.path | startswith("10_raw/")) | select(.mtime > $since) | .path'
+
+# 2) Read one file (raw, wiki, taxonomy, index, log — same shape)
+curl http://localhost:8321/api/wiki/{{workspace_name}}/files/<path> \
+  -H 'x-process-key: wiki.compile'
+
+# 3) Write a wiki note — heredoc for multi-KB bodies (recommended)
+curl http://localhost:8321/api/wiki/{{workspace_name}}/files/20_wiki/<slug>.md \
+  -X POST \
+  -H 'content-type: application/json' \
+  -H 'x-process-key: wiki.compile' \
+  -d @- <<'JSON'
+{"content":"---\ntitle: <Title>\nsources:\n  - 10_raw/<slug-a>.md\n  - 10_raw/<slug-b>.md\ncompiled_at: 2026-05-13\nprocess: wiki.compile\n---\n\n# <Title>\n\n## Summary\n\n...\n\n## Source extracts\n\n...\n"}
+JSON
+
+# 4) Append an entry to the index / log
+curl http://localhost:8321/api/wiki/{{workspace_name}}/files/20_wiki/_index.md \
+  -X PATCH \
+  -H 'content-type: application/json' \
+  -H 'x-process-key: wiki.compile' \
+  -d '{"mode":"append","content":"- [[<slug>]] — <one-line summary>\n"}'
+```
+
+Inside `<<'JSON'` (single-quoted marker) the body is verbatim — only JSON's own escapes (`\"`, `\\`, `\n`) apply.
+
+## Anti-patterns (silent denials — never claim success after these)
+
+- `Write` / `Edit` tools — **stripped from the session allow-list** for every `wiki.*` process key. The SDK denies them silently under `dontAsk` ("Permission to use Write has been denied …"). There is no path-rewrite that makes them work; use the Wiki API via curl. The agent that hit "Write denied → reported failure" is the canonical failure mode this section exists to prevent.
+- `Bash(find ...)`, `Bash(ls ...)`, `Bash(cat ...)`, `Bash(grep ...)`, `Bash(wc ...)`, and every other shell utility — silently denied. Only `Bash(curl *)` and `Bash(jq *)` are on the allow-list. Enumerate via `GET /api/wiki/<ws>/index`, not from disk.
+- `echo '{...}' | curl ...`, `cat <<JSON | curl ... -d @- JSON`, `bash -c "curl ..."`, `( curl ... )`, `var=... curl ...`, `curl ... ; curl ...` — Bash command does not start with `curl`; silently denied. The reverse — `curl ... -d @- <<'JSON' … JSON` on the same line — DOES start with `curl` and IS allowed (the heredoc redirects into curl's stdin).
+- `curl ... -d @/some/path` — `@<filepath>` is blocked by the security hook and the shim. The only acceptable `@…` value is the literal stdin marker `@-`.
+- `curl http://example.com/...` (non-loopback) — only `http://localhost:8321/api/*` is permitted.
+- POST to a non-existent path (`/api/send-message`, `/api/notify-user`, `/api/dm`, etc.) — not daemon routes; calls return 401/404 and DO NOT notify anyone. Your completion DM (final assistant text) is what the daemon forwards.
+- Re-POSTing to `/api/wiki/.../20_wiki/<slug>.md` to update — POST is create-only; the second call returns 409. Use `PATCH mode: "replace"` to overwrite, or pick a different slug.
+
+## Common error codes
+
+| Status | Body code | Cause | Recovery |
+|---|---|---|---|
+| 400 | `invalid_body` | JSON body did not parse / `content` not a string | Switch to the heredoc shape if you were inline-escaping a multi-KB body. |
+| 400 | `invalid_path` / `invalid_layer` | Slug shape or layer prefix rejected | Path must be exactly `20_wiki/<slug>.md`. Slug matches `^[a-z0-9][a-z0-9-]*$`. |
+| 403 | `missing_process_key` | Header missing | Add `-H 'x-process-key: wiki.compile'`. |
+| 403 | `wiki_write_denied` | Trying to write outside `20_wiki/` (or the `_index.md` / `log.md` exceptions) under `wiki.compile` | Fix the target path. Use `wiki-graduate` for inbox-to-wiki promotion (same process key, different source layer). |
+| 409 | `append_only` | POST to an existing slug | Use `PATCH mode: "replace"` or pick a different slug. |
+| 413 | — | Body exceeds 512 KB | Split the note or trim verbatim extracts. |
+| 5xx | — | Daemon error | Append a failure line to `log.md`, classify the run as partial, do not retry inside the same turn. |
+
+If a Bash call returns with no stdout body and no `PA_API_ERROR` on stderr, your command was silently denied — rewrite it as a flat, single-line curl invocation.
+
+## Completion message (mandatory final assistant text)
+
+End the turn with one short line — the daemon forwards it verbatim to the channel the bang command came from. Keep it scannable on mobile:
+
+- Success: `Compiled <N> wiki page(s) from <M> raw note(s) — added <A>, updated <B>, unchanged <C>.`
+- Partial: `Compiled with warnings — <one-sentence diagnostic>. See log.md for details.`
+- Failure: `Compile failed — <one-sentence reason>.`
+
+Do not paste the file list, narrative, or follow-up suggestions into the completion message — the dashboard timeline + `log.md` carry the detail. Do not call `/api/send-message` or any other "send" endpoint; the final assistant text is the delivery channel.

package/agent-assets/skills/wiki/wiki-connect/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: wiki-connect
+description: Load for wiki.connect. Bridges two domains by surfacing shared terms, references, and structural analogies; writes a cited connection report to 30_outputs/.
+allowed-tools:
+  - Bash(curl *)
+  - Bash(jq *)
+---
+
+# Wiki Connect
+
+You run under process key `wiki.connect`.
+
+Read `<wiki_command>` for the two topics — fields `topic_a` and `topic_b`. Your job is to find genuine bridges between the two domains using only what the wiki contains. Speculative analogies are out of scope; if there is no real overlap, say so plainly.
+
+## Method
+
+1. Search each topic independently:
+   ```
+   GET /api/wiki/{{workspace_name}}/search?q=<topic_a>
+   GET /api/wiki/{{workspace_name}}/search?q=<topic_b>
+   ```
+   Read enough matches to characterise each domain.
+2. Surface four types of bridges:
+   - **Shared terminology** — terms that appear in both domains. Use `90_meta/taxonomy.md` to disambiguate true synonyms from accidental string matches.
+   - **Common references** — the same source URL, author, or wiki note linked from both domains.
+   - **Structural analogies** — patterns of reasoning, tradeoffs, or recurring shapes that show up in both, even when the surface vocabulary differs.
+   - **Bridging concept candidates** — a new wiki note that would naturally sit between the two (proposal only — you must not create it from `wiki.connect`).
+3. Cite every bridge with at least one path from each side (`<wiki_a path>` ↔ `<wiki_b path>`). A bridge that can only cite one side is a candidate, not a bridge — file it under "Bridging concept candidates".
+
+## Output
+
+Write exactly one report:
+
+```
+POST /api/wiki/{{workspace_name}}/files/30_outputs/<YYYY-MM-DD>-connect-<slug>.md
+x-process-key: wiki.connect
+```
+
+- `<YYYY-MM-DD>` is today's date.
+- `<slug>` is `<slug-a>--<slug-b>` using the canonical slugs from `90_meta/taxonomy.md` when available, kebab-cased and joined by a double hyphen.
+
+Report shape:
+
+```
+# Connect — <topic_a> ↔ <topic_b> (<YYYY-MM-DD>)
+
+## Summary
+- one paragraph: is there real connective tissue, weak overlap, or essentially none?
+
+## Shared terminology
+- `term` — meaning in <topic_a> vs <topic_b>, cited
+
+## Common references
+- `<source>` — used by `<wiki_a path>` and `<wiki_b path>`
+
+## Structural analogies
+- short paragraph each, both sides cited
+
+## Bridging concept candidates
+- proposed wiki slug, one-sentence rationale, suggested anchor notes
+```
+
+If no genuine bridges exist, write the report anyway with empty sections marked `_(none)_` and a `## Summary` that names that clearly — a "no connection" finding is still useful to the owner. Append a one-line `log.md` entry referencing the output filename and both topics.
+
+### Completion message (mandatory)
+
+End the turn with one short final assistant message that the daemon forwards back to the channel the bang command came from:
+
+- `Connect complete — <topic_a> ↔ <topic_b>: <strong | weak | none>. Report: 30_outputs/<YYYY-MM-DD>-connect-<slug>.md.`
+  - `strong` = at least one genuine bridge in any of the four buckets.
+  - `weak` = only shared terminology or only candidates, no concrete cross-cited overlap.
+  - `none` = the summary said so explicitly.
+- On failure: `Connect failed — <one-sentence reason>.`
+
+Do not paste bridge content into the completion message.

package/agent-assets/skills/wiki/wiki-graduate/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: wiki-graduate
+description: Load alongside wiki-compile. Promotes ready inbox material into a real wiki note with the canonical schema; never invents content beyond the source.
+allowed-tools:
+  - Bash(curl *)
+  - Bash(jq *)
+---
+
+# Wiki Graduate
+
+You are loaded alongside `wiki-compile` so a compile pass can promote a single inbox note or output artifact into a real `20_wiki/<slug>.md` article when the source has matured enough.
+
+`00_inbox/` is **read-only** to agents (`wiki-vault-rules` §Layers). You may read inbox material, but the only legal write surface for the graduated article is `20_wiki/` via the Wiki API. Never write back into `00_inbox/`.
+
+## When to apply
+
+A source qualifies for graduation only if all of these are true:
+
+1. The user explicitly referenced it as a candidate (e.g. via a graduate task body in `<wiki_command>`), OR the compile pass identified the same idea across ≥3 raw notes that converge on a stable framing.
+2. The synthesis would not duplicate an existing `20_wiki/<slug>.md`.
+3. The source contains enough substantive content (>200 words of original facts/argument) to warrant a wiki note — short links and bookmarks do not graduate.
+
+If any of these fail, skip the graduation and leave a note in `log.md`: "wiki.graduate skipped: <slug> — <reason>".
+
+## Method
+
+1. Read the source path. Inbox paths look like `00_inbox/<anything>.md`; output paths look like `30_outputs/<YYYY-MM-DD>-<slug>.md`.
+2. Extract the substantive ideas. Preserve quoted source text verbatim; paraphrase only the user's own commentary.
+3. Apply the wiki schema (`90_meta/schemas/wiki.md`): summary → key facts → source links → related notes. Include frontmatter that names the source path under `derived_from:` and dates the promotion under `graduated_at:`.
+4. Link to existing related wiki notes using `[[slug]]` syntax. Use the canonical slug from `90_meta/taxonomy.md` when available.
+5. Update `20_wiki/_index.md` so the new article is discoverable.
+
+## Write path
+
+```
+POST /api/wiki/{{workspace_name}}/files/20_wiki/<slug>.md
+PATCH /api/wiki/{{workspace_name}}/files/20_wiki/_index.md (mode: "append")
+x-process-key: wiki.compile
+```
+
+Use `wiki.compile` as the process key — graduation is a sub-action of the compile pass, not a separate process. If the slug collides with an existing wiki note, append a year disambiguator (`<slug>-<YYYY>`) only as a last resort; prefer extending the existing note via `wiki-compile` itself.
+
+Append a `log.md` entry: "wiki.graduate: promoted `<source path>` → `20_wiki/<slug>.md`".
+
+End with a short internal summary only.

package/agent-assets/skills/wiki/wiki-ingest/SKILL.md

@@ -0,0 +1,182 @@
+---
+name: wiki-ingest
+description: Load for wiki.ingest_url. Captures one URL into 10_raw/<slug>.md by POSTing through the daemon Wiki API. Carries the canonical curl invocation, the path / response contract, and the strict success-verification rule.
+allowed-tools:
+  - WebFetch
+  - Bash(curl *)
+  - Bash(jq *)
+---
+
+# Wiki URL Ingestion
+
+You run under process key `wiki.ingest_url` in workspace `{{workspace_name}}` (vault `{{vault_path}}`). Read `<wiki_command>` for the target `url` and optional `batch_id`. Your job: capture the page faithfully into ONE new file via the daemon Wiki API. Source fidelity beats summarization.
+
+## The success contract (read this first)
+
+A run is "successful" **only** when the daemon's Wiki API has returned `{"ok":true,"path":"10_raw/<slug>.md"}` to your `curl POST`. There is no other definition of success. The vault is on disk; you cannot write it any other way.
+
+Therefore:
+
+- The final tool call before your completion DM MUST be a successful `curl ... /api/wiki/{{workspace_name}}/files/10_raw/<slug>.md`.
+- You MUST inspect the curl response body. If you do not see the JSON `{"ok":true,"path":"<the exact path you POSTed>"}`, the write did not happen — emit the FAILURE DM, not the success DM.
+- You MUST NOT fabricate a path, claim success after writing to a local file, claim success after a 4xx/5xx response, or claim success after calling any other endpoint.
+
+## Allowed endpoints (the entire surface for this skill)
+
+The only daemon routes this skill writes to are:
+
+| Method | Path | Purpose |
+|---|---|---|
+| `POST`  | `/api/wiki/{{workspace_name}}/files/10_raw/<slug>.md` | Create the raw note (this is the success path) |
+| `PATCH` | `/api/wiki/{{workspace_name}}/files/log.md` | Append a one-line failure entry on fetch failure |
+| `GET`   | `/api/wiki/{{workspace_name}}/files/10_raw/<slug>.md` | Verification read after POST (optional) |
+| `GET`   | `/api/wiki/{{workspace_name}}/search?q=<q>` | Optional — check whether the URL was already ingested |
+
+Do NOT call any other daemon endpoint. The daemon has **no** `/api/send-message`, `/api/whatsapp/send`, `/api/notify-user`, `/api/dm`, `/api/messages/send`, or anything similar — those names look plausible but do not exist; calls there return 401/404 and your "delivery" never happens. The completion DM you emit as your final assistant text is forwarded by the daemon automatically.
+
+## Procedure
+
+1. **Fetch the source page** (one of these, depending on backend):
+   - Claude: `WebFetch <url>`.
+   - Codex: `curl <url>` against the real internet (the workspace-write sandbox has outbound network).
+   - Gemini: `web_fetch <url>`.
+   Preserve facts verbatim; mark uncertainty.
+2. **Derive a slug**: lowercase kebab-case from the URL host + path tail, matching `^[a-z0-9][a-z0-9-]*$`. Examples: `news-webike-31883`, `nytimes-headline-2026-05-12`. ~60 chars max.
+3. **Build the raw note body** as Markdown:
+   - Frontmatter (`source`, `retrieved`, `title`, `process: wiki.ingest_url`).
+   - `# <title>` headline.
+   - `## Source extracts` — verbatim or close-paraphrase quotes.
+   - `## Open questions` — anything you could not verify from the page.
+4. **POST the note** via the canonical curl shape (next section). Inspect the response body.
+5. **Verify**: the response body must be exactly `{"ok":true,"path":"10_raw/<slug>.md"}`. If anything else (4xx/5xx, missing `ok`, wrong path, no body, `PA_API_ERROR …` on stderr), treat it as failure. Follow the error table below or PATCH `log.md` and emit the failure DM.
+6. **Emit the completion DM** (last section). Success or failure, exactly one line, no extra prose.
+
+## Path shape — exact, no nesting
+
+The path component after `/files/` must be **exactly** `10_raw/<slug>.md` — a single segment under `10_raw/`. No date prefix folder, no category folder, no sub-categorisation:
+
+| Wrong | Why | Correct |
+|---|---|---|
+| `10_raw/articles/2026-05-13-ninja-h2-sx-owner-reviews.md` | nested folder `articles/` — `invalid_layer` 400 | `10_raw/news-webike-31883.md` |
+| `10_raw/2026-05-13/ninja.md` | date folder — `invalid_layer` 400 | `10_raw/news-webike-31883.md` |
+| `10_raw/news.md/file.md` | path has `.md` mid-segment | `10_raw/news-webike-31883.md` |
+| `10_RAW/news.md` | uppercase root | `10_raw/news-webike-31883.md` |
+| `10_raw/News-Webike-31883.md` | slug not lowercase | `10_raw/news-webike-31883.md` |
+
+The only acceptable nested form is `10_raw/images/<slug>/<file>` for source images — text notes are always a single segment.
+
+## Canonical curl invocation
+
+The Bash command MUST start with the literal token `curl`. The session's `Bash(curl *)` allow-rule is prefix-matched; commands wrapped in `echo … |`, `cat <<EOF |`, `bash -c`, `( … )`, command substitution, or any other shell construct are silently denied under `dontAsk` mode and you receive no error. If a Bash call returns with no stdout, no stderr, and no `PA_API_ERROR`, your command was silently denied — rewrite it to start with literal `curl`.
+
+### POST the raw note — heredoc shape (recommended for article bodies)
+
+Article bodies are typically several KB and benefit from heredoc quoting (no shell escapes for `"`, real newlines instead of `\n`). The command still starts with `curl`; the heredoc redirects into curl's stdin, and the shim reads it via `-d @-`:
+
+```bash
+curl http://localhost:8321/api/wiki/{{workspace_name}}/files/10_raw/<slug>.md \
+  -X POST \
+  -H 'content-type: application/json' \
+  -H 'x-process-key: wiki.ingest_url' \
+  -d @- <<'JSON'
+{"content":"---\nsource: https://news.example.com/path/123\nretrieved: 2026-05-13T05:08:00Z\ntitle: Sample article\nprocess: wiki.ingest_url\n---\n\n# Sample article\n\n## Source extracts\n\n- First quoted paragraph from the page.\n\n## Open questions\n\n- Anything not verifiable from the page."}
+JSON
+```
+
+Inside `<<'JSON'` (single-quoted marker) the body is verbatim — shell does NOT expand `$`, backticks, or quotes. Only JSON's own escapes apply: `\"`, `\\`, `\n`.
+
+### POST inline (for short bodies only)
+
+```bash
+curl http://localhost:8321/api/wiki/{{workspace_name}}/files/10_raw/<slug>.md \
+  -X POST \
+  -H 'content-type: application/json' \
+  -H 'x-process-key: wiki.ingest_url' \
+  -d '{"content":"---\nsource: ...\n---\n\n# Title\n\n## Source extracts\n\n- Short body."}'
+```
+
+Expected response (anything else means failure):
+
+```
+{"ok":true,"path":"10_raw/<slug>.md"}
+```
+
+### (Optional) Verify the file actually exists
+
+```bash
+curl http://localhost:8321/api/wiki/{{workspace_name}}/files/10_raw/<slug>.md \
+  -H 'x-process-key: wiki.ingest_url'
+```
+
+Expected response: `{"path":"10_raw/<slug>.md","content":"...","mtime":"...","sizeBytes":N}`. A 404 means the POST silently failed even if you thought you saw `ok:true`.
+
+### Append a failure entry to log.md (use ONLY when the raw note will NOT be created)
+
+```bash
+curl http://localhost:8321/api/wiki/{{workspace_name}}/files/log.md \
+  -X PATCH \
+  -H 'content-type: application/json' \
+  -H 'x-process-key: wiki.ingest_url' \
+  -d '{"mode":"append","content":"[2026-05-13T05:08:00Z] wiki.ingest_url failed https://news.example.com/path/123 — fetch returned 403\n"}'
+```
+
+## Body-quoting rules
+
+**Heredoc body (recommended for article bodies):** wrap with a single-quoted marker (`<<'JSON' … JSON`). The body is verbatim — shell does NOT expand `$`, backticks, or quotes. Only JSON's own escapes apply: `\"`, `\\`, `\n`. The line `JSON` must appear at column 0 with no trailing characters.
+
+**Inline body (short bodies only):** wrap the JSON in outer single quotes; inside, use JSON escapes:
+
+| Need in `content` | Write in shell-arg |
+|---|---|
+| `"` | `\"` |
+| `\` | `\\` |
+| newline | `\n` |
+| `'` | `'\''` (close-escape-reopen), or substitute `’` (U+2019) |
+| `$`, backticks | leave as-is (single quotes suppress expansion) |
+
+Keep the note compact — well under 512 KB. Curate 5-20 KB of the most informative extracts rather than dumping the whole page.
+
+## Anti-patterns (silent denials / 4xx — never claim success after these)
+
+- `WebFetch http://localhost:8321/...` — Claude WebFetch refuses loopback. Use curl.
+- `echo '{...}' | curl ...`, `cat <<JSON | curl ... -d @- JSON ; …`, `bash -c "curl ..."` — Bash command does not start with `curl`; denied silently under `dontAsk`. (Heredoc redirected directly into curl on the same line — `curl ... -d @- <<'JSON' … JSON` — IS allowed because the command still starts with `curl`.)
+- `curl ... -d @/tmp/body.json` — `@<path>` form is blocked by the security hook and by the shim.
+- `curl http://example.com/...` (non-loopback) — security hook denies; only `http://localhost:8321/api/*` is permitted.
+- POST to a non-existent path like `/api/send-message`, `/api/whatsapp/send`, `/api/notify-user`, `/api/dm`. These are NOT daemon routes; calls return 401/404 and DO NOT notify anyone.
+- POST/PATCH to `/api/wiki/.../10_raw/<slug>.md` a second time — raw is create-only; the second call returns 409 and **does NOT** modify the file.
+- `Write` / `Edit` tools — stripped from the session allow-list for every `wiki.*` process key. The SDK denies them silently under `dontAsk` (you'll see "Permission to use Write has been denied …"). There is no path-rewrite that makes them work; use the Wiki API via curl. `Bash(find ...)`, `Bash(ls ...)`, `Bash(cat ...)` and other shell utilities are also denied — only `Bash(curl *)` and `Bash(jq *)` are on the allow-list.
+
+## Troubleshooting
+
+Every non-2xx response causes the curl shim to write one line to stderr:
+
+```
+PA_API_ERROR {"method":"POST","path":"/api/wiki/...","status":<n>,"bodyPreview":"<json error>"}
+```
+
+Read `status` + `bodyPreview` and react:
+
+| Status | Body code | Cause | Recovery |
+|---|---|---|---|
+| 200 | (response is `{"ok":true,"path":...}`) | Success | Emit the success DM. |
+| 200 | (response missing `ok` or `path`) | Should not happen — but if it does, treat as failure | Emit failure DM. |
+| 400 | `invalid_body` | JSON body did not parse / `content` not a string | Re-emit the body. For inline `-d` check your single-quote / `\n` / `\"` escapes. If the body was `@-` literally, the heredoc was missed — switch to the heredoc shape (`-d @- <<'JSON' … JSON` on the same line as curl). |
+| 400 | `invalid_path` / `invalid_layer` | Slug or layer rejected | Path must be **exactly** `10_raw/<slug>.md`, slug matching `^[a-z0-9][a-z0-9-]*$`. No nested folders. |
+| 403 | `missing_process_key` | Header missing | Add `-H 'x-process-key: wiki.ingest_url'` and retry. |
+| 403 | `raw_write_denied` | Process key isn't `wiki.ingest_url` | Configuration error; emit failure DM, do not retry. |
+| 409 | `append_only` | Slug already exists in `10_raw/` | Suffix the slug (`<slug>-2`), retry the POST **once**. If `-2` also 409, PATCH log.md and emit failure DM — do not loop further. |
+| 413 | (body too large) | Article > 512 KB | Trim verbatim extracts; keep essentials. |
+| 5xx | — | Daemon error | PATCH log.md and emit failure DM. Do not retry — the daemon will not heal mid-turn. |
+
+If the Bash call returns to the prompt with **no stdout body and no `PA_API_ERROR`**, your command did not start with literal `curl` and was silently denied. Rewrite it as a flat, single-line curl invocation following the canonical shape above.
+
+## Completion message (mandatory final assistant text)
+
+Emit exactly one line as your final assistant message. The daemon forwards this verbatim to the channel the bang came from — no other delivery mechanism is needed and you must NOT try to "send" it through another endpoint.
+
+- Success (only after seeing `{"ok":true,"path":"10_raw/<slug>.md"}`): `Ingested <url> → 10_raw/<slug>.md`
+- Failure (any other outcome): `Failed <url> — <one-sentence reason>`
+
+The path you put in the success DM must be **byte-identical** to the `path` field returned by the daemon. Inventing or paraphrasing it is the bug this section exists to prevent.
+
+No follow-up offers, no explanation paragraphs — just the single line.

package/agent-assets/skills/wiki/wiki-lint/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: wiki-lint
+description: Load for wiki.lint. Audits the wiki for orphans, broken links, schema drift, taxonomy candidates, and stale notes; writes a dated health report.
+allowed-tools:
+  - Bash(curl *)
+  - Bash(jq *)
+---
+
+# Wiki Lint
+
+You run under process key `wiki.lint`.
+
+Use the Wiki API to inventory the workspace and produce one health report. Never write outside the Wiki API and never modify content layers (`10_raw/`, `20_wiki/`, `30_outputs/`); the only meta surface you may write is the health report and the taxonomy candidates section.
+
+## Inputs
+
+Read the full index and recent operational history:
+
+```
+GET /api/wiki/{{workspace_name}}/index
+GET /api/wiki/{{workspace_name}}/files/log.md
+GET /api/wiki/{{workspace_name}}/files/90_meta/taxonomy.md
+GET /api/wiki/{{workspace_name}}/files/90_meta/schemas/raw.md
+GET /api/wiki/{{workspace_name}}/files/90_meta/schemas/wiki.md
+GET /api/wiki/{{workspace_name}}/files/90_meta/schemas/output.md
+```
+
+Sample (do not exhaustively read) `10_raw/` and `20_wiki/` notes that look anomalous from the index alone — large size deltas, unusually old `mtime`, slugs that don't appear anywhere in `_index.md`.
+
+## Checks
+
+1. **Orphans** — wiki notes (`20_wiki/<slug>.md`) that no other wiki note links to.
+2. **Broken wikilinks** — `[[slug]]` references whose target file does not exist.
+3. **Missing frontmatter** — notes that violate the schema in `90_meta/schemas/`.
+4. **Stale content** — wiki notes whose newest source link is older than 90 days, or whose body has not changed in 180 days while the raw set behind it has grown.
+5. **Term inconsistencies** — slug/title variants that look like the same concept (canonicalise via `90_meta/taxonomy.md`).
+6. **Taxonomy candidates** — recurring concepts (≥3 raw notes or ≥2 wiki notes) that are not yet listed in `90_meta/taxonomy.md`.
+7. **Index drift** — `20_wiki/_index.md` listing entries that do not exist on disk, or wiki notes missing from the index.
+
+## Outputs
+
+Write exactly one health report:
+
+```
+POST /api/wiki/{{workspace_name}}/files/90_meta/health/<YYYY-MM-DD>.md
+x-process-key: wiki.lint
+```
+
+Use today's date in `{{language}}`-neutral ISO form. The report must have these sections in order:
+
+```
+# Wiki Health — <YYYY-MM-DD>
+
+## Summary
+- one-line tally per check (e.g. "3 orphans, 1 broken link, 0 stale notes")
+
+## Action items
+- bullet list, each item names the affected file and the proposed fix
+
+## Orphans
+## Broken wikilinks
+## Missing frontmatter
+## Stale content
+## Term inconsistencies
+## Taxonomy candidates
+## Index drift
+```
+
+Empty sections must still appear with `_(none)_` as the body so a downstream diff can detect the absence.
+
+If — and only if — there are taxonomy candidates, append (PATCH `mode: "append"`) a `# Candidates` section to `90_meta/taxonomy.md`:
+
+```
+PATCH /api/wiki/{{workspace_name}}/files/90_meta/taxonomy.md
+x-process-key: wiki.lint
+```
+
+Each candidate line: ` - <canonical-slug> — <one-sentence rationale, references to N raw / M wiki>`. The owner reviews this section before any promotion happens; you must not move candidates into the main `## Topics` section yourself.
+
+Append a concise `log.md` entry summarising the report ("wiki.lint: 3 orphans, 1 broken link, 2 taxonomy candidates"). If a check could not run (e.g. unreadable file), call it out explicitly in the report's `## Summary` section rather than silently dropping it.
+
+### Completion message (mandatory)
+
+End the turn with one short final assistant message that the daemon forwards back to the channel the bang command came from:
+
+- `Lint complete — <tally>. Report: 90_meta/health/<YYYY-MM-DD>.md.`
+  - `<tally>` = the same one-line totals from the report's `## Summary`, e.g. "3 orphans, 1 broken link, 2 taxonomy candidates".
+- On hard failure (no report written): `Lint failed — <one-sentence reason>.`
+
+Do not paste the full report into the completion message. The user opens the file or the dashboard for detail.

package/agent-assets/skills/wiki/wiki-trace/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: wiki-trace
+description: Load for wiki.trace. Reconstructs the chronological evolution of an idea across raw, wiki, and outputs; writes a cited timeline to 30_outputs/.
+allowed-tools:
+  - Bash(curl *)
+  - Bash(jq *)
+---
+
+# Wiki Trace
+
+You run under process key `wiki.trace`.
+
+Read `<wiki_command>` for the user's `topic` (free-form). Your job is to reconstruct **how thinking about that topic evolved over time** using only what the wiki actually contains. Never invent sources.
+
+## Method
+
+1. Search across all layers:
+   ```
+   GET /api/wiki/{{workspace_name}}/search?q=<topic>
+   ```
+   Then drill into matches by reading their bodies. Cover `10_raw/`, `20_wiki/`, and `30_outputs/`.
+2. Order findings chronologically. Prefer dates that the content asserts (raw `retrieved` timestamps, source publish dates, output filenames `<YYYY-MM-DD>-…`). When only file `mtime` is available, mark the entry as "discovered on" rather than "happened on".
+3. Group into **phases** — a phase is a span where the dominant framing, vocabulary, or open question stays roughly stable. Two to five phases is the usual shape; one phase is fine for a topic the wiki only mentions briefly.
+4. For each phase, surface:
+   - The dominant question or claim.
+   - The new evidence introduced.
+   - What changed compared to the previous phase.
+5. Cite every claim with a wiki path (e.g. `10_raw/quantum-computing-2024-overview.md`). Do not collapse multiple sources into a single uncited paragraph.
+
+## Output
+
+Write exactly one timeline report to:
+
+```
+POST /api/wiki/{{workspace_name}}/files/30_outputs/<YYYY-MM-DD>-trace-<slug>.md
+x-process-key: wiki.trace
+```
+
+- `<YYYY-MM-DD>` is today's date.
+- `<slug>` is a kebab-case slug derived from the topic (e.g. `quantum-computing`). Use the canonical slug from `90_meta/taxonomy.md` when one exists.
+
+Report shape:
+
+```
+# Trace — <topic> (<YYYY-MM-DD>)
+
+## Summary
+- one-paragraph synthesis of the arc
+
+## Phase 1 — <YYYY-MM> through <YYYY-MM>: <short label>
+- key question / claim
+- evidence: `<wiki path>`, `<wiki path>`
+- shift since last phase: _(first phase, no prior)_
+
+## Phase 2 — …
+…
+
+## Gaps
+- bullet list of questions the wiki cannot yet answer
+```
+
+If the wiki has fewer than two distinct sources on the topic, say so directly in `## Summary` and keep the report short — do not pad it with speculation. Append a one-line `log.md` entry referencing the output filename and the topic.
+
+### Completion message (mandatory)
+
+End the turn with one short final assistant message that the daemon forwards back to the channel the bang command came from:
+
+- `Trace complete — <topic>: <N> phase(s) across <M> source(s). Timeline: 30_outputs/<YYYY-MM-DD>-trace-<slug>.md.`
+- Sparse-vault case: `Trace complete — wiki has <M> source(s) on <topic>; too few to show a clear arc. Report: 30_outputs/<YYYY-MM-DD>-trace-<slug>.md.`
+- On failure (no report written): `Trace failed — <one-sentence reason>.`
+
+Do not summarise the timeline content in the completion message — let the file carry it.