@hybridaione/hybridclaw 0.12.5 → 0.12.7

package/AGENTS.md

@@ -21,7 +21,7 @@ HybridClaw is a personal AI assistant bot for Discord, powered by HybridAI.
 Enterprise-grade Node.js 22 application with gateway service, TUI client, and
 Docker-sandboxed container runtime.
 
-**Version:** 0.9.7  |  **Package:** `@hybridaione/hybridclaw`
+**Version:** 0.12.6  |  **Package:** `@hybridaione/hybridclaw`
  |  **License:** see `LICENSE`
 
 Architecture: gateway (core runtime, SQLite persistence, REST API, Discord
@@ -45,8 +45,9 @@ src/
   agent/                Agent execution: conversation loop, tool executor, prompt hooks, delegation
   audit/                Append-only audit trail, approval tracking, hash-chain integrity
   auth/                 HybridAI and OpenAI Codex authentication flows
-  channels/discord/     Discord integration and delivery logic
+  channels/             Channel transports (discord, slack, telegram, email, whatsapp, msteams, voice, imessage)
   config/               CLI flag parsing, runtime config management
+  doctor/               Doctor checks and resource hygiene maintenance
   gateway/              Core gateway service: HTTP APIs, health, session mgmt, approvals
   infra/                Container setup, IPC (file-based), worker signatures, runners
   memory/               SQLite database, semantic memory, compaction, consolidation, chunking
@@ -90,6 +91,26 @@ User message → Gateway (HTTP/Discord) → ContainerInput (JSON)
 | Approval rule | `.hybridclaw/policy.yaml`                                    | §7.4     |
 | Template      | `templates/<name>.md` + `src/workspace.ts`                   | §7.5     |
 
+### OpenTelemetry (Distributed Tracing)
+
+The gateway supports optional OpenTelemetry instrumentation for distributed
+tracing in cloud deployments. OTel is OFF by default (zero overhead).
+
+| Env Var                          | Purpose                                                      |
+|----------------------------------|--------------------------------------------------------------|
+| `OTEL_ENABLED=true`             | Enable OTel SDK initialization                               |
+| `OTEL_EXPORTER_OTLP_ENDPOINT`   | OTLP collector endpoint (also enables OTel if set)           |
+| `OTEL_EXPORTER_OTLP_PROTOCOL`   | `grpc` (default) or `http/protobuf`                          |
+| `OTEL_SERVICE_NAME`             | Service name reported in spans (default: `hybridclaw-gateway`)|
+
+When enabled, spans are emitted for: gateway message handling, agent runs,
+host/container execution, and skill loading. Trace context (traceId, spanId)
+is injected into structured log lines for correlation.
+
+Implementation: `src/observability/otel.ts`. The SDK packages
+(`@opentelemetry/sdk-node`, exporters) are dynamically imported only when
+OTel is active.
+
 ---
 
 ## 3) Engineering Principles

package/CHANGELOG.md

@@ -1,6 +1,191 @@
 # Changelog
 
-## [Coming up]
+## Unreleased
+
+## [0.12.7](https://github.com/HybridAIOne/hybridclaw/tree/v0.12.7)
+
+### Added
+
+- **Nine new external API providers**: Google Gemini (`gemini/`), DeepSeek
+  (`deepseek/`), xAI / Grok (`xai/`), Z.AI / GLM (`zai/`), Kimi / Moonshot
+  (`kimi/`), MiniMax (`minimax/`), DashScope / Qwen (`dashscope/`), Xiaomi
+  MiMo (`xiaomi/`), and Kilo Code (`kilo/`). Each provider supports
+  `auth login`, `auth status`, and `auth logout` with `--api-key`,
+  `--base-url`, `--model`, and `--no-default` flags, plus full runtime config
+  enablement and model-prefix routing.
+- **Runtime model discovery for OpenAI-compat remote providers**: The nine
+  providers above now auto-discover their current model lineups at runtime
+  via `GET <baseUrl>/models` and surface them through `/model list <provider>`
+  alongside any user-pinned entries in `<provider>.models`. Discovered models
+  are cached for one hour, deduplicated with pinned entries, and silently
+  fall back to the configured list if the provider's `/v1/models` endpoint is
+  unreachable, absent (404), or otherwise errors.
+- **ByteRover memory plugin**: New bundled `byterover-memory` external memory
+  provider that injects prompt-time recall through `brv query`, exposes
+  `brv_query` / `brv_curate` / `brv_status` model tools, and curates
+  completed turns, native memory writes, and pre-compaction summaries into
+  ByteRover's Context Tree. Works offline by default with optional cloud sync.
+- **Mem0 memory plugin**: New bundled `mem0-memory` external memory provider
+  that layers Mem0 profile and search recall on top of built-in memory,
+  exposes `mem0_profile` / `mem0_search` / `mem0_conclude` tools and a local
+  `/mem0 ...` command surface, mirrors completed turns and explicit native
+  memory writes into Mem0, prefetches profile context on `session_start`, and
+  curates compaction snapshots before older turns are archived.
+- **Skill availability controls**: Added `hybridclaw skill enable <name>
+  [--channel <kind>]`, `hybridclaw skill disable <name> [--channel <kind>]`,
+  interactive TUI `/skill config` toggles, and matching gateway slash-command
+  support for enabling or disabling skills globally or per channel.
+- **OpenTelemetry distributed tracing**: The gateway can now emit spans for
+  message handling, agent runs, host/container execution, and skill loading to
+  OTLP collectors when `OTEL_ENABLED=true` or
+  `OTEL_EXPORTER_OTLP_ENDPOINT` is set, with `traceId` / `spanId` correlation
+  injected into structured logs.
+- **Memory plugin and skills docs expansion**: Added a memory-plugin
+  comparison guide, per-category bundled-skills guides, and richer browser
+  docs prompt blocks with copy buttons and styled callouts.
+
+### Changed
+
+- **Model and provider surfaces now share one registry**: `/model list`,
+  `/model info`, provider status output, and `/admin/models` now use the same
+  data-driven provider catalog, show model counts consistently, and sort
+  enabled or reachable providers first in the admin console.
+- **Fresh installs default HybridAI to `gpt-5.4-mini`**: New runtime homes now
+  seed `hybridai.defaultModel` from the shared `DEFAULT_HYBRIDAI_MODEL`
+  constant so onboarding, migration, and fresh-install defaults stay aligned.
+- **Kilo Code base URL migrated to `https://api.kilo.ai/api/gateway`**: The
+  retired `api.kilocode.ai` host now serves a marketing site, so the default
+  Kilo Code base URL has been updated across `config.ts`, the runtime config
+  defaults, the `auth login kilo` normalizer (suffix `/api/gateway`), and
+  `config.example.json`. Persisted runtime configs still pointing at
+  `https://api.kilocode.ai/v1` are silently migrated to the new URL on load
+  so existing installations self-heal.
+- **Codex model catalog handling is more resilient**: HybridClaw now pins the
+  `client_version` needed for the full upstream Codex catalog and ships static
+  supplemental entries for UI-known Codex variants when the upstream list is
+  temporarily incomplete.
+- **Renamed `HybridAIRequestError` → `ProviderRequestError`**: The error class
+  wraps failures from every OpenAI-compat provider (HybridAI, OpenRouter,
+  Mistral, Kilo Code, local Ollama, etc.), so the HybridAI-specific name was
+  misleading. The error-message prefix now reads `Provider API error <status>`
+  instead of `HybridAI API error <status>`. `HybridAIRequestError` is kept as
+  a deprecated alias for backward compatibility; new code should import
+  `ProviderRequestError` directly.
+- **Simpler `formatModelForDisplay` rule**: Models that already carry a
+  provider prefix (`kilo/...`, `gemini/...`, etc.) no longer incorrectly pick
+  up a leading `hybridai/`. The function now treats any slash-containing
+  non-`hybridai/` model as already-namespaced, removing the fragile
+  `NON_HYBRID_PROVIDER_PREFIXES` whitelist dependency for this path.
+- **TUI reply metadata is clearer**: The usage footer now shows the active
+  skill name alongside tools and plugins when a response was driven by a
+  skill.
+- **Plugin dependency checks are quieter**: `plugin install` and
+  `plugin check` now treat global binaries as satisfying declared
+  dependencies, skipping unnecessary npm or pip installs and approval prompts
+  when the required executable is already on `PATH`.
+- **Memory plugin docs standardized**: All six memory-plugin doc pages now follow
+  the same structure: Prerequisites, HybridClaw Setup, Config, Commands,
+  Example Prompts & Use Cases, Tips & Tricks, and Troubleshooting. Added
+  external links, local vs cloud options, and researched tips for each.
+- **Browser docs prompt UX expanded**: The docs shell now groups tips and
+  multi-step prompts into styled callouts, adds copy buttons for try-it
+  blocks, and publishes bundled-skill pages grouped by category.
+
+### Fixed
+
+- **Bundled ESM skill scripts resolve repo-managed dependencies in the
+  sandbox**: Source-checkout container runs now symlink the workspace
+  `node_modules` directory into the agent workspace so bundled skill scripts
+  can import repo dependencies consistently inside Docker.
+- **`/auth status` suggestions list every supported provider**: Slash-command
+  provider completion and status suggestions now include the full provider set
+  instead of omitting newer backends.
+- **Mem0 sync no longer sends unsupported `app_id` fields**: Stored-turn
+  mirroring and later recall now work against Mem0's accepted write shape.
+- **Dream consolidation works for cloud sessions**: `/dream` memory
+  consolidation now runs correctly when the session is backed by cloud state.
+- **Fresh-install model migration tracks the shared default constant**:
+  Migration logic now respects `DEFAULT_HYBRIDAI_MODEL` instead of relying on
+  a stale sentinel when deciding whether a runtime home is still on the
+  original default model.
+- **Browser docs renderer edge cases**: Separate callout blocks no longer
+  merge together, copy actions strip leading numbering more reliably, and the
+  docs copy icon renders and positions consistently across browsers.
+
+## [0.12.6](https://github.com/HybridAIOne/hybridclaw/tree/v0.12.6)
+
+### Added
+
+- **Twilio voice channel**: Added a built-in Twilio ConversationRelay phone
+  channel with inbound webhook handling, outbound `hybridclaw gateway voice
+  call <number>` support, admin-console setup, and a dedicated setup and
+  troubleshooting guide.
+- **Salesforce skill**: New bundled skill for enterprise CRM integration with
+  OAuth token binding, a dedicated `secret` CLI surface for credential
+  management, and hardened field-level configuration.
+- **Local skill import**: `skill import` now accepts local filesystem
+  directories and `.zip` archives as sources, with persistent import-source
+  markers so locally-imported skills retain personal trust across restarts.
+- **Admin approvals policy console**: New `/admin/approvals` interface for
+  viewing and managing approval policies from the browser.
+- **Console chat UI**: Migrated the legacy standalone chat UI into the console
+  React app with unified channels selection and improved upstream error
+  handling.
+- **Doctor resource hygiene**: `hybridclaw doctor` now includes a resource
+  hygiene maintenance pass that detects and cleans stale gateway artifacts,
+  with cached DB snapshots and disk-state diffing for efficient checks.
+- **Fetch Email-Config button**: The admin email channel editor includes a
+  one-click button to fetch and validate HybridAI mailbox credentials.
+- **XLSX skill creation script**: Bundled creation script prevents silent
+  generation failures when the xlsx skill produces spreadsheet output.
+- **ToggleGroup component**: New `ToggleGroup` / `ToggleGroupItem` UI
+  primitive used across the admin console for binary-toggle controls.
+- **Provider health panel**: Inline login action and inactive-provider
+  collapse in the admin console for quicker provider triage.
+
+### Changed
+
+- **Per-channel instructions in `/admin/channels`**: The admin console now
+  lets operators edit transport-specific prompt guidance, and runtime config
+  exposes the same values under `channelInstructions.*` so channels such as
+  voice can enforce spoken-output rules without editing prompt files directly.
+- **OAuth token domain binding**: Bearer tokens are now bound to their OAuth
+  issuer domain to prevent cross-domain exfiltration, and the gateway proxy
+  auto-captures tokens using config constants instead of raw environment
+  variables.
+- **Secret CLI simplification**: Removed the `[--raw]` option from
+  `secret show` and `secret set`, streamlining the operator-facing surface.
+- **CI pipeline split**: Unit tests now run as parallel lint and test jobs
+  with a shared `setup-node-workspace` composite action and PR-level
+  concurrency groups that cancel stale runs.
+- **Security scanner hints**: Block messages now include actionable override
+  hints so operators understand how to respond to policy violations.
+- **DRY provider utilities**: Refactored model-matching and `agentId`
+  normalization into shared provider utilities with prefix-aware matching.
+
+### Fixed
+
+- **Voice approval and relay handling**: Spoken approval replies normalize more
+  reliably, voice turns skip the usual yellow implicit wait, and the Twilio
+  relay path handles disconnect, interrupt, and runtime-unavailable cases more
+  cleanly instead of dropping into noisier failure states.
+- **Memory-flush pool slot leak**: Host processes spawned during memory-flush
+  no longer leak worker pool slots, and empty sessions are cleaned up
+  automatically.
+- **Stream terminated retry**: Terminated stream errors are now retried
+  correctly, preserving PDF creation workflows across transport retries.
+- **Skill scanning and promotion**: Runtime-created skills in agent workspace
+  directories now appear in `/skill list` and are promoted to the managed
+  directory on save.
+- **Teams webhook resilience**: Missing Teams credentials on incoming webhook
+  requests are handled gracefully instead of crashing the handler.
+- **AuthProvider callback stability**: Stabilized React `AuthProvider`
+  callbacks with memoized context values to prevent unnecessary re-renders.
+- **Upstream error mapping**: Nested HybridAI error payloads are unwrapped
+  and mapped to `502` responses to avoid gateway auth confusion, with
+  `no-store` cache headers on error responses.
+- **Skip-skill-scan persistence**: The `--skip-skill-scan` CLI decision is
+  now persisted so the runtime guard honors it across restarts.
 
 ## [0.12.5](https://github.com/HybridAIOne/hybridclaw/tree/v0.12.5)
 
@@ -56,6 +241,10 @@
 - **Immediate one-shot scheduler jobs**: Added config-backed `one_shot` jobs
   that run immediately, retry up to `maxRetries`, preserve review state, and
   surface richer delivery output across the gateway and admin scheduler UI.
+- **Mem0 memory plugin**: Added a bundled `mem0-memory` plugin so local
+  HybridClaw installs can mirror turns into Mem0 cloud memory, inject
+  prompt-time Mem0 recall, expose `mem0_*` tools, and mirror explicit native
+  memory writes back into Mem0.
 
 ### Changed
 

package/README.md

@@ -19,9 +19,9 @@ security, and operational visibility. It combines sandboxed execution, secure
 credentials, approvals, persistent memory, and admin surfaces behind a single
 gateway.
 
-Connect it to Discord, Slack, WhatsApp, Telegram, Microsoft Teams, email, or the web. Run it
-locally, deploy it for business workflows, and keep your agents, secrets, and
-data under your control.
+Connect it to Discord, Slack, WhatsApp, Telegram, Microsoft Teams, email,
+Twilio voice, or the web. Run it locally, deploy it for business workflows,
+and keep your agents, secrets, and data under your control.
 
 [Quick Start](https://www.hybridclaw.io/docs/getting-started/quickstart) ·
 [Installation](https://www.hybridclaw.io/docs/getting-started/installation) ·
@@ -78,7 +78,7 @@ Open locally:
 
 - Chat UI: `http://127.0.0.1:9090/chat`
 - Admin UI: `http://127.0.0.1:9090/admin` for channels, versioned agent files,
-  scheduler, audit, and config
+  scheduler, audit, config, and channel-specific instructions
 - Agents UI: `http://127.0.0.1:9090/agents`
 - OpenAI-compatible API: `http://127.0.0.1:9090/v1/models` and `http://127.0.0.1:9090/v1/chat/completions`
 
@@ -94,7 +94,7 @@ Once the gateway is running, open HybridClaw locally:
 
 - Web Chat: `http://127.0.0.1:9090/chat`
 - Admin Console: `http://127.0.0.1:9090/admin` for channels, versioned agent files,
-  scheduler, audit, and config
+  scheduler, audit, config, and channel-specific instructions
 - Agent Dashboard: `http://127.0.0.1:9090/agents`
 - or connect Slack, WhatsApp, Telegram, Discord, Microsoft Teams, Email
 
@@ -103,16 +103,41 @@ Once the gateway is running, open HybridClaw locally:
 - `/admin/agents` edits allowlisted bootstrap markdown files such as
   `AGENTS.md`, keeps saved revisions, and restores earlier versions from the
   browser.
+- `/admin/channels` edits transport config, encrypted channel credentials,
+  Twilio voice settings, and per-channel instructions that are injected into
+  prompts at runtime.
+- `/admin/approvals` manages approval policies from the browser.
 - `hybridclaw tui` includes a keyboard-driven approval picker and prints a
   ready-to-run `hybridclaw tui --resume <sessionId>` command on exit.
+- `hybridclaw doctor` checks runtime health including resource hygiene
+  maintenance for stale gateway artifacts.
 - `hybridclaw onboarding` and related local setup flows can restore the last
   known-good saved config snapshot or roll back to a tracked revision when
   `config.json` becomes invalid.
+- `hybridclaw skill import` supports community sources, local directories,
+  and `.zip` archives.
 - Channel delivery stays predictable: email seeds its first mailbox cursor from
   the current head instead of replaying old inbox mail, retry-aware transports
   honor server `Retry-After` backoff, and WhatsApp startup avoids intermittent
   init-query bad-request failures.
 
+## Models, Skills, and Memory
+
+- `hybridclaw auth login` and `/model list` cover HybridAI, Codex, OpenRouter,
+  Mistral, Hugging Face, Gemini, DeepSeek, xAI, Z.AI, Kimi, MiniMax,
+  DashScope, Xiaomi, Kilo Code, and local backends such as Ollama, LM Studio,
+  llama.cpp, and vLLM. Remote OpenAI-compatible providers can merge
+  runtime-discovered model catalogs with operator-pinned lists.
+- Skills can be enabled or disabled globally or per channel from
+  `hybridclaw skill enable|disable`, TUI `/skill config`, or the admin
+  `Skills` page.
+- Built-in memory can stay standalone or layer with ByteRover, Mem0, Honcho,
+  MemPalace, QMD, and GBrain plugins depending on whether you want
+  local-first recall, hosted memory, or domain-specific retrieval.
+- Optional OpenTelemetry tracing exports gateway and agent spans to OTLP
+  backends and annotates structured logs with trace ids for cross-system
+  correlation.
+
 ## How HybridClaw compares
 
 | Capability | HybridClaw | OpenClaw | Hermes Agent |
@@ -161,7 +186,7 @@ Once the gateway is running, open HybridClaw locally:
 
 ## Architecture
 
-- **Gateway service** (Node.js) — shared message/command handlers, SQLite persistence (KV + semantic + knowledge graph + canonical sessions + usage events), scheduler, heartbeat, web/API, loopback OpenAI-compatible API, and channel integrations for Discord, Slack, Microsoft Teams, Telegram, iMessage, WhatsApp, and email
+- **Gateway service** (Node.js) — shared message/command handlers, SQLite persistence (KV + semantic + knowledge graph + canonical sessions + usage events), scheduler, heartbeat, web/API, loopback OpenAI-compatible API, and channel integrations for Discord, Slack, Microsoft Teams, Telegram, iMessage, WhatsApp, Twilio voice, and email
 - **TUI client** — thin client over HTTP (`/api/chat`, `/api/command`) with
   a structured startup banner that surfaces model, sandbox, gateway, and
   chatbot context before the first prompt, an interactive approval picker for
@@ -191,6 +216,7 @@ Browse the full manual at
 - Channels:
   [Connect Your First Channel](https://www.hybridclaw.io/docs/getting-started/first-channel),
   [Overview](https://www.hybridclaw.io/docs/channels/overview),
+  [Twilio Voice](https://www.hybridclaw.io/docs/guides/twilio-voice),
   [Discord](https://www.hybridclaw.io/docs/channels/discord),
   [Slack](https://www.hybridclaw.io/docs/channels/slack),
   [Telegram](https://www.hybridclaw.io/docs/channels/telegram),
@@ -202,7 +228,10 @@ Browse the full manual at
   [Extensibility](https://www.hybridclaw.io/docs/extensibility),
   [Bundled Skills](https://www.hybridclaw.io/docs/guides/bundled-skills),
   [Plugin System](https://www.hybridclaw.io/docs/extensibility/plugins),
+  [Memory Plugins](https://www.hybridclaw.io/docs/extensibility/memory-plugins),
+  [ByteRover Memory Plugin](https://www.hybridclaw.io/docs/extensibility/byterover-memory-plugin),
   [GBrain Plugin](https://www.hybridclaw.io/docs/extensibility/gbrain-plugin),
+  [Mem0 Memory Plugin](https://www.hybridclaw.io/docs/extensibility/mem0-memory-plugin),
   [Honcho Memory Plugin](https://www.hybridclaw.io/docs/extensibility/honcho-memory-plugin), and
   [MemPalace Memory Plugin](https://www.hybridclaw.io/docs/extensibility/mempalace-memory-plugin)
 - Configuration:

package/config.example.json

@@ -14,6 +14,7 @@
       "msteams": [],
       "slack": [],
       "telegram": [],
+      "voice": [],
       "whatsapp": [],
       "email": []
     }
@@ -21,6 +22,16 @@
   "tools": {
     "disabled": []
   },
+  "channelInstructions": {
+    "discord": "",
+    "msteams": "",
+    "slack": "",
+    "telegram": "",
+    "voice": "This is a live phone call. Produce plain spoken text only.\nKeep each reply short and conversational, usually one or two short sentences.\nAbsolutely no markdown, bullets, numbered lists, headings, code fences, tables, JSON, or decorative formatting.\nDo not narrate internal reasoning, planning, tool usage, or stage directions. Say only what the caller should hear.\nDo not spell punctuation, formatting marks, or raw URLs unless the caller explicitly asks for exact characters.",
+    "whatsapp": "",
+    "email": "",
+    "imessage": ""
+  },
   "adaptiveSkills": {
     "enabled": false,
     "observationEnabled": true,
@@ -157,6 +168,25 @@
     "ackReaction": "👀",
     "mediaMaxMb": 20
   },
+  "voice": {
+    "enabled": false,
+    "provider": "twilio",
+    "twilio": {
+      "accountSid": "",
+      "authToken": "",
+      "fromNumber": ""
+    },
+    "relay": {
+      "ttsProvider": "default",
+      "voice": "",
+      "transcriptionProvider": "default",
+      "language": "en-US",
+      "interruptible": true,
+      "welcomeGreeting": "Hello! How can I help you today?"
+    },
+    "webhookPath": "/voice",
+    "maxConcurrentCalls": 8
+  },
   "imessage": {
     "enabled": false,
     "backend": "local",
@@ -216,6 +246,51 @@
     "baseUrl": "https://router.huggingface.co/v1",
     "models": ["huggingface/meta-llama/Llama-3.1-8B-Instruct"]
   },
+  "gemini": {
+    "enabled": false,
+    "baseUrl": "https://generativelanguage.googleapis.com/v1beta/openai",
+    "models": ["gemini/gemini-2.5-pro"]
+  },
+  "deepseek": {
+    "enabled": false,
+    "baseUrl": "https://api.deepseek.com/v1",
+    "models": ["deepseek/deepseek-chat"]
+  },
+  "xai": {
+    "enabled": false,
+    "baseUrl": "https://api.x.ai/v1",
+    "models": ["xai/grok-3"]
+  },
+  "zai": {
+    "enabled": false,
+    "baseUrl": "https://api.z.ai/api/paas/v4",
+    "models": ["zai/glm-5.1"]
+  },
+  "kimi": {
+    "enabled": false,
+    "baseUrl": "https://api.moonshot.ai/v1",
+    "models": ["kimi/kimi-k2.5"]
+  },
+  "minimax": {
+    "enabled": false,
+    "baseUrl": "https://api.minimax.io/v1",
+    "models": ["minimax/MiniMax-M2"]
+  },
+  "dashscope": {
+    "enabled": false,
+    "baseUrl": "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",
+    "models": ["dashscope/qwen3-coder-plus"]
+  },
+  "xiaomi": {
+    "enabled": false,
+    "baseUrl": "https://api.xiaomimimo.com/v1",
+    "models": ["xiaomi/MiMo-7B-RL"]
+  },
+  "kilo": {
+    "enabled": false,
+    "baseUrl": "https://api.kilo.ai/api/gateway",
+    "models": ["kilo/anthropic/claude-sonnet-4.6"]
+  },
   "local": {
     "backends": {
       "ollama": {
@@ -459,6 +534,29 @@
   },
   "scheduler": {
     "jobs": [
+      {
+        "id": "resource-hygiene",
+        "name": "Resource Hygiene",
+        "description": "Runs conservative doctor-based resource hygiene twice daily and auto-applies only safe cleanup.",
+        "schedule": {
+          "kind": "every",
+          "at": null,
+          "everyMs": 43200000,
+          "expr": null,
+          "tz": "UTC"
+        },
+        "action": {
+          "kind": "system_event",
+          "message": "resource_hygiene_maintenance"
+        },
+        "delivery": {
+          "kind": "last-channel",
+          "channel": "",
+          "to": "",
+          "webhookUrl": ""
+        },
+        "enabled": true
+      },
       {
         "id": "morning-standup",
         "name": "Daily Standup Report",