@aitne-sh/aitne 0.1.9 → 0.1.10

package/agent-assets/skills/external-services/SKILL.delegated.codex.md

@@ -122,7 +122,7 @@ curl -sS -X POST http://localhost:8321/api/integrations/google_calendar/exec \
   }'
 ```
 
-`outputSchema` is **required** (4 KB cap). Defaults: `maxToolCalls=7`,
+`outputSchema` is **required** (4 KB cap). Defaults: `maxToolCalls=8`,
 `maxBudgetUsd=0.05`, `timeoutMs=60000`. Bump up to 15 / 0.50 / 300000
 for genuinely larger intents.
 
@@ -157,31 +157,7 @@ destructive-confirm second call.
   know about, call `POST /api/notify` with a one-line summary. The
   daemon does NOT auto-notify — it's an explicit choice.
 
-### Error envelope
-
-`/exec` extends the direct-mode envelope with delegated-mode fields.
-Discriminator: `body.mode === "delegated"`.
-
-| HTTP | `error` | retry? | What to do |
-|---|---|---|---|
-| 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
-| 409 | `mode_mismatch` | no | Calendar isn't delegated, OR your DM backend matches `delegatedBackend`. Re-read `integrations.md`. |
-| 409 | `precondition` | no | Mode/backend flipped during queue wait. Re-check state. |
-| 429 | `task_quota_exhausted` | no | Daily cap reached. Wait or surface. |
-| 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Simplify schema. |
-| 502 | `tool_unavailable` | no | No connector tool fits. Surface the gap. |
-| 502 | `tool_failed` | maybe | Connector tool returned an error. Surface verbatim. |
-| 502 | `auth_error` | no | Connector signed out. Re-authenticate. |
-| 502 | `policy_violation` | no | Subprocess attempted an out-of-allowlist tool (anti-injection). |
-| 502 | `loop_aborted` | no | `maxToolCalls` exceeded. Bump or simplify. |
-| 502 | `budget_exhausted` | no | `maxBudgetUsd` exceeded. Caller can raise the cap. |
-| 502 | `post_write_format_failure` | no | Write succeeded; formatting failed. Surface with partial trace. |
-| 503 | `delegated_proxy_busy` | yes | Queue saturated. Backoff and retry once. |
-| 503 | `task_mode_disabled` | no | Operator killed it. Stop. |
-| 504 | `timeout` | yes (1×) | Wall-clock fired. Retry once. |
-| 500 | `subprocess_crashed` | no | Daemon-side defect. Surface and stop. |
-
-Always preserve `body.message` verbatim when reporting to the user.
+{{> ref:exec-errors }}
 <!-- /service:calendar -->
 
 ---
@@ -266,72 +242,10 @@ existing rows (dedup). → Full guide: load the `agent-create` or `schedule` ski
 
 ---
 
-## One-Shot Scheduling
+## Scheduling & Skills CRUD
 
-Schedule a future DM or agent task. Use `<current_time>` to resolve relative times into absolute ISO 8601 with offset.
-
-### DM vs Agent Task
-
-| Criterion | `/api/schedule/dm` (free) | `/api/schedule` (~$0.03) |
-|---|---|---|
-| Message text knowable now? | Yes | No — needs lookup/decision at execution |
-| Needs API data at execution? | No | Yes |
-| Multi-step action? | No | Yes |
-| Conditional on state that may change? | No | Yes |
-
-**Default to DM** — every agent wake-up costs money and context.
-
-### Context-loss warning
-
-> The wake-up agent has NO memory of why it was scheduled — the `description` field is its only context.
-
-Include: **What** (verb + object), **Why** (trigger/reason), **Who/What** (names, IDs, URLs), **Expected output** (what success looks like).
-
-Bad: `"Meeting prep"` — which meeting? when? what to prepare? The wake-up agent will skip ambiguous descriptions.
-
-### POST /api/schedule/dm — Pre-composed DM
-```bash
-curl -s -X POST http://localhost:8321/api/schedule/dm \
-  -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "message": "Reminder: Design review in 30 min.", "platform": "slack"}'
-```
-
-### POST /api/schedule — Agent task
-```bash
-curl -s -X POST http://localhost:8321/api/schedule \
-  -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "taskType": "wake", "prompt": "Check PR #42 status and notify user.", "description": "PR #42 status check", "tier": "medium", "taskContext": {"scheduledBy": "dm_conversation"}}'
-```
-Fields: `time` (required), `taskType` (`wake`), `prompt` (required — the agent instruction, ≤8000 chars), `description` (optional label, ≤200 chars), `tier` (`lite`/`medium`/`high`) **or** `model` (registered id like `claude-opus-4-8`, legacy alias `sonnet`/`opus`, or composite `<backendId>/<modelId>`) — mutually exclusive, `taskContext` (optional metadata). See the `schedule` skill body for the full surface and `/api/schedule/options` for the live model list.
-
-### Manage pending items
-```bash
-curl -s "http://localhost:8321/api/schedule?status=pending"                         # list
-curl -s -X PATCH http://localhost:8321/api/schedule/42 \
-  -H 'Content-Type: application/json' -d '{"time": "2026-04-06T17:00:00-04:00"}'   # edit
-curl -s -X DELETE http://localhost:8321/api/schedule/42                              # cancel
-```
-Editable: `time`, `description`, `message` (dm only), `tier` (or `model`, mutually exclusive — pass `null` to clear), `taskContext`. Only `pending` items.
-
-### Time discipline
-- Absolute ISO 8601 with offset required — no relative times.
-- Do not schedule during quiet hours (default 22:00–08:00, configurable) unless critical.
-- Maximum 5 wake-ups per execution.
-
----
-
-## Skills Management
-
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
-
-```bash
-curl -s http://localhost:8321/api/skills                                            # list all
-curl -s http://localhost:8321/api/skills/todo-digest                                # read one
-curl -s -X POST http://localhost:8321/api/skills \
-  -H 'Content-Type: application/json' \
-  -d '{"name": "todo-digest", "description": "Summarize today.md", "content": "# TODO Digest\n...", "allowedTools": ["Bash(curl *)", "Read"]}'
-curl -s -X PUT http://localhost:8321/api/skills/todo-digest \
-  -H 'Content-Type: application/json' -d '{"description": "New description"}'      # update
-curl -s -X DELETE http://localhost:8321/api/skills/todo-digest                      # delete
-```
-Always `GET /api/skills` before creating (check name collisions). **Omit frontmatter** from `content` — the API injects it.
+One-shot DMs / agent wake-ups (`/api/schedule`, `/api/schedule/dm`) and
+user-authored Skills CRUD (`/api/skills`) work identically to direct
+mode — they are never proxied. Load the `schedule` skill for scheduling
+and the `agent-create` skill for recurring work; this variant does not
+mirror those surfaces.

package/agent-assets/skills/external-services/SKILL.delegated.gemini.md

@@ -121,7 +121,7 @@ curl -sS -X POST http://localhost:8321/api/integrations/google_calendar/exec \
   }'
 ```
 
-`outputSchema` is **required** (4 KB cap). Defaults: `maxToolCalls=7`,
+`outputSchema` is **required** (4 KB cap). Defaults: `maxToolCalls=8`,
 `maxBudgetUsd=0.05`, `timeoutMs=60000`.
 
 ### Destructive-confirm two-step (`allowDestructive`)
@@ -155,31 +155,7 @@ destructive-confirm second call.
   know about, call `POST /api/notify` with a one-line summary. The
   daemon does NOT auto-notify — it's an explicit choice.
 
-### Error envelope
-
-`/exec` extends the direct-mode envelope with delegated-mode fields.
-Discriminator: `body.mode === "delegated"`.
-
-| HTTP | `error` | retry? | What to do |
-|---|---|---|---|
-| 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
-| 409 | `mode_mismatch` | no | Calendar isn't delegated. Re-read `integrations.md`. |
-| 409 | `precondition` | no | Mode/backend flipped during queue wait. Re-check state. |
-| 429 | `task_quota_exhausted` | no | Daily cap reached. Wait or surface. |
-| 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Simplify schema. |
-| 502 | `tool_unavailable` | no | No connector tool fits. Surface the gap. |
-| 502 | `tool_failed` | maybe | Connector tool returned an error. Surface verbatim. |
-| 502 | `auth_error` | no | Connector signed out. Re-authenticate. |
-| 502 | `policy_violation` | no | Subprocess attempted an out-of-allowlist tool (anti-injection). |
-| 502 | `loop_aborted` | no | `maxToolCalls` exceeded. Bump or simplify. |
-| 502 | `budget_exhausted` | no | `maxBudgetUsd` exceeded. Caller can raise the cap. |
-| 502 | `post_write_format_failure` | no | Write succeeded; formatting failed. Surface with partial trace. |
-| 503 | `delegated_proxy_busy` | yes | Queue saturated. Backoff and retry once. |
-| 503 | `task_mode_disabled` | no | Operator killed it. Stop. |
-| 504 | `timeout` | yes (1×) | Wall-clock fired. Retry once. |
-| 500 | `subprocess_crashed` | no | Daemon-side defect. Surface and stop. |
-
-Always preserve `body.message` verbatim when reporting to the user.
+{{> ref:exec-errors }}
 <!-- /service:calendar -->
 
 ---
@@ -264,72 +240,10 @@ existing rows (dedup). → Full guide: load the `agent-create` or `schedule` ski
 
 ---
 
-## One-Shot Scheduling
+## Scheduling & Skills CRUD
 
-Schedule a future DM or agent task. Use `<current_time>` to resolve relative times into absolute ISO 8601 with offset.
-
-### DM vs Agent Task
-
-| Criterion | `/api/schedule/dm` (free) | `/api/schedule` (~$0.03) |
-|---|---|---|
-| Message text knowable now? | Yes | No — needs lookup/decision at execution |
-| Needs API data at execution? | No | Yes |
-| Multi-step action? | No | Yes |
-| Conditional on state that may change? | No | Yes |
-
-**Default to DM** — every agent wake-up costs money and context.
-
-### Context-loss warning
-
-> The wake-up agent has NO memory of why it was scheduled — the `description` field is its only context.
-
-Include: **What** (verb + object), **Why** (trigger/reason), **Who/What** (names, IDs, URLs), **Expected output** (what success looks like).
-
-Bad: `"Meeting prep"` — which meeting? when? what to prepare? The wake-up agent will skip ambiguous descriptions.
-
-### POST /api/schedule/dm — Pre-composed DM
-```bash
-curl -s -X POST http://localhost:8321/api/schedule/dm \
-  -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "message": "Reminder: Design review in 30 min.", "platform": "slack"}'
-```
-
-### POST /api/schedule — Agent task
-```bash
-curl -s -X POST http://localhost:8321/api/schedule \
-  -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "taskType": "wake", "prompt": "Check PR #42 status and notify user.", "description": "PR #42 status check", "tier": "medium", "taskContext": {"scheduledBy": "dm_conversation"}}'
-```
-Fields: `time` (required), `taskType` (`wake`), `prompt` (required — the agent instruction, ≤8000 chars), `description` (optional label, ≤200 chars), `tier` (`lite`/`medium`/`high`) **or** `model` (registered id like `claude-opus-4-8`, legacy alias `sonnet`/`opus`, or composite `<backendId>/<modelId>`) — mutually exclusive, `taskContext` (optional metadata). See the `schedule` skill body for the full surface and `/api/schedule/options` for the live model list.
-
-### Manage pending items
-```bash
-curl -s "http://localhost:8321/api/schedule?status=pending"                         # list
-curl -s -X PATCH http://localhost:8321/api/schedule/42 \
-  -H 'Content-Type: application/json' -d '{"time": "2026-04-06T17:00:00-04:00"}'   # edit
-curl -s -X DELETE http://localhost:8321/api/schedule/42                              # cancel
-```
-Editable: `time`, `description`, `message` (dm only), `tier` (or `model`, mutually exclusive — pass `null` to clear), `taskContext`. Only `pending` items.
-
-### Time discipline
-- Absolute ISO 8601 with offset required — no relative times.
-- Do not schedule during quiet hours (default 22:00–08:00, configurable) unless critical.
-- Maximum 5 wake-ups per execution.
-
----
-
-## Skills Management
-
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
-
-```bash
-curl -s http://localhost:8321/api/skills                                            # list all
-curl -s http://localhost:8321/api/skills/todo-digest                                # read one
-curl -s -X POST http://localhost:8321/api/skills \
-  -H 'Content-Type: application/json' \
-  -d '{"name": "todo-digest", "description": "Summarize today.md", "content": "# TODO Digest\n...", "allowedTools": ["Bash(curl *)", "Read"]}'
-curl -s -X PUT http://localhost:8321/api/skills/todo-digest \
-  -H 'Content-Type: application/json' -d '{"description": "New description"}'      # update
-curl -s -X DELETE http://localhost:8321/api/skills/todo-digest                      # delete
-```
-Always `GET /api/skills` before creating (check name collisions). **Omit frontmatter** from `content` — the API injects it.
+One-shot DMs / agent wake-ups (`/api/schedule`, `/api/schedule/dm`) and
+user-authored Skills CRUD (`/api/skills`) work identically to direct
+mode — they are never proxied. Load the `schedule` skill for scheduling
+and the `agent-create` skill for recurring work; this variant does not
+mirror those surfaces.

package/agent-assets/skills/external-services/SKILL.native.claude.md

@@ -241,7 +241,7 @@ session's integration state.
 When the hourly_check native flow's Step 0b fetches imminent-window
 events, POST each materialised event to `/api/observations` so
 subsequent runs can dedup. The daemon computes `contentHash`
-server-side via `@personal-agent/shared/observations-hash.ts` — pass
+server-side via `@aitne/shared/observations-hash` — pass
 the raw `payload`.
 
 **Batch when you have more than one event.** Use
@@ -284,7 +284,7 @@ schedule surface (scheduling is daemon-internal, not an integration).
 
 ## Skills Management — direct, unchanged
 
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`.
+User-authored skills: `<contextDir>/policies/skills/{slug}/SKILL.md`.
 Built-in skills are read-only (403). Native-mode gating does not apply.
 
 ```bash

package/agent-assets/skills/external-services/references/exec-errors.md

@@ -0,0 +1,32 @@
+---
+kind: reference
+name: exec-errors
+description: Delegated `/exec` error envelope — HTTP status, `error` code, retry guidance. Shared across the cross-backend SKILL.delegated.*.md Calendar variants.
+---
+
+### Error envelope
+
+`/exec` extends the direct-mode envelope with delegated-mode fields.
+Discriminator: `body.mode === "delegated"`.
+
+| HTTP | `error` | retry? | What to do |
+|---|---|---|---|
+| 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
+| 409 | `mode_mismatch` | no | Calendar isn't delegated, OR your DM backend matches `delegatedBackend`. Re-read `integrations.md` and stop. |
+| 409 | `precondition` | no | Mode/backend flipped during the queue wait. Re-check state and re-plan. |
+| 429 | `task_quota_exhausted` | no | Daily cap reached; wait or surface. |
+| 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Consider a simpler schema. |
+| 502 | `tool_unavailable` | no | No connector tool fits the intent. Surface the gap. |
+| 502 | `tool_failed` | maybe | Connector tool returned an error. Surface `body.message` verbatim; retry only if clearly transient. |
+| 502 | `auth_error` | no | Connector signed out. Tell the user to re-authenticate it. |
+| 502 | `policy_violation` | no | Subprocess attempted a tool outside the per-task allowlist (anti-injection). |
+| 502 | `loop_aborted` | no | `maxToolCalls` exceeded. Bump the cap or simplify. |
+| 502 | `budget_exhausted` | no | `maxBudgetUsd` exceeded. Caller can raise the cap. |
+| 502 | `post_write_format_failure` | no | Write succeeded; formatting failed. Side effect is real — surface with the partial trace. |
+| 503 | `delegated_proxy_busy` | yes | Daemon queue saturated. Backoff a few seconds, try once. |
+| 503 | `task_mode_disabled` | no | Operator turned the kill switch off. Stop. |
+| 504 | `timeout` | yes (1×) | Wall-clock fired. Retry once if intent was simple. |
+| 500 | `subprocess_crashed` | no | Unhandled exception inside the subprocess. Surface and stop. |
+
+Always preserve `body.message` verbatim when reporting to the user — it
+carries the connector's own language.

package/agent-assets/skills/external-services/references/skills-crud.md

@@ -1,12 +1,12 @@
 ---
 kind: reference
 name: skills-crud
-description: Dashboard-shaped CRUD for user-authored skills under ~/.personal-agent/skills/. Built-in skills are read-only (403).
+description: Dashboard-shaped CRUD for user-authored skills under <contextDir>/policies/skills/. Built-in skills are read-only (403).
 ---
 
 ## Skills Management
 
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
+User-authored skills: `<contextDir>/policies/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
 
 ```bash
 curl -s http://localhost:8321/api/skills                                            # list all
@@ -22,6 +22,6 @@ Always `GET /api/skills` before creating (check name collisions). **Omit frontma
 
 The description is the **only** routing signal the SDK uses to pick a
 skill — keep it under 280 chars and make the trigger surface
-distinct from every other skill in the manifest. Slug grammar is
-strict: `[a-z0-9][a-z0-9-]*[a-z0-9]` or `[a-z0-9]` (single char),
-1-64 chars total. PUT rejects collisions with built-in slugs.
+distinct from every other skill in the manifest. Slug grammar:
+`^[a-z0-9][a-z0-9-]*$` (1-64 chars; a trailing hyphen is allowed,
+no alphanumeric terminal required). PUT rejects collisions with built-in slugs.

package/agent-assets/skills/gmail-lifestyle/SKILL.md

@@ -97,8 +97,9 @@ user's **external Obsidian vault**.
 > **external** Obsidian vault (user's personal knowledge base reached
 > via `/api/obsidian/*`), **not** the primary management store
 > reached via `/api/context/*`. The agent's own state files
-> (`state/today.md`, `plans/roadmap.md`, `projects/*`, `user/*`, `rules/*`,
-> `routines/*`, `agent/*`) live in the primary store and must
+> (`state/today.md`, `plans/roadmap.md`, `plans/projects/*`, `identity/*`,
+> `policies/*`, `policies/routines/*`, `journal/agent.md`) live in the
+> primary store and must
 > **never** receive receipt attachments. See the
 > `external-services` skill's obsidian reference for the external
 > vault's full CRUD surface.

package/agent-assets/skills/gmail-lifestyle/references/receipts-api.md

@@ -41,6 +41,7 @@ Response:
     {
       "id": 1,
       "providerMsgId": "18f...",
+      "accountId": "...",
       "attachmentId": "ANGj...",
       "filename": "receipt.pdf",
       "mimeType": "application/pdf",
@@ -55,6 +56,9 @@ Response:
 }
 ```
 
+`accountId` identifies the source mail account; `POST /receipts/:id/download`
+uses it to resolve the provider.
+
 ## GET /api/receipts/summary
 
 ```bash

package/agent-assets/skills/gmail-lifestyle/references/travel-bookings-api.md

@@ -68,8 +68,17 @@ curl -s "http://localhost:8321/api/travel-bookings/upcoming?limit=10"
 
 ## PATCH /api/travel-bookings/:id
 
+Accepts `{"status": "..."}` and/or `{"destination": "..."}`. Valid
+status values are `upcoming`, `completed`, `cancelled`.
+
 ```bash
+# Update status
 curl -s -X PATCH "http://localhost:8321/api/travel-bookings/1" \
   -H "Content-Type: application/json" \
   -d '{"status": "completed"}'
+
+# Correct a parsed destination
+curl -s -X PATCH "http://localhost:8321/api/travel-bookings/1" \
+  -H "Content-Type: application/json" \
+  -d '{"destination": "San Francisco"}'
 ```

package/agent-assets/skills/mail/SKILL.delegated.claude.md

@@ -101,8 +101,7 @@ should set `cacheable: true` so a repeat invocation within 60s returns
 ~5ms from the in-memory LRU. The cache key includes the integration
 state version, so flipping `deniedTools` or `delegatedBackend` purges
 entries automatically. Cache hits still write a `delegated_task.exec`
-audit row with `cost_usd=0` and `detail.cacheHit=true` — accounting
-stays correct.
+audit row with `cost_usd=0` and `detail.cacheHit=true`.
 
 Never set `cacheable: true` on:
 - destructive-confirm second calls (`allowDestructive: true`),
@@ -205,19 +204,12 @@ curl -s -X POST http://localhost:8321/api/integrations/gmail/exec \
 ## Default deny floor
 
 The setup wizard pre-populates `gmail.deniedTools` with the connector's
-destructive defaults (send / batch label mutate / etc.). `/exec`
-honors the deny list, and the response distinguishes two cases:
-
-- **Every connector tool is denied** → `403 denied_tool`. There is no
-  surface to plan against, so the daemon rejects the task up front
-  without spawning the subprocess.
-- **The connector still has usable tools but the specific tool a planned
-  task needs is denied (or no tool fits)** → `502 tool_unavailable`. The
-  subprocess plans, finds no permitted tool for the intent, and reports
-  the gap.
-
-In both cases, surface that to the user and ask whether to lift the
-relevant deny before retrying.
+destructive defaults. `/exec` honors the deny list, distinguishing two
+cases: if **every** connector tool is denied → `403 denied_tool` (no
+surface to plan against, rejected up front); if usable tools remain but
+the specific tool a planned task needs is denied (or no tool fits) →
+`502 tool_unavailable`. In both cases, surface that to the user and ask
+whether to lift the relevant deny before retrying.
 
 ## Decision rules
 
@@ -271,23 +263,19 @@ curl -s -X POST http://localhost:8321/api/notify \
   -d '{"message": "Sent reply to alice@example.com (Re: Proposal)"}'
 ```
 
-Do not call `/api/notify` for routine reads / drafts / searches. The
-default posture is autonomous; the user's `deniedTools` is the
-hard-stop, on-demand retrospective covers awareness, and `/api/notify`
-is the small hammer for "speak up if I'm about to do something
-unusual."
+Do not call `/api/notify` for routine reads / drafts / searches.
 
 ## Cost / retrospective
 
 Every `/exec` writes one row to `agent_actions` with
-`action_type='delegated_task.exec'` (token + USD breakdown, parent
-`event_id` / `processKey` attached automatically via session env
-vars). When the user asks what you did:
+`action_type='delegated_task.exec'` (token + USD breakdown). When the
+user asks what you did:
 
 ```bash
 curl -s "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since=2026-04-25T00:00:00Z&limit=50"
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag, and
-timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.delegated.codex.md

@@ -261,5 +261,6 @@ curl -sS "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag,
-and timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.delegated.gemini.md

@@ -255,5 +255,6 @@ curl -sS "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag,
-and timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.md

@@ -99,16 +99,10 @@ includes dormant and unhealthy rows that every operation will reject.
 ### Send vs draft
 - **Prefer drafts.** Create via `POST /mail/:acct/drafts`. The user sends
   from the provider's web UI.
-- Direct send (`POST /mail/:acct/messages/send`) succeeds autonomously —
-  the daemon does not DM the owner before sending. (The user's
-  `deniedTools` list applies to **delegated-mode connector tools** —
-  e.g. Codex's `send_email` — and is enforced at the
-  `/api/integrations/:key/exec` task-mode chokepoint via the per-task
-  allowed-tools envelope. In direct mode, the `/api/mail/*` route
-  handler has no equivalent deny check today, so a send call is what
-  it appears to be: a send.) When you judge the user would want to
-  know about a send immediately (e.g. a reply to a stranger), call
-  `POST /api/notify` yourself.
+- Direct send (`POST /mail/:acct/messages/send`) is autonomous — no owner
+  DM, no deny gate (see api.md for the `deniedTools`-scope nuance). When
+  you judge the user would want to know about a send immediately (e.g. a
+  reply to a stranger), call `POST /api/notify` yourself.
 - Never include `bcc` unless the user explicitly asks for it.
 
 ### Replies — RFC-2822 headers are the source of truth
@@ -118,7 +112,9 @@ all four kinds.
 
 1. Fetch the thread metadata: `GET /api/mail/:acct/threads/:threadId?body=none`
    (returns `messages[]` in chronological order without raw HTML bodies).
-2. From the last message, pull `rfc822MsgId` and `references`.
+2. From the last message, pull `rfc822MsgId` (thread message objects carry
+   no `references` field — you SUPPLY `references` in the reply block below,
+   you do not read it off the message).
 3. Build the `reply` block:
    ```json
    {
@@ -198,13 +194,9 @@ curl -s "http://localhost:8321/api/mail/ACCT/messages/MSG/body?format=raw&chunk=
   deny list. The daemon does not DM the owner before the call. Single
   ops only; if you're about to trash 3+ messages at once, stop and ask
   the user — the agent's own judgment is the gate, not the daemon.
-- **Delegated mode**: this skill body is loaded only when `gmail.mode ===
-  "direct"`. When Gmail is delegated, the materializer picks
-  `SKILL.delegated.<sessionBackend>.md` (cross-backend) or skips the
-  skill entirely (same-backend, native MCP). If you somehow reach
-  `/api/mail/*` from this body while Gmail is delegated, the route
-  returns `410 integration_delegated` — re-read `integrations.md` and
-  use `POST /api/integrations/gmail/exec` (task mode) instead.
+- **Delegated / native mode**: see §0 for routing. A `/api/mail/*` call
+  that hits a delegated/native gate returns `410` (`integration_delegated`
+  / `integration_native`) — re-read `integrations.md` and dispatch per §0.
 
 ## 3. Provider capability matrix
 

package/agent-assets/skills/mail/SKILL.native.claude.md

@@ -102,7 +102,7 @@ When you fetch Gmail data during a routine (e.g. `routine.hourly_check`'s
 Step 0a), POST each materialised thread to the daemon's
 `/api/observations` endpoint so subsequent runs can dedup. The daemon
 computes `contentHash` server-side via
-`@personal-agent/shared/observations-hash.ts` — pass the raw `payload`
+`@aitne/shared/observations-hash` — pass the raw `payload`
 verbatim; do **not** compute the hash yourself (LLM-side hashes drift
 between runs and from the delegated-sync-worker's hash, breaking
 `delegated → native` flip dedup).
@@ -159,9 +159,10 @@ window (§11.3.1) with HTTP 409; on 409 stop and re-read
 
 ## Cost / audit
 
-Every native MCP call lands one `agent_actions` row of type `mcp_call`
-with `provider="claude"`, the tool name, `inputTokens` /
-`outputTokens`, and the parent `event_id` / `processKey` attached. The
-cost dashboard's `nativeAttribution` column (§14.4) joins those rows
-to the integration registry by `toolNamespace` prefix so the operator
-can see the spend shift after a flip.
+Every native MCP call is logged to the `mcp_tool_calls` table
+(`server_id`, `tool_name`, `event_type`, `session_id`, `ok` / `error`,
+`called_at`, `duration_ms`) — NOT to `agent_actions`, and with no
+per-call token or provider columns. The operator's cost view attributes
+native spend by server / namespace from those rows so it can see the
+shift after a flip. You do not query this yourself — just call the
+connector and POST observations.

package/agent-assets/skills/mail/SKILL.native.codex.md

@@ -112,7 +112,7 @@ and RFC-2822 reply chain shape are unchanged for non-Gmail accounts.
 
 POST each materialised Gmail thread fetched in a routine to
 `/api/observations`. The daemon computes `contentHash` server-side via
-`@personal-agent/shared/observations-hash.ts`; pass `payload` verbatim.
+`@aitne/shared/observations-hash`; pass `payload` verbatim.
 
 **Batch when you have more than one thread.** Use
 `POST /api/observations/batch` with up to 200 items in a single

package/agent-assets/skills/mail/SKILL.native.gemini.md

@@ -119,7 +119,7 @@ for non-Gmail accounts.
 
 POST each materialised Gmail message fetched in a routine to
 `/api/observations`. The daemon computes `contentHash` server-side via
-the shared util in `@personal-agent/shared/observations-hash.ts`; pass
+the shared util in `@aitne/shared/observations-hash`; pass
 `payload` verbatim.
 
 **Batch when you have more than one message.** Use

package/agent-assets/skills/mail/references/api.md

@@ -84,7 +84,12 @@ curl -s "http://localhost:8321/api/mail/ACCT/drafts"
 curl -s "http://localhost:8321/api/mail/ACCT/drafts/DRAFT_ID"
 curl -sX POST   "http://localhost:8321/api/mail/ACCT/drafts" -d '{...}'
 curl -sX PATCH  "http://localhost:8321/api/mail/ACCT/drafts/DRAFT_ID" -d '{...}'
-# PATCH response: { status, id, warnings? }
+# PATCH response: { status, id, previousId?, warnings? }
+# - `previousId` is an optional field in the shape, but NO current provider
+#   ever populates it: Gmail and Outlook/Graph updates are atomic (id
+#   preserved, previousId unset) and IMAP draft-update is unimplemented
+#   (PATCH /drafts/:id on an IMAP account returns 501 not_implemented — see
+#   providers.md). Treat the returned `id` as stable.
 # - On Outlook, `warnings: ["reply_threading_immutable_after_create"]` if
 #   `reply` was supplied — reply headers are fixed at createDraft time.
 curl -sX DELETE "http://localhost:8321/api/mail/ACCT/drafts/DRAFT_ID"

package/agent-assets/skills/mail/references/examples.md

@@ -21,7 +21,8 @@ curl -s "http://localhost:8321/api/mail/search?q=from:alice+proposal&limit=5"
 
 # 2. Fetch the thread.
 curl -s "http://localhost:8321/api/mail/acct-1/threads/THREAD_ID"
-# → last message has rfc822MsgId, references[], providerMsgId.
+# → last message has rfc822MsgId, providerMsgId (no references[] on the
+#   message — you SUPPLY references in the reply block below).
 
 # 3. Create a draft threaded to it. Drafts are Autonomous tier.
 curl -sX POST "http://localhost:8321/api/mail/acct-1/drafts" \