@aitne-sh/aitne 0.1.8 → 0.1.10

package/agent-assets/skills/external-services/SKILL.native.codex.md

@@ -32,9 +32,9 @@ and the `<integration-routing-table>` block in the session preamble.
 
 ## Source of Truth (READ FIRST)
 
-Same as the direct-mode body — `rules/management.md` →
+Same as the direct-mode body — `policies/management.md` →
 `## Source of Truth` and `~/.personal-agent/integrations.md` →
-`## Note Sources`. If `rules/management.md` Schedule != Google
+`## Note Sources`. If `policies/management.md` Schedule != Google
 Calendar, the native binding is irrelevant; route through the
 provider-specific direct route (`/api/apple-calendar/*` or
 `/api/calendar/outlook/*`).
@@ -120,7 +120,7 @@ this file.
 <!-- service:apple-calendar -->
 ## Apple Calendar (iCloud CalDAV) — direct, unchanged
 
-If `rules/management.md` Schedule = Apple Calendar, use the
+If `policies/management.md` Schedule = Apple Calendar, use the
 `/api/apple-calendar/*` routes documented in the base body. Apple
 Calendar has no MCP connector; native-mode gating does not apply.
 <!-- /service:apple-calendar -->
@@ -130,7 +130,7 @@ Calendar has no MCP connector; native-mode gating does not apply.
 <!-- service:outlook-calendar -->
 ## Outlook Calendar (Microsoft Graph) — direct, unchanged
 
-If `rules/management.md` Schedule = Outlook Calendar, use
+If `policies/management.md` Schedule = Outlook Calendar, use
 `/api/calendar/outlook/*` per the direct-mode body. No Outlook
 connector ships for Codex today; native-mode gating does not apply.
 <!-- /service:outlook-calendar -->
@@ -143,7 +143,7 @@ connector ships for Codex today; native-mode gating does not apply.
 Same surface as the direct-mode body. Full CRUD via
 `/api/obsidian/*`; requires the Obsidian app running. Omit `.md`
 extensions from paths. Never use this skill to read or write the
-agent's primary management vault (`today.md`, `roadmap.md`,
+agent's primary management vault (`state/today.md`, `plans/roadmap.md`,
 `projects/`, `rules/`, …) — that lives behind `/api/context/*`.
 
 ```bash
@@ -171,10 +171,10 @@ curl -s -X DELETE http://localhost:8321/api/obsidian/notes/Projects/Old
 
 ```bash
 curl -s http://localhost:8321/api/github/repos
-curl -s "http://localhost:8321/api/github/pulls?state=open"
+curl -s "http://localhost:8321/api/github/pulls?owner=user&repo=repo&state=open"
 curl -s -X POST http://localhost:8321/api/github/pulls/comment \
   -H 'Content-Type: application/json' \
-  -d '{"owner": "user", "repo": "repo", "pullNumber": 42, "body": "LGTM"}'
+  -d '{"owner": "user", "repo": "repo", "pull_number": 42, "comment": "LGTM"}'
 ```
 <!-- /service:github -->
 

package/agent-assets/skills/external-services/SKILL.native.gemini.md

@@ -33,7 +33,7 @@ and the `<integration-routing-table>` block in the session preamble.
 
 ## Source of Truth (READ FIRST)
 
-Same files as the direct-mode body — `rules/management.md` →
+Same files as the direct-mode body — `policies/management.md` →
 `## Source of Truth` and `~/.personal-agent/integrations.md` →
 `## Note Sources`. If Schedule != Google Calendar, route through the
 provider-specific direct route (`/api/apple-calendar/*` or
@@ -124,7 +124,7 @@ materialised event to `/api/observations` per the section below.
 ## Apple Calendar (iCloud CalDAV) — direct, unchanged
 
 Use `/api/apple-calendar/*` per the direct-mode body if
-`rules/management.md` Schedule = Apple Calendar.
+`policies/management.md` Schedule = Apple Calendar.
 <!-- /service:apple-calendar -->
 
 ---
@@ -170,10 +170,10 @@ curl -s -X DELETE http://localhost:8321/api/obsidian/notes/Projects/Old
 
 ```bash
 curl -s http://localhost:8321/api/github/repos
-curl -s "http://localhost:8321/api/github/pulls?state=open"
+curl -s "http://localhost:8321/api/github/pulls?owner=user&repo=repo&state=open"
 curl -s -X POST http://localhost:8321/api/github/pulls/comment \
   -H 'Content-Type: application/json' \
-  -d '{"owner": "user", "repo": "repo", "pullNumber": 42, "body": "LGTM"}'
+  -d '{"owner": "user", "repo": "repo", "pull_number": 42, "comment": "LGTM"}'
 ```
 <!-- /service:github -->
 

package/agent-assets/skills/external-services/references/calendar-apple.md

@@ -7,7 +7,7 @@ description: Apple Calendar (iCloud CalDAV) reference — list/get/create/update
 <!-- service:apple-calendar -->
 ## Apple Calendar (iCloud CalDAV)
 
-Use this section **only when `rules/management.md` Schedule = Apple Calendar**. The provider-routing table at the top of this skill is non-negotiable.
+Use this section **only when `policies/management.md` Schedule = Apple Calendar**. The provider-routing table at the top of this skill is non-negotiable.
 
 The route shape mirrors `/api/calendar/*` so prose patterns transfer: list → get → patch / create / delete. Differences are flagged below.
 
@@ -43,7 +43,7 @@ curl -s -X POST http://localhost:8321/api/apple-calendar/events \
   -H 'Content-Type: application/json' \
   -d '{"summary": "Team meeting", "start": "2026-04-26T14:00:00+09:00", "end": "2026-04-26T15:00:00+09:00"}'
 ```
-Optional: `description`, `location`. **[Apple only]** `attendees`, `reminders`, `recurrence`, `visibility` from the Google shape are accepted by the Zod schema but are silently dropped — iCloud invitations and reminder defaults belong to the user's Apple ID and the agent should not author them. If a user asks for those, tell them and stop.
+Optional: `description`, `location`. **[Apple only]** `attendees`, `reminders`, `recurrence`, `visibility` from the Google shape are **rejected** — the Apple schema is `.strict()`, so including any of them fails the whole request with `400 validation_error` and no event is created (the same applies to PATCH). iCloud invitations and reminder defaults belong to the user's Apple ID and the agent should not author them. If a user asks for those, tell them and stop — do not include the fields in the request.
 
 ### Update event (write — Autonomous)
 ```bash

package/agent-assets/skills/external-services/references/calendar-outlook.md

@@ -7,7 +7,7 @@ description: Outlook Calendar reference (Microsoft Graph) — read-only on-deman
 <!-- service:outlook-calendar -->
 ## Outlook Calendar (Microsoft Graph)
 
-Use this section **only when `rules/management.md` Schedule = Outlook Calendar**. The provider-routing table at the top of this skill is non-negotiable.
+Use this section **only when `policies/management.md` Schedule = Outlook Calendar**. The provider-routing table at the top of this skill is non-negotiable.
 
 v1 is **read-only and on-demand** — there is no Outlook calendar poller, so `schedule.approaching` events do not fire for Outlook calendars (the user's own Outlook clients fill that gap). Write surfaces (create / update / delete) are deferred. If the user asks the agent to schedule or change an Outlook event, tell them you can read the calendar but must defer the write to them.
 

package/agent-assets/skills/external-services/references/exec-errors.md

@@ -0,0 +1,32 @@
+---
+kind: reference
+name: exec-errors
+description: Delegated `/exec` error envelope — HTTP status, `error` code, retry guidance. Shared across the cross-backend SKILL.delegated.*.md Calendar variants.
+---
+
+### Error envelope
+
+`/exec` extends the direct-mode envelope with delegated-mode fields.
+Discriminator: `body.mode === "delegated"`.
+
+| HTTP | `error` | retry? | What to do |
+|---|---|---|---|
+| 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
+| 409 | `mode_mismatch` | no | Calendar isn't delegated, OR your DM backend matches `delegatedBackend`. Re-read `integrations.md` and stop. |
+| 409 | `precondition` | no | Mode/backend flipped during the queue wait. Re-check state and re-plan. |
+| 429 | `task_quota_exhausted` | no | Daily cap reached; wait or surface. |
+| 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Consider a simpler schema. |
+| 502 | `tool_unavailable` | no | No connector tool fits the intent. Surface the gap. |
+| 502 | `tool_failed` | maybe | Connector tool returned an error. Surface `body.message` verbatim; retry only if clearly transient. |
+| 502 | `auth_error` | no | Connector signed out. Tell the user to re-authenticate it. |
+| 502 | `policy_violation` | no | Subprocess attempted a tool outside the per-task allowlist (anti-injection). |
+| 502 | `loop_aborted` | no | `maxToolCalls` exceeded. Bump the cap or simplify. |
+| 502 | `budget_exhausted` | no | `maxBudgetUsd` exceeded. Caller can raise the cap. |
+| 502 | `post_write_format_failure` | no | Write succeeded; formatting failed. Side effect is real — surface with the partial trace. |
+| 503 | `delegated_proxy_busy` | yes | Daemon queue saturated. Backoff a few seconds, try once. |
+| 503 | `task_mode_disabled` | no | Operator turned the kill switch off. Stop. |
+| 504 | `timeout` | yes (1×) | Wall-clock fired. Retry once if intent was simple. |
+| 500 | `subprocess_crashed` | no | Unhandled exception inside the subprocess. Surface and stop. |
+
+Always preserve `body.message` verbatim when reporting to the user — it
+carries the connector's own language.

package/agent-assets/skills/external-services/references/obsidian.md

@@ -9,8 +9,8 @@ description: External Obsidian vault CRUD — separate from the agent's primary
 
 **Scope**: this skill targets a **separate** Obsidian vault the user maintains
 alongside this app — e.g. a personal knowledge base. It is **not** the agent's
-own primary management store. The agent's primary files (`today.md`,
-`roadmap.md`, `projects/`, `rules/`, `routines/`, `user/`, `agent/`, …) live
+own primary management store. The agent's primary files (`state/today.md`,
+`plans/roadmap.md`, `projects/`, `rules/`, `routines/`, `user/`, `agent/`, …) live
 in the primary vault and are reached via `/api/context/*` (see the `context`
 skill). **Never** use this skill to read or write the primary vault.
 

package/agent-assets/skills/external-services/references/skills-crud.md

@@ -1,12 +1,12 @@
 ---
 kind: reference
 name: skills-crud
-description: Dashboard-shaped CRUD for user-authored skills under ~/.personal-agent/skills/. Built-in skills are read-only (403).
+description: Dashboard-shaped CRUD for user-authored skills under <contextDir>/policies/skills/. Built-in skills are read-only (403).
 ---
 
 ## Skills Management
 
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
+User-authored skills: `<contextDir>/policies/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
 
 ```bash
 curl -s http://localhost:8321/api/skills                                            # list all
@@ -22,6 +22,6 @@ Always `GET /api/skills` before creating (check name collisions). **Omit frontma
 
 The description is the **only** routing signal the SDK uses to pick a
 skill — keep it under 280 chars and make the trigger surface
-distinct from every other skill in the manifest. Slug grammar is
-strict: `[a-z0-9][a-z0-9-]*[a-z0-9]` or `[a-z0-9]` (single char),
-1-64 chars total. PUT rejects collisions with built-in slugs.
+distinct from every other skill in the manifest. Slug grammar:
+`^[a-z0-9][a-z0-9-]*$` (1-64 chars; a trailing hyphen is allowed,
+no alphanumeric terminal required). PUT rejects collisions with built-in slugs.

package/agent-assets/skills/gmail-lifestyle/SKILL.md

@@ -1,26 +1,24 @@
 ---
 name: gmail-lifestyle
-description: Load when the user mentions receipts / expenses / flights / hotels / trains / commute / travel time / a booking — Gmail-observer-derived travel bookings, calendar-event commute calculations, and receipt save-to-external-vault all live here.
+description: Load when the user mentions receipts / expenses / flights / hotels / trains / a booking — Gmail-observer-derived travel bookings and receipt save-to-external-vault both live here.
 allowed-tools:
   - Bash(curl *)
   - Read
 ---
 
-# Gmail Lifestyle — travel bookings, commute, receipts
+# Gmail Lifestyle — travel bookings, receipts
 
-This skill merges three closely-related surfaces that all depend on
-data the daemon's **Gmail observer** has scanned: travel bookings,
-commute / travel-time calculations over calendar events, and receipt
-attachments saved into the user's external Obsidian vault.
+This skill merges two closely-related surfaces that both depend on
+data the daemon's **Gmail observer** has scanned: travel bookings and
+receipt attachments saved into the user's external Obsidian vault.
 
 It is conditionally loaded — see the manifest predicate
 `gmailLifestyleActive(db)` / `gmailLifestyleActiveForDm(db, msg)`
 in `packages/daemon/src/core/skills-manifest.ts`. Routines load it
 when there is fresh-or-pending data; DM events also load it on
-trigger phrases (`receipt`, `expense`, `flight`, `train`,
-`commute`, `travel time`, plus the user's primary-language
-equivalents — the predicate handles both the structured triggers
-and the message-text triggers).
+trigger phrases (`receipt`, `expense`, `flight`, `train`, plus the
+user's primary-language equivalents — the predicate handles both the
+structured triggers and the message-text triggers).
 
 Output language: Policy C for user-facing summaries — see
 `<output_language_policy>`. Path patterns and external API field
@@ -85,77 +83,6 @@ Reservation.
 
 ---
 
-## Travel time / commute
-
-Uses the Google Maps Directions API to estimate travel time between
-locations. Computes departure times for calendar events with a
-`location` field.
-
-**Prerequisite**: `googleMapsApiKey` configured in the daemon's
-secret store, with the Directions API enabled.
-
-### When to use
-
-- **Morning routine** — for today's calendar events with a location,
-  compute departure times and add to today.md `## Commute & Travel`.
-- **User asks about commute / travel time** — query specific routes.
-- **Pre-event reminders** — DM departure-time suggestions.
-
-### Sourcing today's events
-
-The right fetch path depends on Google Calendar's current mode
-(read `<integration_modes>` injected at session start):
-
-<!-- mode:direct:google_calendar -->
-Direct mode → `GET /api/calendar/events?date=today&days=1`
-(see the `external-services` skill).
-<!-- /mode:direct:google_calendar -->
-<!-- mode:delegated-same:google_calendar -->
-Same-backend delegated → use this session backend's native Calendar
-list-events MCP tool. `/api/calendar/events` returns 410.
-<!-- /mode:delegated-same:google_calendar -->
-<!-- mode:delegated-cross:google_calendar -->
-Cross-backend delegated → `POST /api/integrations/google_calendar/exec`
-with a natural-language `task` + `outputSchema` (see the
-`external-services` skill — cross-backend variant for worked
-examples).
-<!-- /mode:delegated-cross:google_calendar -->
-<!-- mode:native:google_calendar -->
-Native mode → use this session backend's native Calendar list-events
-MCP tool (same call shape as `delegated-same`). The materialized
-`external-services` skill body (`SKILL.native.<session-backend>.md`)
-lists the per-backend tool names. The daemon does not proxy in
-native mode; `/api/calendar/events` returns 410 and
-`/api/integrations/google_calendar/exec` returns 410 too.
-<!-- /mode:native:google_calendar -->
-<!-- mode:disabled:google_calendar -->
-Disabled → skip this section; there is no calendar to source events
-from.
-<!-- /mode:disabled:google_calendar -->
-
-### API
-
-Full `/api/travel-time` reference (point-to-point + for-event) is in
-the dedicated reference below.
-
-{{> ref:travel-time-api }}
-
-### Formatting — today.md
-
-```
-## Commute & Travel
-14:00 Team meeting @ WeWork Times Square — depart by 13:15 (transit, 40 min)
-18:30 Dinner @ Restaurant ABC — depart by 18:00 (transit, 25 min)
-```
-
-Only include events that have a `location` field. Omit the section
-when no events have locations today.
-
-Mode display names: transit → Transit, driving → Driving, walking →
-Walking, bicycling → Bicycle.
-
----
-
 ## Receipts
 
 The daemon's Gmail observer scans travel-booking emails for PDF /
@@ -170,8 +97,9 @@ user's **external Obsidian vault**.
 > **external** Obsidian vault (user's personal knowledge base reached
 > via `/api/obsidian/*`), **not** the primary management store
 > reached via `/api/context/*`. The agent's own state files
-> (`today.md`, `roadmap.md`, `projects/*`, `user/*`, `rules/*`,
-> `routines/*`, `agent/*`) live in the primary store and must
+> (`state/today.md`, `plans/roadmap.md`, `plans/projects/*`, `identity/*`,
+> `policies/*`, `policies/routines/*`, `journal/agent.md`) live in the
+> primary store and must
 > **never** receive receipt attachments. See the
 > `external-services` skill's obsidian reference for the external
 > vault's full CRUD surface.

package/agent-assets/skills/gmail-lifestyle/references/receipts-api.md

@@ -41,6 +41,7 @@ Response:
     {
       "id": 1,
       "providerMsgId": "18f...",
+      "accountId": "...",
       "attachmentId": "ANGj...",
       "filename": "receipt.pdf",
       "mimeType": "application/pdf",
@@ -55,6 +56,9 @@ Response:
 }
 ```
 
+`accountId` identifies the source mail account; `POST /receipts/:id/download`
+uses it to resolve the provider.
+
 ## GET /api/receipts/summary
 
 ```bash

package/agent-assets/skills/gmail-lifestyle/references/travel-bookings-api.md

@@ -68,8 +68,17 @@ curl -s "http://localhost:8321/api/travel-bookings/upcoming?limit=10"
 
 ## PATCH /api/travel-bookings/:id
 
+Accepts `{"status": "..."}` and/or `{"destination": "..."}`. Valid
+status values are `upcoming`, `completed`, `cancelled`.
+
 ```bash
+# Update status
 curl -s -X PATCH "http://localhost:8321/api/travel-bookings/1" \
   -H "Content-Type: application/json" \
   -d '{"status": "completed"}'
+
+# Correct a parsed destination
+curl -s -X PATCH "http://localhost:8321/api/travel-bookings/1" \
+  -H "Content-Type: application/json" \
+  -d '{"destination": "San Francisco"}'
 ```

package/agent-assets/skills/mail/SKILL.delegated.claude.md

@@ -90,7 +90,7 @@ Response shape on success:
 `outputSchema` is **required** — the subprocess emits exactly one JSON
 object as its final message and the daemon validates it. Schemas
 larger than 4 KB are rejected (`schema_too_large`). Caps default to
-`maxToolCalls=7`, `maxBudgetUsd=0.05`, `timeoutMs=60000` — bump them via
+`maxToolCalls=8`, `maxBudgetUsd=0.05`, `timeoutMs=60000` — bump them via
 the request body up to the hard caps (15 / 0.50 / 300000) when a task
 genuinely needs more.
 
@@ -101,8 +101,7 @@ should set `cacheable: true` so a repeat invocation within 60s returns
 ~5ms from the in-memory LRU. The cache key includes the integration
 state version, so flipping `deniedTools` or `delegatedBackend` purges
 entries automatically. Cache hits still write a `delegated_task.exec`
-audit row with `cost_usd=0` and `detail.cacheHit=true` — accounting
-stays correct.
+audit row with `cost_usd=0` and `detail.cacheHit=true`.
 
 Never set `cacheable: true` on:
 - destructive-confirm second calls (`allowDestructive: true`),
@@ -205,11 +204,12 @@ curl -s -X POST http://localhost:8321/api/integrations/gmail/exec \
 ## Default deny floor
 
 The setup wizard pre-populates `gmail.deniedTools` with the connector's
-destructive defaults (send / batch label mutate / etc.). `/exec`
-honors the deny list: a task that requires a denied tool surfaces as
-`tool_unavailable` (not 403) — the subprocess reports the gap and the
-daemon returns 502. Surface that to the user and ask whether to lift
-the deny before retrying.
+destructive defaults. `/exec` honors the deny list, distinguishing two
+cases: if **every** connector tool is denied → `403 denied_tool` (no
+surface to plan against, rejected up front); if usable tools remain but
+the specific tool a planned task needs is denied (or no tool fits) →
+`502 tool_unavailable`. In both cases, surface that to the user and ask
+whether to lift the relevant deny before retrying.
 
 ## Decision rules
 
@@ -236,6 +236,7 @@ Discriminator: `body.mode === "delegated"`.
 | 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
 | 409 | `mode_mismatch` | no | Gmail isn't delegated, OR your DM backend matches `delegatedBackend`. Re-read `integrations.md` and stop. |
 | 409 | `precondition` | no | Mode/backend was flipped while the call queued. Re-read `integrations.md` and re-plan. |
+| 403 | `denied_tool` | no | Every tool in the connector is denied — task mode has no surface to plan against. Surface to the user and ask whether to lift the deny. |
 | 429 | `task_quota_exhausted` | no | Daily cap reached; wait or surface. |
 | 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Consider a simpler schema. |
 | 502 | `tool_unavailable` | no | No connector tool fits the intent. Surface the gap to the user. |
@@ -262,23 +263,19 @@ curl -s -X POST http://localhost:8321/api/notify \
   -d '{"message": "Sent reply to alice@example.com (Re: Proposal)"}'
 ```
 
-Do not call `/api/notify` for routine reads / drafts / searches. The
-default posture is autonomous; the user's `deniedTools` is the
-hard-stop, on-demand retrospective covers awareness, and `/api/notify`
-is the small hammer for "speak up if I'm about to do something
-unusual."
+Do not call `/api/notify` for routine reads / drafts / searches.
 
 ## Cost / retrospective
 
 Every `/exec` writes one row to `agent_actions` with
-`action_type='delegated_task.exec'` (token + USD breakdown, parent
-`event_id` / `processKey` attached automatically via session env
-vars). When the user asks what you did:
+`action_type='delegated_task.exec'` (token + USD breakdown). When the
+user asks what you did:
 
 ```bash
 curl -s "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since=2026-04-25T00:00:00Z&limit=50"
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag, and
-timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.delegated.codex.md

@@ -85,7 +85,7 @@ Response shape on success:
 `outputSchema` is **required** — the subprocess emits exactly one JSON
 object as its final message and the daemon validates it. Schemas
 larger than 4 KB are rejected (`schema_too_large`). Caps default to
-`maxToolCalls=7`, `maxBudgetUsd=0.05`, `timeoutMs=60000` — bump them
+`maxToolCalls=8`, `maxBudgetUsd=0.05`, `timeoutMs=60000` — bump them
 via the request body up to the hard caps (15 / 0.50 / 300000) when a
 task genuinely needs more.
 
@@ -193,9 +193,12 @@ curl -sS -X POST http://localhost:8321/api/integrations/gmail/exec \
 ## Default deny floor
 
 The setup wizard pre-populates `gmail.deniedTools` with the connector's
-destructive defaults. `/exec` honors the deny list: a task that
-requires a denied tool surfaces as `tool_unavailable` — surface that
-to the user and ask whether to lift the deny before retrying.
+destructive defaults. `/exec` honors the deny list, distinguishing two
+cases: if **every** connector tool is denied → `403 denied_tool` (no
+surface to plan against, rejected up front); if usable tools remain but
+the specific tool a planned task needs is denied (or no tool fits) →
+`502 tool_unavailable`. In both cases, surface that to the user and ask
+whether to lift the relevant deny before retrying.
 
 ## Decision rules
 
@@ -218,6 +221,7 @@ Discriminator: `body.mode === "delegated"`.
 | 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
 | 409 | `mode_mismatch` | no | Gmail isn't delegated, OR your DM backend matches `delegatedBackend`. Re-read `integrations.md` and stop. |
 | 409 | `precondition` | no | Mode/backend was flipped during queue wait. Re-read `integrations.md` and re-plan. |
+| 403 | `denied_tool` | no | Every tool in the connector is denied — no surface to plan against. Surface to the user and ask whether to lift the deny. |
 | 429 | `task_quota_exhausted` | no | Daily cap reached; wait or surface. |
 | 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Consider a simpler schema. |
 | 502 | `tool_unavailable` | no | No connector tool fits. Surface the gap. |
@@ -257,5 +261,6 @@ curl -sS "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag,
-and timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.delegated.gemini.md

@@ -83,7 +83,7 @@ Response shape on success:
 `outputSchema` is **required** — the subprocess emits exactly one JSON
 object as its final message and the daemon validates it. Schemas
 larger than 4 KB are rejected (`schema_too_large`). Caps default to
-`maxToolCalls=7`, `maxBudgetUsd=0.05`, `timeoutMs=60000` — bump them
+`maxToolCalls=8`, `maxBudgetUsd=0.05`, `timeoutMs=60000` — bump them
 via the request body up to the hard caps (15 / 0.50 / 300000) when a
 task genuinely needs more.
 
@@ -187,9 +187,12 @@ curl -sS -X POST http://localhost:8321/api/integrations/gmail/exec \
 ## Default deny floor
 
 The setup wizard pre-populates `gmail.deniedTools` with the connector's
-destructive defaults. `/exec` honors the deny list: a task that
-requires a denied tool surfaces as `tool_unavailable` — surface that
-to the user and ask whether to lift the deny before retrying.
+destructive defaults. `/exec` honors the deny list, distinguishing two
+cases: if **every** connector tool is denied → `403 denied_tool` (no
+surface to plan against, rejected up front); if usable tools remain but
+the specific tool a planned task needs is denied (or no tool fits) →
+`502 tool_unavailable`. In both cases, surface that to the user and ask
+whether to lift the relevant deny before retrying.
 
 ## Decision rules
 
@@ -212,6 +215,7 @@ Discriminator: `body.mode === "delegated"`.
 | 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
 | 409 | `mode_mismatch` | no | Gmail isn't delegated, OR your DM backend matches `delegatedBackend`. Re-read `integrations.md` and stop. |
 | 409 | `precondition` | no | Mode/backend was flipped during queue wait. Re-read `integrations.md` and re-plan. |
+| 403 | `denied_tool` | no | Every tool in the connector is denied — no surface to plan against. Surface to the user and ask whether to lift the deny. |
 | 429 | `task_quota_exhausted` | no | Daily cap reached; wait or surface. |
 | 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Consider a simpler schema. |
 | 502 | `tool_unavailable` | no | No connector tool fits. Surface the gap. |
@@ -251,5 +255,6 @@ curl -sS "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag,
-and timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.md

@@ -99,16 +99,10 @@ includes dormant and unhealthy rows that every operation will reject.
 ### Send vs draft
 - **Prefer drafts.** Create via `POST /mail/:acct/drafts`. The user sends
   from the provider's web UI.
-- Direct send (`POST /mail/:acct/messages/send`) succeeds autonomously —
-  the daemon does not DM the owner before sending. (The user's
-  `deniedTools` list applies to **delegated-mode connector tools** —
-  e.g. Codex's `send_email` — and is enforced at the
-  `/api/integrations/:key/exec` task-mode chokepoint via the per-task
-  allowed-tools envelope. In direct mode, the `/api/mail/*` route
-  handler has no equivalent deny check today, so a send call is what
-  it appears to be: a send.) When you judge the user would want to
-  know about a send immediately (e.g. a reply to a stranger), call
-  `POST /api/notify` yourself.
+- Direct send (`POST /mail/:acct/messages/send`) is autonomous — no owner
+  DM, no deny gate (see api.md for the `deniedTools`-scope nuance). When
+  you judge the user would want to know about a send immediately (e.g. a
+  reply to a stranger), call `POST /api/notify` yourself.
 - Never include `bcc` unless the user explicitly asks for it.
 
 ### Replies — RFC-2822 headers are the source of truth
@@ -118,7 +112,9 @@ all four kinds.
 
 1. Fetch the thread metadata: `GET /api/mail/:acct/threads/:threadId?body=none`
    (returns `messages[]` in chronological order without raw HTML bodies).
-2. From the last message, pull `rfc822MsgId` and `references`.
+2. From the last message, pull `rfc822MsgId` (thread message objects carry
+   no `references` field — you SUPPLY `references` in the reply block below,
+   you do not read it off the message).
 3. Build the `reply` block:
    ```json
    {
@@ -198,13 +194,9 @@ curl -s "http://localhost:8321/api/mail/ACCT/messages/MSG/body?format=raw&chunk=
   deny list. The daemon does not DM the owner before the call. Single
   ops only; if you're about to trash 3+ messages at once, stop and ask
   the user — the agent's own judgment is the gate, not the daemon.
-- **Delegated mode**: this skill body is loaded only when `gmail.mode ===
-  "direct"`. When Gmail is delegated, the materializer picks
-  `SKILL.delegated.<sessionBackend>.md` (cross-backend) or skips the
-  skill entirely (same-backend, native MCP). If you somehow reach
-  `/api/mail/*` from this body while Gmail is delegated, the route
-  returns `410 integration_delegated` — re-read `integrations.md` and
-  use `POST /api/integrations/gmail/exec` (task mode) instead.
+- **Delegated / native mode**: see §0 for routing. A `/api/mail/*` call
+  that hits a delegated/native gate returns `410` (`integration_delegated`
+  / `integration_native`) — re-read `integrations.md` and dispatch per §0.
 
 ## 3. Provider capability matrix
 

package/agent-assets/skills/mail/SKILL.native.claude.md

@@ -102,7 +102,7 @@ When you fetch Gmail data during a routine (e.g. `routine.hourly_check`'s
 Step 0a), POST each materialised thread to the daemon's
 `/api/observations` endpoint so subsequent runs can dedup. The daemon
 computes `contentHash` server-side via
-`@personal-agent/shared/observations-hash.ts` — pass the raw `payload`
+`@aitne/shared/observations-hash` — pass the raw `payload`
 verbatim; do **not** compute the hash yourself (LLM-side hashes drift
 between runs and from the delegated-sync-worker's hash, breaking
 `delegated → native` flip dedup).
@@ -159,9 +159,10 @@ window (§11.3.1) with HTTP 409; on 409 stop and re-read
 
 ## Cost / audit
 
-Every native MCP call lands one `agent_actions` row of type `mcp_call`
-with `provider="claude"`, the tool name, `inputTokens` /
-`outputTokens`, and the parent `event_id` / `processKey` attached. The
-cost dashboard's `nativeAttribution` column (§14.4) joins those rows
-to the integration registry by `toolNamespace` prefix so the operator
-can see the spend shift after a flip.
+Every native MCP call is logged to the `mcp_tool_calls` table
+(`server_id`, `tool_name`, `event_type`, `session_id`, `ok` / `error`,
+`called_at`, `duration_ms`) — NOT to `agent_actions`, and with no
+per-call token or provider columns. The operator's cost view attributes
+native spend by server / namespace from those rows so it can see the
+shift after a flip. You do not query this yourself — just call the
+connector and POST observations.

package/agent-assets/skills/mail/SKILL.native.codex.md

@@ -112,7 +112,7 @@ and RFC-2822 reply chain shape are unchanged for non-Gmail accounts.
 
 POST each materialised Gmail thread fetched in a routine to
 `/api/observations`. The daemon computes `contentHash` server-side via
-`@personal-agent/shared/observations-hash.ts`; pass `payload` verbatim.
+`@aitne/shared/observations-hash`; pass `payload` verbatim.
 
 **Batch when you have more than one thread.** Use
 `POST /api/observations/batch` with up to 200 items in a single

package/agent-assets/skills/mail/SKILL.native.gemini.md

@@ -119,7 +119,7 @@ for non-Gmail accounts.
 
 POST each materialised Gmail message fetched in a routine to
 `/api/observations`. The daemon computes `contentHash` server-side via
-the shared util in `@personal-agent/shared/observations-hash.ts`; pass
+the shared util in `@aitne/shared/observations-hash`; pass
 `payload` verbatim.
 
 **Batch when you have more than one message.** Use