@symerian/symi 3.0.20 → 3.0.22

package/docs/experiments/research/memory.md

@@ -1,228 +0,0 @@
----
-summary: "Research notes: offline memory system for Symi workspaces (Markdown source-of-truth + derived index)"
-read_when:
-  - Designing workspace memory (~/.symi/workspace) beyond daily Markdown logs
-  - Deciding: standalone CLI vs deep Symi integration
-  - Adding offline recall + reflection (retain/recall/reflect)
-title: "Workspace Memory Research"
----
-
-# Workspace Memory v2 (offline): research notes
-
-Target: Symi-style workspace (`agents.defaults.workspace`, default `~/.symi/workspace`) where “memory” is stored as one Markdown file per day (`memory/YYYY-MM-DD.md`) plus a small set of stable files (e.g. `memory.md`, `SYMICORE.md`).
-
-This doc proposes an **offline-first** memory architecture that keeps Markdown as the canonical, reviewable source of truth, but adds **structured recall** (search, entity summaries, confidence updates) via a derived index.
-
-## Why change?
-
-The current setup (one file per day) is excellent for:
-
-- “append-only” journaling
-- human editing
-- git-backed durability + auditability
-- low-friction capture (“just write it down”)
-
-It’s weak for:
-
-- high-recall retrieval (“what did we decide about X?”, “last time we tried Y?”)
-- entity-centric answers (“tell me about Alice / The Castle / warelay”) without rereading many files
-- opinion/preference stability (and evidence when it changes)
-- time constraints (“what was true during Nov 2025?”) and conflict resolution
-
-## Design goals
-
-- **Offline**: works without network; can run on laptop/Castle; no cloud dependency.
-- **Explainable**: retrieved items should be attributable (file + location) and separable from inference.
-- **Low ceremony**: daily logging stays Markdown, no heavy schema work.
-- **Incremental**: v1 is useful with FTS only; semantic/vector and graphs are optional upgrades.
-- **Agent-friendly**: makes “recall within token budgets” easy (return small bundles of facts).
-
-## North star model (Hindsight × Letta)
-
-Two pieces to blend:
-
-1. **Letta/MemGPT-style control loop**
-
-- keep a small “core” always in context (persona + key user facts)
-- everything else is out-of-context and retrieved via tools
-- memory writes are explicit tool calls (append/replace/insert), persisted, then re-injected next turn
-
-2. **Hindsight-style memory substrate**
-
-- separate what’s observed vs what’s believed vs what’s summarized
-- support retain/recall/reflect
-- confidence-bearing opinions that can evolve with evidence
-- entity-aware retrieval + temporal queries (even without full knowledge graphs)
-
-## Proposed architecture (Markdown source-of-truth + derived index)
-
-### Canonical store (git-friendly)
-
-Keep `~/.symi/workspace` as canonical human-readable memory.
-
-Suggested workspace layout:
-
-```
-~/.symi/workspace/
-  memory.md                    # small: durable facts + preferences (core-ish)
-  memory/
-    YYYY-MM-DD.md              # daily log (append; narrative)
-  bank/                        # “typed” memory pages (stable, reviewable)
-    world.md                   # objective facts about the world
-    experience.md              # what the agent did (first-person)
-    opinions.md                # subjective prefs/judgments + confidence + evidence pointers
-    entities/
-      Peter.md
-      The-Castle.md
-      warelay.md
-      ...
-```
-
-Notes:
-
-- **Daily log stays daily log**. No need to turn it into JSON.
-- The `bank/` files are **curated**, produced by reflection jobs, and can still be edited by hand.
-- `memory.md` remains “small + core-ish”: the things you want Symi to see every session.
-
-### Derived store (machine recall)
-
-Add a derived index under the workspace (not necessarily git tracked):
-
-```
-~/.symi/workspace/.memory/index.sqlite
-```
-
-Back it with:
-
-- SQLite schema for facts + entity links + opinion metadata
-- SQLite **FTS5** for lexical recall (fast, tiny, offline)
-- optional embeddings table for semantic recall (still offline)
-
-The index is always **rebuildable from Markdown**.
-
-## Retain / Recall / Reflect (operational loop)
-
-### Retain: normalize daily logs into “facts”
-
-Hindsight’s key insight that matters here: store **narrative, self-contained facts**, not tiny snippets.
-
-Practical rule for `memory/YYYY-MM-DD.md`:
-
-- at end of day (or during), add a `## Retain` section with 2–5 bullets that are:
-  - narrative (cross-turn context preserved)
-  - self-contained (standalone makes sense later)
-  - tagged with type + entity mentions
-
-Example:
-
-```
-## Retain
-- W @Peter: Currently in Marrakech (Nov 27–Dec 1, 2025) for Andy’s birthday.
-- B @warelay: I fixed the Baileys WS crash by wrapping connection.update handlers in try/catch (see memory/2025-11-27.md).
-- O(c=0.95) @Peter: Prefers concise replies (<1500 chars) on WhatsApp; long content goes into files.
-```
-
-Minimal parsing:
-
-- Type prefix: `W` (world), `B` (experience/biographical), `O` (opinion), `S` (observation/summary; usually generated)
-- Entities: `@Peter`, `@warelay`, etc (slugs map to `bank/entities/*.md`)
-- Opinion confidence: `O(c=0.0..1.0)` optional
-
-If you don’t want authors to think about it: the reflect job can infer these bullets from the rest of the log, but having an explicit `## Retain` section is the easiest “quality lever”.
-
-### Recall: queries over the derived index
-
-Recall should support:
-
-- **lexical**: “find exact terms / names / commands” (FTS5)
-- **entity**: “tell me about X” (entity pages + entity-linked facts)
-- **temporal**: “what happened around Nov 27” / “since last week”
-- **opinion**: “what does Peter prefer?” (with confidence + evidence)
-
-Return format should be agent-friendly and cite sources:
-
-- `kind` (`world|experience|opinion|observation`)
-- `timestamp` (source day, or extracted time range if present)
-- `entities` (`["Peter","warelay"]`)
-- `content` (the narrative fact)
-- `source` (`memory/2025-11-27.md#L12` etc)
-
-### Reflect: produce stable pages + update beliefs
-
-Reflection is a scheduled job (daily or heartbeat `ultrathink`) that:
-
-- updates `bank/entities/*.md` from recent facts (entity summaries)
-- updates `bank/opinions.md` confidence based on reinforcement/contradiction
-- optionally proposes edits to `memory.md` (“core-ish” durable facts)
-
-Opinion evolution (simple, explainable):
-
-- each opinion has:
-  - statement
-  - confidence `c ∈ [0,1]`
-  - last_updated
-  - evidence links (supporting + contradicting fact IDs)
-- when new facts arrive:
-  - find candidate opinions by entity overlap + similarity (FTS first, embeddings later)
-  - update confidence by small deltas; big jumps require strong contradiction + repeated evidence
-
-## CLI integration: standalone vs deep integration
-
-Recommendation: **deep integration in Symi**, but keep a separable core library.
-
-### Why integrate into Symi?
-
-- Symi already knows:
-  - the workspace path (`agents.defaults.workspace`)
-  - the session model + heartbeats
-  - logging + troubleshooting patterns
-- You want the agent itself to call the tools:
-  - `symi memory recall "…" --k 25 --since 30d`
-  - `symi memory reflect --since 7d`
-
-### Why still split a library?
-
-- keep memory logic testable without gateway/runtime
-- reuse from other contexts (local scripts, future desktop app, etc.)
-
-Shape:
-The memory tooling is intended to be a small CLI + library layer, but this is exploratory only.
-
-## “S-Collide” / SuCo: when to use it (research)
-
-If “S-Collide” refers to **SuCo (Subspace Collision)**: it’s an ANN retrieval approach that targets strong recall/latency tradeoffs by using learned/structured collisions in subspaces (paper: arXiv 2411.14754, 2024).
-
-Pragmatic take for `~/.symi/workspace`:
-
-- **don’t start** with SuCo.
-- start with SQLite FTS + (optional) simple embeddings; you’ll get most UX wins immediately.
-- consider SuCo/HNSW/ScaNN-class solutions only once:
-  - corpus is big (tens/hundreds of thousands of chunks)
-  - brute-force embedding search becomes too slow
-  - recall quality is meaningfully bottlenecked by lexical search
-
-Offline-friendly alternatives (in increasing complexity):
-
-- SQLite FTS5 + metadata filters (zero ML)
-- Embeddings + brute force (works surprisingly far if chunk count is low)
-- HNSW index (common, robust; needs a library binding)
-- SuCo (research-grade; attractive if there’s a solid implementation you can embed)
-
-Open question:
-
-- what’s the **best** offline embedding model for “personal assistant memory” on your machines (laptop + desktop)?
-  - if you already have Ollama: embed with a local model; otherwise ship a small embedding model in the toolchain.
-
-## Smallest useful pilot
-
-If you want a minimal, still-useful version:
-
-- Add `bank/` entity pages and a `## Retain` section in daily logs.
-- Use SQLite FTS for recall with citations (path + line numbers).
-- Add embeddings only if recall quality or scale demands it.
-
-## References
-
-- Letta / MemGPT concepts: “core memory blocks” + “archival memory” + tool-driven self-editing memory.
-- Hindsight Technical Report: “retain / recall / reflect”, four-network memory, narrative fact extraction, opinion confidence evolution.
-- SuCo: arXiv 2411.14754 (2024): “Subspace Collision” approximate nearest neighbor retrieval.

package/docs/gateway/authentication.md

@@ -1,162 +0,0 @@
----
-summary: "Model authentication: OAuth, API keys, and setup-token"
-read_when:
-  - Debugging model auth or OAuth expiry
-  - Documenting authentication or credential storage
-title: "Authentication"
----
-
-# Authentication
-
-Symi supports OAuth and API keys for model providers. For Anthropic
-accounts, we recommend using an **API key**. For Claude subscription access,
-use the long‑lived token created by `claude setup-token`.
-
-See [/concepts/oauth](/concepts/oauth) for the full OAuth flow and storage
-layout.
-
-## Recommended Anthropic setup (API key)
-
-If you’re using Anthropic directly, use an API key.
-
-1. Create an API key in the Anthropic Console.
-2. Put it on the **gateway host** (the machine running `symi gateway`).
-
-```bash
-export ANTHROPIC_API_KEY="..."
-symi models status
-```
-
-3. If the Gateway runs under systemd/launchd, prefer putting the key in
-   `~/.symi/.env` so the daemon can read it:
-
-```bash
-cat >> ~/.symi/.env <<'EOF'
-ANTHROPIC_API_KEY=...
-EOF
-```
-
-Then restart the daemon (or restart your Gateway process) and re-check:
-
-```bash
-symi models status
-symi doctor
-```
-
-If you’d rather not manage env vars yourself, the onboarding wizard can store
-API keys for daemon use: `symi onboard`.
-
-See [Help](/help) for details on env inheritance (`env.shellEnv`,
-`~/.symi/.env`, systemd/launchd).
-
-## Anthropic: setup-token (subscription auth)
-
-For Anthropic, the recommended path is an **API key**. If you’re using a Claude
-subscription, the setup-token flow is also supported. Run it on the **gateway host**:
-
-```bash
-claude setup-token
-```
-
-Then paste it into Symi:
-
-```bash
-symi models auth setup-token --provider anthropic
-```
-
-If the token was created on another machine, paste it manually:
-
-```bash
-symi models auth paste-token --provider anthropic
-```
-
-If you see an Anthropic error like:
-
-```
-This credential is only authorized for use with Claude Code and cannot be used for other API requests.
-```
-
-…use an Anthropic API key instead.
-
-Manual token entry (any provider; writes `auth-profiles.json` + updates config):
-
-```bash
-symi models auth paste-token --provider anthropic
-symi models auth paste-token --provider openrouter
-```
-
-Automation-friendly check (exit `1` when expired/missing, `2` when expiring):
-
-```bash
-symi models status --check
-```
-
-Optional ops scripts (systemd/Termux) are documented here:
-[/automation/auth-monitoring](/automation/auth-monitoring)
-
-> `claude setup-token` requires an interactive TTY.
-
-## Checking model auth status
-
-```bash
-symi models status
-symi doctor
-```
-
-## API key rotation behavior (gateway)
-
-Some providers support retrying a request with alternative keys when an API call
-hits a provider rate limit.
-
-- Priority order:
-  - `SYMI_LIVE_<PROVIDER>_KEY` (single override)
-  - `<PROVIDER>_API_KEYS`
-  - `<PROVIDER>_API_KEY`
-  - `<PROVIDER>_API_KEY_*`
-- Google providers also include `GOOGLE_API_KEY` as an additional fallback.
-- The same key list is deduplicated before use.
-- Symi retries with the next key only for rate-limit errors (for example
-  `429`, `rate_limit`, `quota`, `resource exhausted`).
-- Non-rate-limit errors are not retried with alternate keys.
-- If all keys fail, the final error from the last attempt is returned.
-
-## Controlling which credential is used
-
-### Per-session (chat command)
-
-Use `/model <alias-or-id>@<profileId>` to pin a specific provider credential for the current session (example profile ids: `anthropic:default`, `anthropic:work`).
-
-Use `/model` (or `/model list`) for a compact picker; use `/model status` for the full view (candidates + next auth profile, plus provider endpoint details when configured).
-
-### Per-agent (CLI override)
-
-Set an explicit auth profile order override for an agent (stored in that agent’s `auth-profiles.json`):
-
-```bash
-symi models auth order get --provider anthropic
-symi models auth order set --provider anthropic anthropic:default
-symi models auth order clear --provider anthropic
-```
-
-Use `--agent <id>` to target a specific agent; omit it to use the configured default agent.
-
-## Troubleshooting
-
-### “No credentials found”
-
-If the Anthropic token profile is missing, run `claude setup-token` on the
-**gateway host**, then re-check:
-
-```bash
-symi models status
-```
-
-### Token expiring/expired
-
-Run `symi models status` to confirm which profile is expiring. If the profile
-is missing, rerun `claude setup-token` and paste the token again.
-
-## Requirements
-
-- Claude Max or Pro subscription (for `claude setup-token`)
-- Claude Code CLI installed (`claude` command available)

package/docs/gateway/background-process.md

@@ -1,96 +0,0 @@
----
-summary: "Background exec execution and process management"
-read_when:
-  - Adding or modifying background exec behavior
-  - Debugging long-running exec tasks
-title: "Background Exec and Process Tool"
----
-
-# Background Exec + Process Tool
-
-Symi runs shell commands through the `exec` tool and keeps long‑running tasks in memory. The `process` tool manages those background sessions.
-
-## exec tool
-
-Key parameters:
-
-- `command` (required)
-- `yieldMs` (default 10000): auto‑background after this delay
-- `background` (bool): background immediately
-- `timeout` (seconds, default 1800): kill the process after this timeout
-- `elevated` (bool): run on host if elevated mode is enabled/allowed
-- Need a real TTY? Set `pty: true`.
-- `workdir`, `env`
-
-Behavior:
-
-- Foreground runs return output directly.
-- When backgrounded (explicit or timeout), the tool returns `status: "running"` + `sessionId` and a short tail.
-- Output is kept in memory until the session is polled or cleared.
-- If the `process` tool is disallowed, `exec` runs synchronously and ignores `yieldMs`/`background`.
-
-## Child process bridging
-
-When spawning long-running child processes outside the exec/process tools (for example, CLI respawns or gateway helpers), attach the child-process bridge helper so termination signals are forwarded and listeners are detached on exit/error. This avoids orphaned processes on systemd and keeps shutdown behavior consistent across platforms.
-
-Environment overrides:
-
-- `PI_BASH_YIELD_MS`: default yield (ms)
-- `PI_BASH_MAX_OUTPUT_CHARS`: in‑memory output cap (chars)
-- `SYMI_BASH_PENDING_MAX_OUTPUT_CHARS`: pending stdout/stderr cap per stream (chars)
-- `PI_BASH_JOB_TTL_MS`: TTL for finished sessions (ms, bounded to 1m–3h)
-
-Config (preferred):
-
-- `tools.exec.backgroundMs` (default 10000)
-- `tools.exec.timeoutSec` (default 1800)
-- `tools.exec.cleanupMs` (default 1800000)
-- `tools.exec.notifyOnExit` (default true): enqueue a system event + request heartbeat when a backgrounded exec exits.
-- `tools.exec.notifyOnExitEmptySuccess` (default false): when true, also enqueue completion events for successful backgrounded runs that produced no output.
-
-## process tool
-
-Actions:
-
-- `list`: running + finished sessions
-- `poll`: drain new output for a session (also reports exit status)
-- `log`: read the aggregated output (supports `offset` + `limit`)
-- `write`: send stdin (`data`, optional `eof`)
-- `kill`: terminate a background session
-- `clear`: remove a finished session from memory
-- `remove`: kill if running, otherwise clear if finished
-
-Notes:
-
-- Only backgrounded sessions are listed/persisted in memory.
-- Sessions are lost on process restart (no disk persistence).
-- Session logs are only saved to chat history if you run `process poll/log` and the tool result is recorded.
-- `process` is scoped per agent; it only sees sessions started by that agent.
-- `process list` includes a derived `name` (command verb + target) for quick scans.
-- `process log` uses line-based `offset`/`limit`.
-- When both `offset` and `limit` are omitted, it returns the last 200 lines and includes a paging hint.
-- When `offset` is provided and `limit` is omitted, it returns from `offset` to the end (not capped to 200).
-
-## Examples
-
-Run a long task and poll later:
-
-```json
-{ "tool": "exec", "command": "sleep 5 && echo done", "yieldMs": 1000 }
-```
-
-```json
-{ "tool": "process", "action": "poll", "sessionId": "<id>" }
-```
-
-Start immediately in background:
-
-```json
-{ "tool": "exec", "command": "npm run build", "background": true }
-```
-
-Send stdin:
-
-```json
-{ "tool": "process", "action": "write", "sessionId": "<id>", "data": "y\n" }
-```

package/docs/gateway/bonjour.md

@@ -1,177 +0,0 @@
----
-summary: "Bonjour/mDNS discovery + debugging (Gateway beacons, clients, and common failure modes)"
-read_when:
-  - Debugging Bonjour discovery issues on macOS/iOS
-  - Changing mDNS service types, TXT records, or discovery UX
-title: "Bonjour Discovery"
----
-
-# Bonjour / mDNS discovery
-
-Symi uses Bonjour (mDNS / DNS‑SD) as a **LAN‑only convenience** to discover
-an active Gateway (WebSocket endpoint). It is best‑effort and does **not** replace SSH or
-Tailnet-based connectivity.
-
-## Wide‑area Bonjour (Unicast DNS‑SD) over Tailscale
-
-If the node and gateway are on different networks, multicast mDNS won’t cross the
-boundary. You can keep the same discovery UX by switching to **unicast DNS‑SD**
-("Wide‑Area Bonjour") over Tailscale.
-
-High‑level steps:
-
-1. Run a DNS server on the gateway host (reachable over Tailnet).
-2. Publish DNS‑SD records for `_symi-gw._tcp` under a dedicated zone
-   (example: `symi.internal.`).
-3. Configure Tailscale **split DNS** so your chosen domain resolves via that
-   DNS server for clients (including iOS).
-
-Symi supports any discovery domain; `symi.internal.` is just an example.
-iOS/Android nodes browse both `local.` and your configured wide‑area domain.
-
-### Gateway config (recommended)
-
-```json5
-{
-  gateway: { bind: "tailnet" }, // tailnet-only (recommended)
-  discovery: { wideArea: { enabled: true } }, // enables wide-area DNS-SD publishing
-}
-```
-
-### One‑time DNS server setup (gateway host)
-
-```bash
-symi dns setup --apply
-```
-
-This installs CoreDNS and configures it to:
-
-- listen on port 53 only on the gateway’s Tailscale interfaces
-- serve your chosen domain (example: `symi.internal.`) from `~/.symi/dns/<domain>.db`
-
-Validate from a tailnet‑connected machine:
-
-```bash
-dns-sd -B _symi-gw._tcp symi.internal.
-dig @<TAILNET_IPV4> -p 53 _symi-gw._tcp.symi.internal PTR +short
-```
-
-### Tailscale DNS settings
-
-In the Tailscale admin console:
-
-- Add a nameserver pointing at the gateway’s tailnet IP (UDP/TCP 53).
-- Add split DNS so your discovery domain uses that nameserver.
-
-Once clients accept tailnet DNS, iOS nodes can browse
-`_symi-gw._tcp` in your discovery domain without multicast.
-
-### Gateway listener security (recommended)
-
-The Gateway WS port (default `18789`) binds to loopback by default. For LAN/tailnet
-access, bind explicitly and keep auth enabled.
-
-For tailnet‑only setups:
-
-- Set `gateway.bind: "tailnet"` in `~/.symi/symi.json`.
-- Restart the Gateway (or restart the macOS menubar app).
-
-## What advertises
-
-Only the Gateway advertises `_symi-gw._tcp`.
-
-## Service types
-
-- `_symi-gw._tcp` — gateway transport beacon (used by macOS/iOS/Android nodes).
-
-## TXT keys (non‑secret hints)
-
-The Gateway advertises small non‑secret hints to make UI flows convenient:
-
-- `role=gateway`
-- `displayName=<friendly name>`
-- `lanHost=<hostname>.local`
-- `gatewayPort=<port>` (Gateway WS + HTTP)
-- `gatewayTls=1` (only when TLS is enabled)
-- `gatewayTlsSha256=<sha256>` (only when TLS is enabled and fingerprint is available)
-- `canvasPort=<port>` (only when the canvas host is enabled; currently the same as `gatewayPort`)
-- `sshPort=<port>` (defaults to 22 when not overridden)
-- `transport=gateway`
-- `cliPath=<path>` (optional; absolute path to a runnable `symi` entrypoint)
-- `tailnetDns=<magicdns>` (optional hint when Tailnet is available)
-
-Security notes:
-
-- Bonjour/mDNS TXT records are **unauthenticated**. Clients must not treat TXT as authoritative routing.
-- Clients should route using the resolved service endpoint (SRV + A/AAAA). Treat `lanHost`, `tailnetDns`, `gatewayPort`, and `gatewayTlsSha256` as hints only.
-- TLS pinning must never allow an advertised `gatewayTlsSha256` to override a previously stored pin.
-- iOS/Android nodes should treat discovery-based direct connects as **TLS-only** and require explicit user confirmation before trusting a first-time fingerprint.
-
-## Debugging on macOS
-
-Useful built‑in tools:
-
-- Browse instances:
-
-  ```bash
-  dns-sd -B _symi-gw._tcp local.
-  ```
-
-- Resolve one instance (replace `<instance>`):
-
-  ```bash
-  dns-sd -L "<instance>" _symi-gw._tcp local.
-  ```
-
-If browsing works but resolving fails, you’re usually hitting a LAN policy or
-mDNS resolver issue.
-
-## Debugging in Gateway logs
-
-The Gateway writes a rolling log file (printed on startup as
-`gateway log file: ...`). Look for `bonjour:` lines, especially:
-
-- `bonjour: advertise failed ...`
-- `bonjour: ... name conflict resolved` / `hostname conflict resolved`
-- `bonjour: watchdog detected non-announced service ...`
-
-## Debugging on iOS node
-
-The iOS node uses `NWBrowser` to discover `_symi-gw._tcp`.
-
-To capture logs:
-
-- Settings → Gateway → Advanced → **Discovery Debug Logs**
-- Settings → Gateway → Advanced → **Discovery Logs** → reproduce → **Copy**
-
-The log includes browser state transitions and result‑set changes.
-
-## Common failure modes
-
-- **Bonjour doesn’t cross networks**: use Tailnet or SSH.
-- **Multicast blocked**: some Wi‑Fi networks disable mDNS.
-- **Sleep / interface churn**: macOS may temporarily drop mDNS results; retry.
-- **Browse works but resolve fails**: keep machine names simple (avoid emojis or
-  punctuation), then restart the Gateway. The service instance name derives from
-  the host name, so overly complex names can confuse some resolvers.
-
-## Escaped instance names (`\032`)
-
-Bonjour/DNS‑SD often escapes bytes in service instance names as decimal `\DDD`
-sequences (e.g. spaces become `\032`).
-
-- This is normal at the protocol level.
-- UIs should decode for display (iOS uses `BonjourEscapes.decode`).
-
-## Disabling / configuration
-
-- `SYMI_DISABLE_BONJOUR=1` disables advertising (legacy: `SYMI_DISABLE_BONJOUR`).
-- `gateway.bind` in `~/.symi/symi.json` controls the Gateway bind mode.
-- `SYMI_SSH_PORT` overrides the SSH port advertised in TXT (legacy: `SYMI_SSH_PORT`).
-- `SYMI_TAILNET_DNS` publishes a MagicDNS hint in TXT (legacy: `SYMI_TAILNET_DNS`).
-- `SYMI_CLI_PATH` overrides the advertised CLI path (legacy: `SYMI_CLI_PATH`).
-
-## Related docs
-
-- Discovery policy and transport selection: [Discovery](/gateway/discovery)
-- Node pairing + approvals: [Gateway pairing](/gateway/pairing)