@aitne-sh/aitne 0.1.9 → 0.1.11

package/agent-assets/skills/external-services/SKILL.delegated.codex.md

@@ -122,7 +122,7 @@ curl -sS -X POST http://localhost:8321/api/integrations/google_calendar/exec \
   }'
 ```
 
-`outputSchema` is **required** (4 KB cap). Defaults: `maxToolCalls=7`,
+`outputSchema` is **required** (4 KB cap). Defaults: `maxToolCalls=8`,
 `maxBudgetUsd=0.05`, `timeoutMs=60000`. Bump up to 15 / 0.50 / 300000
 for genuinely larger intents.
 
@@ -157,31 +157,7 @@ destructive-confirm second call.
   know about, call `POST /api/notify` with a one-line summary. The
   daemon does NOT auto-notify — it's an explicit choice.
 
-### Error envelope
-
-`/exec` extends the direct-mode envelope with delegated-mode fields.
-Discriminator: `body.mode === "delegated"`.
-
-| HTTP | `error` | retry? | What to do |
-|---|---|---|---|
-| 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
-| 409 | `mode_mismatch` | no | Calendar isn't delegated, OR your DM backend matches `delegatedBackend`. Re-read `integrations.md`. |
-| 409 | `precondition` | no | Mode/backend flipped during queue wait. Re-check state. |
-| 429 | `task_quota_exhausted` | no | Daily cap reached. Wait or surface. |
-| 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Simplify schema. |
-| 502 | `tool_unavailable` | no | No connector tool fits. Surface the gap. |
-| 502 | `tool_failed` | maybe | Connector tool returned an error. Surface verbatim. |
-| 502 | `auth_error` | no | Connector signed out. Re-authenticate. |
-| 502 | `policy_violation` | no | Subprocess attempted an out-of-allowlist tool (anti-injection). |
-| 502 | `loop_aborted` | no | `maxToolCalls` exceeded. Bump or simplify. |
-| 502 | `budget_exhausted` | no | `maxBudgetUsd` exceeded. Caller can raise the cap. |
-| 502 | `post_write_format_failure` | no | Write succeeded; formatting failed. Surface with partial trace. |
-| 503 | `delegated_proxy_busy` | yes | Queue saturated. Backoff and retry once. |
-| 503 | `task_mode_disabled` | no | Operator killed it. Stop. |
-| 504 | `timeout` | yes (1×) | Wall-clock fired. Retry once. |
-| 500 | `subprocess_crashed` | no | Daemon-side defect. Surface and stop. |
-
-Always preserve `body.message` verbatim when reporting to the user.
+{{> ref:exec-errors }}
 <!-- /service:calendar -->
 
 ---
@@ -266,72 +242,10 @@ existing rows (dedup). → Full guide: load the `agent-create` or `schedule` ski
 
 ---
 
-## One-Shot Scheduling
+## Scheduling & Skills CRUD
 
-Schedule a future DM or agent task. Use `<current_time>` to resolve relative times into absolute ISO 8601 with offset.
-
-### DM vs Agent Task
-
-| Criterion | `/api/schedule/dm` (free) | `/api/schedule` (~$0.03) |
-|---|---|---|
-| Message text knowable now? | Yes | No — needs lookup/decision at execution |
-| Needs API data at execution? | No | Yes |
-| Multi-step action? | No | Yes |
-| Conditional on state that may change? | No | Yes |
-
-**Default to DM** — every agent wake-up costs money and context.
-
-### Context-loss warning
-
-> The wake-up agent has NO memory of why it was scheduled — the `description` field is its only context.
-
-Include: **What** (verb + object), **Why** (trigger/reason), **Who/What** (names, IDs, URLs), **Expected output** (what success looks like).
-
-Bad: `"Meeting prep"` — which meeting? when? what to prepare? The wake-up agent will skip ambiguous descriptions.
-
-### POST /api/schedule/dm — Pre-composed DM
-```bash
-curl -s -X POST http://localhost:8321/api/schedule/dm \
-  -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "message": "Reminder: Design review in 30 min.", "platform": "slack"}'
-```
-
-### POST /api/schedule — Agent task
-```bash
-curl -s -X POST http://localhost:8321/api/schedule \
-  -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "taskType": "wake", "prompt": "Check PR #42 status and notify user.", "description": "PR #42 status check", "tier": "medium", "taskContext": {"scheduledBy": "dm_conversation"}}'
-```
-Fields: `time` (required), `taskType` (`wake`), `prompt` (required — the agent instruction, ≤8000 chars), `description` (optional label, ≤200 chars), `tier` (`lite`/`medium`/`high`) **or** `model` (registered id like `claude-opus-4-8`, legacy alias `sonnet`/`opus`, or composite `<backendId>/<modelId>`) — mutually exclusive, `taskContext` (optional metadata). See the `schedule` skill body for the full surface and `/api/schedule/options` for the live model list.
-
-### Manage pending items
-```bash
-curl -s "http://localhost:8321/api/schedule?status=pending"                         # list
-curl -s -X PATCH http://localhost:8321/api/schedule/42 \
-  -H 'Content-Type: application/json' -d '{"time": "2026-04-06T17:00:00-04:00"}'   # edit
-curl -s -X DELETE http://localhost:8321/api/schedule/42                              # cancel
-```
-Editable: `time`, `description`, `message` (dm only), `tier` (or `model`, mutually exclusive — pass `null` to clear), `taskContext`. Only `pending` items.
-
-### Time discipline
-- Absolute ISO 8601 with offset required — no relative times.
-- Do not schedule during quiet hours (default 22:00–08:00, configurable) unless critical.
-- Maximum 5 wake-ups per execution.
-
----
-
-## Skills Management
-
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
-
-```bash
-curl -s http://localhost:8321/api/skills                                            # list all
-curl -s http://localhost:8321/api/skills/todo-digest                                # read one
-curl -s -X POST http://localhost:8321/api/skills \
-  -H 'Content-Type: application/json' \
-  -d '{"name": "todo-digest", "description": "Summarize today.md", "content": "# TODO Digest\n...", "allowedTools": ["Bash(curl *)", "Read"]}'
-curl -s -X PUT http://localhost:8321/api/skills/todo-digest \
-  -H 'Content-Type: application/json' -d '{"description": "New description"}'      # update
-curl -s -X DELETE http://localhost:8321/api/skills/todo-digest                      # delete
-```
-Always `GET /api/skills` before creating (check name collisions). **Omit frontmatter** from `content` — the API injects it.
+One-shot DMs / agent wake-ups (`/api/schedule`, `/api/schedule/dm`) and
+user-authored Skills CRUD (`/api/skills`) work identically to direct
+mode — they are never proxied. Load the `schedule` skill for scheduling
+and the `agent-create` skill for recurring work; this variant does not
+mirror those surfaces.

package/agent-assets/skills/external-services/SKILL.delegated.gemini.md

@@ -121,7 +121,7 @@ curl -sS -X POST http://localhost:8321/api/integrations/google_calendar/exec \
   }'
 ```
 
-`outputSchema` is **required** (4 KB cap). Defaults: `maxToolCalls=7`,
+`outputSchema` is **required** (4 KB cap). Defaults: `maxToolCalls=8`,
 `maxBudgetUsd=0.05`, `timeoutMs=60000`.
 
 ### Destructive-confirm two-step (`allowDestructive`)
@@ -155,31 +155,7 @@ destructive-confirm second call.
   know about, call `POST /api/notify` with a one-line summary. The
   daemon does NOT auto-notify — it's an explicit choice.
 
-### Error envelope
-
-`/exec` extends the direct-mode envelope with delegated-mode fields.
-Discriminator: `body.mode === "delegated"`.
-
-| HTTP | `error` | retry? | What to do |
-|---|---|---|---|
-| 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
-| 409 | `mode_mismatch` | no | Calendar isn't delegated. Re-read `integrations.md`. |
-| 409 | `precondition` | no | Mode/backend flipped during queue wait. Re-check state. |
-| 429 | `task_quota_exhausted` | no | Daily cap reached. Wait or surface. |
-| 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Simplify schema. |
-| 502 | `tool_unavailable` | no | No connector tool fits. Surface the gap. |
-| 502 | `tool_failed` | maybe | Connector tool returned an error. Surface verbatim. |
-| 502 | `auth_error` | no | Connector signed out. Re-authenticate. |
-| 502 | `policy_violation` | no | Subprocess attempted an out-of-allowlist tool (anti-injection). |
-| 502 | `loop_aborted` | no | `maxToolCalls` exceeded. Bump or simplify. |
-| 502 | `budget_exhausted` | no | `maxBudgetUsd` exceeded. Caller can raise the cap. |
-| 502 | `post_write_format_failure` | no | Write succeeded; formatting failed. Surface with partial trace. |
-| 503 | `delegated_proxy_busy` | yes | Queue saturated. Backoff and retry once. |
-| 503 | `task_mode_disabled` | no | Operator killed it. Stop. |
-| 504 | `timeout` | yes (1×) | Wall-clock fired. Retry once. |
-| 500 | `subprocess_crashed` | no | Daemon-side defect. Surface and stop. |
-
-Always preserve `body.message` verbatim when reporting to the user.
+{{> ref:exec-errors }}
 <!-- /service:calendar -->
 
 ---
@@ -264,72 +240,10 @@ existing rows (dedup). → Full guide: load the `agent-create` or `schedule` ski
 
 ---
 
-## One-Shot Scheduling
+## Scheduling & Skills CRUD
 
-Schedule a future DM or agent task. Use `<current_time>` to resolve relative times into absolute ISO 8601 with offset.
-
-### DM vs Agent Task
-
-| Criterion | `/api/schedule/dm` (free) | `/api/schedule` (~$0.03) |
-|---|---|---|
-| Message text knowable now? | Yes | No — needs lookup/decision at execution |
-| Needs API data at execution? | No | Yes |
-| Multi-step action? | No | Yes |
-| Conditional on state that may change? | No | Yes |
-
-**Default to DM** — every agent wake-up costs money and context.
-
-### Context-loss warning
-
-> The wake-up agent has NO memory of why it was scheduled — the `description` field is its only context.
-
-Include: **What** (verb + object), **Why** (trigger/reason), **Who/What** (names, IDs, URLs), **Expected output** (what success looks like).
-
-Bad: `"Meeting prep"` — which meeting? when? what to prepare? The wake-up agent will skip ambiguous descriptions.
-
-### POST /api/schedule/dm — Pre-composed DM
-```bash
-curl -s -X POST http://localhost:8321/api/schedule/dm \
-  -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "message": "Reminder: Design review in 30 min.", "platform": "slack"}'
-```
-
-### POST /api/schedule — Agent task
-```bash
-curl -s -X POST http://localhost:8321/api/schedule \
-  -H 'Content-Type: application/json' \
-  -d '{"time": "2026-04-06T16:00:00-04:00", "taskType": "wake", "prompt": "Check PR #42 status and notify user.", "description": "PR #42 status check", "tier": "medium", "taskContext": {"scheduledBy": "dm_conversation"}}'
-```
-Fields: `time` (required), `taskType` (`wake`), `prompt` (required — the agent instruction, ≤8000 chars), `description` (optional label, ≤200 chars), `tier` (`lite`/`medium`/`high`) **or** `model` (registered id like `claude-opus-4-8`, legacy alias `sonnet`/`opus`, or composite `<backendId>/<modelId>`) — mutually exclusive, `taskContext` (optional metadata). See the `schedule` skill body for the full surface and `/api/schedule/options` for the live model list.
-
-### Manage pending items
-```bash
-curl -s "http://localhost:8321/api/schedule?status=pending"                         # list
-curl -s -X PATCH http://localhost:8321/api/schedule/42 \
-  -H 'Content-Type: application/json' -d '{"time": "2026-04-06T17:00:00-04:00"}'   # edit
-curl -s -X DELETE http://localhost:8321/api/schedule/42                              # cancel
-```
-Editable: `time`, `description`, `message` (dm only), `tier` (or `model`, mutually exclusive — pass `null` to clear), `taskContext`. Only `pending` items.
-
-### Time discipline
-- Absolute ISO 8601 with offset required — no relative times.
-- Do not schedule during quiet hours (default 22:00–08:00, configurable) unless critical.
-- Maximum 5 wake-ups per execution.
-
----
-
-## Skills Management
-
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
-
-```bash
-curl -s http://localhost:8321/api/skills                                            # list all
-curl -s http://localhost:8321/api/skills/todo-digest                                # read one
-curl -s -X POST http://localhost:8321/api/skills \
-  -H 'Content-Type: application/json' \
-  -d '{"name": "todo-digest", "description": "Summarize today.md", "content": "# TODO Digest\n...", "allowedTools": ["Bash(curl *)", "Read"]}'
-curl -s -X PUT http://localhost:8321/api/skills/todo-digest \
-  -H 'Content-Type: application/json' -d '{"description": "New description"}'      # update
-curl -s -X DELETE http://localhost:8321/api/skills/todo-digest                      # delete
-```
-Always `GET /api/skills` before creating (check name collisions). **Omit frontmatter** from `content` — the API injects it.
+One-shot DMs / agent wake-ups (`/api/schedule`, `/api/schedule/dm`) and
+user-authored Skills CRUD (`/api/skills`) work identically to direct
+mode — they are never proxied. Load the `schedule` skill for scheduling
+and the `agent-create` skill for recurring work; this variant does not
+mirror those surfaces.

package/agent-assets/skills/external-services/SKILL.native.claude.md

@@ -14,10 +14,16 @@ Base URL: `http://localhost:8321`. All daemon calls via `curl -s` with
 > **Refusal directive — read first.** Google Calendar is in `native`
 > mode bound to Claude. Do **NOT** call any of:
 >
-> - `POST /api/integrations/google_calendar/exec` (returns `410` with
->   `X-Integration-Mode: native`)
-> - `POST /api/integrations/google_calendar/reconcile` (410)
 > - `/api/calendar/*` (route-prefix 410 in native mode)
+> - `POST /api/integrations/google_calendar/exec`
+> - `POST /api/integrations/google_calendar/reconcile`
+>
+> In native mode `POST /api/integrations/google_calendar/exec` returns
+> **409 `mode_mismatch`** (the handler rejects non-delegated mode);
+> `.../reconcile` is not mode-gated at all. Do not call either — use the
+> native connector. The 410 + `X-Integration-Mode: native` refusal
+> contract applies ONLY to the integration's own data routes
+> (`/api/calendar/*`).
 >
 > Reach Google Calendar through the in-session Google Calendar
 > connector your harness exposes. Your tool menu lists every available
@@ -128,13 +134,13 @@ The suggest-time capability is read-only and exempt from the confirm dance.
 - All-day events use `YYYY-MM-DD` with no offset.
 - Be explicit which shape the destructive-confirm plan describes.
 
-### Imminent-event reminders (hourly_check)
+### Imminent-event reminders (activity_scan)
 
 Native mode replaces the daemon-side
 `POST /api/integrations/google_calendar/reconcile` POST that delegated
 mode uses. In native mode, the agent itself drives the imminent-window
 fetch every hour and POSTs each materialised event to
-`/api/observations`. The hourly_check native variant's Step 0b spells
+`/api/observations`. The activity_scan native variant's Step 0b spells
 out the exact shape; this skill describes the call surface.
 
 Free-busy queries are composed locally — the suggest-time capability
@@ -238,10 +244,10 @@ session's integration state.
 
 ## Persisting Calendar observations from native fetches
 
-When the hourly_check native flow's Step 0b fetches imminent-window
+When the activity_scan native flow's Step 0b fetches imminent-window
 events, POST each materialised event to `/api/observations` so
 subsequent runs can dedup. The daemon computes `contentHash`
-server-side via `@personal-agent/shared/observations-hash.ts` — pass
+server-side via `@aitne/shared/observations-hash` — pass
 the raw `payload`.
 
 **Batch when you have more than one event.** Use
@@ -268,7 +274,7 @@ curl -s -X POST http://localhost:8321/api/observations \
 window (§11.3.1) — stop and re-read `<integration_modes>`.
 
 The two-fetch pattern (imminent 15-min + 24-hour drift detection)
-documented in `routine.hourly_check.native.claude.md` is the canonical
+documented in `routine.activity_scan.native.claude.md` is the canonical
 shape; this skill describes the per-call surface, not the orchestration.
 
 ---
@@ -284,7 +290,7 @@ schedule surface (scheduling is daemon-internal, not an integration).
 
 ## Skills Management — direct, unchanged
 
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`.
+User-authored skills: `<contextDir>/policies/skills/{slug}/SKILL.md`.
 Built-in skills are read-only (403). Native-mode gating does not apply.
 
 ```bash

package/agent-assets/skills/external-services/SKILL.native.codex.md

@@ -14,10 +14,16 @@ with `Content-Type: application/json` on POST/PATCH/PUT.
 > **Refusal directive — read first.** Google Calendar is in `native`
 > mode bound to Codex. Do **NOT** call any of:
 >
-> - `POST /api/integrations/google_calendar/exec` (410 with
->   `X-Integration-Mode: native`)
-> - `POST /api/integrations/google_calendar/reconcile` (410)
 > - `/api/calendar/*` (route-prefix 410)
+> - `POST /api/integrations/google_calendar/exec`
+> - `POST /api/integrations/google_calendar/reconcile`
+>
+> In native mode `POST /api/integrations/google_calendar/exec` returns
+> **409 `mode_mismatch`** (the handler rejects non-delegated mode);
+> `.../reconcile` is not mode-gated at all. Do not call either — use the
+> native connector. The 410 + `X-Integration-Mode: native` refusal
+> contract applies ONLY to the integration's own data routes
+> (`/api/calendar/*`).
 >
 > Reach Google Calendar through the in-session Google Calendar
 > connector your harness exposes. Your tool menu lists every available
@@ -106,9 +112,9 @@ master-id PATCH shifts the whole series. Confirm scope before issuing.
 Same as Claude's native body — ISO 8601 with TZ offset for timed
 events; `YYYY-MM-DD` for all-day. Reject naked-ISO inputs.
 
-### Imminent-event reminders (hourly_check)
+### Imminent-event reminders (activity_scan)
 
-The hourly_check native variant's Step 0b drives the imminent-window
+The activity_scan native variant's Step 0b drives the imminent-window
 fetch each hour; this skill describes the per-call surface. POST each
 materialised event to `/api/observations` per the section at the end of
 this file.

package/agent-assets/skills/external-services/SKILL.native.gemini.md

@@ -14,10 +14,16 @@ Base URL: `http://localhost:8321`. All daemon calls via `curl -s` with
 > **Refusal directive — read first.** Google Calendar is in `native`
 > mode bound to Gemini. Do **NOT** call any of:
 >
-> - `POST /api/integrations/google_calendar/exec` (410 with
->   `X-Integration-Mode: native`)
-> - `POST /api/integrations/google_calendar/reconcile` (410)
 > - `/api/calendar/*` (route-prefix 410)
+> - `POST /api/integrations/google_calendar/exec`
+> - `POST /api/integrations/google_calendar/reconcile`
+>
+> In native mode `POST /api/integrations/google_calendar/exec` returns
+> **409 `mode_mismatch`** (the handler rejects non-delegated mode);
+> `.../reconcile` is not mode-gated at all. Do not call either — use the
+> native connector. The 410 + `X-Integration-Mode: native` refusal
+> contract applies ONLY to the integration's own data routes
+> (`/api/calendar/*`).
 >
 > Reach Google Calendar through the in-session Google Calendar
 > connector your harness exposes (typically Gemini CLI's
@@ -110,9 +116,9 @@ master-id update shifts the whole series. Confirm scope.
 ISO 8601 with TZ offset for timed events; `YYYY-MM-DD` for all-day.
 Connectors typically reject naked-ISO inputs.
 
-### Imminent-event reminders (hourly_check)
+### Imminent-event reminders (activity_scan)
 
-The hourly_check native variant's Step 0b drives the imminent-window
+The activity_scan native variant's Step 0b drives the imminent-window
 fetch each hour; this skill describes the per-call surface. POST each
 materialised event to `/api/observations` per the section below.
 

package/agent-assets/skills/external-services/references/exec-errors.md

@@ -0,0 +1,32 @@
+---
+kind: reference
+name: exec-errors
+description: Delegated `/exec` error envelope — HTTP status, `error` code, retry guidance. Shared across the cross-backend SKILL.delegated.*.md Calendar variants.
+---
+
+### Error envelope
+
+`/exec` extends the direct-mode envelope with delegated-mode fields.
+Discriminator: `body.mode === "delegated"`.
+
+| HTTP | `error` | retry? | What to do |
+|---|---|---|---|
+| 400 | `validation_error` / `schema_too_large` | no | Fix the request body. |
+| 409 | `mode_mismatch` | no | Calendar isn't delegated, OR your DM backend matches `delegatedBackend`. Re-read `integrations.md` and stop. |
+| 409 | `precondition` | no | Mode/backend flipped during the queue wait. Re-check state and re-plan. |
+| 429 | `task_quota_exhausted` | no | Daily cap reached; wait or surface. |
+| 502 | `parse_error` / `schema_violation` | no (daemon already retried once) | Consider a simpler schema. |
+| 502 | `tool_unavailable` | no | No connector tool fits the intent. Surface the gap. |
+| 502 | `tool_failed` | maybe | Connector tool returned an error. Surface `body.message` verbatim; retry only if clearly transient. |
+| 502 | `auth_error` | no | Connector signed out. Tell the user to re-authenticate it. |
+| 502 | `policy_violation` | no | Subprocess attempted a tool outside the per-task allowlist (anti-injection). |
+| 502 | `loop_aborted` | no | `maxToolCalls` exceeded. Bump the cap or simplify. |
+| 502 | `budget_exhausted` | no | `maxBudgetUsd` exceeded. Caller can raise the cap. |
+| 502 | `post_write_format_failure` | no | Write succeeded; formatting failed. Side effect is real — surface with the partial trace. |
+| 503 | `delegated_proxy_busy` | yes | Daemon queue saturated. Backoff a few seconds, try once. |
+| 503 | `task_mode_disabled` | no | Operator turned the kill switch off. Stop. |
+| 504 | `timeout` | yes (1×) | Wall-clock fired. Retry once if intent was simple. |
+| 500 | `subprocess_crashed` | no | Unhandled exception inside the subprocess. Surface and stop. |
+
+Always preserve `body.message` verbatim when reporting to the user — it
+carries the connector's own language.

package/agent-assets/skills/external-services/references/skills-crud.md

@@ -1,12 +1,12 @@
 ---
 kind: reference
 name: skills-crud
-description: Dashboard-shaped CRUD for user-authored skills under ~/.personal-agent/skills/. Built-in skills are read-only (403).
+description: Dashboard-shaped CRUD for user-authored skills under <contextDir>/policies/skills/. Built-in skills are read-only (403).
 ---
 
 ## Skills Management
 
-User-authored skills: `~/.personal-agent/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
+User-authored skills: `<contextDir>/policies/skills/{slug}/SKILL.md`. Built-in skills are read-only (403). Slug: lowercase kebab-case `[a-z0-9][a-z0-9-]*`, 1–64 chars.
 
 ```bash
 curl -s http://localhost:8321/api/skills                                            # list all
@@ -22,6 +22,6 @@ Always `GET /api/skills` before creating (check name collisions). **Omit frontma
 
 The description is the **only** routing signal the SDK uses to pick a
 skill — keep it under 280 chars and make the trigger surface
-distinct from every other skill in the manifest. Slug grammar is
-strict: `[a-z0-9][a-z0-9-]*[a-z0-9]` or `[a-z0-9]` (single char),
-1-64 chars total. PUT rejects collisions with built-in slugs.
+distinct from every other skill in the manifest. Slug grammar:
+`^[a-z0-9][a-z0-9-]*$` (1-64 chars; a trailing hyphen is allowed,
+no alphanumeric terminal required). PUT rejects collisions with built-in slugs.

package/agent-assets/skills/gmail-lifestyle/SKILL.md

@@ -97,8 +97,9 @@ user's **external Obsidian vault**.
 > **external** Obsidian vault (user's personal knowledge base reached
 > via `/api/obsidian/*`), **not** the primary management store
 > reached via `/api/context/*`. The agent's own state files
-> (`state/today.md`, `plans/roadmap.md`, `projects/*`, `user/*`, `rules/*`,
-> `routines/*`, `agent/*`) live in the primary store and must
+> (`state/today.md`, `plans/roadmap.md`, `plans/projects/*`, `identity/*`,
+> `policies/*`, `policies/routines/*`, `journal/agent.md`) live in the
+> primary store and must
 > **never** receive receipt attachments. See the
 > `external-services` skill's obsidian reference for the external
 > vault's full CRUD surface.

package/agent-assets/skills/gmail-lifestyle/references/receipts-api.md

@@ -41,6 +41,7 @@ Response:
     {
       "id": 1,
       "providerMsgId": "18f...",
+      "accountId": "...",
       "attachmentId": "ANGj...",
       "filename": "receipt.pdf",
       "mimeType": "application/pdf",
@@ -55,6 +56,9 @@ Response:
 }
 ```
 
+`accountId` identifies the source mail account; `POST /receipts/:id/download`
+uses it to resolve the provider.
+
 ## GET /api/receipts/summary
 
 ```bash

package/agent-assets/skills/gmail-lifestyle/references/travel-bookings-api.md

@@ -68,8 +68,17 @@ curl -s "http://localhost:8321/api/travel-bookings/upcoming?limit=10"
 
 ## PATCH /api/travel-bookings/:id
 
+Accepts `{"status": "..."}` and/or `{"destination": "..."}`. Valid
+status values are `upcoming`, `completed`, `cancelled`.
+
 ```bash
+# Update status
 curl -s -X PATCH "http://localhost:8321/api/travel-bookings/1" \
   -H "Content-Type: application/json" \
   -d '{"status": "completed"}'
+
+# Correct a parsed destination
+curl -s -X PATCH "http://localhost:8321/api/travel-bookings/1" \
+  -H "Content-Type: application/json" \
+  -d '{"destination": "San Francisco"}'
 ```

package/agent-assets/skills/mail/SKILL.delegated.claude.md

@@ -101,8 +101,7 @@ should set `cacheable: true` so a repeat invocation within 60s returns
 ~5ms from the in-memory LRU. The cache key includes the integration
 state version, so flipping `deniedTools` or `delegatedBackend` purges
 entries automatically. Cache hits still write a `delegated_task.exec`
-audit row with `cost_usd=0` and `detail.cacheHit=true` — accounting
-stays correct.
+audit row with `cost_usd=0` and `detail.cacheHit=true`.
 
 Never set `cacheable: true` on:
 - destructive-confirm second calls (`allowDestructive: true`),
@@ -205,19 +204,12 @@ curl -s -X POST http://localhost:8321/api/integrations/gmail/exec \
 ## Default deny floor
 
 The setup wizard pre-populates `gmail.deniedTools` with the connector's
-destructive defaults (send / batch label mutate / etc.). `/exec`
-honors the deny list, and the response distinguishes two cases:
-
-- **Every connector tool is denied** → `403 denied_tool`. There is no
-  surface to plan against, so the daemon rejects the task up front
-  without spawning the subprocess.
-- **The connector still has usable tools but the specific tool a planned
-  task needs is denied (or no tool fits)** → `502 tool_unavailable`. The
-  subprocess plans, finds no permitted tool for the intent, and reports
-  the gap.
-
-In both cases, surface that to the user and ask whether to lift the
-relevant deny before retrying.
+destructive defaults. `/exec` honors the deny list, distinguishing two
+cases: if **every** connector tool is denied → `403 denied_tool` (no
+surface to plan against, rejected up front); if usable tools remain but
+the specific tool a planned task needs is denied (or no tool fits) →
+`502 tool_unavailable`. In both cases, surface that to the user and ask
+whether to lift the relevant deny before retrying.
 
 ## Decision rules
 
@@ -271,23 +263,19 @@ curl -s -X POST http://localhost:8321/api/notify \
   -d '{"message": "Sent reply to alice@example.com (Re: Proposal)"}'
 ```
 
-Do not call `/api/notify` for routine reads / drafts / searches. The
-default posture is autonomous; the user's `deniedTools` is the
-hard-stop, on-demand retrospective covers awareness, and `/api/notify`
-is the small hammer for "speak up if I'm about to do something
-unusual."
+Do not call `/api/notify` for routine reads / drafts / searches.
 
 ## Cost / retrospective
 
 Every `/exec` writes one row to `agent_actions` with
-`action_type='delegated_task.exec'` (token + USD breakdown, parent
-`event_id` / `processKey` attached automatically via session env
-vars). When the user asks what you did:
+`action_type='delegated_task.exec'` (token + USD breakdown). When the
+user asks what you did:
 
 ```bash
 curl -s "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since=2026-04-25T00:00:00Z&limit=50"
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag, and
-timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.delegated.codex.md

@@ -261,5 +261,6 @@ curl -sS "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag,
-and timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.delegated.gemini.md

@@ -255,5 +255,6 @@ curl -sS "http://localhost:8321/api/agent/actions?kind=delegated_task.exec&since
 ```
 
 Summarise from the returned `actions` array — each row carries
-`detail.task` (the natural-language intent), cost, cache hit flag,
-and timestamp.
+`detail.taskHash` (a hash, NOT the task text — the verbatim intent is
+deliberately not persisted, so do not try to read intent prose from it),
+cost, cache hit flag, and timestamp.

package/agent-assets/skills/mail/SKILL.md

@@ -54,7 +54,7 @@ accordingly:
   user) registered on that backend. The daemon does not poll Outlook
   in this mode — mail observations only land when the agent fetches
   in-turn through the user's MCP during a DM that needs them. There
-  is no proactive hourly_check fetch for `outlook_mail` (user-managed
+  is no proactive activity_scan fetch for `outlook_mail` (user-managed
   reactive-only contract; see
   `docs/design/appendices/native-integration-mode.md`).
 <!-- /mode:native:outlook_mail -->
@@ -99,16 +99,10 @@ includes dormant and unhealthy rows that every operation will reject.
 ### Send vs draft
 - **Prefer drafts.** Create via `POST /mail/:acct/drafts`. The user sends
   from the provider's web UI.
-- Direct send (`POST /mail/:acct/messages/send`) succeeds autonomously —
-  the daemon does not DM the owner before sending. (The user's
-  `deniedTools` list applies to **delegated-mode connector tools** —
-  e.g. Codex's `send_email` — and is enforced at the
-  `/api/integrations/:key/exec` task-mode chokepoint via the per-task
-  allowed-tools envelope. In direct mode, the `/api/mail/*` route
-  handler has no equivalent deny check today, so a send call is what
-  it appears to be: a send.) When you judge the user would want to
-  know about a send immediately (e.g. a reply to a stranger), call
-  `POST /api/notify` yourself.
+- Direct send (`POST /mail/:acct/messages/send`) is autonomous — no owner
+  DM, no deny gate (see api.md for the `deniedTools`-scope nuance). When
+  you judge the user would want to know about a send immediately (e.g. a
+  reply to a stranger), call `POST /api/notify` yourself.
 - Never include `bcc` unless the user explicitly asks for it.
 
 ### Replies — RFC-2822 headers are the source of truth
@@ -118,7 +112,9 @@ all four kinds.
 
 1. Fetch the thread metadata: `GET /api/mail/:acct/threads/:threadId?body=none`
    (returns `messages[]` in chronological order without raw HTML bodies).
-2. From the last message, pull `rfc822MsgId` and `references`.
+2. From the last message, pull `rfc822MsgId` (thread message objects carry
+   no `references` field — you SUPPLY `references` in the reply block below,
+   you do not read it off the message).
 3. Build the `reply` block:
    ```json
    {
@@ -191,20 +187,16 @@ curl -s "http://localhost:8321/api/mail/ACCT/messages/MSG/body?format=raw&chunk=
 ```
 
 ### When NOT to act
-- During `routine.hourly_check` this skill is **read-only** — no sending,
+- During `routine.activity_scan` this skill is **read-only** — no sending,
   no draft edits, no tag changes, no trash / untrash / archive.
 - No bulk operations without user confirmation.
 - Trash / untrash / archive run autonomously when not on the user's
   deny list. The daemon does not DM the owner before the call. Single
   ops only; if you're about to trash 3+ messages at once, stop and ask
   the user — the agent's own judgment is the gate, not the daemon.
-- **Delegated mode**: this skill body is loaded only when `gmail.mode ===
-  "direct"`. When Gmail is delegated, the materializer picks
-  `SKILL.delegated.<sessionBackend>.md` (cross-backend) or skips the
-  skill entirely (same-backend, native MCP). If you somehow reach
-  `/api/mail/*` from this body while Gmail is delegated, the route
-  returns `410 integration_delegated` — re-read `integrations.md` and
-  use `POST /api/integrations/gmail/exec` (task mode) instead.
+- **Delegated / native mode**: see §0 for routing. A `/api/mail/*` call
+  that hits a delegated/native gate returns `410` (`integration_delegated`
+  / `integration_native`) — re-read `integrations.md` and dispatch per §0.
 
 ## 3. Provider capability matrix