@aitne-sh/aitne 0.1.7 → 0.1.9

package/agent-assets/skills/external-services/SKILL.delegated.codex.md

@@ -1,9 +1,8 @@
 ---
 name: external-services
-description: Load when the task involves Google Calendar, the user's external Obsidian vault, GitHub, or Skills management AND Google Calendar is in cross-backend delegated mode (DM session on Codex CLI, Calendar delegated to a different backend's connector). Calendar calls flow through `POST /api/integrations/google_calendar/exec`; the rest of the surface (Obsidian, GitHub, recurring schedules, one-shot scheduling, skills CRUD) is unchanged from the direct-mode body.
+description: Load when the task touches Google Calendar, Obsidian, GitHub, or Skills CRUD AND Google Calendar is cross-backend delegated from a Codex CLI DM session. Calendar calls route through `POST /api/integrations/google_calendar/exec`; other surfaces keep their direct routes.
 allowed-tools:
   - Bash(curl *)
-  - Bash(jq *)
   - Read
 ---
 
@@ -22,8 +21,7 @@ these calls (Calendar is not delegated to Codex here).
 
 The rest of this skill — Obsidian, GitHub, recurring schedules, one-shot
 scheduling, skills CRUD — works identically to the direct-mode body.
-Refer to that body for those services; **only the Calendar section
-below changes** under cross-backend delegation.
+Refer to that body for those services; **only the Calendar section below changes** under cross-backend delegation.
 
 To check which backend currently owns the Calendar connector, read
 `~/.personal-agent/integrations.md`. The `/exec` body below is
@@ -194,7 +192,7 @@ Always preserve `body.message` verbatim when reporting to the user.
 **Scope**: this skill targets a **separate** Obsidian vault the user
 maintains alongside this app — e.g. a personal knowledge base. It is
 **not** the agent's own primary management store. The agent's primary
-files (`today.md`, `roadmap.md`, `projects/`, `rules/`, `routines/`,
+files (`state/today.md`, `plans/roadmap.md`, `projects/`, `rules/`, `routines/`,
 `user/`, `agent/`, …) live in the primary vault and are reached via
 `/api/context/*` (see the `context` skill). **Never** use this skill to
 read or write the primary vault.
@@ -239,10 +237,10 @@ skill and the `/api/context/*` endpoints instead.
 
 ```bash
 curl -s http://localhost:8321/api/github/repos                              # list watched repos
-curl -s "http://localhost:8321/api/github/pulls?state=open"                  # list PRs
+curl -s "http://localhost:8321/api/github/pulls?owner=user&repo=repo&state=open" # list PRs
 curl -s -X POST http://localhost:8321/api/github/pulls/comment \
   -H 'Content-Type: application/json' \
-  -d '{"owner": "user", "repo": "repo", "pullNumber": 42, "body": "LGTM"}' # comment — Autonomous
+  -d '{"owner": "user", "repo": "repo", "pull_number": 42, "comment": "LGTM"}' # comment — Autonomous
 ```
 <!-- /service:github -->
 
@@ -258,23 +256,13 @@ update, archive).
 
 ---
 
-## Recurring Schedules
+## Recurring tasks
 
-CRUD for repeating agent tasks. Timezone auto-filled from daemon config.
-
-```bash
-curl -s -X POST http://localhost:8321/api/recurring-schedules \
-  -H 'Content-Type: application/json' \
-  -d '{"taskType": "wake", "description": "Morning inbox triage.", "recurrenceRule": {"frequency": "daily", "time": "09:00"}}'
-curl -s "http://localhost:8321/api/recurring-schedules?enabled=true"         # list
-curl -s -X PATCH http://localhost:8321/api/recurring-schedules/1 \
-  -H 'Content-Type: application/json' \
-  -d '{"recurrenceRule": {"frequency": "weekly", "time": "10:00", "daysOfWeek": [1,3,5]}}'
-curl -s -X PATCH http://localhost:8321/api/recurring-schedules/1 \
-  -H 'Content-Type: application/json' -d '{"enabled": false}'              # disable
-curl -s -X DELETE http://localhost:8321/api/recurring-schedules/1           # delete
-```
-`recurrenceRule`: `frequency` (daily/weekly/monthly), `time` (HH:MM), `daysOfWeek` (0=Sun..6=Sat, weekly), `daysOfMonth` (1-31, monthly). → Full guide: load `schedule` skill.
+Recurring autonomous **work** (fetch / check / act on a cadence) is an **Agent** —
+create one with the `agent-create` skill (`POST /api/agents`), managed on `/agents`.
+Recurring scheduled **DMs / briefings** stay on `POST /api/recurring-schedules`
+with `taskType: "dm_session"`. `GET /api/recurring-schedules?enabled=true` lists
+existing rows (dedup). → Full guide: load the `agent-create` or `schedule` skill.
 
 ---
 
@@ -312,9 +300,9 @@ curl -s -X POST http://localhost:8321/api/schedule/dm \
 ```bash
 curl -s -X POST http://localhost:8321/api/schedule \
   -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "taskType": "wake", "description": "Check PR #42 status and notify user.", "model": "sonnet", "taskContext": {"scheduledBy": "dm_conversation"}}'
+  -d '{"time": "2026-04-06T16:00:00-04:00", "taskType": "wake", "prompt": "Check PR #42 status and notify user.", "description": "PR #42 status check", "tier": "medium", "taskContext": {"scheduledBy": "dm_conversation"}}'
 ```
-Fields: `time` (required), `taskType` (`wake`), `description` (required, min 20 chars), `model` (optional), `taskContext` (optional metadata).
+Fields: `time` (required), `taskType` (`wake`), `prompt` (required — the agent instruction, ≤8000 chars), `description` (optional label, ≤200 chars), `tier` (`lite`/`medium`/`high`) **or** `model` (registered id like `claude-opus-4-8`, legacy alias `sonnet`/`opus`, or composite `<backendId>/<modelId>`) — mutually exclusive, `taskContext` (optional metadata). See the `schedule` skill body for the full surface and `/api/schedule/options` for the live model list.
 
 ### Manage pending items
 ```bash
@@ -323,7 +311,7 @@ curl -s -X PATCH http://localhost:8321/api/schedule/42 \
   -H 'Content-Type: application/json' -d '{"time": "2026-04-06T17:00:00-04:00"}'   # edit
 curl -s -X DELETE http://localhost:8321/api/schedule/42                              # cancel
 ```
-Editable: `time`, `description`, `message` (dm only), `model`, `taskContext`. Only `pending` items.
+Editable: `time`, `description`, `message` (dm only), `tier` (or `model`, mutually exclusive — pass `null` to clear), `taskContext`. Only `pending` items.
 
 ### Time discipline
 - Absolute ISO 8601 with offset required — no relative times.

package/agent-assets/skills/external-services/SKILL.delegated.gemini.md

@@ -1,9 +1,8 @@
 ---
 name: external-services
-description: Load when the task involves Google Calendar, the user's external Obsidian vault, GitHub, or Skills management AND Google Calendar is in cross-backend delegated mode (DM session on Gemini CLI, Calendar delegated to a different backend's connector). Calendar calls flow through `POST /api/integrations/google_calendar/exec`; the rest of the surface (Obsidian, GitHub, recurring schedules, one-shot scheduling, skills CRUD) is unchanged from the direct-mode body.
+description: Load when the task touches Google Calendar, Obsidian, GitHub, or Skills CRUD AND Google Calendar is cross-backend delegated from a Gemini CLI DM session. Calendar calls route through `POST /api/integrations/google_calendar/exec`; other surfaces keep their direct routes.
 allowed-tools:
   - Bash(curl *)
-  - Bash(jq *)
   - Read
 ---
 
@@ -24,8 +23,7 @@ a different backend than the one running the DM.
 
 The rest of this skill — Obsidian, GitHub, recurring schedules, one-shot
 scheduling, skills CRUD — works identically to the direct-mode body.
-Refer to that body for those services; **only the Calendar section
-below changes** under cross-backend delegation.
+Refer to that body for those services; **only the Calendar section below changes** under cross-backend delegation.
 
 To check which backend currently owns the Calendar connector, read
 `~/.personal-agent/integrations.md`. The skill body assumes Codex
@@ -192,7 +190,7 @@ Always preserve `body.message` verbatim when reporting to the user.
 **Scope**: this skill targets a **separate** Obsidian vault the user
 maintains alongside this app — e.g. a personal knowledge base. It is
 **not** the agent's own primary management store. The agent's primary
-files (`today.md`, `roadmap.md`, `projects/`, `rules/`, `routines/`,
+files (`state/today.md`, `plans/roadmap.md`, `projects/`, `rules/`, `routines/`,
 `user/`, `agent/`, …) live in the primary vault and are reached via
 `/api/context/*` (see the `context` skill). **Never** use this skill to
 read or write the primary vault.
@@ -237,10 +235,10 @@ skill and the `/api/context/*` endpoints instead.
 
 ```bash
 curl -s http://localhost:8321/api/github/repos                              # list watched repos
-curl -s "http://localhost:8321/api/github/pulls?state=open"                  # list PRs
+curl -s "http://localhost:8321/api/github/pulls?owner=user&repo=repo&state=open" # list PRs
 curl -s -X POST http://localhost:8321/api/github/pulls/comment \
   -H 'Content-Type: application/json' \
-  -d '{"owner": "user", "repo": "repo", "pullNumber": 42, "body": "LGTM"}' # comment — Autonomous
+  -d '{"owner": "user", "repo": "repo", "pull_number": 42, "comment": "LGTM"}' # comment — Autonomous
 ```
 <!-- /service:github -->
 
@@ -256,23 +254,13 @@ update, archive).
 
 ---
 
-## Recurring Schedules
+## Recurring tasks
 
-CRUD for repeating agent tasks. Timezone auto-filled from daemon config.
-
-```bash
-curl -s -X POST http://localhost:8321/api/recurring-schedules \
-  -H 'Content-Type: application/json' \
-  -d '{"taskType": "wake", "description": "Morning inbox triage.", "recurrenceRule": {"frequency": "daily", "time": "09:00"}}'
-curl -s "http://localhost:8321/api/recurring-schedules?enabled=true"         # list
-curl -s -X PATCH http://localhost:8321/api/recurring-schedules/1 \
-  -H 'Content-Type: application/json' \
-  -d '{"recurrenceRule": {"frequency": "weekly", "time": "10:00", "daysOfWeek": [1,3,5]}}'
-curl -s -X PATCH http://localhost:8321/api/recurring-schedules/1 \
-  -H 'Content-Type: application/json' -d '{"enabled": false}'              # disable
-curl -s -X DELETE http://localhost:8321/api/recurring-schedules/1           # delete
-```
-`recurrenceRule`: `frequency` (daily/weekly/monthly), `time` (HH:MM), `daysOfWeek` (0=Sun..6=Sat, weekly), `daysOfMonth` (1-31, monthly). → Full guide: load `schedule` skill.
+Recurring autonomous **work** (fetch / check / act on a cadence) is an **Agent** —
+create one with the `agent-create` skill (`POST /api/agents`), managed on `/agents`.
+Recurring scheduled **DMs / briefings** stay on `POST /api/recurring-schedules`
+with `taskType: "dm_session"`. `GET /api/recurring-schedules?enabled=true` lists
+existing rows (dedup). → Full guide: load the `agent-create` or `schedule` skill.
 
 ---
 
@@ -310,9 +298,9 @@ curl -s -X POST http://localhost:8321/api/schedule/dm \
 ```bash
 curl -s -X POST http://localhost:8321/api/schedule \
   -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "taskType": "wake", "description": "Check PR #42 status and notify user.", "model": "sonnet", "taskContext": {"scheduledBy": "dm_conversation"}}'
+  -d '{"time": "2026-04-06T16:00:00-04:00", "taskType": "wake", "prompt": "Check PR #42 status and notify user.", "description": "PR #42 status check", "tier": "medium", "taskContext": {"scheduledBy": "dm_conversation"}}'
 ```
-Fields: `time` (required), `taskType` (`wake`), `description` (required, min 20 chars), `model` (optional), `taskContext` (optional metadata).
+Fields: `time` (required), `taskType` (`wake`), `prompt` (required — the agent instruction, ≤8000 chars), `description` (optional label, ≤200 chars), `tier` (`lite`/`medium`/`high`) **or** `model` (registered id like `claude-opus-4-8`, legacy alias `sonnet`/`opus`, or composite `<backendId>/<modelId>`) — mutually exclusive, `taskContext` (optional metadata). See the `schedule` skill body for the full surface and `/api/schedule/options` for the live model list.
 
 ### Manage pending items
 ```bash
@@ -321,7 +309,7 @@ curl -s -X PATCH http://localhost:8321/api/schedule/42 \
   -H 'Content-Type: application/json' -d '{"time": "2026-04-06T17:00:00-04:00"}'   # edit
 curl -s -X DELETE http://localhost:8321/api/schedule/42                              # cancel
 ```
-Editable: `time`, `description`, `message` (dm only), `model`, `taskContext`. Only `pending` items.
+Editable: `time`, `description`, `message` (dm only), `tier` (or `model`, mutually exclusive — pass `null` to clear), `taskContext`. Only `pending` items.
 
 ### Time discipline
 - Absolute ISO 8601 with offset required — no relative times.

package/agent-assets/skills/external-services/SKILL.md

@@ -3,7 +3,6 @@ name: external-services
 description: Load for calendar work (Google Calendar, Outlook Calendar, OR Apple Calendar / iCloud), the user's external Obsidian vault, GitHub, or user-authored Skills management. Mail lives in `mail`; Notion in `notion`; one-shot and recurring scheduling in `schedule`.
 allowed-tools:
   - Bash(curl *)
-  - Bash(jq *)
   - Read
 ---
 
@@ -16,7 +15,7 @@ Base URL: `http://localhost:8321`. All calls via `curl -s` with `Content-Type: a
 Two adjacent files declare where the user's data lives — read both before
 routing any external-service call.
 
-1. **`rules/management.md` → `## Source of Truth`** carries durable
+1. **`policies/management.md` → `## Source of Truth`** carries durable
    user-authored answers ("Schedule = Google Calendar", "Tasks = Notion",
    etc.). This is the authoritative routing table.
 2. **`~/.personal-agent/integrations.md` → `## Note Sources`** is the
@@ -34,7 +33,7 @@ integrations DB. Treat it as a routing hint, not a knob.
 
 ### Calendar provider routing
 
-The user's calendar provider lives in `rules/management.md` → `## Source of Truth` → Schedule row. Read it before every calendar call.
+The user's calendar provider lives in `policies/management.md` → `## Source of Truth` → Schedule row. Read it before every calendar call.
 
 | Schedule value in management rules | Use this base path | Backed by |
 |---|---|---|
@@ -44,7 +43,7 @@ The user's calendar provider lives in `rules/management.md` → `## Source of Tr
 
 **Hard rule**: NEVER cross-call. Calling `/api/calendar/*` while Schedule = Apple Calendar does NOT return empty — it queries the user's separate Google account if one exists, returning the wrong day. Calling `/api/apple-calendar/*` while Schedule = Google Calendar returns 503. Both failure modes are silent at the agent level — only the user notices, in the form of wrong answers.
 
-If `rules/management.md` is missing, ambiguous, or names a provider not listed here, **stop and ask the user** rather than guessing. Do not default to Google.
+If `policies/management.md` is missing, ambiguous, or names a provider not listed here, **stop and ask the user** rather than guessing. Do not default to Google.
 
 The endpoint sets are intentionally near-identical in shape (same JSON for events, same query parameters for listing) so the rest of this skill body documents both at once. Provider-specific differences are flagged inline with **[Apple only]** or **[Google only]**.
 
@@ -81,261 +80,23 @@ direct route when not.
 
 ---
 
-<!-- service:calendar -->
-## Calendar
-
-Google Calendar proxy. Operates on the user's primary calendar (configurable via `calendarId` param).
-
-**Timezone rule**: Always include a TZ offset in `start`/`end` dateTime values (e.g. `-04:00`). All-day events use `YYYY-MM-DD` (no TZ needed).
-
-**Event status**: GET returns deleted events with `status: "cancelled"` (200, not 404). Always check `status` before acting. The list endpoint automatically excludes cancelled events.
-
-### List events
-```bash
-curl -s "http://localhost:8321/api/calendar/events?date=today&days=3"
-```
-
-### Get event detail
-```bash
-curl -s "http://localhost:8321/api/calendar/events/abc123eventid"
-```
-**Always GET before PATCH** to see current state and attendees.
-
-### Create event (write — Autonomous)
-```bash
-curl -s -X POST "http://localhost:8321/api/calendar/events" \
-  -H 'Content-Type: application/json' \
-  -d '{"summary": "Team meeting", "start": "2026-04-02T14:00:00-04:00", "end": "2026-04-02T15:00:00-04:00"}'
-```
-Optional: `description`, `location`, `reminders`, `recurrence`, `attendees`, `visibility`. All-day: `YYYY-MM-DD`. Attendees: add `?sendUpdates=all` to notify. RRULE: `RRULE:FREQ=WEEKLY;BYDAY=MO,WE,FR`.
-
-### Update event (write — Autonomous; commonly on the starter denylist)
-```bash
-curl -s -X PATCH "http://localhost:8321/api/calendar/events/abc123" \
-  -H 'Content-Type: application/json' \
-  -d '{"start": "2026-04-02T15:00:00-04:00", "end": "2026-04-02T16:00:00-04:00"}'
-```
-For recurring events, use the instance ID to update a single occurrence — never PATCH the master.
-
-**ATTENDEES WARNING**: PATCH with `attendees` **replaces the entire list** — it does NOT append. To add one attendee: (1) GET, (2) copy existing, (3) add new, (4) PATCH full list.
-
-### Delete event (write — Autonomous; default starter denylist denies it)
-```bash
-curl -s -X DELETE "http://localhost:8321/api/calendar/events/abc123"
-```
-Add `?sendUpdates=all` to notify attendees. Do NOT PATCH a cancelled event.
-
-### List calendars
-```bash
-curl -s http://localhost:8321/api/calendar/calendars
-```
-
-### Free/busy query
-```bash
-curl -s -X POST http://localhost:8321/api/calendar/freebusy \
-  -H 'Content-Type: application/json' \
-  -d '{"timeMin": "2026-04-11T09:00:00-04:00", "timeMax": "2026-04-11T18:00:00-04:00"}'
-```
-
-### Calendar error envelope (direct mode)
-
-| HTTP | `error` | What it means / what to do |
-|---|---|---|
-| 400 | `validation_error` | Bad request shape (e.g. missing `start`/`end`, malformed RRULE). Fix and retry. |
-| 404 | `not_found` | Event id unknown or already deleted. Re-list before retrying. |
-| 410 | `integration_delegated` | Calendar flipped to delegated mode mid-session. This skill body is direct-only — re-read `integrations.md` and use `POST /api/integrations/google_calendar/exec` (cross-backend task mode) or your session backend's native Calendar MCP (the same-backend variant) instead. |
-| 502 | `calendar_error` | Upstream Google API error — `message` carries the API's text. Surface verbatim; do not retry unless clearly transient. |
-| 503 | `calendar_not_configured` | Direct OAuth credentials are missing or the user has disabled Calendar in settings. Tell the user and stop. |
-<!-- /service:calendar -->
+{{> ref:calendar-google }}
 
 ---
 
-<!-- service:outlook-calendar -->
-## Outlook Calendar (Microsoft Graph)
-
-Use this section **only when `rules/management.md` Schedule = Outlook Calendar**. The provider-routing table at the top of this skill is non-negotiable.
-
-v1 is **read-only and on-demand** — there is no Outlook calendar poller, so `schedule.approaching` events do not fire for Outlook calendars (the user's own Outlook clients fill that gap). Write surfaces (create / update / delete) are deferred. If the user asks the agent to schedule or change an Outlook event, tell them you can read the calendar but must defer the write to them.
-
-OAuth is **shared with Outlook Mail** via the same MSAL cache row (`mail:outlook:<accountId>`) — if Outlook Mail is configured `direct` and authenticated, calendar reads succeed with no second consent.
-
-### List events
-```bash
-curl -s "http://localhost:8321/api/calendar/outlook/events?date=today&days=3"
-```
-Same query params as Google (`date`: `YYYY-MM-DD` or `today`; `days`: 1–90; optional `calendarId`). Returns `{ events: [...], accountId }`.
-
-### List calendars
-```bash
-curl -s http://localhost:8321/api/calendar/outlook/calendars
-```
-Returns `{ calendars: [...], accountId }`. The user's primary calendar is marked `primary: true`.
-
-### Outlook Calendar error envelope
-
-| HTTP | `error` | What it means / what to do |
-|---|---|---|
-| 400 | bad query | Malformed `date` or `days` value. |
-| 502 | `calendar_error` | Upstream Microsoft Graph error — `message` carries wire text. |
-| 503 | `outlook_not_configured` | No authenticated Outlook account. Direct OAuth credentials missing. |
-| 503 | `outlook_calendar_disabled` | The user toggled Outlook Calendar off in Settings → Calendar. Tell the user and stop. |
-<!-- /service:outlook-calendar -->
+{{> ref:calendar-outlook }}
 
 ---
 
-<!-- service:apple-calendar -->
-## Apple Calendar (iCloud CalDAV)
-
-Use this section **only when `rules/management.md` Schedule = Apple Calendar**. The provider-routing table at the top of this skill is non-negotiable.
-
-The route shape mirrors `/api/calendar/*` so prose patterns transfer: list → get → patch / create / delete. Differences are flagged below.
-
-### Probe configuration before first use
-```bash
-curl -s http://localhost:8321/api/apple-calendar/status
-# → { "configured": bool, "available": bool }
-```
-- `configured: false` → user has not entered Apple ID + app-specific password yet. Tell the user to open the dashboard's Apple Calendar card (Connections page) and paste a password from `appleid.apple.com` → Sign-In and Security → App-Specific Passwords. **Do not try to read or write events** until `available: true`.
-- `configured: true, available: false` → credentials are stored but iCloud rejected the last connection. Surface verbatim; common cause is the user revoked the app-specific password.
-
-### List events
-```bash
-curl -s "http://localhost:8321/api/apple-calendar/events?date=today&days=3"
-```
-Same query params as Google: `date` (`YYYY-MM-DD` or `today`), `days` (max 90). Returns `{ events: [...] }` with the same JSON shape used by the Google route — `id`, `summary`, `start`, `end`, `location`, `description`, `allDay`, `status`, plus two Apple-specific fields:
-- `recurring` (bool) — true for any event in a recurring series.
-- `recurrenceId` (string|null) — populated for an expanded instance of a series.
-
-For a recurring instance the `id` is `<UID>__<RECURRENCE-ID>` so you can address a specific occurrence.
-
-**Timezones**: dateTime values are emitted in UTC (`Z` suffix). Convert to the user's local timezone before showing them.
-
-### Get event detail
-```bash
-curl -s "http://localhost:8321/api/apple-calendar/events/<id>"
-```
-Always GET before PATCH so you see the current summary/start/end.
-
-### Create event (write — Autonomous)
-```bash
-curl -s -X POST http://localhost:8321/api/apple-calendar/events \
-  -H 'Content-Type: application/json' \
-  -d '{"summary": "Team meeting", "start": "2026-04-26T14:00:00+09:00", "end": "2026-04-26T15:00:00+09:00"}'
-```
-Optional: `description`, `location`. **[Apple only]** `attendees`, `reminders`, `recurrence`, `visibility` from the Google shape are accepted by the Zod schema but are silently dropped — iCloud invitations and reminder defaults belong to the user's Apple ID and the agent should not author them. If a user asks for those, tell them and stop.
-
-### Update event (write — Autonomous)
-```bash
-curl -s -X PATCH http://localhost:8321/api/apple-calendar/events/<id> \
-  -H 'Content-Type: application/json' \
-  -d '{"start": "2026-04-26T15:00:00+09:00", "end": "2026-04-26T16:00:00+09:00"}'
-```
-
-**[Apple only] Recurring-event editing semantics — read before writing**
-- A composite id (one whose suffix matches `__YYYY-MM-DD…`) addresses **one occurrence** of a series. PATCH/DELETE on it returns `501 recurring_instance_unsupported`. To move a single occurrence the user must edit it from Calendar.app.
-- A bare id whose GET returned `recurring: true` is the **series master**. PATCH on the master shifts the **entire series** (every future occurrence moves), and DELETE removes the entire series. Confirm with the user that they intend a series-level edit before issuing the call — agents have historically read "PATCH this event's start" as a single-instance reschedule, which is wrong here.
-- A bare id with `recurring: false` is a normal one-off event — PATCH/DELETE behave as usual.
-- `summary`, `start`, and `end` may be updated independently. Toggling all-day-ness (`YYYY-MM-DD` ↔ `…T…Z`) requires providing **both** `start` and `end` in the same PATCH; the codec rejects partial all-day toggles with `400 validation_error`.
-- Time strings must include a TZ offset (`Z` or `±HH:MM`); naked ISO without offset returns `400 validation_error` — do not interpret a user-stated time as local without an explicit offset.
-
-### Delete event (write — Autonomous)
-```bash
-curl -s -X DELETE http://localhost:8321/api/apple-calendar/events/<id>
-```
-Same recurring semantics as PATCH (see the rules block above).
-
-### List calendars
-```bash
-curl -s http://localhost:8321/api/apple-calendar/calendars
-# → { "calendars": [{ id, summary, description, primary }, ...] }
-```
-The `id` is an opaque CalDAV URL. The user's primary calendar is marked `primary: true`. To change which calendar create/list reads, see the dashboard Apple Calendar card.
-
-### Free/busy query
-```bash
-curl -s -X POST http://localhost:8321/api/apple-calendar/freebusy \
-  -H 'Content-Type: application/json' \
-  -d '{"timeMin": "2026-04-26T09:00:00Z", "timeMax": "2026-04-26T18:00:00Z"}'
-```
-**[Apple only]** Free-busy is derived from `listEvents` — events with `status: "cancelled"` are excluded. `calendarIds` is ignored (the primary calendar is the only target).
-
-### Apple Calendar error envelope
-
-| HTTP | `error` | What it means / what to do |
-|---|---|---|
-| 400 | `validation_error` | Bad request shape. Fix and retry. |
-| 401 | `auth_failed` | iCloud rejected the credentials. Tell the user to refresh the app-specific password in the dashboard. |
-| 404 | `not_found` | Event id unknown or already deleted. Re-list before retrying. |
-| 501 | `recurring_instance_unsupported` | The id targets a single occurrence of a recurring series — see the PATCH/DELETE notes above. |
-| 502 | `apple_calendar_error` | Upstream iCloud / CalDAV error. `message` carries the wire text. |
-| 503 | `apple_calendar_not_configured` | Credentials missing or last connection failed. Run the status probe above. |
-
-### Known gap: no proactive notifications
-
-The hourly polling pivot (`schedule.approaching` events, observation deltas) only fires for Google Calendar today. With Apple Calendar selected, on-demand DM queries work but the agent will not proactively warn about an imminent event — the user's own iOS / macOS Calendar.app notifications fill that gap.
-<!-- /service:apple-calendar -->
+{{> ref:calendar-apple }}
 
 ---
 
-<!-- service:obsidian -->
-## Obsidian (external vault)
-
-**Scope**: this skill targets a **separate** Obsidian vault the user maintains
-alongside this app — e.g. a personal knowledge base. It is **not** the agent's
-own primary management store. The agent's primary files (`today.md`,
-`roadmap.md`, `projects/`, `rules/`, `routines/`, `user/`, `agent/`, …) live
-in the primary vault and are reached via `/api/context/*` (see the `context`
-skill). **Never** use this skill to read or write the primary vault.
-
-Use this skill when the user asks the agent to look up, append to, or create
-notes inside their external knowledge vault — never for the agent's own
-working state.
-
-Output language: follow `<output_language_policy>` (Policy C — body
-and any new headings the agent creates are in `<settings primary_language>`).
-Preserve verbatim any path / file-name patterns the user has established.
-
-Full CRUD over the external vault. Requires the Obsidian app running (the
-CLI proxies through it). Omit `.md` extension from paths. All writes are
-Autonomous; the daemon does not DM the owner before/after the call. Call
-`POST /api/notify` yourself when the user would want to know.
-
-```bash
-curl -s http://localhost:8321/api/obsidian/status                            # external vault availability
-curl -s "http://localhost:8321/api/obsidian/search?q=meeting+notes&limit=10" # search external vault
-curl -s http://localhost:8321/api/obsidian/notes/Daily%20Notes/2026-04-06    # read external note
-curl -s -X POST http://localhost:8321/api/obsidian/notes \
-  -H 'Content-Type: application/json' \
-  -d '{"name": "Meeting Notes 2026-04-02", "content": "# Meeting\n..."}'    # create external note (fails if exists)
-curl -s -X PUT http://localhost:8321/api/obsidian/notes/Projects/ProjectA \
-  -H 'Content-Type: application/json' -d '{"content": "# Full body"}'       # create-or-overwrite external note
-curl -s -X PATCH http://localhost:8321/api/obsidian/notes \
-  -H 'Content-Type: application/json' \
-  -d '{"file": "Meeting Notes 2026-04-02", "content": "\n- Action item"}'   # append to external note
-curl -s -X PATCH http://localhost:8321/api/obsidian/daily \
-  -H 'Content-Type: application/json' -d '{"content": "- [ ] Follow up"}'   # append to external daily note
-curl -s -X DELETE http://localhost:8321/api/obsidian/notes/Projects/Old      # delete from external vault (moves to trash)
-```
-**Endpoint choice**: Read → GET, Create-only → POST, Edit → PUT, Append → PATCH.
-
-If the user's request is really about the agent's own state (today, roadmap,
-projects, journal, rules, routines, user profile), switch to the `context`
-skill and the `/api/context/*` endpoints instead.
-<!-- /service:obsidian -->
+{{> ref:obsidian }}
 
 ---
 
-<!-- service:github -->
-## GitHub
-
-```bash
-curl -s http://localhost:8321/api/github/repos                              # list watched repos
-curl -s "http://localhost:8321/api/github/pulls?owner=user&repo=repo&state=open" # list PRs
-curl -s -X POST http://localhost:8321/api/github/pulls/comment \
-  -H 'Content-Type: application/json' \
-  -d '{"owner": "user", "repo": "repo", "pull_number": 42, "comment": "LGTM"}' # comment — Autonomous
-```
-<!-- /service:github -->
+{{> ref:github }}
 
 ---
 
@@ -360,18 +121,4 @@ flows.
 
 ---
 
-## Skills Management
-
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
-
-```bash
-curl -s http://localhost:8321/api/skills                                            # list all
-curl -s http://localhost:8321/api/skills/todo-digest                                # read one
-curl -s -X POST http://localhost:8321/api/skills \
-  -H 'Content-Type: application/json' \
-  -d '{"name": "todo-digest", "description": "Summarize today.md", "content": "# TODO Digest\n...", "allowedTools": ["Bash(curl *)", "Read"]}'
-curl -s -X PUT http://localhost:8321/api/skills/todo-digest \
-  -H 'Content-Type: application/json' -d '{"description": "New description"}'      # update
-curl -s -X DELETE http://localhost:8321/api/skills/todo-digest                      # delete
-```
-Always `GET /api/skills` before creating (check name collisions). **Omit frontmatter** from `content` — the API injects it.
+{{> ref:skills-crud }}

package/agent-assets/skills/external-services/SKILL.native.claude.md

@@ -1,9 +1,8 @@
 ---
 name: external-services
-description: Load when an external-services surface is in scope (Google Calendar / Obsidian / GitHub / Skills CRUD / scheduling) and Google Calendar is in native mode bound to Claude (`nativeBackend === "claude"`). Calendar runs through Claude's hosted Calendar connector directly; the daemon does not proxy Calendar. Other surfaces (Apple/Outlook Calendar, Obsidian, GitHub, scheduling, Skills CRUD) keep their direct routes.
+description: Load when an external-services surface is in scope and Google Calendar is in native mode bound to Claude (`nativeBackend === "claude"`). Calendar runs via Claude's hosted Calendar connector; daemon does not proxy. Obsidian, GitHub, scheduling, Skills CRUD keep direct routes.
 allowed-tools:
   - Bash(curl *)
-  - Bash(jq *)
   - Read
 ---
 
@@ -38,14 +37,14 @@ in the session preamble.
 The same two files documented in the direct-mode body are still
 authoritative for non-Calendar routing:
 
-1. **`rules/management.md` → `## Source of Truth`** — durable
+1. **`policies/management.md` → `## Source of Truth`** — durable
    user-authored answers ("Schedule = Google Calendar", "Tasks =
    Notion", etc.).
 2. **`~/.personal-agent/integrations.md` → `## Note Sources`** — the
    daemon-rendered snapshot for the user's external Obsidian vault path
    plus Notion's mode.
 
-If `rules/management.md` Schedule = Apple Calendar or Outlook Calendar,
+If `policies/management.md` Schedule = Apple Calendar or Outlook Calendar,
 the user's chosen provider is **not** Google Calendar and the
 native-Claude binding is irrelevant — route to `/api/apple-calendar/*`
 or `/api/calendar/outlook/*` exactly as the direct-mode body documents.
@@ -150,7 +149,7 @@ the window and intersect.
 <!-- service:apple-calendar -->
 ## Apple Calendar (iCloud CalDAV) — direct, unchanged
 
-If `rules/management.md` Schedule = Apple Calendar, use the
+If `policies/management.md` Schedule = Apple Calendar, use the
 `/api/apple-calendar/*` routes documented in the base body. Apple
 Calendar has no MCP connector; native-mode gating does not apply.
 
@@ -166,7 +165,7 @@ native binding above is Google-only.
 <!-- service:outlook-calendar -->
 ## Outlook Calendar (Microsoft Graph) — direct, unchanged
 
-If `rules/management.md` Schedule = Outlook Calendar, use
+If `policies/management.md` Schedule = Outlook Calendar, use
 `/api/calendar/outlook/*` per the direct-mode body. Microsoft does not
 ship a hosted Outlook Calendar connector for Claude / Codex / Gemini
 today; native-mode gating does not apply.
@@ -179,7 +178,7 @@ today; native-mode gating does not apply.
 
 **Scope**: this skill targets the **separate** Obsidian vault the user
 maintains alongside this app — never the agent's primary management
-store (`today.md`, `roadmap.md`, `projects/`, `rules/`, `routines/`,
+store (`state/today.md`, `plans/roadmap.md`, `projects/`, `rules/`, `routines/`,
 `user/`, `agent/`). Those are reached via `/api/context/*` (see the
 `context` skill).
 

package/agent-assets/skills/external-services/SKILL.native.codex.md

@@ -1,9 +1,8 @@
 ---
 name: external-services
-description: Load when an external-services surface is in scope (Google Calendar / Obsidian / GitHub / Skills CRUD / scheduling) and Google Calendar is in native mode bound to Codex (`nativeBackend === "codex"`). Calendar runs through the in-session Calendar connector your Codex harness exposes directly; the daemon does not proxy Calendar. Other surfaces (Apple/Outlook Calendar, Obsidian, GitHub, scheduling, Skills CRUD) keep their direct routes.
+description: Load when an external-services surface is in scope and Google Calendar is in native mode bound to Codex (`nativeBackend === "codex"`). Calendar runs via the Codex Calendar connector; daemon does not proxy. Obsidian, GitHub, scheduling, Skills CRUD keep direct routes.
 allowed-tools:
   - Bash(curl *)
-  - Bash(jq *)
   - Read
 ---
 
@@ -33,9 +32,9 @@ and the `<integration-routing-table>` block in the session preamble.
 
 ## Source of Truth (READ FIRST)
 
-Same as the direct-mode body — `rules/management.md` →
+Same as the direct-mode body — `policies/management.md` →
 `## Source of Truth` and `~/.personal-agent/integrations.md` →
-`## Note Sources`. If `rules/management.md` Schedule != Google
+`## Note Sources`. If `policies/management.md` Schedule != Google
 Calendar, the native binding is irrelevant; route through the
 provider-specific direct route (`/api/apple-calendar/*` or
 `/api/calendar/outlook/*`).
@@ -121,7 +120,7 @@ this file.
 <!-- service:apple-calendar -->
 ## Apple Calendar (iCloud CalDAV) — direct, unchanged
 
-If `rules/management.md` Schedule = Apple Calendar, use the
+If `policies/management.md` Schedule = Apple Calendar, use the
 `/api/apple-calendar/*` routes documented in the base body. Apple
 Calendar has no MCP connector; native-mode gating does not apply.
 <!-- /service:apple-calendar -->
@@ -131,7 +130,7 @@ Calendar has no MCP connector; native-mode gating does not apply.
 <!-- service:outlook-calendar -->
 ## Outlook Calendar (Microsoft Graph) — direct, unchanged
 
-If `rules/management.md` Schedule = Outlook Calendar, use
+If `policies/management.md` Schedule = Outlook Calendar, use
 `/api/calendar/outlook/*` per the direct-mode body. No Outlook
 connector ships for Codex today; native-mode gating does not apply.
 <!-- /service:outlook-calendar -->
@@ -144,7 +143,7 @@ connector ships for Codex today; native-mode gating does not apply.
 Same surface as the direct-mode body. Full CRUD via
 `/api/obsidian/*`; requires the Obsidian app running. Omit `.md`
 extensions from paths. Never use this skill to read or write the
-agent's primary management vault (`today.md`, `roadmap.md`,
+agent's primary management vault (`state/today.md`, `plans/roadmap.md`,
 `projects/`, `rules/`, …) — that lives behind `/api/context/*`.
 
 ```bash
@@ -172,10 +171,10 @@ curl -s -X DELETE http://localhost:8321/api/obsidian/notes/Projects/Old
 
 ```bash
 curl -s http://localhost:8321/api/github/repos
-curl -s "http://localhost:8321/api/github/pulls?state=open"
+curl -s "http://localhost:8321/api/github/pulls?owner=user&repo=repo&state=open"
 curl -s -X POST http://localhost:8321/api/github/pulls/comment \
   -H 'Content-Type: application/json' \
-  -d '{"owner": "user", "repo": "repo", "pullNumber": 42, "body": "LGTM"}'
+  -d '{"owner": "user", "repo": "repo", "pull_number": 42, "comment": "LGTM"}'
 ```
 <!-- /service:github -->