agentix-cli 0.15.0 → 0.17.0

package/dist/index.d.ts

@@ -977,6 +977,14 @@ declare class HookRegistry {
      * For blocking events, stops at the first hook that returns { blocked: true }.
      */
     execute(event: HookEvent, context: HookContext): Promise<HookResult>;
+    /**
+     * Register an in-process handler for an event. Used by modules that ship
+     * their hook behavior as plain JS functions rather than as command/script/
+     * prompt definitions loaded from disk (e.g. the workflow engine's
+     * subscribers to on:gitlab-issue / on:gitlab-pipeline / post:response).
+     * Priority follows the same rule as register(): lower runs first.
+     */
+    registerHandler(event: HookEvent, name: string, handler: HookHandler, priority?: number): void;
     /**
      * Check if any hooks are registered for an event.
      */
@@ -985,6 +993,9 @@ declare class HookRegistry {
      * Clear all hooks (useful for testing).
      */
     clear(): void;
+    /** Total number of registered hook entries across all events. Used by the
+     *  daemon reload path to surface hook-count deltas in the reload summary. */
+    size(): number;
     /**
      * Create a HookHandler from a HookDefinition.
      */
@@ -1537,20 +1548,45 @@ declare const daemonConfigSchema: z.ZodObject<{
             accounts: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
                 token: z.ZodString;
                 agentBinding: z.ZodString;
+                /** Per-account sender allowlist. When set, OVERRIDES the global
+                 *  `policy.allowFrom`. Entries accept:
+                 *    - numeric user id  ("1816212449")         — matches sender (from.id)
+                 *    - numeric chat id  ("-1003861455814")     — matches chat (chat.id)
+                 *    - "@username"                             — matches sender username
+                 *  A message is dispatched iff at least one entry matches. */
+                allowFrom: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                /** When false, the daemon keeps the bot token registered so outbound
+                 *  `send()` / ring notifications work, but does NOT long-poll for inbound
+                 *  updates. Use this on nodes where the bound agent lives on a different
+                 *  daemon — otherwise two daemons race on the same `getUpdates` cursor and
+                 *  Telegram responds 409 Conflict on every poll.
+                 *  Defaults to true (poll) so existing single-node setups are unchanged. */
+                pollInbound: z.ZodDefault<z.ZodBoolean>;
             }, "strip", z.ZodTypeAny, {
                 token: string;
                 agentBinding: string;
+                pollInbound: boolean;
+                allowFrom?: string[] | undefined;
             }, {
                 token: string;
                 agentBinding: string;
+                allowFrom?: string[] | undefined;
+                pollInbound?: boolean | undefined;
             }>>>;
             policy: z.ZodDefault<z.ZodObject<{
                 dm: z.ZodDefault<z.ZodEnum<["pair", "block"]>>;
                 group: z.ZodDefault<z.ZodEnum<["mention-required", "all"]>>;
+                /** Global sender allowlist applied to every account that doesn't set
+                 *  its own `allowFrom`. When neither is configured, every incoming
+                 *  message is dropped — closed by default. Same entry forms as the
+                 *  per-account list (user id, chat id, @username). */
+                allowFrom: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             }, "strip", z.ZodTypeAny, {
                 dm: "block" | "pair";
                 group: "all" | "mention-required";
+                allowFrom?: string[] | undefined;
             }, {
+                allowFrom?: string[] | undefined;
                 dm?: "block" | "pair" | undefined;
                 group?: "all" | "mention-required" | undefined;
             }>>;
@@ -1559,18 +1595,24 @@ declare const daemonConfigSchema: z.ZodObject<{
             accounts: Record<string, {
                 token: string;
                 agentBinding: string;
+                pollInbound: boolean;
+                allowFrom?: string[] | undefined;
             }>;
             policy: {
                 dm: "block" | "pair";
                 group: "all" | "mention-required";
+                allowFrom?: string[] | undefined;
             };
         }, {
             enabled?: boolean | undefined;
             accounts?: Record<string, {
                 token: string;
                 agentBinding: string;
+                allowFrom?: string[] | undefined;
+                pollInbound?: boolean | undefined;
             }> | undefined;
             policy?: {
+                allowFrom?: string[] | undefined;
                 dm?: "block" | "pair" | undefined;
                 group?: "all" | "mention-required" | undefined;
             } | undefined;
@@ -1593,6 +1635,78 @@ declare const daemonConfigSchema: z.ZodObject<{
                 group?: string | undefined;
                 contact?: string | undefined;
             }>, "many">>;
+            /** Data-source ingestion — turns WhatsApp from a messaging-only channel
+             *  into a source that seeds the wiki with contact/group metadata (and
+             *  optionally bounded message windows) per an explicit allowlist.
+             *  Default-deny: `enabled: false` and empty allowlists mean nothing is
+             *  ingested. See docs/reference/whatsapp-ingest.md for the full story. */
+            ingest: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                /** `metadata-only` pulls contact/group info; `messages` additionally
+                 *  pulls the last `messageCap` messages per allowlisted chat. */
+                mode: z.ZodDefault<z.ZodEnum<["metadata-only", "messages"]>>;
+                /** Phone numbers or JIDs. Substring match, same semantics as allowFrom. */
+                allowContacts: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                allowGroups: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                denyContacts: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                denyGroups: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                /** Per-chat cap when mode = "messages". Keeps the raw-entry size bounded. */
+                messageCap: z.ZodDefault<z.ZodNumber>;
+                /** Max age (days) of messages to consider for the bounded window. */
+                historyDays: z.ZodDefault<z.ZodNumber>;
+                /** Skip re-writing a contact entry unless this many days have passed
+                 *  OR the profile hash differs. Prevents churn on unchanged profiles. */
+                contactRefreshDays: z.ZodDefault<z.ZodNumber>;
+                /** Safety rails on live Baileys reads — personal-account accounts
+                 *  can get throttled/banned under burst reads. */
+                throttle: z.ZodDefault<z.ZodObject<{
+                    minMsBetweenCalls: z.ZodDefault<z.ZodNumber>;
+                    maxCallsPerMinute: z.ZodDefault<z.ZodNumber>;
+                    maxChatsPerSweep: z.ZodDefault<z.ZodNumber>;
+                }, "strip", z.ZodTypeAny, {
+                    minMsBetweenCalls: number;
+                    maxCallsPerMinute: number;
+                    maxChatsPerSweep: number;
+                }, {
+                    minMsBetweenCalls?: number | undefined;
+                    maxCallsPerMinute?: number | undefined;
+                    maxChatsPerSweep?: number | undefined;
+                }>>;
+                /** Purge absorbed raw entries older than this many days. `0` = never. */
+                retentionDays: z.ZodDefault<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                mode: "messages" | "metadata-only";
+                allowContacts: string[];
+                allowGroups: string[];
+                denyContacts: string[];
+                denyGroups: string[];
+                messageCap: number;
+                historyDays: number;
+                contactRefreshDays: number;
+                throttle: {
+                    minMsBetweenCalls: number;
+                    maxCallsPerMinute: number;
+                    maxChatsPerSweep: number;
+                };
+                retentionDays: number;
+            }, {
+                enabled?: boolean | undefined;
+                mode?: "messages" | "metadata-only" | undefined;
+                allowContacts?: string[] | undefined;
+                allowGroups?: string[] | undefined;
+                denyContacts?: string[] | undefined;
+                denyGroups?: string[] | undefined;
+                messageCap?: number | undefined;
+                historyDays?: number | undefined;
+                contactRefreshDays?: number | undefined;
+                throttle?: {
+                    minMsBetweenCalls?: number | undefined;
+                    maxCallsPerMinute?: number | undefined;
+                    maxChatsPerSweep?: number | undefined;
+                } | undefined;
+                retentionDays?: number | undefined;
+            }>>;
         }, "strip", z.ZodTypeAny, {
             enabled: boolean;
             sessionDir: string;
@@ -1601,18 +1715,52 @@ declare const daemonConfigSchema: z.ZodObject<{
                 group?: string | undefined;
                 contact?: string | undefined;
             }[];
-            defaultAgent?: string | undefined;
+            ingest: {
+                enabled: boolean;
+                mode: "messages" | "metadata-only";
+                allowContacts: string[];
+                allowGroups: string[];
+                denyContacts: string[];
+                denyGroups: string[];
+                messageCap: number;
+                historyDays: number;
+                contactRefreshDays: number;
+                throttle: {
+                    minMsBetweenCalls: number;
+                    maxCallsPerMinute: number;
+                    maxChatsPerSweep: number;
+                };
+                retentionDays: number;
+            };
             allowFrom?: string[] | undefined;
+            defaultAgent?: string | undefined;
         }, {
             enabled?: boolean | undefined;
+            allowFrom?: string[] | undefined;
             sessionDir?: string | undefined;
             defaultAgent?: string | undefined;
-            allowFrom?: string[] | undefined;
             routes?: {
                 agent: string;
                 group?: string | undefined;
                 contact?: string | undefined;
             }[] | undefined;
+            ingest?: {
+                enabled?: boolean | undefined;
+                mode?: "messages" | "metadata-only" | undefined;
+                allowContacts?: string[] | undefined;
+                allowGroups?: string[] | undefined;
+                denyContacts?: string[] | undefined;
+                denyGroups?: string[] | undefined;
+                messageCap?: number | undefined;
+                historyDays?: number | undefined;
+                contactRefreshDays?: number | undefined;
+                throttle?: {
+                    minMsBetweenCalls?: number | undefined;
+                    maxCallsPerMinute?: number | undefined;
+                    maxChatsPerSweep?: number | undefined;
+                } | undefined;
+                retentionDays?: number | undefined;
+            } | undefined;
         }>>;
         discord: z.ZodDefault<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -1719,6 +1867,247 @@ declare const daemonConfigSchema: z.ZodObject<{
                 node?: string | undefined;
             }[] | undefined;
         }>>;
+        github: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            /** GitHub PAT or env var (${GITHUB_TOKEN}) for posting comments back. */
+            token: z.ZodOptional<z.ZodString>;
+            /** Path to file containing the token (first line read at startup). */
+            tokenFile: z.ZodOptional<z.ZodString>;
+            /** GitHub App ID (legacy issuer). */
+            appId: z.ZodOptional<z.ZodNumber>;
+            /** GitHub App Client ID (preferred JWT issuer per GitHub's updated docs). */
+            clientId: z.ZodOptional<z.ZodString>;
+            /** Path to the GitHub App private key PEM file. */
+            privateKeyFile: z.ZodOptional<z.ZodString>;
+            /** Webhook secret for validating X-Hub-Signature-256. */
+            webhookSecret: z.ZodOptional<z.ZodString>;
+            /** Repo → agent routing. Use "owner/repo" or "*" for default. */
+            routes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                repo: z.ZodString;
+                agent: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                agent: string;
+                repo: string;
+            }, {
+                agent: string;
+                repo: string;
+            }>, "many">>;
+            /** Per-agent identity mappings (GitHub usernames, tokens, mesh nodes). */
+            agentMappings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                agentId: z.ZodString;
+                githubUsernames: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                token: z.ZodOptional<z.ZodString>;
+                tokenFile: z.ZodOptional<z.ZodString>;
+                node: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                agentId: string;
+                githubUsernames: string[];
+                token?: string | undefined;
+                node?: string | undefined;
+                tokenFile?: string | undefined;
+            }, {
+                agentId: string;
+                token?: string | undefined;
+                node?: string | undefined;
+                tokenFile?: string | undefined;
+                githubUsernames?: string[] | undefined;
+            }>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            routes: {
+                agent: string;
+                repo: string;
+            }[];
+            agentMappings: {
+                agentId: string;
+                githubUsernames: string[];
+                token?: string | undefined;
+                node?: string | undefined;
+                tokenFile?: string | undefined;
+            }[];
+            token?: string | undefined;
+            webhookSecret?: string | undefined;
+            tokenFile?: string | undefined;
+            appId?: number | undefined;
+            clientId?: string | undefined;
+            privateKeyFile?: string | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            token?: string | undefined;
+            routes?: {
+                agent: string;
+                repo: string;
+            }[] | undefined;
+            webhookSecret?: string | undefined;
+            agentMappings?: {
+                agentId: string;
+                token?: string | undefined;
+                node?: string | undefined;
+                tokenFile?: string | undefined;
+                githubUsernames?: string[] | undefined;
+            }[] | undefined;
+            tokenFile?: string | undefined;
+            appId?: number | undefined;
+            clientId?: string | undefined;
+            privateKeyFile?: string | undefined;
+        }>>;
+        webrtc: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            /** ICE STUN servers for NAT discovery. Default is Google's public STUN. */
+            stunServers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            /** Optional TURN relays (required when both peers are behind symmetric NAT). */
+            turnServers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                urls: z.ZodString;
+                username: z.ZodOptional<z.ZodString>;
+                credential: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                urls: string;
+                username?: string | undefined;
+                credential?: string | undefined;
+            }, {
+                urls: string;
+                username?: string | undefined;
+                credential?: string | undefined;
+            }>, "many">>;
+            /** Peer names permitted to *initiate* a call into this daemon. Empty = allow all mesh peers. */
+            allowedCallers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            /** Where to send "someone is calling" notifications when an inbound ring
+             *  arrives. Each entry is delivered via the matching channel adapter —
+             *  same plumbing as any other outbound message. Empty disables notifications. */
+            ringNotify: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                channel: z.ZodString;
+                chatId: z.ZodString;
+                accountId: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                channel: string;
+                chatId: string;
+                accountId?: string | undefined;
+            }, {
+                channel: string;
+                chatId: string;
+                accountId?: string | undefined;
+            }>, "many">>;
+            /** Base URL used when building the tap-to-join link in ring notifications.
+             *  Defaults to `http://<node.bind>` — override when the daemon's public
+             *  hostname differs (e.g. HTTPS-terminated tunnel, Tailscale MagicDNS). */
+            callUrlBase: z.ZodOptional<z.ZodString>;
+            /** AI participant ("bot") joins calls when a browser opens with `?bot=<id>`.
+             *  v1 is transcribe-only — bot consumes remote audio, transcribes via
+             *  Whisper, posts chunks to the configured channel. No TTS-back. */
+            bot: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                /** Default agent id used to attribute the transcript when the URL
+                 *  doesn't override via `?bot=<other-agent>`. */
+                defaultAgentId: z.ZodOptional<z.ZodString>;
+                /** "auto" tries mlx-whisper, falls back to OpenAI; explicit forces. */
+                whisperBackend: z.ZodDefault<z.ZodEnum<["auto", "mlx", "openai"]>>;
+                whisperModel: z.ZodOptional<z.ZodString>;
+                whisperLanguage: z.ZodDefault<z.ZodString>;
+                /** Absolute path to mlx_whisper if not on the daemon's PATH (common
+                 *  on macOS launchd, where ~/.pyenv/shims is missing from the env). */
+                mlxBinary: z.ZodOptional<z.ZodString>;
+                /** Where to send each transcribed chunk. Same shape as ringNotify[]. */
+                transcriptChannel: z.ZodOptional<z.ZodObject<{
+                    channel: z.ZodString;
+                    chatId: z.ZodString;
+                    accountId: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                }, {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                }>>;
+                /** Hard cap so a forgotten bot doesn't run forever. */
+                maxCallMinutes: z.ZodDefault<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                whisperBackend: "openai" | "auto" | "mlx";
+                whisperLanguage: string;
+                maxCallMinutes: number;
+                defaultAgentId?: string | undefined;
+                whisperModel?: string | undefined;
+                mlxBinary?: string | undefined;
+                transcriptChannel?: {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                } | undefined;
+            }, {
+                enabled?: boolean | undefined;
+                defaultAgentId?: string | undefined;
+                whisperBackend?: "openai" | "auto" | "mlx" | undefined;
+                whisperModel?: string | undefined;
+                whisperLanguage?: string | undefined;
+                mlxBinary?: string | undefined;
+                transcriptChannel?: {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                } | undefined;
+                maxCallMinutes?: number | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            stunServers: string[];
+            turnServers: {
+                urls: string;
+                username?: string | undefined;
+                credential?: string | undefined;
+            }[];
+            allowedCallers: string[];
+            ringNotify: {
+                channel: string;
+                chatId: string;
+                accountId?: string | undefined;
+            }[];
+            bot: {
+                enabled: boolean;
+                whisperBackend: "openai" | "auto" | "mlx";
+                whisperLanguage: string;
+                maxCallMinutes: number;
+                defaultAgentId?: string | undefined;
+                whisperModel?: string | undefined;
+                mlxBinary?: string | undefined;
+                transcriptChannel?: {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                } | undefined;
+            };
+            callUrlBase?: string | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            stunServers?: string[] | undefined;
+            turnServers?: {
+                urls: string;
+                username?: string | undefined;
+                credential?: string | undefined;
+            }[] | undefined;
+            allowedCallers?: string[] | undefined;
+            ringNotify?: {
+                channel: string;
+                chatId: string;
+                accountId?: string | undefined;
+            }[] | undefined;
+            callUrlBase?: string | undefined;
+            bot?: {
+                enabled?: boolean | undefined;
+                defaultAgentId?: string | undefined;
+                whisperBackend?: "openai" | "auto" | "mlx" | undefined;
+                whisperModel?: string | undefined;
+                whisperLanguage?: string | undefined;
+                mlxBinary?: string | undefined;
+                transcriptChannel?: {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                } | undefined;
+                maxCallMinutes?: number | undefined;
+            } | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         gitlab: {
             enabled: boolean;
@@ -1743,10 +2132,13 @@ declare const daemonConfigSchema: z.ZodObject<{
             accounts: Record<string, {
                 token: string;
                 agentBinding: string;
+                pollInbound: boolean;
+                allowFrom?: string[] | undefined;
             }>;
             policy: {
                 dm: "block" | "pair";
                 group: "all" | "mention-required";
+                allowFrom?: string[] | undefined;
             };
         };
         whatsapp: {
@@ -1757,8 +2149,25 @@ declare const daemonConfigSchema: z.ZodObject<{
                 group?: string | undefined;
                 contact?: string | undefined;
             }[];
-            defaultAgent?: string | undefined;
+            ingest: {
+                enabled: boolean;
+                mode: "messages" | "metadata-only";
+                allowContacts: string[];
+                allowGroups: string[];
+                denyContacts: string[];
+                denyGroups: string[];
+                messageCap: number;
+                historyDays: number;
+                contactRefreshDays: number;
+                throttle: {
+                    minMsBetweenCalls: number;
+                    maxCallsPerMinute: number;
+                    maxChatsPerSweep: number;
+                };
+                retentionDays: number;
+            };
             allowFrom?: string[] | undefined;
+            defaultAgent?: string | undefined;
         };
         discord: {
             enabled: boolean;
@@ -1771,6 +2180,56 @@ declare const daemonConfigSchema: z.ZodObject<{
             botToken?: string | undefined;
             appToken?: string | undefined;
         };
+        github: {
+            enabled: boolean;
+            routes: {
+                agent: string;
+                repo: string;
+            }[];
+            agentMappings: {
+                agentId: string;
+                githubUsernames: string[];
+                token?: string | undefined;
+                node?: string | undefined;
+                tokenFile?: string | undefined;
+            }[];
+            token?: string | undefined;
+            webhookSecret?: string | undefined;
+            tokenFile?: string | undefined;
+            appId?: number | undefined;
+            clientId?: string | undefined;
+            privateKeyFile?: string | undefined;
+        };
+        webrtc: {
+            enabled: boolean;
+            stunServers: string[];
+            turnServers: {
+                urls: string;
+                username?: string | undefined;
+                credential?: string | undefined;
+            }[];
+            allowedCallers: string[];
+            ringNotify: {
+                channel: string;
+                chatId: string;
+                accountId?: string | undefined;
+            }[];
+            bot: {
+                enabled: boolean;
+                whisperBackend: "openai" | "auto" | "mlx";
+                whisperLanguage: string;
+                maxCallMinutes: number;
+                defaultAgentId?: string | undefined;
+                whisperModel?: string | undefined;
+                mlxBinary?: string | undefined;
+                transcriptChannel?: {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                } | undefined;
+            };
+            callUrlBase?: string | undefined;
+        };
     }, {
         gitlab?: {
             enabled?: boolean | undefined;
@@ -1795,22 +2254,42 @@ declare const daemonConfigSchema: z.ZodObject<{
             accounts?: Record<string, {
                 token: string;
                 agentBinding: string;
+                allowFrom?: string[] | undefined;
+                pollInbound?: boolean | undefined;
             }> | undefined;
             policy?: {
+                allowFrom?: string[] | undefined;
                 dm?: "block" | "pair" | undefined;
                 group?: "all" | "mention-required" | undefined;
             } | undefined;
         } | undefined;
         whatsapp?: {
             enabled?: boolean | undefined;
+            allowFrom?: string[] | undefined;
             sessionDir?: string | undefined;
             defaultAgent?: string | undefined;
-            allowFrom?: string[] | undefined;
             routes?: {
                 agent: string;
                 group?: string | undefined;
                 contact?: string | undefined;
             }[] | undefined;
+            ingest?: {
+                enabled?: boolean | undefined;
+                mode?: "messages" | "metadata-only" | undefined;
+                allowContacts?: string[] | undefined;
+                allowGroups?: string[] | undefined;
+                denyContacts?: string[] | undefined;
+                denyGroups?: string[] | undefined;
+                messageCap?: number | undefined;
+                historyDays?: number | undefined;
+                contactRefreshDays?: number | undefined;
+                throttle?: {
+                    minMsBetweenCalls?: number | undefined;
+                    maxCallsPerMinute?: number | undefined;
+                    maxChatsPerSweep?: number | undefined;
+                } | undefined;
+                retentionDays?: number | undefined;
+            } | undefined;
         } | undefined;
         discord?: {
             enabled?: boolean | undefined;
@@ -1823,6 +2302,56 @@ declare const daemonConfigSchema: z.ZodObject<{
             botToken?: string | undefined;
             appToken?: string | undefined;
         } | undefined;
+        github?: {
+            enabled?: boolean | undefined;
+            token?: string | undefined;
+            routes?: {
+                agent: string;
+                repo: string;
+            }[] | undefined;
+            webhookSecret?: string | undefined;
+            agentMappings?: {
+                agentId: string;
+                token?: string | undefined;
+                node?: string | undefined;
+                tokenFile?: string | undefined;
+                githubUsernames?: string[] | undefined;
+            }[] | undefined;
+            tokenFile?: string | undefined;
+            appId?: number | undefined;
+            clientId?: string | undefined;
+            privateKeyFile?: string | undefined;
+        } | undefined;
+        webrtc?: {
+            enabled?: boolean | undefined;
+            stunServers?: string[] | undefined;
+            turnServers?: {
+                urls: string;
+                username?: string | undefined;
+                credential?: string | undefined;
+            }[] | undefined;
+            allowedCallers?: string[] | undefined;
+            ringNotify?: {
+                channel: string;
+                chatId: string;
+                accountId?: string | undefined;
+            }[] | undefined;
+            callUrlBase?: string | undefined;
+            bot?: {
+                enabled?: boolean | undefined;
+                defaultAgentId?: string | undefined;
+                whisperBackend?: "openai" | "auto" | "mlx" | undefined;
+                whisperModel?: string | undefined;
+                whisperLanguage?: string | undefined;
+                mlxBinary?: string | undefined;
+                transcriptChannel?: {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                } | undefined;
+                maxCallMinutes?: number | undefined;
+            } | undefined;
+        } | undefined;
     }>>;
     crons: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -2408,6 +2937,7 @@ declare const daemonConfigSchema: z.ZodObject<{
             url: z.ZodString;
             dashboardUrl: z.ZodOptional<z.ZodString>;
             token: z.ZodOptional<z.ZodString>;
+            /** Phone numbers or JIDs. Substring match, same semantics as allowFrom. */
             dashboardToken: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             name: string;
@@ -2422,7 +2952,8 @@ declare const daemonConfigSchema: z.ZodObject<{
             dashboardUrl?: string | undefined;
             dashboardToken?: string | undefined;
         }>, "many">>;
-        draftAgent: z.ZodOptional<z.ZodString>;
+        draftAgent: z.ZodOptional<z.ZodString>; /** Safety rails on live Baileys reads — personal-account accounts
+         *  can get throttled/banned under burst reads. */
     }, "strip", z.ZodTypeAny, {
         enabled: boolean;
         port: number;
@@ -2452,6 +2983,89 @@ declare const daemonConfigSchema: z.ZodObject<{
         }[] | undefined;
         draftAgent?: string | undefined;
     }>>;
+    graph: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        /** Where the schema/nodes/classifications live. Relative to cwd. */
+        baseDir: z.ZodDefault<z.ZodString>;
+        /** Which agent makes LLM classification proposals. Falls back to
+         *  `dashboard.draftAgent` at call sites if unset. */
+        draftAgent: z.ZodOptional<z.ZodString>;
+        /** Agent used by `agentx graph review` to triage pending classifications.
+         *  Should be an agent with the wiki skill so it can call `wiki query` for
+         *  context before deciding approve/reject. Falls back to draftAgent. */
+        reviewAgent: z.ZodOptional<z.ZodString>;
+        /** Structural auto-approval policy. Evaluated against each classification
+         *  independently of `autoApproveConfidence`; either triggers approval.
+         *    - "strict"        : never approve via structure — every classification
+         *                        waits for human review
+         *    - "extend-leaves" : auto-approve when the proposed path (a) reuses only
+         *                        existing nodes, or (b) adds exactly one NEW node at
+         *                        the deepest level. Structural changes (new mid-path
+         *                        node, new root) still queue for review. Default.
+         *    - "any"           : auto-approve every classification regardless of
+         *                        structural change
+         */
+        autoApproveStructure: z.ZodDefault<z.ZodEnum<["strict", "extend-leaves", "any"]>>;
+        /** Minimum classifier confidence (0..1) to auto-approve. OR'd with the
+         *  structural policy — either hitting the threshold lets the classification
+         *  bypass the pending queue. 1.0 (default) disables this knob, so approval
+         *  is driven by `autoApproveStructure` alone. Lower it to e.g. 0.7 if you
+         *  also want high-confidence structural changes auto-approved. */
+        autoApproveConfidence: z.ZodDefault<z.ZodNumber>;
+        /** Weights for the wiki hybrid retrieval score. Path-ancestry match vs
+         *  BM25 over article text. Sum need not be 1. */
+        retrievalWeights: z.ZodDefault<z.ZodObject<{
+            graph: z.ZodDefault<z.ZodNumber>;
+            bm25: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            graph: number;
+            bm25: number;
+        }, {
+            graph?: number | undefined;
+            bm25?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        baseDir: string;
+        autoApproveStructure: "any" | "strict" | "extend-leaves";
+        autoApproveConfidence: number;
+        retrievalWeights: {
+            graph: number;
+            bm25: number;
+        };
+        draftAgent?: string | undefined;
+        reviewAgent?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        draftAgent?: string | undefined;
+        baseDir?: string | undefined;
+        reviewAgent?: string | undefined;
+        autoApproveStructure?: "any" | "strict" | "extend-leaves" | undefined;
+        autoApproveConfidence?: number | undefined;
+        retrievalWeights?: {
+            graph?: number | undefined;
+            bm25?: number | undefined;
+        } | undefined;
+    }>>;
+    /** Workflow engine — declarative state machines that bind channel events
+     *  to agents. Off by default; existing installs see no change until
+     *  flipped. Definitions live under `dir` (default .agentx/workflows/). */
+    workflows: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        dir: z.ZodDefault<z.ZodString>;
+        /** Controls whether the dashboard exposes the visual editor. "readonly"
+         *  serves the list + run timelines but strips write controls from the
+         *  page. "disabled" hides the tab entirely. */
+        editor: z.ZodDefault<z.ZodEnum<["disabled", "readonly", "edit"]>>;
+    }, "strip", z.ZodTypeAny, {
+        dir: string;
+        enabled: boolean;
+        editor: "disabled" | "readonly" | "edit";
+    }, {
+        dir?: string | undefined;
+        enabled?: boolean | undefined;
+        editor?: "disabled" | "readonly" | "edit" | undefined;
+    }>>;
     /** Registered inbound webhooks — an inventory the dashboard manages. Each
      *  entry binds an (agent, source) pair to an optional signing secret. The
      *  actual inbound URL is always POST /webhook/<agentId>/<source>. */
@@ -2462,12 +3076,15 @@ declare const daemonConfigSchema: z.ZodObject<{
         secretEnv: z.ZodOptional<z.ZodString>;
         description: z.ZodOptional<z.ZodString>;
         enabled: z.ZodDefault<z.ZodBoolean>;
+        /** Route to a mesh peer instead of local execution. */
+        node: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         enabled: boolean;
         id: string;
         source: "custom" | "gitlab" | "discord" | "slack" | "github" | "sentry" | "stripe";
         agentId: string;
         description?: string | undefined;
+        node?: string | undefined;
         secretEnv?: string | undefined;
     }, {
         id: string;
@@ -2475,18 +3092,57 @@ declare const daemonConfigSchema: z.ZodObject<{
         agentId: string;
         enabled?: boolean | undefined;
         description?: string | undefined;
+        node?: string | undefined;
         secretEnv?: string | undefined;
     }>, "many">>;
-    /** Session cache-reuse policy. `staleMinutes` controls how long a Claude
-     *  session can idle before we rebuild the prompt from scratch (paying the
-     *  full cache-create tax again). Longer is cheaper at Opus rates but means
-     *  an agent may resume with mildly outdated context. */
+    /** Session cache-reuse policy. Controls when we drop a Claude `--resume`
+     *  session and rebuild the prompt from scratch.
+     *  - `staleMinutes`: idle timeout before rotation. Longer is cheaper at
+     *    Opus rates but lets a session accumulate tool-result bloat across an
+     *    all-day chat.
+     *  - `maxTurnsPerSession`: hard cap on turns per Claude session. Prevents
+     *    unbounded `--resume` growth. When hit, next turn starts fresh with
+     *    the compacted summary + recent-messages context.
+     *  - `tierTwoThresholdTokens`: if the prior turn's (input + cacheRead +
+     *    cacheCreate) exceeded this, rotate proactively. Claude bills tier-2
+     *    at 1.5× above 200K total input, so rotating before that threshold
+     *    undercuts the multiplier. */
     session: z.ZodDefault<z.ZodObject<{
         staleMinutes: z.ZodDefault<z.ZodNumber>;
+        maxTurnsPerSession: z.ZodDefault<z.ZodNumber>;
+        tierTwoThresholdTokens: z.ZodDefault<z.ZodNumber>;
+        /** Context assembly strategy:
+         *  - "layered" (default): the classic stacked layers — session history,
+         *    memory, cross-chat, wiki hint all appended every turn.
+         *  - "planner": a Haiku pre-call decides what to retrieve before the
+         *    main agent runs. Always-on core is kept (channel/scope/landscape/
+         *    identity/intent + last 3 turns verbatim); history blob, wiki hint,
+         *    and cross-chat are replaced by planner-selected bundles. Per-task
+         *    overrides via AgentTask.contextStrategy for A/B benchmarking. */
+        contextStrategy: z.ZodDefault<z.ZodEnum<["layered", "planner"]>>;
+        /** Soft dispatch budget for claude-code-tier agents (shared OAuth pools
+         *  one counter across the fleet). Warms at 80% of the cap; short-circuits
+         *  cold dispatches (no warm Claude session) when exceeded. Warm sessions
+         *  are always allowed through. Defaults sized for Max 5×:
+         *   - maxClaudeCodeDispatchesPerHour: 80 (headroom under typical hourly cap)
+         *   - maxClaudeCodeDispatchesPer5h: 180 (headroom under ~225/5h tier)
+         *  Raise for Max 20×, lower if your workload stays under the cap naturally. */
+        maxClaudeCodeDispatchesPerHour: z.ZodDefault<z.ZodNumber>;
+        maxClaudeCodeDispatchesPer5h: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         staleMinutes: number;
+        maxTurnsPerSession: number;
+        tierTwoThresholdTokens: number;
+        contextStrategy: "layered" | "planner";
+        maxClaudeCodeDispatchesPerHour: number;
+        maxClaudeCodeDispatchesPer5h: number;
     }, {
         staleMinutes?: number | undefined;
+        maxTurnsPerSession?: number | undefined;
+        tierTwoThresholdTokens?: number | undefined;
+        contextStrategy?: "layered" | "planner" | undefined;
+        maxClaudeCodeDispatchesPerHour?: number | undefined;
+        maxClaudeCodeDispatchesPer5h?: number | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     agents: Record<string, {
@@ -2528,6 +3184,18 @@ declare const daemonConfigSchema: z.ZodObject<{
         bind: string;
         defaultAgent?: string | undefined;
     };
+    graph: {
+        enabled: boolean;
+        baseDir: string;
+        autoApproveStructure: "any" | "strict" | "extend-leaves";
+        autoApproveConfidence: number;
+        retrievalWeights: {
+            graph: number;
+            bm25: number;
+        };
+        draftAgent?: string | undefined;
+        reviewAgent?: string | undefined;
+    };
     providers: Record<string, {
         apiKey?: string | undefined;
         defaultModel?: string | undefined;
@@ -2557,10 +3225,13 @@ declare const daemonConfigSchema: z.ZodObject<{
             accounts: Record<string, {
                 token: string;
                 agentBinding: string;
+                pollInbound: boolean;
+                allowFrom?: string[] | undefined;
             }>;
             policy: {
                 dm: "block" | "pair";
                 group: "all" | "mention-required";
+                allowFrom?: string[] | undefined;
             };
         };
         whatsapp: {
@@ -2571,8 +3242,25 @@ declare const daemonConfigSchema: z.ZodObject<{
                 group?: string | undefined;
                 contact?: string | undefined;
             }[];
-            defaultAgent?: string | undefined;
+            ingest: {
+                enabled: boolean;
+                mode: "messages" | "metadata-only";
+                allowContacts: string[];
+                allowGroups: string[];
+                denyContacts: string[];
+                denyGroups: string[];
+                messageCap: number;
+                historyDays: number;
+                contactRefreshDays: number;
+                throttle: {
+                    minMsBetweenCalls: number;
+                    maxCallsPerMinute: number;
+                    maxChatsPerSweep: number;
+                };
+                retentionDays: number;
+            };
             allowFrom?: string[] | undefined;
+            defaultAgent?: string | undefined;
         };
         discord: {
             enabled: boolean;
@@ -2585,6 +3273,56 @@ declare const daemonConfigSchema: z.ZodObject<{
             botToken?: string | undefined;
             appToken?: string | undefined;
         };
+        github: {
+            enabled: boolean;
+            routes: {
+                agent: string;
+                repo: string;
+            }[];
+            agentMappings: {
+                agentId: string;
+                githubUsernames: string[];
+                token?: string | undefined;
+                node?: string | undefined;
+                tokenFile?: string | undefined;
+            }[];
+            token?: string | undefined;
+            webhookSecret?: string | undefined;
+            tokenFile?: string | undefined;
+            appId?: number | undefined;
+            clientId?: string | undefined;
+            privateKeyFile?: string | undefined;
+        };
+        webrtc: {
+            enabled: boolean;
+            stunServers: string[];
+            turnServers: {
+                urls: string;
+                username?: string | undefined;
+                credential?: string | undefined;
+            }[];
+            allowedCallers: string[];
+            ringNotify: {
+                channel: string;
+                chatId: string;
+                accountId?: string | undefined;
+            }[];
+            bot: {
+                enabled: boolean;
+                whisperBackend: "openai" | "auto" | "mlx";
+                whisperLanguage: string;
+                maxCallMinutes: number;
+                defaultAgentId?: string | undefined;
+                whisperModel?: string | undefined;
+                mlxBinary?: string | undefined;
+                transcriptChannel?: {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                } | undefined;
+            };
+            callUrlBase?: string | undefined;
+        };
     };
     crons: Record<string, {
         enabled: boolean;
@@ -2679,16 +3417,27 @@ declare const daemonConfigSchema: z.ZodObject<{
         token?: string | undefined;
         draftAgent?: string | undefined;
     };
+    workflows: {
+        dir: string;
+        enabled: boolean;
+        editor: "disabled" | "readonly" | "edit";
+    };
     webhooks: {
         enabled: boolean;
         id: string;
         source: "custom" | "gitlab" | "discord" | "slack" | "github" | "sentry" | "stripe";
         agentId: string;
         description?: string | undefined;
+        node?: string | undefined;
         secretEnv?: string | undefined;
     }[];
     session: {
         staleMinutes: number;
+        maxTurnsPerSession: number;
+        tierTwoThresholdTokens: number;
+        contextStrategy: "layered" | "planner";
+        maxClaudeCodeDispatchesPerHour: number;
+        maxClaudeCodeDispatchesPer5h: number;
     };
     business?: {
         enabled: boolean;
@@ -2772,6 +3521,18 @@ declare const daemonConfigSchema: z.ZodObject<{
             interval?: number | undefined;
         } | undefined;
     } | undefined;
+    graph?: {
+        enabled?: boolean | undefined;
+        draftAgent?: string | undefined;
+        baseDir?: string | undefined;
+        reviewAgent?: string | undefined;
+        autoApproveStructure?: "any" | "strict" | "extend-leaves" | undefined;
+        autoApproveConfidence?: number | undefined;
+        retrievalWeights?: {
+            graph?: number | undefined;
+            bm25?: number | undefined;
+        } | undefined;
+    } | undefined;
     providers?: Record<string, {
         apiKey?: string | undefined;
         defaultModel?: string | undefined;
@@ -2801,22 +3562,42 @@ declare const daemonConfigSchema: z.ZodObject<{
             accounts?: Record<string, {
                 token: string;
                 agentBinding: string;
+                allowFrom?: string[] | undefined;
+                pollInbound?: boolean | undefined;
             }> | undefined;
             policy?: {
+                allowFrom?: string[] | undefined;
                 dm?: "block" | "pair" | undefined;
                 group?: "all" | "mention-required" | undefined;
             } | undefined;
         } | undefined;
         whatsapp?: {
             enabled?: boolean | undefined;
+            allowFrom?: string[] | undefined;
             sessionDir?: string | undefined;
             defaultAgent?: string | undefined;
-            allowFrom?: string[] | undefined;
             routes?: {
                 agent: string;
                 group?: string | undefined;
                 contact?: string | undefined;
             }[] | undefined;
+            ingest?: {
+                enabled?: boolean | undefined;
+                mode?: "messages" | "metadata-only" | undefined;
+                allowContacts?: string[] | undefined;
+                allowGroups?: string[] | undefined;
+                denyContacts?: string[] | undefined;
+                denyGroups?: string[] | undefined;
+                messageCap?: number | undefined;
+                historyDays?: number | undefined;
+                contactRefreshDays?: number | undefined;
+                throttle?: {
+                    minMsBetweenCalls?: number | undefined;
+                    maxCallsPerMinute?: number | undefined;
+                    maxChatsPerSweep?: number | undefined;
+                } | undefined;
+                retentionDays?: number | undefined;
+            } | undefined;
         } | undefined;
         discord?: {
             enabled?: boolean | undefined;
@@ -2829,6 +3610,56 @@ declare const daemonConfigSchema: z.ZodObject<{
             botToken?: string | undefined;
             appToken?: string | undefined;
         } | undefined;
+        github?: {
+            enabled?: boolean | undefined;
+            token?: string | undefined;
+            routes?: {
+                agent: string;
+                repo: string;
+            }[] | undefined;
+            webhookSecret?: string | undefined;
+            agentMappings?: {
+                agentId: string;
+                token?: string | undefined;
+                node?: string | undefined;
+                tokenFile?: string | undefined;
+                githubUsernames?: string[] | undefined;
+            }[] | undefined;
+            tokenFile?: string | undefined;
+            appId?: number | undefined;
+            clientId?: string | undefined;
+            privateKeyFile?: string | undefined;
+        } | undefined;
+        webrtc?: {
+            enabled?: boolean | undefined;
+            stunServers?: string[] | undefined;
+            turnServers?: {
+                urls: string;
+                username?: string | undefined;
+                credential?: string | undefined;
+            }[] | undefined;
+            allowedCallers?: string[] | undefined;
+            ringNotify?: {
+                channel: string;
+                chatId: string;
+                accountId?: string | undefined;
+            }[] | undefined;
+            callUrlBase?: string | undefined;
+            bot?: {
+                enabled?: boolean | undefined;
+                defaultAgentId?: string | undefined;
+                whisperBackend?: "openai" | "auto" | "mlx" | undefined;
+                whisperModel?: string | undefined;
+                whisperLanguage?: string | undefined;
+                mlxBinary?: string | undefined;
+                transcriptChannel?: {
+                    channel: string;
+                    chatId: string;
+                    accountId?: string | undefined;
+                } | undefined;
+                maxCallMinutes?: number | undefined;
+            } | undefined;
+        } | undefined;
     } | undefined;
     crons?: Record<string, {
         agent: string;
@@ -2965,16 +3796,27 @@ declare const daemonConfigSchema: z.ZodObject<{
         }[] | undefined;
         draftAgent?: string | undefined;
     } | undefined;
+    workflows?: {
+        dir?: string | undefined;
+        enabled?: boolean | undefined;
+        editor?: "disabled" | "readonly" | "edit" | undefined;
+    } | undefined;
     webhooks?: {
         id: string;
         source: "custom" | "gitlab" | "discord" | "slack" | "github" | "sentry" | "stripe";
         agentId: string;
         enabled?: boolean | undefined;
         description?: string | undefined;
+        node?: string | undefined;
         secretEnv?: string | undefined;
     }[] | undefined;
     session?: {
         staleMinutes?: number | undefined;
+        maxTurnsPerSession?: number | undefined;
+        tierTwoThresholdTokens?: number | undefined;
+        contextStrategy?: "layered" | "planner" | undefined;
+        maxClaudeCodeDispatchesPerHour?: number | undefined;
+        maxClaudeCodeDispatchesPer5h?: number | undefined;
     } | undefined;
 }>;
 type DaemonConfig = z.infer<typeof daemonConfigSchema>;
@@ -2997,6 +3839,12 @@ interface PeerState {
     lastCheck?: Date;
     agentCard?: AgentCard;
     agents: AgentSkill[];
+    /** Count of back-to-back failed health probes since the last successful one.
+     *  Used to suppress transient flaps: the `healthy` flag only flips to false
+     *  after N consecutive failures (see UNHEALTHY_AFTER). Reset to 0 on success. */
+    consecutiveFailures: number;
+    /** Last probe error message — surfaced for debugging via /mesh. */
+    lastError?: string;
 }
 declare class A2AMesh {
     private peers;
@@ -3009,6 +3857,16 @@ declare class A2AMesh {
      */
     start(): Promise<void>;
     stop(): Promise<void>;
+    /** Hot-reload the peer set from a fresh config. Adds new peers (kicks off
+     *  immediate discovery), removes vanished ones, and rebuilds the A2AClient
+     *  for peers whose url or token changed. Health-check interval is honored
+     *  on the next tick — we don't reset the timer just for peer-set edits.
+     *  Returns the diff for the caller to log. */
+    reloadPeers(next: DaemonConfig): Promise<{
+        added: string[];
+        removed: string[];
+        updated: string[];
+    }>;
     /**
      * Discover agent cards from all peers.
      */
@@ -3019,19 +3877,44 @@ declare class A2AMesh {
      * Uses the peer's /task HTTP endpoint (agentx daemon API).
      * If no agent specified, uses the first available agent on the peer.
      */
-    sendTask(peerName: string, text: string, agentId?: string): Promise<string>;
+    sendTask(peerName: string, text: string, agentId?: string, opts?: {
+        timeoutMs?: number;
+    }): Promise<string>;
+    /**
+     * Forward a WebRTC signaling message (SDP / ICE / hangup) to a remote peer's
+     * /webrtc/signal endpoint. Not gated by peer health — a healthy control plane
+     * is useful but a one-off probe miss should not drop a live call; the browser
+     * layer will retry on timeout.
+     *
+     * Peer lookup is tolerant: the `to` field comes from whichever daemon
+     * originated the signal, which often spells the same node differently
+     * ("MacBook-Local" vs "macbook-local"). Match on a normalized name so config
+     * drift across sides doesn't break the signaling path.
+     */
+    sendSignal(peerName: string, signal: unknown): Promise<boolean>;
+    /** Look up a peer by a name that differs only in case / non-alphanumeric
+     *  characters (e.g. spaces, hyphens). Used by WebRTC signaling where the
+     *  `to` value is controlled by the opposite daemon and may not match the
+     *  exact spelling in this daemon's `mesh.peers[].name`. */
+    private findPeerByNormalizedName;
     /**
      * Find a peer that has a specific skill.
      */
     findPeerWithSkill(skillId: string): PeerState | undefined;
     /**
      * Get the combined agent directory across all healthy peers.
+     *
+     * `channels` lists the channel adapter names each peer hosts (telegram,
+     * whatsapp, gitlab, ...) — sourced from the peer's agent-card. Used by
+     * workflow `action.send` to forward outbound messages back to the peer
+     * that owns the channel when the workflow runs on a different node.
      */
     directory(): Array<{
         peer: string;
         peerUrl: string;
         healthy: boolean;
         skills: AgentSkill[];
+        channels: string[];
         lastCheck?: Date;
     }>;
 }
@@ -3048,6 +3931,18 @@ declare class AgentXDaemon {
     private business?;
     private httpServer?;
     private webhooks;
+    private github?;
+    private webrtc?;
+    private botManager?;
+    private workflowDispatcher?;
+    private workflowStore?;
+    private workflowRuns?;
+    /** Structured per-agent memory (Claude-Code-style user / feedback /
+     *  project / reference). Deliberately owned by the daemon (not the
+     *  registry) so HTTP callers — including an agent curling from its
+     *  own Claude Code session — can write without going through the
+     *  dispatcher. Inlined into agent system prompts happens elsewhere. */
+    private readonly agentMemory;
     private log;
     private sseClients;
     private configPath?;
@@ -3077,6 +3972,11 @@ declare class AgentXDaemon {
     private scheduleMidnightHook;
     private runDailyCostReport;
     private startChannels;
+    /** Wires the workflow dispatcher + hook subscribers against the running
+     *  daemon. No-op when `workflows.enabled` is false — the observability
+     *  page + editor still work (they read/write disk directly via the
+     *  board-dashboard routes), but no transitions fire. */
+    private bootWorkflowEngine;
     private startHttpApi;
     /**
      * Broadcast an SSE event to all connected clients.
@@ -3093,6 +3993,17 @@ declare class AgentXDaemon {
      * then `chunk` events for every new delta, and `end` when the task finishes.
      */
     private handleTaskStream;
+    /**
+     * SSE stream for WebRTC signaling. Browser connects here identifying itself
+     * with (callId, as). The broker fans out any signal addressed `to=<as>` on
+     * this `callId` to the stream.
+     */
+    private handleWebRtcSSE;
+    /**
+     * Serve the minimal browser call page. Static HTML; no framework.
+     * The page does getUserMedia, RTCPeerConnection, and POSTs/listens signals.
+     */
+    private serveCallPage;
     private handleHttp;
     /**
      * OpenAI-compatible chat completions endpoint.
@@ -3107,6 +4018,48 @@ declare class AgentXDaemon {
      */
     private handleOpenAICompat;
     private json;
+    /** Boot-time: install the `remember` skill into every agent workspace
+     *  that doesn't already have it, and sync each agent's existing memory
+     *  into <workspace>/CLAUDE.md + .agentx-memory.md. Idempotent — safe to
+     *  run on every daemon start. Write-if-absent for the skill, sentinel-
+     *  replace for CLAUDE.md, so operator edits survive. */
+    private installAgentMemorySurface;
+    /** Look up an agent's workspace from the live registry. Returns null
+     *  for agents the daemon doesn't know about (e.g., a stale memory
+     *  entry for a since-removed agent). */
+    private workspaceFor;
+    /** Agent-memory HTTP surface. Agents call this from inside a Claude
+     *  Code session via `Bash` + `curl` — see the `remember` skill. The
+     *  heavy lifting is in `AgentRegistry.agentMemory` (AgentMemory); this
+     *  is a thin JSON wrapper that validates + delegates. */
+    private handleMemoryApi;
+    /** Mesh receiver for forwarded workflow events. Peers POST the same
+     *  payload shape the MeshForwarder sends. Enforces that the run is
+     *  actually home'd here before acting — protects against routing loops. */
+    private handleTaskApi;
+    private handleWorkflowEvent;
+    /** Mesh-callable outbound send. A peer's workflow `action.send` invokes
+     *  this when the channel lives on this node (e.g. clawd-server hosts
+     *  whatsapp; macbook's workflow forwards here). Just unwraps to the local
+     *  router's outbound path so all the same per-account/per-bot resolution
+     *  applies. Authentication is currently the mesh token at the network
+     *  edge — the endpoint trusts callers that reach it. */
+    private handleChannelSend;
+    /** List chats the given channel adapter has observed. Merges local with
+     *  every healthy mesh peer that hosts the channel — a channel's "true"
+     *  chat list is spread across whichever nodes are actually paired
+     *  (e.g. macbook has the channel enabled but WhatsApp Baileys is unpaired,
+     *  while clawd-server is paired; macbook's list is empty but we still want
+     *  the author to pick from clawd-server's cache). Dedup by `id`; the first
+     *  source with a given id wins.
+     *
+     *  `sources` in the response tells the editor where the entries came from
+     *  so it can show that metadata alongside. */
+    private handleChannelChats;
+    /** Manual run endpoint used by `agentx workflow run <id>`. Only workflows
+     *  whose trigger node is `trigger.manual` are runnable here — any other
+     *  source expects a live event and shouldn't race with a manual kick. */
+    private handleWorkflowManualRun;
 }
 
 declare const CACHE_AWARE_PRICING: Record<string, {
@@ -3228,6 +4181,28 @@ declare class TokenTracker {
      * breakdown inline for at-a-glance spend attribution.
      */
     appendToTokenCosts(report: DailyReport, filePath?: string): void;
+    /**
+     * Return true if TOKEN_COSTS.md already has a row for `date`. Lets callers
+     * skip duplicate appends after daemon restarts or timer-edge double fires.
+     */
+    hasTokenCostsEntry(date: string, filePath?: string): boolean;
+    /**
+     * Find the most recent date already logged to TOKEN_COSTS.md (YYYY-MM-DD).
+     * Returns null when the file doesn't exist or has no rows.
+     */
+    lastTokenCostsDate(filePath?: string): string | null;
+    /**
+     * Append reports for any days between (lastLogged + 1) and `throughDate`
+     * that have usage on disk but no row in TOKEN_COSTS.md. Idempotent —
+     * safe to call on every daemon startup. Bounded to `maxDays` to avoid
+     * a stalled daemon backfilling a year's worth on first start.
+     *
+     * Returns the list of dates actually appended, for logging.
+     */
+    catchUpTokenCosts(throughDate: string, opts?: {
+        maxDays?: number;
+        filePath?: string;
+    }): string[];
     /**
      * Get summary across last N days.
      */
@@ -3273,6 +4248,10 @@ interface AgentPeer {
 interface AgentTask {
     message: string;
     agentId: string;
+    /** Correlator threaded by the workflow engine. When the engine dispatches
+     *  an agent as part of a state transition, this carries the run id so
+     *  post:response can re-enter the engine with an agentResult condition. */
+    workflowRunId?: string;
     /** Per-invocation model override (e.g. cron model). Falls back to agent.model. */
     model?: string;
     /** Cacheable text delivered to Claude via --append-system-prompt. Typically
@@ -3280,6 +4259,16 @@ interface AgentTask {
      *  here (instead of in the user-message body) keeps it inside Claude's
      *  cached system prompt across session resumes. */
     systemPromptAppend?: string;
+    /** Per-invocation override for the context assembly strategy. When unset,
+     *  the registry falls back to config.session.contextStrategy. Set this
+     *  from benchmark harnesses that want to A/B the same request under
+     *  "layered" and "planner" without reloading daemon config. */
+    contextStrategy?: "layered" | "planner";
+    /** Upper bound on how long this task may run. Applied to mesh
+     *  forwarding (as fetch timeout) and local execution when the runtime
+     *  supports it. Workflow `agent` nodes pass this through from their
+     *  config.timeoutMinutes. */
+    timeoutMinutes?: number;
     context?: {
         channel?: string;
         sender?: string;
@@ -3333,6 +4322,10 @@ interface AgentResponse {
      *  trustworthy — a task that ran sonnet but was logged as opus would
      *  overstate cost by ~5×. */
     billedModel?: string;
+    /** Set when the task was forwarded to a mesh peer that hosted the
+     *  requested agent (the local registry didn't have it). Name of the
+     *  peer that actually ran it. */
+    viaMesh?: string;
 }
 /** Callback for streaming text deltas */
 type StreamCallback = (delta: string, fullText: string) => void;
@@ -3368,10 +4361,23 @@ declare function executeTask(agent: AgentDef, task: AgentTask, providers: Record
 
 type WikiAccess = "private" | "shared" | "public";
 /**
- * Article metadata. Intentionally minimal — tags do the heavy lifting.
+ * Article type — the organizational spine. Matches Farzapedia's
+ * `type: person | project | place | concept | event`, extended with
+ * `decision` and `pattern` for workflow-heavy corpora.
+ * Optional on legacy articles; Phase 2 migration backfills it.
+ */
+type WikiArticleType = "person" | "project" | "place" | "concept" | "event" | "decision" | "pattern";
+/**
+ * Article metadata. `type` + `related` are the primary retrieval surface;
+ * tags remain as a secondary hint but are no longer central.
  */
 interface WikiArticleMeta {
     title: string;
+    /** Organizational spine — Phase 2 migration backfills any missing values. */
+    type?: WikiArticleType;
+    /** Wikilink targets (by title) — persisted from `[[wikilinks]]` in body. */
+    related?: string[];
+    /** Secondary hint, no longer the retrieval spine. */
     tags: string[];
     owner: string;
     access: WikiAccess;
@@ -3379,6 +4385,10 @@ interface WikiArticleMeta {
     created: string;
     lastUpdated: string;
     sources: string[];
+    /** Intent graph path (root → leaf node ids) when the article was authored
+     *  under an active intent graph. Empty for legacy articles — retrieval
+     *  falls back to pure BM25 for those. */
+    graphPath?: string[];
 }
 interface WikiArticle {
     meta: WikiArticleMeta;
@@ -3398,6 +4408,8 @@ interface WikiIndex {
     articles: Array<{
         path: string;
         title: string;
+        type?: WikiArticleType;
+        related?: string[];
         tags: string[];
         owner: string;
         access: WikiAccess;
@@ -3411,7 +4423,7 @@ interface WikiIndex {
 }
 
 declare class WikiStore {
-    private baseDir;
+    readonly baseDir: string;
     private rawDir;
     private log;
     constructor(baseDir?: string, log?: (...args: unknown[]) => void);
@@ -3475,9 +4487,19 @@ declare class WikiStore {
     search(query: string, agentId: string, maxResults?: number): WikiArticle[];
     /**
      * Find articles relevant to a message (for context injection).
-     * Extracts keywords from the message and searches the wiki.
+     *
+     * Scoring:
+     *   - BM25 over title+tags+content (always)
+     *   - + ancestry bonus if the caller classified the message through the
+     *     intent graph and articles carry `graphPath` from a previous classification
+     *
+     * `weights.graph` is scaled against `weights.bm25`. When the caller omits
+     * `messagePath`, retrieval collapses to pure BM25 and matches legacy behavior.
      */
-    findRelevant(message: string, agentId?: string, maxArticles?: number): WikiArticle[];
+    findRelevant(message: string, agentId?: string, maxArticles?: number, messagePath?: string[], weights?: {
+        graph: number;
+        bm25: number;
+    }): WikiArticle[];
     /**
      * Build context string from relevant wiki articles for prompt injection.
      * Token-efficient: includes title + first ~500 chars of each article.
@@ -3487,6 +4509,15 @@ declare class WikiStore {
      * Rebuild the master index.
      */
     rebuildIndex(): WikiIndex;
+    /**
+     * Write `_index.md` — the Farzapedia-style content catalog grouped by
+     * article `type`. This is the one file the agentic query (Phase 3) reads
+     * to pick candidate articles before walking the wikilink subgraph.
+     *
+     * Articles without a `type` land in "Untyped" at the bottom; the Phase 2
+     * migration backfills those.
+     */
+    private writeCatalog;
     /**
      * Get wiki stats.
      */
@@ -3608,6 +4639,606 @@ interface AgentWikiSummary {
     }>;
 }
 
+declare const axisTypeSchema: z.ZodEnum<["enum", "free", "ref"]>;
+type AxisType = z.infer<typeof axisTypeSchema>;
+declare const axisDefSchema: z.ZodObject<{
+    name: z.ZodString;
+    type: z.ZodEnum<["enum", "free", "ref"]>;
+    /** For type="enum": closed set of allowed values. */
+    values: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** For type="ref": which level's nodes may be referenced. */
+    refLevel: z.ZodOptional<z.ZodString>;
+    /** If true, this axis may be absent from a node without failing validation.
+     *  Use for axes that apply conditionally (e.g. a department's "lead" ref
+     *  doesn't apply to a person-kind unit). Absent/false = required. */
+    optional: z.ZodOptional<z.ZodBoolean>;
+    /** Optional human-readable help, shown as tooltip in the admin UI. */
+    description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "enum" | "free" | "ref";
+    name: string;
+    values?: string[] | undefined;
+    description?: string | undefined;
+    refLevel?: string | undefined;
+    optional?: boolean | undefined;
+}, {
+    type: "enum" | "free" | "ref";
+    name: string;
+    values?: string[] | undefined;
+    description?: string | undefined;
+    refLevel?: string | undefined;
+    optional?: boolean | undefined;
+}>;
+type AxisDef = z.infer<typeof axisDefSchema>;
+declare const levelDefSchema: z.ZodObject<{
+    id: z.ZodString;
+    /** Axes every node at this level MUST carry. Order matters for UI rendering. */
+    axes: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodEnum<["enum", "free", "ref"]>;
+        /** For type="enum": closed set of allowed values. */
+        values: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** For type="ref": which level's nodes may be referenced. */
+        refLevel: z.ZodOptional<z.ZodString>;
+        /** If true, this axis may be absent from a node without failing validation.
+         *  Use for axes that apply conditionally (e.g. a department's "lead" ref
+         *  doesn't apply to a person-kind unit). Absent/false = required. */
+        optional: z.ZodOptional<z.ZodBoolean>;
+        /** Optional human-readable help, shown as tooltip in the admin UI. */
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    }, {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    }>, "many">;
+    description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    axes: {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    }[];
+    description?: string | undefined;
+}, {
+    id: string;
+    axes: {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    }[];
+    description?: string | undefined;
+}>;
+type LevelDef = z.infer<typeof levelDefSchema>;
+declare const graphSchemaSchema: z.ZodObject<{
+    version: z.ZodDefault<z.ZodNumber>;
+    /** Ordered from root to leaf. Max 5 to keep the taxonomy scannable. */
+    levels: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        /** Axes every node at this level MUST carry. Order matters for UI rendering. */
+        axes: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            type: z.ZodEnum<["enum", "free", "ref"]>;
+            /** For type="enum": closed set of allowed values. */
+            values: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** For type="ref": which level's nodes may be referenced. */
+            refLevel: z.ZodOptional<z.ZodString>;
+            /** If true, this axis may be absent from a node without failing validation.
+             *  Use for axes that apply conditionally (e.g. a department's "lead" ref
+             *  doesn't apply to a person-kind unit). Absent/false = required. */
+            optional: z.ZodOptional<z.ZodBoolean>;
+            /** Optional human-readable help, shown as tooltip in the admin UI. */
+            description: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "enum" | "free" | "ref";
+            name: string;
+            values?: string[] | undefined;
+            description?: string | undefined;
+            refLevel?: string | undefined;
+            optional?: boolean | undefined;
+        }, {
+            type: "enum" | "free" | "ref";
+            name: string;
+            values?: string[] | undefined;
+            description?: string | undefined;
+            refLevel?: string | undefined;
+            optional?: boolean | undefined;
+        }>, "many">;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        axes: {
+            type: "enum" | "free" | "ref";
+            name: string;
+            values?: string[] | undefined;
+            description?: string | undefined;
+            refLevel?: string | undefined;
+            optional?: boolean | undefined;
+        }[];
+        description?: string | undefined;
+    }, {
+        id: string;
+        axes: {
+            type: "enum" | "free" | "ref";
+            name: string;
+            values?: string[] | undefined;
+            description?: string | undefined;
+            refLevel?: string | undefined;
+            optional?: boolean | undefined;
+        }[];
+        description?: string | undefined;
+    }>, "many">;
+    /** Axis describing where a leaf classification came from (channel, cron, etc.). */
+    leafInput: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodEnum<["enum", "free", "ref"]>;
+        /** For type="enum": closed set of allowed values. */
+        values: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** For type="ref": which level's nodes may be referenced. */
+        refLevel: z.ZodOptional<z.ZodString>;
+        /** If true, this axis may be absent from a node without failing validation.
+         *  Use for axes that apply conditionally (e.g. a department's "lead" ref
+         *  doesn't apply to a person-kind unit). Absent/false = required. */
+        optional: z.ZodOptional<z.ZodBoolean>;
+        /** Optional human-readable help, shown as tooltip in the admin UI. */
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    }, {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    }>>;
+    /** Free-form description of the expected result of a leaf classification. */
+    leafOutput: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodEnum<["enum", "free", "ref"]>;
+        /** For type="enum": closed set of allowed values. */
+        values: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** For type="ref": which level's nodes may be referenced. */
+        refLevel: z.ZodOptional<z.ZodString>;
+        /** If true, this axis may be absent from a node without failing validation.
+         *  Use for axes that apply conditionally (e.g. a department's "lead" ref
+         *  doesn't apply to a person-kind unit). Absent/false = required. */
+        optional: z.ZodOptional<z.ZodBoolean>;
+        /** Optional human-readable help, shown as tooltip in the admin UI. */
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    }, {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    version: number;
+    levels: {
+        id: string;
+        axes: {
+            type: "enum" | "free" | "ref";
+            name: string;
+            values?: string[] | undefined;
+            description?: string | undefined;
+            refLevel?: string | undefined;
+            optional?: boolean | undefined;
+        }[];
+        description?: string | undefined;
+    }[];
+    leafInput?: {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    } | undefined;
+    leafOutput?: {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    } | undefined;
+}, {
+    levels: {
+        id: string;
+        axes: {
+            type: "enum" | "free" | "ref";
+            name: string;
+            values?: string[] | undefined;
+            description?: string | undefined;
+            refLevel?: string | undefined;
+            optional?: boolean | undefined;
+        }[];
+        description?: string | undefined;
+    }[];
+    version?: number | undefined;
+    leafInput?: {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    } | undefined;
+    leafOutput?: {
+        type: "enum" | "free" | "ref";
+        name: string;
+        values?: string[] | undefined;
+        description?: string | undefined;
+        refLevel?: string | undefined;
+        optional?: boolean | undefined;
+    } | undefined;
+}>;
+type GraphSchema = z.infer<typeof graphSchemaSchema>;
+declare const graphNodeSchema: z.ZodObject<{
+    id: z.ZodString;
+    /** Matches a `levels[*].id` from the schema. */
+    level: z.ZodString;
+    /** null for root-level nodes (level[0]); otherwise the id of a node at level-1. */
+    parentId: z.ZodNullable<z.ZodString>;
+    /** Values for every axis declared at this level's schema entry. `ref` axes
+     *  hold the id of another node; `enum` axes hold one of the declared values;
+     *  `free` axes hold any string. */
+    axes: z.ZodRecord<z.ZodString, z.ZodString>;
+    createdAt: z.ZodString;
+    createdBy: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    createdAt: string;
+    axes: Record<string, string>;
+    level: string;
+    parentId: string | null;
+    createdBy?: string | undefined;
+}, {
+    id: string;
+    createdAt: string;
+    axes: Record<string, string>;
+    level: string;
+    parentId: string | null;
+    createdBy?: string | undefined;
+}>;
+type GraphNode = z.infer<typeof graphNodeSchema>;
+declare const classificationSourceSchema: z.ZodEnum<["llm", "user", "cache"]>;
+type ClassificationSource = z.infer<typeof classificationSourceSchema>;
+declare const classificationStatusSchema: z.ZodEnum<["pending", "approved", "rejected"]>;
+type ClassificationStatus = z.infer<typeof classificationStatusSchema>;
+declare const classificationSchema: z.ZodObject<{
+    ts: z.ZodString;
+    msgHash: z.ZodString;
+    agentId: z.ZodOptional<z.ZodString>;
+    channel: z.ZodOptional<z.ZodString>;
+    sender: z.ZodOptional<z.ZodString>;
+    /** Node ids from root to leaf, one per level. Shorter-than-full paths are
+     *  allowed if the classifier was only confident down to a certain depth. */
+    path: z.ZodArray<z.ZodString, "many">;
+    /** Axis values asserted by the classifier for new nodes it proposed along
+     *  the path. Keyed by node id. */
+    proposedAxes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
+    /** Leaf-level extras. */
+    leaf: z.ZodDefault<z.ZodObject<{
+        input: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        output: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        output?: string | undefined;
+        input?: string | undefined;
+    }, {
+        output?: string | undefined;
+        input?: string | undefined;
+    }>>;
+    source: z.ZodEnum<["llm", "user", "cache"]>;
+    status: z.ZodEnum<["pending", "approved", "rejected"]>;
+    confidence: z.ZodOptional<z.ZodNumber>;
+    /** Redacted first ~200 chars of the message, for the approval UI. */
+    preview: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string[];
+    status: "pending" | "approved" | "rejected";
+    source: "user" | "llm" | "cache";
+    ts: string;
+    msgHash: string;
+    proposedAxes: Record<string, Record<string, string>>;
+    leaf: {
+        output?: string | undefined;
+        input?: string | undefined;
+    };
+    channel?: string | undefined;
+    agentId?: string | undefined;
+    sender?: string | undefined;
+    confidence?: number | undefined;
+    preview?: string | undefined;
+}, {
+    path: string[];
+    status: "pending" | "approved" | "rejected";
+    source: "user" | "llm" | "cache";
+    ts: string;
+    msgHash: string;
+    channel?: string | undefined;
+    agentId?: string | undefined;
+    sender?: string | undefined;
+    proposedAxes?: Record<string, Record<string, string>> | undefined;
+    leaf?: {
+        output?: string | undefined;
+        input?: string | undefined;
+    } | undefined;
+    confidence?: number | undefined;
+    preview?: string | undefined;
+}>;
+type Classification = z.infer<typeof classificationSchema>;
+/** Row in the fingerprint → path snap cache. */
+declare const fingerprintEntrySchema: z.ZodObject<{
+    fingerprint: z.ZodString;
+    path: z.ZodArray<z.ZodString, "many">;
+    leaf: z.ZodDefault<z.ZodObject<{
+        input: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        output: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        output?: string | undefined;
+        input?: string | undefined;
+    }, {
+        output?: string | undefined;
+        input?: string | undefined;
+    }>>;
+    updatedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    path: string[];
+    leaf: {
+        output?: string | undefined;
+        input?: string | undefined;
+    };
+    fingerprint: string;
+    updatedAt: string;
+}, {
+    path: string[];
+    fingerprint: string;
+    updatedAt: string;
+    leaf?: {
+        output?: string | undefined;
+        input?: string | undefined;
+    } | undefined;
+}>;
+type FingerprintEntry = z.infer<typeof fingerprintEntrySchema>;
+/** Nodes file is a plain list, not a nested tree — lookups are by id. */
+declare const nodesFileSchema: z.ZodObject<{
+    version: z.ZodDefault<z.ZodNumber>;
+    nodes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        /** Matches a `levels[*].id` from the schema. */
+        level: z.ZodString;
+        /** null for root-level nodes (level[0]); otherwise the id of a node at level-1. */
+        parentId: z.ZodNullable<z.ZodString>;
+        /** Values for every axis declared at this level's schema entry. `ref` axes
+         *  hold the id of another node; `enum` axes hold one of the declared values;
+         *  `free` axes hold any string. */
+        axes: z.ZodRecord<z.ZodString, z.ZodString>;
+        createdAt: z.ZodString;
+        createdBy: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        createdAt: string;
+        axes: Record<string, string>;
+        level: string;
+        parentId: string | null;
+        createdBy?: string | undefined;
+    }, {
+        id: string;
+        createdAt: string;
+        axes: Record<string, string>;
+        level: string;
+        parentId: string | null;
+        createdBy?: string | undefined;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    version: number;
+    nodes: {
+        id: string;
+        createdAt: string;
+        axes: Record<string, string>;
+        level: string;
+        parentId: string | null;
+        createdBy?: string | undefined;
+    }[];
+}, {
+    version?: number | undefined;
+    nodes?: {
+        id: string;
+        createdAt: string;
+        axes: Record<string, string>;
+        level: string;
+        parentId: string | null;
+        createdBy?: string | undefined;
+    }[] | undefined;
+}>;
+type NodesFile = z.infer<typeof nodesFileSchema>;
+/** Index file — record of fingerprints. Hot path; kept as a map on disk. */
+declare const indexFileSchema: z.ZodObject<{
+    version: z.ZodDefault<z.ZodNumber>;
+    entries: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        fingerprint: z.ZodString;
+        path: z.ZodArray<z.ZodString, "many">;
+        leaf: z.ZodDefault<z.ZodObject<{
+            input: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+            output: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            output?: string | undefined;
+            input?: string | undefined;
+        }, {
+            output?: string | undefined;
+            input?: string | undefined;
+        }>>;
+        updatedAt: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        path: string[];
+        leaf: {
+            output?: string | undefined;
+            input?: string | undefined;
+        };
+        fingerprint: string;
+        updatedAt: string;
+    }, {
+        path: string[];
+        fingerprint: string;
+        updatedAt: string;
+        leaf?: {
+            output?: string | undefined;
+            input?: string | undefined;
+        } | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    entries: Record<string, {
+        path: string[];
+        leaf: {
+            output?: string | undefined;
+            input?: string | undefined;
+        };
+        fingerprint: string;
+        updatedAt: string;
+    }>;
+    version: number;
+}, {
+    entries?: Record<string, {
+        path: string[];
+        fingerprint: string;
+        updatedAt: string;
+        leaf?: {
+            output?: string | undefined;
+            input?: string | undefined;
+        } | undefined;
+    }> | undefined;
+    version?: number | undefined;
+}>;
+type IndexFile = z.infer<typeof indexFileSchema>;
+
+/**
+ * Ships with the install. When .agentx/graph/schema.json is missing, the
+ * store seeds this so a fresh daemon has something to classify against.
+ *
+ * Five levels, three primaries at the leaf (who / what / where) — matches
+ * the "primary colors per level" design from the plan.
+ */
+declare const STARTER_SCHEMA: GraphSchema;
+
+interface GraphStoreOptions {
+    baseDir?: string;
+    log?: (...args: unknown[]) => void;
+}
+declare class GraphStore {
+    readonly baseDir: string;
+    private log;
+    constructor(opts?: GraphStoreOptions);
+    schemaPath(): string;
+    nodesPath(): string;
+    indexPath(): string;
+    classificationsPath(): string;
+    /** Load the graph schema, seeding STARTER_SCHEMA if the file is missing. */
+    loadSchema(): GraphSchema;
+    saveSchema(schema: GraphSchema): void;
+    loadNodes(): NodesFile;
+    saveNodes(file: NodesFile): void;
+    /** Validate a node against the schema AND uniqueness within the nodes file. */
+    validateNode(node: GraphNode, schema: GraphSchema, all: GraphNode[]): void;
+    /**
+     * Commit a full classification path: for each path element that doesn't
+     * yet exist, infer its schema level by matching the proposed axes against
+     * the level's required axes (first match ≥ cursor wins — this handles
+     * paths that skip levels, like business → noqta where location is
+     * absent). Refreshes the node list between adds so callers in a loop
+     * don't hit "Node id already exists" on the second iteration.
+     */
+    commitNodesAlongPath(path: string[], proposedAxes: Record<string, Record<string, string>>, schema: GraphSchema, createdBy?: string): {
+        added: GraphNode[];
+        skipped: string[];
+    };
+    /** Append a node. Caller is responsible for id uniqueness; we check and throw. */
+    addNode(node: GraphNode): GraphNode;
+    appendClassification(c: Classification): boolean;
+    /**
+     * All pending classifications, newest first. Collapses the append-only
+     * ledger by msgHash — the most recent entry per message wins (so if an
+     * entry was updated via updateClassificationStatus, we see the current
+     * state, not the original).
+     */
+    listPendingClassifications(limit?: number): Classification[];
+    /** Same contract as listPendingClassifications but filtered to any status. */
+    listByStatus(status: Classification["status"], limit?: number): Classification[];
+    /**
+     * Read every classification, collapse by msgHash keeping the newest entry
+     * per message. Used by listByStatus + the review loop to see current state.
+     * Returns newest-first order.
+     */
+    private readAllCollapsed;
+    /**
+     * Append a status-update entry for an existing classification. The ledger
+     * stays append-only; readers collapse by msgHash. Returns the updated
+     * classification, or null if no prior entry for msgHash exists.
+     */
+    updateClassificationStatus(msgHash: string, update: {
+        status: Classification["status"];
+        reviewer?: string;
+        reviewReason?: string;
+    }): Classification | null;
+    /** Read the last N classifications, newest first. Cheap enough for the admin UI. */
+    readRecentClassifications(limit?: number): Classification[];
+    /**
+     * Hash that represents "this kind of message" for snap-to-path caching.
+     * Normalizes casing + whitespace; includes channel + sender so two people
+     * writing the same words can still land on different paths if they should.
+     */
+    fingerprint(msg: {
+        text: string;
+        channel?: string;
+        sender?: string;
+    }): string;
+    loadIndex(): IndexFile;
+    saveIndex(file: IndexFile): void;
+    getFingerprint(fp: string): FingerprintEntry | undefined;
+    setFingerprint(fp: string, entry: Omit<FingerprintEntry, "fingerprint" | "updatedAt">): void;
+    /** Update the axes on an existing node. Schema-validates the result. */
+    updateNodeAxes(id: string, axes: Record<string, string>): GraphNode;
+    /** Remove a node. Refuses to delete if any other node still references it
+     *  (child via parentId, or axis ref). */
+    deleteNode(id: string): void;
+    /** Approve a pending classification. Commits any new nodes along its path,
+     *  stamps the fingerprint index so future similar messages hit the cache,
+     *  and appends an audit entry. Idempotent — no-op if already cached. */
+    approveClassification(c: Classification): void;
+    /** Record rejection — no nodes committed, no fingerprint set. */
+    rejectClassification(c: Classification): void;
+}
+
 interface MeshPeerInfo {
     peer: string;
     healthy: boolean;
@@ -3704,7 +5335,16 @@ declare class AgentRegistry {
     private rateLimiter;
     private tokenTracker;
     private landscape?;
+    /** Mesh handle. When set, `execute` falls back to a peer that advertises
+     *  the requested agent before returning "Unknown agent". Duck-typed so
+     *  we don't create a circular import with src/a2a/mesh.ts. */
+    private meshFallback?;
     private messageQueue;
+    /** Intent Knowledge Graph classifier. Null when graph.enabled=false. */
+    private classifier?;
+    private graphStore?;
+    /** Runtime handover store — shared with MessageRouter via file on disk. */
+    private handoverStore;
     /** Active soul profile per agent+chat session: "agentId:channel:chatId" → profile name */
     private activeSouls;
     /** Live output captured per running task id — drives the dashboard streaming modal. */
@@ -3719,6 +5359,28 @@ declare class AgentRegistry {
      * Set landscape builder (called after mesh init).
      */
     setLandscape(builder: LandscapeBuilder): void;
+    /** Wire the mesh so `execute` can fall back to a peer that hosts an
+     *  agent this node doesn't have. Called by the daemon after mesh boot.
+     *  Pass `undefined` to disable fallback (testing, mesh disabled). */
+    setMeshFallback(mesh: NonNullable<AgentRegistry["meshFallback"]>): void;
+    /** Hot-swap the provider map. Daemon reload calls this after agentx.json
+     *  changes — the next task that executes will resolve credentials through
+     *  the fresh table (see executeTask call-site). In-flight tasks keep the
+     *  old provider reference from their closure, which is the desired behavior
+     *  (rotating a key mid-task shouldn't fail the task). */
+    setProviders(next: Record<string, {
+        apiKey?: string;
+    }>): void;
+    /** Hot-swap the live DaemonConfig reference. Registry reads it lazily at
+     *  execute-time for landscape + session policies, so next-task semantics
+     *  match setProviders. */
+    setConfig(next: DaemonConfig): void;
+    /**
+     * If there's an active handover routing TO this agent for this (channel,
+     * chatId) pair AND the operator's summary hasn't been consumed yet, pull
+     * + clear it so the target agent sees the note exactly once.
+     */
+    private buildHandoverNote;
     /**
      * Get agent definition by ID.
      */
@@ -3743,6 +5405,7 @@ declare class AgentRegistry {
     findAllMentioned(text: string): string[];
     /** Wiki hub accessor. */
     getWikiHub(): WikiHub;
+    getGraphStore(): GraphStore | undefined;
     /**
      * Build peer list for context engine.
      */
@@ -3916,6 +5579,11 @@ interface IncomingMessage {
     resolvedAgent?: string;
     preferNode?: string;
     channelMeta?: ChannelMeta;
+    /** Correlator threaded by the workflow engine. When a workflow dispatches
+     *  an agent, this carries the run id through the pipeline so post:response
+     *  can re-enter the engine with `kind: agentResult` transitions. Opaque
+     *  everywhere outside src/workflows/. */
+    workflowRunId?: string;
 }
 interface OutgoingMessage {
     channel: string;
@@ -3945,6 +5613,58 @@ interface ChannelAdapter {
     getChannelMeta?(chatId: string): Promise<ChannelMeta | undefined>;
 }
 
+interface HandoverOverride {
+    channel: string;
+    chatId: string;
+    accountId?: string;
+    fromAgent: string;
+    toAgent: string;
+    summary?: string;
+    createdAt: string;
+    createdBy?: string;
+    /** When set, overrides past this time are treated as expired (ignored on
+     *  read, optionally pruned on access). null = indefinite. */
+    expiresAt?: string | null;
+    /** Set after the summary has been injected once. Route stays active. */
+    summaryConsumedAt?: string;
+}
+interface HandoverFile {
+    version: number;
+    overrides: Record<string, HandoverOverride>;
+}
+declare class HandoverStore {
+    readonly filePath: string;
+    private log;
+    constructor(opts?: {
+        baseDir?: string;
+        log?: (...args: unknown[]) => void;
+    });
+    /** Canonical key for an override. Using "-" for missing accountId keeps
+     *  the key shape uniform across channels. */
+    key(channel: string, chatId: string, accountId?: string): string;
+    load(): HandoverFile;
+    private save;
+    /** Return the active override for a chat, or undefined. Skips expired. */
+    get(channel: string, chatId: string, accountId?: string): HandoverOverride | undefined;
+    /** Create or replace an override. If `fromAgent` isn't supplied the caller
+     *  can pass "" and the router will fill it in from current routing. */
+    set(o: Omit<HandoverOverride, "createdAt"> & {
+        createdAt?: string;
+    }): HandoverOverride;
+    /** Remove an override (release the handover). Idempotent. */
+    remove(channel: string, chatId: string, accountId?: string): boolean;
+    /** Mark the summary as consumed (after it's been injected once). Route
+     *  stays active; subsequent messages just skip the note. */
+    consumeSummary(channel: string, chatId: string, accountId?: string): string | undefined;
+    /** List all non-expired overrides. Used by the admin UI. */
+    listActive(): HandoverOverride[];
+    /** Overrides pointing at this agent (incoming) or away from it (outgoing). */
+    listByAgent(agentId: string): {
+        incoming: HandoverOverride[];
+        outgoing: HandoverOverride[];
+    };
+}
+
 interface ServiceTrigger {
     pattern: string;
     channel?: string;
@@ -3974,6 +5694,14 @@ declare class ServiceMatcher {
     private services;
     private log;
     constructor(serviceDefs: Record<string, Omit<ServiceDef, "id">>, log?: (...args: unknown[]) => void);
+    /** Recompile the service set from a fresh config. Safe to call at runtime —
+     *  the only state is the compiled regex array, which is fully replaced. A
+     *  message currently inside match() sees the old list for one iteration,
+     *  but that's fine: match() is synchronous and holds no cross-call state. */
+    reload(serviceDefs: Record<string, Omit<ServiceDef, "id">>): {
+        count: number;
+    };
+    private compile;
     /**
      * Match an incoming message against all service triggers.
      * Returns the first matching service or null.
@@ -4526,7 +6254,13 @@ declare class MessageRouter {
     private serviceMatcher?;
     private business?;
     private groupLog;
+    /** Runtime per-chat routing overrides (handovers). Consulted at the top
+     *  of resolveAgent; config routes + mention matching only run when no
+     *  override applies. */
+    private handoverStore;
     private log;
+    /** Exposed so the admin panel + registry can share the same store. */
+    getHandoverStore(): HandoverStore;
     /**
      * Short-TTL cache of recently processed incoming message IDs, keyed by
      * `<channel>:<accountId>:<id>`. Prevents duplicate replies from:
@@ -4563,7 +6297,19 @@ declare class MessageRouter {
     flushPersistence(): void;
     setMesh(mesh: A2AMesh): void;
     setServiceMatcher(matcher: ServiceMatcher): void;
+    /** Accessor so the daemon reload path can call matcher.reload() without
+     *  holding a duplicate reference. Returns undefined if services were
+     *  empty at boot. */
+    getServiceMatcher(): ServiceMatcher | undefined;
     setBusiness(business: BusinessLayer): void;
+    /** Swap the live DaemonConfig reference after a hot-reload. Router reads
+     *  from this.config at send-time for things like per-account Telegram token
+     *  resolution, default agents, and policy allowlists — so any /reload that
+     *  touches channels must call this to avoid sending from a stale snapshot. */
+    updateConfig(next: DaemonConfig): void;
+    /** Look up a live adapter by name, e.g. "telegram". Used by the daemon
+     *  reload path to hot-swap account configs without a restart. */
+    getChannel(name: string): ChannelAdapter | undefined;
     addChannel(adapter: ChannelAdapter): void;
     /**
      * Send an outbound message to any registered channel.
@@ -4628,6 +6374,9 @@ declare class MessageRouter {
 interface TelegramAccountConfig {
     token: string;
     agentBinding: string;
+    allowFrom?: string[];
+    /** When false, register the token for outbound send only (no long-poll). */
+    pollInbound?: boolean;
 }
 declare class TelegramAdapter implements ChannelAdapter {
     readonly name = "telegram";
@@ -4635,11 +6384,55 @@ declare class TelegramAdapter implements ChannelAdapter {
     private offsetStore;
     private handler?;
     private polling;
+    /** Per-account polling gate — flipped to false when an account is removed
+     *  or its token changes, so its pollLoop observes the stop and exits without
+     *  affecting siblings. Keyed by accountId. */
+    private accountPolling;
     private log;
-    constructor(accounts: Record<string, TelegramAccountConfig>, log?: (...args: unknown[]) => void);
+    /** Global allowlist fallback. When a per-account allowFrom is unset,
+     *  this list applies. When BOTH are unset, everything is rejected
+     *  (closed by default). */
+    private globalAllowFrom?;
+    constructor(accounts: Record<string, TelegramAccountConfig>, opts?: {
+        policy?: {
+            allowFrom?: string[];
+        };
+    }, log?: (...args: unknown[]) => void);
+    /** Effective sender allowlist for an account. Returns undefined when the
+     *  account has no explicit config AND the global policy is unset — the
+     *  caller treats undefined as "closed, drop everything". */
+    private effectiveAllowFrom;
+    /** Accept a message only when at least one allowlist entry matches the
+     *  sender's user id, the chat id, or the sender's @username. */
+    private isAllowed;
     onMessage(handler: (msg: IncomingMessage) => Promise<void>): void;
     start(): Promise<void>;
+    /** Start a single account's poll loop. Used by both start() (boot) and
+     *  reloadAccounts() (hot-add on /reload). Verifies the bot token, records
+     *  the bot's identity, then spawns the long-poll loop. No-op if the account
+     *  is already polling. */
+    private startAccount;
+    /** Stop a single account's poll loop without touching siblings. Flips the
+     *  per-account gate and aborts the in-flight long-poll so Telegram releases
+     *  the server-side session immediately (otherwise a new start with the same
+     *  token hits 409 Conflict). */
+    private stopAccount;
     stop(): Promise<void>;
+    /** Hot-reload the account map in place. Diffs the new config against the
+     *  current one: removed accounts get their pollers stopped, added accounts
+     *  get started, and accounts whose token changed get restarted (allowFrom
+     *  changes are effectively read-through via effectiveAllowFrom so they
+     *  don't need a restart, but we do refresh the stored config). Returns the
+     *  diff for the caller to log/surface.
+     *
+     *  Requires the adapter to be already started (polling=true). */
+    reloadAccounts(next: Record<string, TelegramAccountConfig>, policy?: {
+        allowFrom?: string[];
+    }): Promise<{
+        added: string[];
+        removed: string[];
+        tokenChanged: string[];
+    }>;
     /**
      * Get token for a specific account ID. Used by router to send from correct bot.
      */
@@ -4663,10 +6456,46 @@ declare class TelegramAdapter implements ChannelAdapter {
     send(msg: OutgoingMessage & {
         accountId?: string;
     }): Promise<string>;
+    /**
+     * Send a message with an inline keyboard. Used by the workflow user-task
+     * renderer so approve/reject-style tasks get one-tap URL buttons in
+     * Telegram pointing at the daemon's one-click submit endpoint.
+     *
+     * Each button is a URL button (not callback_data) so the user's client
+     * opens the link in a browser — this avoids wiring callback_query
+     * plumbing through the adapter's polling loop for Phase 3 MVP.
+     */
+    sendWithInlineButtons(args: {
+        chatId: string;
+        text: string;
+        buttons: Array<{
+            label: string;
+            url: string;
+        }>;
+        accountId?: string;
+        parseMode?: "markdown" | "html" | "plain";
+    }): Promise<string>;
     /**
      * Edit an existing message (for streaming updates).
      */
     editMessage(chatId: string, messageId: string, text: string, parseMode?: string, accountId?: string): Promise<boolean>;
+    /**
+     * Push a streaming draft to a private chat (Bot API 9.5+ `sendMessageDraft`).
+     * Subsequent calls with the same `draftId` animate in place — much smoother
+     * than `editMessageText` and not subject to the same edit-rate limits.
+     *
+     * **Constraint:** private chats only (DMs). Telegram returns an error for
+     * groups/channels. Callers must check `isDirectMessage(chatId)` first.
+     *
+     * Returns `true` on success, `false` on any error (best-effort streaming —
+     * never throw or callers will lose blocks). Falls back to no-formatting on
+     * a parse-mode error so a malformed HTML chunk doesn't kill the stream.
+     */
+    sendDraft(chatId: string, draftId: number, text: string, parseMode?: string, accountId?: string): Promise<boolean>;
+    /** Telegram convention: positive chat_id → private chat (DM with a user),
+     *  negative → group/supergroup/channel. Used to gate features that only
+     *  work in DMs (sendMessageDraft, message_effect_id, ...). */
+    static isDirectMessage(chatId: string): boolean;
     /**
      * React to a message with an emoji.
      */
@@ -4680,6 +6509,18 @@ declare class TelegramAdapter implements ChannelAdapter {
      * Get verified context for a Telegram chat.
      * Reads from persistent group store (fed by my_chat_member events + API seed).
      */
+    /** Surface chats the adapter has observed, so the workflow editor (or CLI)
+     *  can present a picker when an author is authoring an `action.send` that
+     *  targets a different chat than the trigger's. DMs come from the per-chat
+     *  account map (populated when a user messages a bot); groups come from
+     *  the persistent group membership store. Both lists are small — bounded
+     *  by the number of distinct chats the bots have been in. */
+    listKnownChats(): Array<{
+        id: string;
+        name?: string;
+        kind: "dm" | "group";
+        accountId?: string;
+    }>;
     getChannelMeta(chatId: string): Promise<ChannelMeta | undefined>;
     /**
      * Seed group membership by querying the Telegram API for each bot.
@@ -4689,6 +6530,105 @@ declare class TelegramAdapter implements ChannelAdapter {
     private apiCall;
 }
 
+interface ContactRecord {
+    jid: string;
+    /** Digits extracted from the JID's user segment. May be empty for LIDs. */
+    phone: string;
+    /** The contact's own "push name" (what they set on their device). */
+    pushName?: string;
+    /** Saved name from WhatsApp address book (if the linked device has it). */
+    savedName?: string;
+    /** Status / about text. Rarely populated from events alone; usually needs a live fetch. */
+    status?: string;
+    /** Last time we got any update for this contact. ISO8601. */
+    updatedAt: string;
+}
+interface ChatRecord {
+    jid: string;
+    /** Best display name we have for the chat. Falls back to phone if missing. */
+    name?: string;
+    /** Derived from the JID — group chats end with @g.us. */
+    isGroup: boolean;
+    /** Last conversation timestamp we observed, as unix seconds. */
+    lastMessageAt?: number;
+    unreadCount?: number;
+    updatedAt: string;
+}
+interface GroupMember {
+    jid: string;
+    admin?: "admin" | "superadmin";
+}
+interface GroupRecord {
+    jid: string;
+    subject: string;
+    description?: string;
+    owner?: string;
+    members: GroupMember[];
+    updatedAt: string;
+}
+declare class WhatsAppCache {
+    private contacts;
+    private chats;
+    private groups;
+    private cachePath;
+    constructor(sessionDir: string);
+    listContacts(): ContactRecord[];
+    listChats(): ChatRecord[];
+    listGroups(): GroupRecord[];
+    getContact(jid: string): ContactRecord | undefined;
+    getChat(jid: string): ChatRecord | undefined;
+    getGroup(jid: string): GroupRecord | undefined;
+    applyContactsUpdate(updates: Array<Record<string, unknown>>): void;
+    applyChatsUpsert(chats: Array<Record<string, unknown>>): void;
+    applyGroupsUpdate(updates: Array<Record<string, unknown>>): void;
+    applyHistorySet(data: Record<string, unknown>): void;
+    /** Write snapshot to cache.json. Call on graceful shutdown and periodically. */
+    save(): void;
+    private load;
+}
+
+/** Shapes returned by the adapter's read API — used by the wiki ingestor.
+ *  These are stable contracts so the ingestor can mock the adapter without
+ *  pulling in Baileys types. */
+interface ContactSummary {
+    jid: string;
+    phone: string;
+    name?: string;
+    pushName?: string;
+    savedName?: string;
+    status?: string;
+    updatedAt?: string;
+}
+interface ChatSummary {
+    jid: string;
+    name: string;
+    isGroup: boolean;
+    lastMessageAt?: number;
+    unreadCount?: number;
+}
+interface GroupInfo {
+    jid: string;
+    subject: string;
+    description?: string;
+    owner?: string;
+    members: Array<{
+        jid: string;
+        admin?: "admin" | "superadmin";
+    }>;
+    memberCount: number;
+}
+interface HistoryMessage {
+    id: string;
+    fromJid: string;
+    fromMe: boolean;
+    timestamp?: number;
+    text: string;
+    media?: {
+        kind: "image" | "audio" | "video" | "document" | "sticker";
+        caption?: string;
+        filename?: string;
+    };
+}
 interface WhatsAppRoute {
     contact?: string;
     group?: string;
@@ -4707,6 +6647,16 @@ declare class WhatsAppAdapter implements ChannelAdapter {
     private generation;
     private sentMessageIds;
     private log;
+    /** Passive snapshot of contacts/chats/groups populated from Baileys events.
+     *  Consumed by the wiki ingestor. Persisted to {sessionDir}/cache.json on stop. */
+    private cache;
+    /** Token-bucket throttle for live Baileys reads. Configurable via
+     *  channels.whatsapp.ingest.throttle. Defaults keep the read surface
+     *  below what personal-account rate limits tend to trigger. */
+    private throttleMinMs;
+    private throttleMaxPerMinute;
+    private lastReadAt;
+    private readsInWindow;
     /** Fires whenever the underlying WhatsApp socket emits a new QR or clears it.
      *  Passing null means the session is now connected. */
     private onQR?;
@@ -4719,7 +6669,19 @@ declare class WhatsAppAdapter implements ChannelAdapter {
         routes?: WhatsAppRoute[];
         onQR?: (qr: string | null) => void;
         onStatus?: (status: "connecting" | "open" | "close", detail?: string) => void;
+        /** Throttle settings for live Baileys reads. Falls back to safe defaults. */
+        throttle?: {
+            minMsBetweenCalls?: number;
+            maxCallsPerMinute?: number;
+        };
     }, log?: (...args: unknown[]) => void);
+    /** Read-only access for the wiki ingestor. Exposed so the ingestor can
+     *  iterate the passive snapshot without reaching into adapter internals. */
+    getCache(): WhatsAppCache;
+    /** True once the socket has connected at least once and emitted the
+     *  authenticated user. The ingestor checks this before attempting any
+     *  live read — a torn-down session will otherwise throw a cryptic error. */
+    isConnected(): boolean;
     /**
      * Resolve which agent handles a message based on routes.
      */
@@ -4731,6 +6693,22 @@ declare class WhatsAppAdapter implements ChannelAdapter {
     editMessage(chatId: string, messageId: string, text: string): Promise<boolean>;
     sendTyping(chatId: string): Promise<void>;
     react(chatId: string, messageId: string, emoji?: string): Promise<void>;
+    listContacts(): ContactSummary[];
+    listChats(): ChatSummary[];
+    getContactProfile(jid: string): Promise<ContactSummary | null>;
+    getGroupMetadata(jid: string): Promise<GroupInfo | null>;
+    /** Fetch up to `limit` recent messages for `jid`. This is the one read
+     *  that always hits Baileys live — there's no cached message body and
+     *  baileys doesn't persist history by default with the options we use.
+     *  Throttled. */
+    getHistory(jid: string, opts?: {
+        limit?: number;
+        before?: string;
+    }): Promise<HistoryMessage[]>;
+    /** Token-bucket gate for live Baileys reads. Enforces
+     *  `throttleMinMs` between calls and caps the per-minute call count.
+     *  Returns a promise that resolves once it's safe to fire. */
+    private throttleGate;
 }
 
 interface CronJobState {
@@ -4891,4 +6869,4 @@ declare function handleError(error: unknown): void;
  */
 declare function getPackageInfo(): PackageJson;
 
-export { A2AClient, A2AMesh, A2AServer, A2AServerConfig, ALL_TOOL_NAMES, AgentCard, AgentConfig, AgentContext, AgentDef, AgentProvider, AgentRegistry, AgentResponse, AgentTask, AgentXDaemon, AgentXRuntime, AnthropicMessage, AuthConfig, BLOCKING_EVENTS, ChannelAdapter, ClaudeCodeProvider, ClaudeProvider, ContentBlock, ContextBuilder, CronJobDef, CronJobState, CronRunResult, CronScheduler, DaemonConfig, EnhanceConfig, EnhanceEngine, EnhanceResult, GenerateOptions, GenerateResult, GenerateStreamEvent, GeneratedFile, GenerationMessage, GenerationResult, GitCommitResult, GitDiffFile, GitLogEntry, GitManager, GitStatus, HOOK_EVENTS, HealConfig, HealEngine, HealResult, HookContext, HookDefinition, HookEvent, HookHandler, HookRegistry, HookResult, IncomingMessage, Memory, MemoryEntry, MemoryHierarchy, MemoryStore, MeshPeer, MessageRouter, MiddlewareFn, ModelUsage, OUTPUT_CONFIGS, OUTPUT_TYPES, OutgoingMessage, OutputConfig, OutputType, PERMISSION_MODES, PROVIDER_CAPABILITIES, PermissionAction, PermissionConfig, PermissionManager, PermissionMode, PermissionRule, Pipeline, PipelineRequest, PipelineResponse, ProjectSchemas, ProviderCapabilities, ProviderName, ProviderOptions, RawGenerationResult, ReplEngine, ReplOptions, RuntimeConfig, Session, StepUsage, StreamEvent, Task, TaskArtifact, TaskMessage, TaskState, TaskStatusUpdate, TechStack, TelegramAdapter, ToolCallInput, ToolExecutor, ToolExecutorOptions, ToolResult, UsageSummary, UsageTracker, WhatsAppAdapter, WikiAccess, WikiArticle, WikiArticleMeta, WikiEntry, WikiIndex, WikiStore, agentConfigSchema$1 as agentConfigSchema, checkCapabilities, createAgentContext, createProvider, createSession, daemonConfigSchema, debug, detectSchemas, detectTechStack, ensureCredentials, executeClaudeCode, executeOrchestrator, executeSdk, executeTask, exportSession, formatSchemas, formatTechStack, formatToolsForSystemPrompt, gatherContext7Docs, generate, generateSkill, generateSkillMd, generateStream, getAnthropicTools, getCommand, getLegacyTools, getPackageInfo, globalHooks, globalPermissions, globalTracker, handleError, installSkillPackage, isCommand, isDebug, listInstalledSkills, listSessions, loadAuthConfig, loadDaemonConfig, loadHooks, loadLatestSession, loadLocalSkills, loadProjectInstructions, loadSession, logger, matchSkillsToTask, outputTypeDescriptions, parseCommand, parseSkillContent, parseSkillFile, permissionConfigSchema, permissionModeSchema, registerCommand, resolveAtImports, resolveOutputType, resolveToken, runModelSetup, saveAuthConfig, saveSession, setDebug, startMcpServer, validateWorkspaces };
+export { A2AClient, A2AMesh, A2AServer, A2AServerConfig, ALL_TOOL_NAMES, AgentCard, AgentConfig, AgentContext, AgentDef, AgentProvider, AgentRegistry, AgentResponse, AgentTask, AgentXDaemon, AgentXRuntime, AnthropicMessage, AuthConfig, AxisDef, AxisType, BLOCKING_EVENTS, ChannelAdapter, Classification, ClassificationSource, ClassificationStatus, ClaudeCodeProvider, ClaudeProvider, ContentBlock, ContextBuilder, CronJobDef, CronJobState, CronRunResult, CronScheduler, DaemonConfig, EnhanceConfig, EnhanceEngine, EnhanceResult, FingerprintEntry, GenerateOptions, GenerateResult, GenerateStreamEvent, GeneratedFile, GenerationMessage, GenerationResult, GitCommitResult, GitDiffFile, GitLogEntry, GitManager, GitStatus, GraphNode, GraphSchema, GraphStore, GraphStoreOptions, HOOK_EVENTS, HealConfig, HealEngine, HealResult, HookContext, HookDefinition, HookEvent, HookHandler, HookRegistry, HookResult, IncomingMessage, IndexFile, LevelDef, Memory, MemoryEntry, MemoryHierarchy, MemoryStore, MeshPeer, MessageRouter, MiddlewareFn, ModelUsage, NodesFile, OUTPUT_CONFIGS, OUTPUT_TYPES, OutgoingMessage, OutputConfig, OutputType, PERMISSION_MODES, PROVIDER_CAPABILITIES, PermissionAction, PermissionConfig, PermissionManager, PermissionMode, PermissionRule, Pipeline, PipelineRequest, PipelineResponse, ProjectSchemas, ProviderCapabilities, ProviderName, ProviderOptions, RawGenerationResult, ReplEngine, ReplOptions, RuntimeConfig, STARTER_SCHEMA, Session, StepUsage, StreamEvent, Task, TaskArtifact, TaskMessage, TaskState, TaskStatusUpdate, TechStack, TelegramAdapter, ToolCallInput, ToolExecutor, ToolExecutorOptions, ToolResult, UsageSummary, UsageTracker, WhatsAppAdapter, WikiAccess, WikiArticle, WikiArticleMeta, WikiEntry, WikiIndex, WikiStore, agentConfigSchema$1 as agentConfigSchema, checkCapabilities, createAgentContext, createProvider, createSession, daemonConfigSchema, debug, detectSchemas, detectTechStack, ensureCredentials, executeClaudeCode, executeOrchestrator, executeSdk, executeTask, exportSession, formatSchemas, formatTechStack, formatToolsForSystemPrompt, gatherContext7Docs, generate, generateSkill, generateSkillMd, generateStream, getAnthropicTools, getCommand, getLegacyTools, getPackageInfo, globalHooks, globalPermissions, globalTracker, handleError, installSkillPackage, isCommand, isDebug, listInstalledSkills, listSessions, loadAuthConfig, loadDaemonConfig, loadHooks, loadLatestSession, loadLocalSkills, loadProjectInstructions, loadSession, logger, matchSkillsToTask, outputTypeDescriptions, parseCommand, parseSkillContent, parseSkillFile, permissionConfigSchema, permissionModeSchema, registerCommand, resolveAtImports, resolveOutputType, resolveToken, runModelSetup, saveAuthConfig, saveSession, setDebug, startMcpServer, validateWorkspaces };