chore: update WASM artifact SHA256 checksums [skip ci]

.env.example

@@ -2,28 +2,9 @@
 DATABASE_URL=postgres://localhost/ironclaw
 DATABASE_POOL_SIZE=10
 
-# Vector store for workspace memory (optional)
-# When set to "lancedb", uses LanceDB for semantic search instead of pgvector/libsql
-# VECTOR_BACKEND=builtin   # default: use database's built-in index (pgvector or libsql_vector_idx); "pgvector" is also accepted as an alias for "builtin"
-# VECTOR_BACKEND=lancedb
-# LANCEDB_PATH=~/.ironclaw/lancedb   # path for LanceDB when VECTOR_BACKEND=lancedb
-
 # LLM Provider
 # LLM_BACKEND=nearai           # default
 # Possible values: nearai, ollama, openai_compatible, openai, anthropic, tinfoil
-# LLM_REQUEST_TIMEOUT_SECS=120  # Increase for local LLMs (Ollama, vLLM, LM Studio)
-
-# === Anthropic Direct ===
-# Two auth modes:
-#   1. API key: Set ANTHROPIC_API_KEY (from console.anthropic.com/settings/keys)
-#   2. OAuth token: Set ANTHROPIC_OAUTH_TOKEN (from `claude login`)
-#      OAuth tokens use Authorization: Bearer instead of x-api-key header.
-# ANTHROPIC_API_KEY=sk-ant-...
-# ANTHROPIC_OAUTH_TOKEN=sk-ant-oat01-...   # from `claude login` credentials
-# ANTHROPIC_MODEL=claude-sonnet-4-20250514
-
-# === OpenAI Direct ===
-# OPENAI_API_KEY=sk-...
 
 # === NEAR AI (Chat Completions API) ===
 # Two auth modes:
@@ -76,17 +57,6 @@ NEARAI_AUTH_URL=https://private.near.ai
 # LLM_BASE_URL=https://api.fireworks.ai/inference/v1
 # LLM_API_KEY=fw_...
 
-# === Anthropic Direct ===
-# LLM_BACKEND=anthropic
-# ANTHROPIC_MODEL=claude-sonnet-4-6
-# ANTHROPIC_API_KEY=sk-ant-...
-# ANTHROPIC_BASE_URL=https://api.anthropic.com  # default
-# Prompt cache retention — controls Anthropic server-side prompt caching:
-#   none  = disabled (no cache_control injected)
-#   short = 5-minute TTL, 1.25× (125%) write surcharge (default)
-#   long  = 1-hour TTL, 2.0× (200%) write surcharge
-# ANTHROPIC_CACHE_RETENTION=short
-
 # For full provider setup guide see docs/LLM_PROVIDERS.md
 
 # Channel Configuration
@@ -138,9 +108,8 @@ HEARTBEAT_NOTIFY_USER=default
 # Memory hygiene settings (automatic cleanup of stale workspace documents)
 # Runs on each heartbeat tick; identity files (IDENTITY.md, SOUL.md) are never deleted
 # MEMORY_HYGIENE_ENABLED=true
-# MEMORY_HYGIENE_DAILY_RETENTION_DAYS=30         # delete daily/ docs older than this many days
-# MEMORY_HYGIENE_CONVERSATION_RETENTION_DAYS=7   # delete conversations/ docs older than this many days
-# MEMORY_HYGIENE_CADENCE_HOURS=12                # minimum hours between cleanup passes
+# MEMORY_HYGIENE_RETENTION_DAYS=30     # delete daily/ docs older than this many days
+# MEMORY_HYGIENE_CADENCE_HOURS=12      # minimum hours between cleanup passes
 
 # Safety settings
 SAFETY_MAX_OUTPUT_LENGTH=100000

.githooks/commit-msg

@@ -1 +0,0 @@
-../scripts/commit-msg-regression.sh

.githooks/pre-commit

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Pre-commit hook: run version bump checks when WIT or extension sources change.
-# Install: git config core.hooksPath .githooks
-
-# Only run the check if relevant files are staged
-STAGED=$(git diff --cached --name-only)
-
-NEEDS_CHECK=false
-if echo "$STAGED" | grep -qE '^wit/|^channels-src/|^tools-src/'; then
-    NEEDS_CHECK=true
-fi
-
-if $NEEDS_CHECK; then
-    echo "pre-commit: checking version bumps..."
-    if ! ./scripts/check-version-bumps.sh; then
-        echo ""
-        echo "Commit blocked: version bump check failed."
-        echo "Bump versions in the relevant registry JSON and/or WIT package declaration."
-        echo "To bypass: git commit --no-verify"
-        exit 1
-    fi
-fi

.github/workflows/code_style.yml

@@ -12,6 +12,7 @@ jobs:
     - name: Install Rust
       uses: dtolnay/rust-toolchain@stable
       with:
+        profile: minimal
         components: rustfmt
     - name: Check formatting
       run: cargo fmt --all -- --check
@@ -35,58 +36,23 @@ jobs:
     - name: Install Rust
       uses: dtolnay/rust-toolchain@stable
       with:
+        profile: minimal
         components: clippy
-    - name: Install protoc (for lancedb)
-      if: matrix.name == 'all-features'
-      uses: arduino/setup-protoc@v3
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - uses: Swatinem/rust-cache@v2
       with:
         key: clippy-${{ matrix.name }}
     - name: Check lints
       run: cargo clippy --all --benches --tests --examples ${{ matrix.flags }} -- -D warnings
 
-  clippy-windows:
-    name: Clippy Windows (${{ matrix.name }})
-    runs-on: windows-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: all-features
-            flags: "--all-features"
-          - name: default
-            flags: ""
-          - name: libsql-only
-            flags: "--no-default-features --features libsql"
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-    - name: Install Rust
-      uses: dtolnay/rust-toolchain@stable
-      with:
-        components: clippy
-    - name: Install protoc (for lancedb)
-      if: matrix.name == 'all-features'
-      uses: arduino/setup-protoc@v3
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-    - uses: Swatinem/rust-cache@v2
-      with:
-        key: clippy-windows-${{ matrix.name }}
-    - name: Check lints
-      run: cargo clippy --all --benches --tests --examples ${{ matrix.flags }} -- -D warnings
-
   # Roll-up job for branch protection
   code-style:
     name: Code Style (fmt + clippy)
     runs-on: ubuntu-latest
     if: always()
-    needs: [format, clippy, clippy-windows]
+    needs: [format, clippy]
     steps:
       - run: |
-          if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" || "${{ needs.clippy-windows.result }}" != "success" ]]; then
+          if [[ "${{ needs.format.result }}" != "success" || "${{ needs.clippy.result }}" != "success" ]]; then
             echo "One or more jobs failed"
             exit 1
           fi

.github/workflows/coverage.yml

@@ -1,31 +1,3 @@
-# Code Coverage Workflow
-#
-# This workflow runs test coverage analysis and uploads reports to Codecov.
-# Coverage reports help identify untested code paths and maintain code quality.
-#
-# What it does:
-# - Runs unit and integration tests with coverage instrumentation
-# - Runs E2E tests with coverage instrumentation
-# - Uploads coverage reports to Codecov (https://codecov.io/gh/nearai/ironclaw)
-#
-# Viewing coverage reports:
-# - PRs automatically get coverage comments showing changes in coverage
-# - Visit https://codecov.io/gh/nearai/ironclaw for detailed coverage reports
-# - Coverage reports are generated for three configurations:
-#   1. all-features: Full feature set
-#   2. default: Default features
-#   3. libsql-only: Minimal libSQL-only configuration
-# - E2E coverage tracks end-to-end test coverage separately
-#
-# Coverage files:
-# - Unit/integration: lcov.info (uploaded to Codecov with "unit" flag)
-# - E2E: e2e-coverage.info (uploaded to Codecov with "e2e" flag)
-#
-# Requirements:
-# - Uses cargo-llvm-cov for coverage instrumentation
-# - Requires PostgreSQL for integration tests (pgvector/pgvector:pg16)
-# - E2E tests require Python 3.12 and Playwright
-
 name: Code Coverage
 on:
   push:

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
       matrix:
         include:
           - name: all-features
-            flags: "--features postgres,libsql,lancedb,html-to-markdown"
+            flags: "--all-features"
           - name: default
             flags: ""
           - name: libsql-only
@@ -25,12 +25,8 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
         with:
+          profile: minimal
           targets: wasm32-wasip2
-      - name: Install protoc (for lancedb)
-        if: matrix.name == 'all-features'
-        uses: arduino/setup-protoc@v3
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
       - uses: Swatinem/rust-cache@v2
         with:
           key: ${{ matrix.name }}
@@ -49,39 +45,12 @@ jobs:
         uses: actions/checkout@v6
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
+        with:
+          profile: minimal
       - uses: Swatinem/rust-cache@v2
       - name: Run Telegram Channel Tests
         run: cargo test --manifest-path channels-src/telegram/Cargo.toml -- --nocapture
 
-  windows-build:
-    name: Windows Build (${{ matrix.name }})
-    runs-on: windows-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: all-features
-            flags: "--all-features"
-          - name: default
-            flags: ""
-          - name: libsql-only
-            flags: "--no-default-features --features libsql"
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-      - name: Install protoc (for lancedb)
-        if: matrix.name == 'all-features'
-        uses: arduino/setup-protoc@v3
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: windows-${{ matrix.name }}
-      - name: Check compilation
-        run: cargo check --all --benches --tests --examples ${{ matrix.flags }}
-
   wasm-wit-compat:
     name: WASM WIT Compatibility
     runs-on: ubuntu-latest
@@ -91,11 +60,8 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
         with:
+          profile: minimal
           targets: wasm32-wasip2
-      - name: Install protoc (for lancedb)
-        uses: arduino/setup-protoc@v3
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
       - uses: Swatinem/rust-cache@v2
         with:
           key: wasm-extensions
@@ -134,10 +100,10 @@ jobs:
     name: Run Tests
     runs-on: ubuntu-latest
     if: always()
-    needs: [tests, telegram-tests, wasm-wit-compat, docker-build, windows-build, version-check]
+    needs: [tests, telegram-tests, wasm-wit-compat, docker-build, version-check]
     steps:
       - run: |
-          if [[ "${{ needs.tests.result }}" != "success" || "${{ needs.telegram-tests.result }}" != "success" || "${{ needs.wasm-wit-compat.result }}" != "success" || "${{ needs.docker-build.result }}" != "success" || "${{ needs.windows-build.result }}" != "success" ]]; then
+          if [[ "${{ needs.tests.result }}" != "success" || "${{ needs.telegram-tests.result }}" != "success" || "${{ needs.wasm-wit-compat.result }}" != "success" || "${{ needs.docker-build.result }}" != "success" ]]; then
             echo "One or more jobs failed"
             exit 1
           fi

.gitignore

@@ -4,9 +4,8 @@
 .env.*
 !.env.example
 
-# Claude Code worktrees and lock files
+# Claude Code worktrees
 .claude/worktrees/
-.claude/scheduled_tasks.lock
 
 # Sidecar tool data
 .sidecar/
@@ -23,4 +22,3 @@ bench-results/
 # WASM build artifacts (loaded from disk, not bundled)
 *.wasm
 
-trace_*.json

CHANGELOG.md

@@ -7,12 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.16.1](https://github.com/nearai/ironclaw/compare/v0.16.0...v0.16.1) - 2026-03-06
-
-### Fixed
-
-- revert WASM artifact SHA256 checksums to null ([#627](https://github.com/nearai/ironclaw/pull/627))
-
 ## [0.16.0](https://github.com/nearai/ironclaw/compare/v0.15.0...v0.16.0) - 2026-03-06
 
 ### Added

CLAUDE.md

@@ -43,53 +43,34 @@ cargo test test_name
 
 # Run with logging
 RUST_LOG=ironclaw=debug cargo run
-
-# Run integration tests (may require running services/DB)
-cargo test --test workspace_integration
-cargo test --test ws_gateway_integration
-cargo test --test heartbeat_integration
-
-# Run E2E tests (Python/Playwright — requires a running ironclaw instance)
-# See tests/e2e/CLAUDE.md for full setup instructions
-cd tests/e2e
-python -m venv .venv && source .venv/bin/activate  # On Windows: .venv\Scripts\activate
-pip install -e .
-playwright install chromium
-pytest scenarios/                    # all scenarios
-pytest scenarios/test_chat.py        # specific scenario
 ```
 
-### Test Tiers
-
-| Tier | Command | What runs | External deps |
-|------|---------|-----------|---------------|
-| Unit | `cargo test` | All `mod tests` + self-contained integration tests | None |
-| Integration | `cargo test --features integration` | + PostgreSQL-dependent tests | Running PostgreSQL |
-| Live | `cargo test --features integration -- --ignored` | + LLM-dependent tests | PostgreSQL + LLM API keys |
-
-Run `bash scripts/check-boundaries.sh` to verify test tier gating and other architecture rules.
-
 ## Project Structure
 
 ```
 src/
 ├── lib.rs              # Library root, module declarations
 ├── main.rs             # Entry point, CLI args, startup
-├── app.rs              # App startup orchestration (channel wiring, DB init)
-├── bootstrap.rs        # Base directory resolution (~/.ironclaw), early .env loading
-├── settings.rs         # User settings persistence (~/.ironclaw/settings.json)
-├── service.rs          # OS service management (launchd/systemd daemon install)
-├── tracing_fmt.rs      # Custom tracing formatter
-├── util.rs             # Shared utilities
-├── config/             # Configuration from env vars (split by subsystem)
-│   ├── mod.rs          # Re-exports all config types; top-level Config struct
-│   ├── agent.rs, llm.rs, channels.rs, database.rs, sandbox.rs, skills.rs
-│   ├── heartbeat.rs, routines.rs, safety.rs, embeddings.rs, wasm.rs
-│   ├── tunnel.rs       # Tunnel provider config (TUNNEL_PROVIDER, TUNNEL_URL, etc.)
-│   └── secrets.rs, hygiene.rs, builder.rs, helpers.rs
+├── config.rs           # Configuration from env vars
 ├── error.rs            # Error types (thiserror)
 │
-├── agent/              # Core agent loop, dispatcher, scheduler, sessions — see src/agent/CLAUDE.md
+├── agent/              # Core agent logic
+│   ├── agent_loop.rs   # Main Agent struct, message handling loop
+│   ├── router.rs       # MessageIntent classification
+│   ├── scheduler.rs    # Parallel job scheduling
+│   ├── worker.rs       # Per-job execution with LLM reasoning
+│   ├── self_repair.rs  # Stuck job detection and recovery
+│   ├── heartbeat.rs    # Proactive periodic execution
+│   ├── session.rs      # Session/thread/turn model with state machine
+│   ├── session_manager.rs # Thread/session lifecycle management
+│   ├── compaction.rs   # Context window management with turn summarization
+│   ├── context_monitor.rs # Memory pressure detection
+│   ├── undo.rs         # Turn-based undo/redo with checkpoints
+│   ├── submission.rs   # Submission parsing (undo, redo, compact, clear, etc.)
+│   ├── dispatcher.rs   # Skill-aware job dispatching
+│   ├── task.rs         # Sub-task execution framework
+│   ├── routine.rs      # Routine types (Trigger, Action, Guardrails)
+│   └── routine_engine.rs # Routine execution (cron ticker, event matcher)
 │
 ├── channels/           # Multi-channel input
 │   ├── channel.rs      # Channel trait, IncomingMessage, OutgoingResponse
@@ -102,60 +83,21 @@ src/
 │   │   ├── overlay.rs  # Approval overlays
 │   │   └── composer.rs # Message composition
 │   ├── http.rs         # HTTP webhook (axum) with secret validation
-│   ├── webhook_server.rs # Unified HTTP server composing all webhook routes
 │   ├── repl.rs         # Simple REPL (for testing)
-│   ├── web/            # Web gateway (browser UI) — see src/channels/web/CLAUDE.md
+│   ├── web/            # Web gateway (browser UI)
+│   │   ├── mod.rs      # Gateway builder, startup
+│   │   ├── server.rs   # Axum router, 40+ API endpoints
+│   │   ├── sse.rs      # SSE broadcast manager
+│   │   ├── ws.rs       # WebSocket gateway + connection tracking
+│   │   ├── types.rs    # Request/response types, SseEvent enum
+│   │   ├── auth.rs     # Bearer token auth middleware
+│   │   ├── log_layer.rs # Tracing layer for log streaming
+│   │   └── static/     # HTML, CSS, JS (single-page app)
 │   └── wasm/           # WASM channel runtime
 │       ├── mod.rs
 │       ├── bundled.rs  # Bundled channel discovery
-│       ├── capabilities.rs # Channel-specific capabilities (HTTP endpoint, emit rate)
-│       ├── error.rs    # WASM channel error types
-│       ├── runtime.rs  # WASM channel execution runtime
 │       └── wrapper.rs  # Channel trait wrapper for WASM modules
 │
-├── cli/                # CLI subcommands (clap)
-│   ├── mod.rs          # Cli struct, Command enum (run/onboard/config/tool/registry/mcp/memory/pairing/service/doctor/status/completion)
-│   ├── config.rs       # config list/get/set subcommands
-│   ├── tool.rs         # tool install/list/remove subcommands
-│   ├── registry.rs     # registry list/install subcommands
-│   ├── mcp.rs          # mcp add/auth/list/test subcommands
-│   ├── memory.rs       # memory search/read/write subcommands
-│   ├── pairing.rs      # pairing list/approve subcommands
-│   ├── service.rs      # service install/start/stop subcommands
-│   ├── doctor.rs       # Active health diagnostics
-│   ├── status.rs       # System health/status display
-│   ├── completion.rs   # Shell completion script generation
-│   └── oauth_defaults.rs # Default OAuth redirect URIs
-│
-├── registry/           # Extension registry catalog
-│   ├── mod.rs          # Public API; re-exports RegistryCatalog, RegistryInstaller, manifest types
-│   ├── manifest.rs     # ExtensionManifest, ArtifactSpec, BundleDefinition types
-│   ├── catalog.rs      # RegistryCatalog: load from filesystem and embedded JSON
-│   ├── installer.rs    # RegistryInstaller: download, verify, install WASM artifacts
-│   ├── artifacts.rs    # Artifact download and caching
-│   └── embedded.rs     # Catalog compiled into binary at build time (via build.rs)
-│
-├── hooks/              # Lifecycle hooks for intercepting agent operations
-│   ├── mod.rs          # 6 HookPoints: BeforeInbound, BeforeToolCall, BeforeOutbound, OnSessionStart, OnSessionEnd, TransformResponse
-│   ├── hook.rs         # Hook trait, HookContext, HookEvent, HookOutcome, HookFailureMode
-│   ├── registry.rs     # HookRegistry: register, prioritize, execute hooks
-│   └── bundled.rs      # Built-in hooks: rule-based filters, webhook forwarders, HookBundleConfig
-│
-├── tunnel/             # Tunnel abstraction for public internet exposure
-│   ├── mod.rs          # Tunnel trait, TunnelProviderConfig, create_tunnel() factory
-│   ├── cloudflare.rs   # CloudflareTunnel (cloudflared binary)
-│   ├── ngrok.rs        # NgrokTunnel
-│   ├── tailscale.rs    # TailscaleTunnel (serve/funnel modes)
-│   ├── custom.rs       # CustomTunnel (arbitrary command with {host}/{port})
-│   └── none.rs         # NoneTunnel (local-only, no exposure)
-│
-├── observability/      # Pluggable event/metric recording
-│   ├── mod.rs          # create_observer() factory, ObservabilityConfig
-│   ├── traits.rs       # Observer trait, ObserverEvent, ObserverMetric
-│   ├── noop.rs         # NoopObserver (zero overhead, default)
-│   ├── log.rs          # LogObserver (tracing-based)
-│   └── multi.rs        # MultiObserver (fan-out to multiple backends)
-│
 ├── orchestrator/       # Internal HTTP API for sandbox containers
 │   ├── mod.rs
 │   ├── api.rs          # Axum endpoints (LLM proxy, events, prompts)
@@ -173,30 +115,34 @@ src/
 │   ├── sanitizer.rs    # Pattern detection, content escaping
 │   ├── validator.rs    # Input validation (length, encoding, patterns)
 │   ├── policy.rs       # PolicyRule system with severity/actions
-│   ├── leak_detector.rs # Secret detection (API keys, tokens, etc.)
-│   └── credential_detect.rs # HTTP request credential detection (headers, URL params)
+│   └── leak_detector.rs # Secret detection (API keys, tokens, etc.)
 │
-├── llm/                # Multi-provider LLM integration — see src/llm/CLAUDE.md
+├── llm/                # LLM integration (multi-provider)
+│   ├── mod.rs          # Provider factory, LlmBackend enum
+│   ├── provider.rs     # LlmProvider trait, message types
+│   ├── nearai_chat.rs  # NEAR AI Chat Completions provider (session token + API key auth)
+│   ├── reasoning.rs    # Planning, tool selection, evaluation
+│   ├── session.rs      # Session token management with auto-renewal
+│   ├── circuit_breaker.rs # Circuit breaker for provider failures
+│   ├── retry.rs        # Retry with exponential backoff
+│   ├── failover.rs     # Multi-provider failover chain
+│   ├── response_cache.rs # LLM response caching
+│   ├── costs.rs        # Token cost tracking
+│   └── rig_adapter.rs  # Rig framework adapter
 │
 ├── tools/              # Extensible tool system
 │   ├── tool.rs         # Tool trait, ToolOutput, ToolError
 │   ├── registry.rs     # ToolRegistry for discovery
 │   ├── sandbox.rs      # Process-based sandbox (stub, superseded by wasm/)
-│   ├── rate_limiter.rs # Shared sliding-window rate limiter for built-in and WASM tools
 │   ├── builtin/        # Built-in tools
 │   │   ├── echo.rs, time.rs, json.rs, http.rs
-│   │   ├── web_fetch.rs # GET URL → clean Markdown (readability + html-to-md conversion)
 │   │   ├── file.rs     # ReadFile, WriteFile, ListDir, ApplyPatch
 │   │   ├── shell.rs    # Shell command execution
 │   │   ├── memory.rs   # Memory tools (search, write, read, tree)
-│   │   ├── message.rs  # MessageTool: agent proactively messages users on any channel
 │   │   ├── job.rs      # CreateJob, ListJobs, JobStatus, CancelJob
 │   │   ├── routine.rs  # routine_create/list/update/delete/history
 │   │   ├── extension_tools.rs # Extension install/auth/activate/remove
 │   │   ├── skill_tools.rs # skill_list/search/install/remove tools
-│   │   ├── secrets_tools.rs # secret_list/secret_delete (zero-exposure: no values exposed)
-│   │   ├── html_converter.rs # HTML→Markdown via readability + html-to-markdown-rs
-│   │   ├── path_utils.rs # Shared path validation/canonicalization helpers
 │   │   └── marketplace.rs, ecommerce.rs, taskrabbit.rs, restaurant.rs (stubs)
 │   ├── builder/        # Dynamic tool building
 │   │   ├── core.rs     # BuildRequirement, SoftwareType, Language
@@ -205,8 +151,7 @@ src/
 │   │   └── validation.rs # WASM validation
 │   ├── mcp/            # Model Context Protocol
 │   │   ├── client.rs   # MCP client over HTTP
-│   │   ├── protocol.rs # JSON-RPC types
-│   │   └── session.rs  # MCP session management (Mcp-Session-Id header, per-server state)
+│   │   └── protocol.rs # JSON-RPC types
 │   └── wasm/           # Full WASM sandbox (wasmtime)
 │       ├── runtime.rs  # Module compilation and caching
 │       ├── wrapper.rs  # Tool trait wrapper for WASM modules
@@ -216,10 +161,13 @@ src/
 │       ├── credential_injector.rs # Safe credential injection
 │       ├── loader.rs   # WASM tool discovery from filesystem
 │       ├── rate_limiter.rs # Per-tool rate limiting
-│       ├── error.rs    # WASM-specific error types
 │       └── storage.rs  # Linear memory persistence
 │
-├── db/                 # Dual-backend persistence (PostgreSQL + libSQL) — see src/db/CLAUDE.md
+├── db/                 # Database abstraction layer
+│   ├── mod.rs          # Database trait (~60 async methods)
+│   ├── postgres.rs     # PostgreSQL backend (delegates to Store + Repository)
+│   ├── libsql_backend.rs # libSQL/Turso backend (embedded SQLite)
+│   └── libsql_migrations.rs # SQLite-dialect schema (idempotent)
 │
 ├── workspace/          # Persistent memory system (OpenClaw-inspired)
 │   ├── mod.rs          # Workspace struct, memory operations
@@ -257,11 +205,9 @@ src/
 │       └── allowlist.rs # DomainAllowlist validation
 │
 ├── secrets/            # Secrets management
-│   ├── mod.rs          # SecretsStore trait, public API
-│   ├── types.rs        # Core types (Secret, SecretRef, SecretMetadata)
 │   ├── crypto.rs       # AES-256-GCM encryption
-│   ├── keychain.rs     # OS keychain integration (macOS Keychain, GNOME Keyring) for master key
-│   └── store.rs        # Encrypted secret storage
+│   ├── store.rs        # Secret storage
+│   └── types.rs        # Credential types
 │
 ├── setup/              # Onboarding wizard (spec: src/setup/README.md)
 │   ├── mod.rs          # Entry point, check_onboard_needed()
@@ -281,11 +227,6 @@ src/
 └── history/            # Persistence
     ├── store.rs        # PostgreSQL repositories
     └── analytics.rs    # Aggregation queries (JobStats, ToolStats)
-
-tests/
-├── *.rs                # Integration tests (workspace, heartbeat, WS gateway, pairing, etc.)
-├── test-pages/         # HTML→Markdown conversion fixtures (CNN, Medium, Yahoo)
-└── e2e/                # Python/Playwright E2E scenarios (see tests/e2e/CLAUDE.md)
 ```
 
 ## Key Patterns
@@ -306,16 +247,13 @@ When designing new features or systems, always prefer generic/extensible archite
 - Use `RwLock` for concurrent read/write access
 
 ### Traits for Extensibility
-- `Database` - Add new database backends (must implement all ~78 methods)
+- `Database` - Add new database backends (must implement all ~60 methods)
 - `Channel` - Add new input sources
 - `Tool` - Add new capabilities
 - `LlmProvider` - Add new LLM backends
 - `SuccessEvaluator` - Custom evaluation logic
 - `EmbeddingProvider` - Add embedding backends (workspace search)
 - `NetworkPolicyDecider` - Custom network access policies for sandbox containers
-- `Hook` - Lifecycle hook at 6 interception points (BeforeInbound, BeforeToolCall, BeforeOutbound, OnSessionStart, OnSessionEnd, TransformResponse)
-- `Observer` - Observability backend (noop/log/multi; future: OpenTelemetry, Prometheus)
-- `Tunnel` - Tunnel provider for public internet exposure
 
 ### Tool Implementation
 ```rust
@@ -387,27 +325,12 @@ Dead code behind the wrong `#[cfg]` gate will only show up when building with a
 
 **Zero clippy warnings policy:** Fix ALL clippy warnings before committing, including pre-existing ones in files you didn't change. Never leave warnings behind — treat `cargo clippy` output as a zero-tolerance gate.
 
-**Transaction safety:** Multi-step database operations (INSERT+INSERT, UPDATE+DELETE, read-then-write) MUST be wrapped in a transaction. Never assume sequential calls are atomic. Before committing DB code, ask: "If this crashes between step N and N+1, is the database consistent?" If not, wrap in a transaction. This applies to both postgres and libsql backends.
-
-**UTF-8 string safety:** Never use byte-index slicing (`&s[..n]`) on user-supplied or external strings — it panics on multi-byte characters. Use `is_char_boundary()` to walk backwards from the desired length, or iterate with `char_indices()`. Grep for `[..` in changed files to catch violations.
-
-**Case-insensitive comparisons:** When comparing user-supplied strings (file paths, media types, extension names), always normalize to lowercase first with `.to_ascii_lowercase()`. On case-insensitive filesystems (macOS, Windows), path comparisons must be case-insensitive. File extension checks (`.png`, `.jpg`) and media type checks (`image/jpeg`) are common offenders.
-
-**Decorator/wrapper trait delegation:** When adding a new method to `LlmProvider` (or any trait with decorator wrappers), you MUST update ALL wrapper types to delegate to their inner provider. Grep for `impl LlmProvider for` to find all implementations. Add a test that exercises the method through the full provider chain (`build_provider_chain()`), not just the base impl.
-
-**Sensitive data in logs & events:** Tool parameters and outputs MUST be redacted before logging or broadcasting via SSE/WebSocket. Use `redact_params()` before any `tracing::info!`, `JobEvent`, or SSE emission that includes tool call data. Never log raw parameters from tool calls.
-
-**Test temporary files:** Use the `tempfile` crate for test directories/files. Never hardcode `/tmp/...` paths — they collide in parallel test runs and break on non-Unix platforms.
-
-**Trust boundaries in multi-process architecture:** Data from worker containers is untrusted. The orchestrator MUST validate: tool domain (never execute `Container`-domain tools on the host), nesting depth (server-side tracking, not client-supplied), and parameter sensitivity (redact before logging/broadcasting).
-
 **Mechanical verification before committing:** Run these checks on changed files before committing:
 - `cargo clippy --all --benches --tests --examples --all-features` -- zero warnings
 - `grep -rnE '\.unwrap\(|\.expect\(' <files>` -- no panics in production
 - `grep -rn 'super::' <files>` -- use `crate::` imports
 - If you fixed a pattern bug, `grep` for other instances of that pattern across `src/`
 - Fix commits must include regression tests (enforced by `commit-msg` hook; bypass with `[skip-regression-check]`)
-- Run `scripts/pre-commit-safety.sh` to catch UTF-8, case-sensitivity, hardcoded /tmp, and logging issues
 
 ## Configuration
 
@@ -483,38 +406,99 @@ SKILLS_AUTO_DISCOVER=true              # Scan skill directories on startup
 # Tinfoil private inference
 TINFOIL_API_KEY=...                    # Required when LLM_BACKEND=tinfoil
 TINFOIL_MODEL=kimi-k2-5               # Default model
-
-# Tunnel (public internet exposure for webhooks)
-TUNNEL_URL=https://abc123.ngrok.io     # Static public URL (manual tunnel)
-# Or use a managed tunnel provider:
-TUNNEL_PROVIDER=none                   # none (default), cloudflare, tailscale, ngrok, custom
-TUNNEL_CF_TOKEN=...                    # Required for TUNNEL_PROVIDER=cloudflare
-TUNNEL_NGROK_TOKEN=...                 # Required for TUNNEL_PROVIDER=ngrok
-# TUNNEL_NGROK_DOMAIN=...             # Custom domain (paid ngrok plan)
-# TUNNEL_TS_FUNNEL=true               # Use tailscale funnel (public) vs serve (tailnet)
-TUNNEL_CUSTOM_COMMAND=...              # Command with {host}/{port} for custom providers
-
-# Observability backend
-OBSERVABILITY_BACKEND=none             # none/noop (default) or log
 ```
 
 ### LLM Providers
 
-Backends: `nearai` (default), `openai`, `anthropic`, `ollama`, `openai_compatible`, `tinfoil` — set via `LLM_BACKEND`. See [src/llm/CLAUDE.md](src/llm/CLAUDE.md) for per-provider auth and configuration details.
+IronClaw supports multiple LLM backends via the `LLM_BACKEND` env var: `nearai` (default), `openai`, `anthropic`, `ollama`, `openai_compatible`, and `tinfoil`.
+
+**NEAR AI** -- Uses the Chat Completions API with dual auth support. Session token auth (default): authenticates with session tokens (`sess_xxx`) obtained via browser OAuth (GitHub/Google), base URL defaults to `https://private.near.ai`. API key auth: set `NEARAI_API_KEY` (from `cloud.near.ai`), base URL defaults to `https://cloud-api.near.ai`. Both modes use the same Chat Completions endpoint. Tool messages are flattened to plain text for compatibility. Set `NEARAI_SESSION_TOKEN` env var for hosting providers that inject tokens via environment.
+
+**NEAR AI Cloud** -- Uses the OpenAI-compatible Chat Completions API (`https://cloud-api.near.ai/v1/chat/completions`). Authenticates with API keys from `cloud.near.ai`. Auto-selected when `NEARAI_API_KEY` is set (or explicitly via `NEARAI_API_MODE=chat_completions`). Tool messages are flattened to plain text for compatibility. Configure with `NEARAI_API_KEY` and `NEARAI_BASE_URL` (default: `https://cloud-api.near.ai`).
+
+**OpenAI-compatible** -- Any endpoint that speaks the OpenAI API (vLLM, LiteLLM, OpenRouter, etc.). Configure with `LLM_BASE_URL`, `LLM_API_KEY` (optional), `LLM_MODEL`. Set `LLM_EXTRA_HEADERS` to inject custom HTTP headers into every request (format: `Key:Value,Key2:Value2`), useful for OpenRouter attribution headers like `HTTP-Referer` and `X-Title`.
+
+**Tinfoil** -- Private inference via `https://inference.tinfoil.sh/v1`. Runs models inside hardware-attested TEEs so neither Tinfoil nor the cloud provider can see prompts or responses. Uses the OpenAI-compatible Chat Completions API. Configure with `TINFOIL_API_KEY` and `TINFOIL_MODEL` (default: `kimi-k2-5`).
 
 ## Database
 
-Dual-backend persistence (PostgreSQL + libSQL/Turso). **All new persistence features must support both backends** — see [src/db/CLAUDE.md](src/db/CLAUDE.md) for schema, SQL dialect differences, adding operations, and libSQL limitations.
+IronClaw supports two database backends, selected at compile time via Cargo feature flags and at runtime via the `DATABASE_BACKEND` environment variable.
+
+**IMPORTANT: All new features that touch persistence MUST support both backends.** Implement the operation as a method on the `Database` trait in `src/db/mod.rs`, then add the implementation in both `src/db/postgres.rs` (delegate to Store/Repository) and `src/db/libsql_backend.rs` (native SQL).
+
+### Backends
+
+| Backend | Feature Flag | Default | Use Case |
+|---------|-------------|---------|----------|
+| PostgreSQL | `postgres` (default) | Yes | Production, existing deployments |
+| libSQL/Turso | `libsql` | No | Zero-dependency local mode, edge, Turso cloud |
 
-Implement every new operation in both `src/db/postgres.rs` and `src/db/libsql/mod.rs`. Test in isolation:
 ```bash
-cargo check                                          # postgres (default)
-cargo check --no-default-features --features libsql  # libsql only
-cargo check --all-features                           # both
+# Build with PostgreSQL only (default)
+cargo build
+
+# Build with libSQL only
+cargo build --no-default-features --features libsql
+
+# Build with both backends available
+cargo build --features "postgres,libsql"
 ```
 
+### Database Trait
+
+The `Database` trait (`src/db/mod.rs`) defines ~60 async methods covering all persistence:
+- Conversations, messages, metadata
+- Jobs, actions, LLM calls, estimation snapshots
+- Sandbox jobs, job events
+- Routines, routine runs
+- Tool failures, settings
+- Workspace: documents, chunks, hybrid search
+
+Both backends implement this trait. PostgreSQL delegates to the existing `Store` + `Repository`. libSQL implements native SQLite-dialect SQL.
+
+### Schema
+
+**PostgreSQL:** `migrations/V1__initial.sql` (351 lines). Uses pgvector for embeddings, tsvector for FTS, PL/pgSQL functions. Managed by `refinery`.
+
+**libSQL:** `src/db/libsql_migrations.rs` (consolidated schema, ~480 lines). Translates PG types:
+- `UUID` -> `TEXT`, `TIMESTAMPTZ` -> `TEXT` (ISO-8601), `JSONB` -> `TEXT`
+- `VECTOR(1536)` -> `F32_BLOB(1536)` with `libsql_vector_idx`
+- `tsvector`/`ts_rank_cd` -> FTS5 virtual table with sync triggers
+- PL/pgSQL functions -> SQLite triggers
+
+**Tables (both backends):**
+
+**Core:**
+- `conversations` - Multi-channel conversation tracking
+- `agent_jobs` - Job metadata and status
+- `job_actions` - Event-sourced tool executions
+- `dynamic_tools` - Agent-built tools
+- `llm_calls` - Cost tracking
+- `estimation_snapshots` - Learning data
+
+**Workspace/Memory:**
+- `memory_documents` - Flexible path-based files (e.g., "context/vision.md", "daily/2024-01-15.md")
+- `memory_chunks` - Chunked content with FTS and vector indexes
+- `heartbeat_state` - Periodic execution tracking
+
+**Other:**
+- `routines`, `routine_runs` - Scheduled/reactive execution
+- `settings` - Per-user key-value settings
+- `tool_failures` - Self-repair tracking
+- `secrets`, `wasm_tools`, `tool_capabilities` - Extension infrastructure
+
 Database configuration: see Configuration section above.
 
+### Current Limitations (libSQL backend)
+
+- **Workspace/memory system** not yet wired through Database trait (requires Store migration)
+- **Secrets store** not yet available (still requires PostgresSecretsStore)
+- **Hybrid search** uses FTS5 only (vector search via libsql_vector_idx not yet implemented)
+- **Settings reload from DB** skipped (Config::from_db requires Store)
+- No incremental migration versioning (schema is CREATE IF NOT EXISTS, no ALTER TABLE support yet)
+- **No encryption at rest** -- The local SQLite database file stores conversation content, job data, workspace memory, and other application data in plaintext. Only secrets (API tokens, credentials) are encrypted via AES-256-GCM before storage. Users handling sensitive data should use full-disk encryption (FileVault, LUKS, BitLocker) or consider the PostgreSQL backend with TDE/encrypted storage.
+- **JSON merge patch vs path-targeted update** -- The libSQL backend uses RFC 7396 JSON Merge Patch (`json_patch`) for metadata updates, while PostgreSQL uses path-targeted `jsonb_set`. Merge patch replaces top-level keys entirely, which may drop nested keys not present in the patch. Callers should avoid relying on partial nested object updates in metadata fields.
+
 ## Safety Layer
 
 All external tool output passes through `SafetyLayer`:
@@ -644,8 +628,8 @@ Key test patterns:
 4. **WIT bindgen integration** - Auto-extract tool description/schema from WASM modules (stubbed)
 5. **Capability granting after tool build** - Built tools get empty capabilities; need UX for granting HTTP/secrets access
 6. **Tool versioning workflow** - No version tracking or rollback for dynamically built tools
-7. **Full channel status view** - Gateway status widget exists, but no per-channel connection dashboard
-8. **Observability backends** - Only `log` and `noop` implemented; OpenTelemetry/Prometheus not yet supported
+7. **Webhook trigger endpoint** - Routines webhook trigger not yet exposed in web gateway
+8. **Full channel status view** - Gateway status widget exists, but no per-channel connection dashboard
 
 ## Tool Architecture
 
@@ -659,8 +643,8 @@ See `src/tools/README.md` for full tool architecture, adding new tools (built-in
 
 1. Create `src/channels/my_channel.rs`
 2. Implement the `Channel` trait
-3. Add config in `src/config/channels.rs`
-4. Wire up in `src/app.rs` channel setup section
+3. Add config in `src/config.rs`
+4. Wire up in `main.rs` channel setup section
 
 ## Debugging
 
@@ -692,11 +676,6 @@ for that module's behavior. When modifying code in a module that has a spec:
 | `src/setup/` | `src/setup/README.md` |
 | `src/workspace/` | `src/workspace/README.md` |
 | `src/tools/` | `src/tools/README.md` |
-| `src/agent/` | `src/agent/CLAUDE.md` |
-| `src/channels/web/` | `src/channels/web/CLAUDE.md` |
-| `src/db/` | `src/db/CLAUDE.md` |
-| `src/llm/` | `src/llm/CLAUDE.md` |
-| `tests/e2e/` | `tests/e2e/CLAUDE.md` |
 
 ## Workspace & Memory System
 

COVERAGE_PLAN.md

@@ -1,862 +0,0 @@
-# IronClaw Coverage Plan: 63.3% to 95%
-
-> Generated 2025-03-06 from [Codecov](https://app.codecov.io/gh/nearai/ironclaw/tree/main/src)
-
-## Current State
-
-| Metric | Value |
-|--------|-------|
-| **Current coverage** | 48,571 / 76,694 lines = **63.33%** |
-| **Target** | 72,859 / 76,694 lines = **95.0%** |
-| **Gap** | **24,288 lines** need coverage |
-| **Files >= 95%** | 43 / 239 |
-| **Files < 95%** | 196 (27,872 total misses) |
-
-## Module Summary
-
-Sorted by uncovered lines (descending):
-
-| Module | Lines | Hits | Miss | Coverage | Priority |
-|--------|------:|-----:|-----:|---------:|----------|
-| `channels/` | 14,079 | 8,677 | 5,402 | 61.6% | P0 |
-| `tools/` | 13,445 | 9,407 | 4,038 | 70.0% | P1 |
-| `agent/` | 9,152 | 6,096 | 3,056 | 66.6% | P0 |
-| `setup/` | 3,005 | 462 | 2,543 | 15.4% | P1 |
-| `extensions/` | 3,540 | 1,298 | 2,242 | 36.7% | P0 |
-| `cli/` | 2,834 | 697 | 2,137 | 24.6% | P1 |
-| `history/` | 1,626 | 0 | 1,626 | 0.0% | P0 |
-| `llm/` | 7,029 | 5,776 | 1,253 | 82.2% | P2 |
-| `(root)` | 4,122 | 3,121 | 1,001 | 75.7% | P2 |
-| `worker/` | 1,274 | 480 | 794 | 37.7% | P1 |
-| `sandbox/` | 1,615 | 897 | 718 | 55.5% | P2 |
-| `registry/` | 1,588 | 1,107 | 481 | 69.7% | P2 |
-| `db/` | 921 | 441 | 480 | 47.9% | P1 |
-| `workspace/` | 2,006 | 1,584 | 422 | 79.0% | P2 |
-| `orchestrator/` | 1,199 | 795 | 404 | 66.3% | P2 |
-| `config/` | 1,464 | 1,095 | 369 | 74.8% | P2 |
-| `hooks/` | 1,379 | 1,081 | 298 | 78.4% | P2 |
-| `secrets/` | 687 | 407 | 280 | 59.2% | P2 |
-| `skills/` | 1,714 | 1,585 | 129 | 92.5% | P3 |
-| `context/` | 693 | 586 | 107 | 84.6% | P3 |
-| `estimation/` | 467 | 369 | 98 | 79.0% | P3 |
-| `safety/` | 1,424 | 1,337 | 87 | 93.9% | P3 |
-| `evaluation/` | 226 | 152 | 74 | 67.3% | P3 |
-| `pairing/` | 498 | 446 | 52 | 89.6% | P3 |
-| `tunnel/` | 391 | 368 | 23 | 94.1% | P3 |
-| `observability/` | 316 | 307 | 9 | 97.2% | Done |
-
-## Top 40 Files by Uncovered Lines
-
-These files account for the vast majority of the coverage gap:
-
-| File | Lines | Miss | Coverage | Lines to 95% |
-|------|------:|-----:|---------:|--------------:|
-| `src/extensions/manager.rs` | 2,404 | 2,083 | 13.3% | 1,962 |
-| `src/setup/wizard.rs` | 2,150 | 1,789 | 16.8% | 1,681 |
-| `src/history/store.rs` | 1,486 | 1,486 | 0.0% | 1,411 |
-| `src/channels/web/server.rs` | 1,985 | 993 | 50.0% | 893 |
-| `src/channels/wasm/wrapper.rs` | 2,237 | 934 | 58.2% | 822 |
-| `src/agent/thread_ops.rs` | 1,044 | 763 | 26.9% | 710 |
-| `src/cli/tool.rs` | 757 | 735 | 2.9% | 697 |
-| `src/setup/channels.rs` | 645 | 596 | 7.6% | 563 |
-| `src/agent/commands.rs` | 587 | 587 | 0.0% | 557 |
-| `src/main.rs` | 740 | 522 | 29.4% | 485 |
-| `src/channels/web/handlers/jobs.rs` | 513 | 456 | 11.1% | 430 |
-| `src/tools/builder/core.rs` | 524 | 456 | 13.0% | 429 |
-| `src/agent/worker.rs` | 1,078 | 467 | 56.7% | 413 |
-| `src/channels/web/handlers/chat.rs` | 564 | 417 | 26.1% | 388 |
-| `src/tools/wasm/wrapper.rs` | 1,005 | 436 | 56.6% | 385 |
-| `src/channels/signal.rs` | 1,814 | 472 | 74.0% | 381 |
-| `src/tools/mcp/auth.rs` | 472 | 378 | 19.9% | 354 |
-| `src/worker/runtime.rs` | 350 | 330 | 5.7% | 312 |
-| `src/tools/builtin/job.rs` | 1,014 | 359 | 64.6% | 308 |
-| `src/cli/mcp.rs` | 322 | 319 | 0.9% | 302 |
-| `src/cli/oauth_defaults.rs` | 730 | 335 | 54.1% | 298 |
-| `src/llm/nearai_chat.rs` | 854 | 340 | 60.2% | 297 |
-| `src/sandbox/container.rs` | 407 | 317 | 22.1% | 296 |
-| `src/tools/mcp/client.rs` | 341 | 291 | 14.7% | 273 |
-| `src/registry/installer.rs` | 765 | 311 | 59.3% | 272 |
-| `src/orchestrator/job_manager.rs` | 405 | 270 | 33.3% | 249 |
-| `src/channels/web/handlers/routines.rs` | 249 | 249 | 0.0% | 236 |
-| `src/agent/scheduler.rs` | 559 | 263 | 53.0% | 235 |
-| `src/tools/wasm/storage.rs` | 296 | 243 | 17.9% | 228 |
-| `src/channels/repl.rs` | 233 | 233 | 0.0% | 221 |
-| `src/llm/session.rs` | 413 | 242 | 41.4% | 221 |
-| `src/worker/claude_bridge.rs` | 629 | 247 | 60.7% | 215 |
-| `src/agent/agent_loop.rs` | 523 | 234 | 55.2% | 207 |
-| `src/worker/api.rs` | 258 | 207 | 19.8% | 194 |
-| `src/sandbox/proxy/http.rs` | 307 | 192 | 37.5% | 176 |
-| `src/channels/wasm/storage.rs` | 182 | 182 | 0.0% | 172 |
-| `src/cli/registry.rs` | 177 | 177 | 0.0% | 168 |
-| `src/llm/reasoning.rs` | 1,163 | 219 | 81.2% | 160 |
-| `src/tools/builder/testing.rs` | 308 | 174 | 43.5% | 158 |
-| `src/db/postgres.rs` | 166 | 166 | 0.0% | 157 |
-
----
-
-## Tier 1 -- High-Impact Unit Tests (~8,500 lines)
-
-Pure logic, serialization, and database queries testable in isolation without real
-infrastructure. Highest coverage gain per unit of effort.
-
-### `src/history/store.rs` -- 0% -> 95% (+1,411 lines)
-
-PostgreSQL repository layer (conversations, jobs, actions, LLM calls, estimation
-snapshots). Test query construction and result mapping. Can use the libSQL backend
-as a real in-memory database or test doubles for the `Database` trait.
-
-**Tests to write:**
-- `test_store_conversation_crud` -- create, read, update, delete conversations
-- `test_store_job_lifecycle` -- insert job, update status through state machine
-- `test_store_action_recording` -- record and query job actions
-- `test_store_llm_call_tracking` -- insert and aggregate LLM call records
-- `test_store_estimation_snapshots` -- save and retrieve estimation data
-
-### `src/history/analytics.rs` -- 0% -> 95% (+133 lines)
-
-Aggregation queries (JobStats, ToolStats). Test the query builders and result
-deserialization.
-
-**Tests to write:**
-- `test_job_stats_aggregation` -- verify counts, durations, success rates
-- `test_tool_stats_ranking` -- verify tool usage frequency sorting
-- `test_analytics_empty_db` -- graceful handling of no data
-
-### `src/extensions/manager.rs` -- 13.3% -> 95% (+1,962 lines)
-
-Largest single file gap. Extension lifecycle orchestration (install, auth,
-activate, remove), config parsing, and state transitions.
-
-**Tests to write:**
-- `test_extension_install_from_manifest` -- parse manifest, create extension record
-- `test_extension_auth_flow` -- OAuth token setup, credential storage
-- `test_extension_activate_deactivate` -- state transitions, tool registration
-- `test_extension_remove_cleanup` -- remove extension, clean up artifacts
-- `test_extension_config_validation` -- reject invalid configs, handle defaults
-- `test_extension_list_filtering` -- filter by status, type, search query
-- `test_extension_capability_check` -- verify required capabilities before activation
-
-### `src/extensions/discovery.rs` -- 27.8% -> 95% (+125 lines)
-
-Extension discovery from filesystem and registry.
-
-**Tests to write:**
-- `test_discover_local_extensions` -- scan directory, parse manifests
-- `test_discover_skip_invalid` -- gracefully skip malformed extension dirs
-- `test_discover_dedup` -- handle duplicate extensions across paths
-
-### `src/tools/builder/core.rs` -- 13% -> 95% (+429 lines)
-
-`BuildRequirement`, `SoftwareType`, `Language` types and project scaffolding.
-
-**Tests to write:**
-- `test_build_requirement_parsing` -- deserialize from JSON
-- `test_scaffold_project_structure` -- verify generated file tree
-- `test_language_detection` -- detect language from file extensions
-- `test_software_type_constraints` -- validate type-specific requirements
-
-### `src/tools/builder/testing.rs` -- 43.5% -> 95% (+158 lines)
-
-Test harness integration for built tools.
-
-**Tests to write:**
-- `test_harness_setup_teardown` -- lifecycle of test environment
-- `test_harness_run_tests` -- execute tests and capture results
-- `test_harness_failure_reporting` -- verify error details on test failure
-
-### `src/tools/mcp/auth.rs` -- 19.9% -> 95% (+354 lines)
-
-OAuth token management for MCP servers.
-
-**Tests to write:**
-- `test_token_refresh_on_expiry` -- auto-refresh when token expires
-- `test_token_header_injection` -- correct Authorization header format
-- `test_token_persistence` -- save/load tokens across restarts
-- `test_oauth_pkce_flow` -- code verifier/challenge generation
-- `test_auth_config_parsing` -- parse various auth config formats
-
-### `src/tools/mcp/client.rs` -- 14.7% -> 95% (+273 lines)
-
-JSON-RPC client for MCP protocol.
-
-**Tests to write:**
-- `test_jsonrpc_request_serialization` -- correct JSON-RPC 2.0 format
-- `test_jsonrpc_response_parsing` -- handle success, error, and batch responses
-- `test_jsonrpc_error_codes` -- map MCP error codes to ToolError
-- `test_tool_list_discovery` -- parse tools/list response
-- `test_tool_call_roundtrip` -- serialize call, parse result
-
-### `src/tools/wasm/storage.rs` -- 17.9% -> 95% (+228 lines)
-
-WASM tool persistence (store, load, delete, list).
-
-**Tests to write:**
-- `test_wasm_tool_store_roundtrip` -- store and retrieve tool binary + metadata
-- `test_wasm_tool_delete` -- remove tool and verify gone
-- `test_wasm_tool_list_filtering` -- filter by name, capability
-- `test_wasm_tool_update_metadata` -- update without re-uploading binary
-
-### `src/tools/wasm/wrapper.rs` -- 56.6% -> 95% (+385 lines)
-
-Tool trait wrapper for WASM modules.
-
-**Tests to write:**
-- `test_wasm_param_marshalling` -- JSON params to WASM component model types
-- `test_wasm_output_conversion` -- WASM return values to ToolOutput
-- `test_wasm_error_propagation` -- WASM traps to ToolError
-- `test_wasm_fuel_exhaustion` -- verify fuel limit enforcement
-- `test_wasm_memory_limit` -- verify memory ceiling
-
-### `src/tools/wasm/loader.rs` -- 62.4% -> 95% (+156 lines)
-
-WASM tool discovery from filesystem.
-
-**Tests to write:**
-- `test_loader_scan_directory` -- find .wasm files with capabilities.json
-- `test_loader_skip_invalid` -- skip files without valid WIT exports
-- `test_loader_cache_invalidation` -- reload when file changes
-
-### `src/tools/builtin/job.rs` -- 64.6% -> 95% (+308 lines)
-
-Job management tools (CreateJob, ListJobs, JobStatus, CancelJob).
-
-**Tests to write:**
-- `test_create_job_params` -- validate required/optional parameters
-- `test_list_jobs_formatting` -- verify output structure
-- `test_job_status_transitions` -- query status at each state
-- `test_cancel_job_running` -- cancel an in-progress job
-- `test_cancel_job_completed` -- error on already-completed job
-
-### `src/secrets/store.rs` -- 48.1% -> 95% (+145 lines)
-
-Encrypted secret storage.
-
-**Tests to write:**
-- `test_secret_store_roundtrip` -- store encrypted, retrieve decrypted
-- `test_secret_update` -- overwrite existing secret
-- `test_secret_delete` -- remove and verify inaccessible
-- `test_secret_list_redacted` -- list shows names but not values
-
-### `src/llm/session.rs` -- 41.4% -> 95% (+221 lines)
-
-Session token management with auto-renewal.
-
-**Tests to write:**
-- `test_session_token_parsing` -- parse `sess_xxx` format
-- `test_session_expiry_detection` -- detect expired tokens
-- `test_session_auto_renewal` -- trigger renewal before expiry
-- `test_session_concurrent_renewal` -- only one renewal in flight
-
-### `src/llm/nearai_chat.rs` -- 60.2% -> 95% (+297 lines)
-
-NEAR AI Chat Completions provider.
-
-**Tests to write:**
-- `test_nearai_request_building` -- correct endpoint, headers, body
-- `test_nearai_response_parsing` -- parse streaming and non-streaming responses
-- `test_nearai_tool_message_flattening` -- tool messages flattened to text
-- `test_nearai_auth_modes` -- session token vs API key auth
-- `test_nearai_error_handling` -- rate limits, auth failures, server errors
-
-### `src/llm/mod.rs` -- 53.7% -> 95% (+112 lines)
-
-Provider factory and backend selection.
-
-**Tests to write:**
-- `test_provider_factory_nearai` -- select NEAR AI from config
-- `test_provider_factory_openai` -- select OpenAI from config
-- `test_provider_factory_ollama` -- select Ollama from config
-- `test_provider_factory_invalid` -- error on unknown backend
-
-### `src/llm/reasoning.rs` -- 81.2% -> 95% (+160 lines)
-
-Planning, tool selection, evaluation logic.
-
-**Tests to write:**
-- `test_reasoning_step_parsing` -- parse planning steps from LLM output
-- `test_tool_selection_scoring` -- rank tools by relevance
-- `test_evaluation_rubric` -- score completions against criteria
-- `test_reasoning_with_no_tools` -- handle tool-less responses
-
-### `src/db/postgres.rs` -- 0% -> 95% (+157 lines)
-
-PostgreSQL backend delegation to Store + Repository.
-
-**Tests to write:**
-- `test_postgres_backend_delegates` -- verify delegation pattern (trait-level)
-- `test_postgres_connection_config` -- TLS, pool size, timeout parsing
-
-### `src/workspace/mod.rs` -- 75.9% -> 95% (+109 lines)
-
-Memory operations (write, read, search, tree).
-
-**Tests to write:**
-- `test_workspace_write_read` -- write document, read it back
-- `test_workspace_search_hybrid` -- FTS + vector search via RRF
-- `test_workspace_tree` -- directory listing of memory filesystem
-- `test_workspace_overwrite` -- update existing document
-
-### `src/workspace/embeddings.rs` -- 35.1% -> 95% (~100 lines)
-
-Embedding provider abstraction.
-
-**Tests to write:**
-- `test_embedding_dimension_handling` -- verify dimension config
-- `test_embedding_batch_processing` -- batch multiple chunks
-- `test_embedding_provider_fallback` -- graceful degradation when unavailable
-
----
-
-## Tier 2 -- Trace Tests (~7,000 lines)
-
-End-to-end tests that exercise the agent loop, worker, scheduler, and dispatcher
-by replaying LLM traces through `TestRig` (see `tests/support/test_rig.rs`). Each
-trace test covers multiple modules simultaneously, making them high-leverage.
-
-Each trace test needs:
-1. A JSON fixture in `tests/fixtures/llm_traces/`
-2. A test file in `tests/` using `TestRigBuilder`
-
-### Trace: Thread Operations
-
-**Covers:** `agent/thread_ops.rs` (+710 lines)
-
-Test thread creation, listing, switching, and deletion via trace replay.
-
-**Fixture:** `thread_operations.json`
-**Tests:**
-- `test_thread_create_and_switch` -- create thread, switch to it, verify context
-- `test_thread_list` -- list all threads, verify metadata
-- `test_thread_delete` -- delete thread, verify removal
-- `test_thread_switch_nonexistent` -- error handling for missing thread
-
-### Trace: Agent Commands
-
-**Covers:** `agent/commands.rs` (+557 lines)
-
-Test slash commands through the agent loop.
-
-**Fixture:** `agent_commands.json`
-**Tests:**
-- `test_command_help` -- /help returns command list
-- `test_command_clear` -- /clear resets conversation
-- `test_command_compact` -- /compact triggers summarization
-- `test_command_undo_redo` -- /undo then /redo restores state
-- `test_command_status` -- /status shows agent state
-
-### Trace: Worker Multi-Turn Execution
-
-**Covers:** `agent/worker.rs` (+413 lines), `agent/agent_loop.rs` (+207 lines)
-
-Test multi-turn tool calling, error recovery, and completion flows.
-
-**Fixture:** `worker_multi_turn.json`
-**Tests:**
-- `test_worker_sequential_tools` -- call tool A, then tool B based on A's result
-- `test_worker_tool_error_recovery` -- tool fails, agent retries or adapts
-- `test_worker_max_turns` -- verify turn limit enforcement
-
-### Trace: Scheduler Parallel Jobs
-
-**Covers:** `agent/scheduler.rs` (+235 lines)
-
-Test parallel job dispatch and completion tracking.
-
-**Fixture:** `scheduler_parallel.json`
-**Tests:**
-- `test_scheduler_parallel_dispatch` -- dispatch 3 jobs, all complete
-- `test_scheduler_job_dependency` -- job B waits for job A
-- `test_scheduler_stuck_detection` -- detect and recover stuck job
-
-### Trace: Dispatcher Skill Selection
-
-**Covers:** `agent/dispatcher.rs` (+153 lines)
-
-Test skill-aware routing and tool attenuation.
-
-**Fixture:** `dispatcher_skills.json`
-**Tests:**
-- `test_dispatcher_skill_match` -- match message to skill, inject prompt
-- `test_dispatcher_tool_attenuation` -- installed skill loses dangerous tools
-- `test_dispatcher_no_skill` -- fallback when no skill matches
-
-### Trace: Routine Execution
-
-**Covers:** `agent/routine_engine.rs` (~80 lines), `agent/routine.rs` (~40 lines)
-
-Test cron tick and event-triggered routine execution.
-
-**Fixture:** `routine_execution.json`
-**Tests:**
-- `test_routine_cron_trigger` -- routine fires on schedule
-- `test_routine_event_trigger` -- routine fires on matching event
-- `test_routine_guardrails` -- routine respects policy constraints
-
-### Trace: Compaction and Context Pressure
-
-**Covers:** `agent/compaction.rs` (~50 lines), `agent/context_monitor.rs` (~30 lines)
-
-Test turn summarization and memory pressure detection.
-
-**Fixture:** `compaction_flow.json`
-**Tests:**
-- `test_compaction_triggers_at_threshold` -- summarize when context exceeds limit
-- `test_compaction_preserves_recent` -- keep recent turns intact
-- `test_context_pressure_warning` -- emit warning at high usage
-
-### Trace: Job Tool Coverage
-
-**Covers:** `tools/builtin/job.rs` (+308 lines), `tools/builtin/skill_tools.rs` (+110 lines)
-
-Test job and skill management tools through agent execution.
-
-**Fixture:** `job_and_skill_tools.json`
-**Tests:**
-- `test_create_and_list_jobs` -- create job, list shows it
-- `test_job_status_query` -- query status of running job
-- `test_skill_list_and_search` -- list local skills, search registry
-
-### Trace: Memory Tools
-
-**Covers:** `tools/builtin/memory.rs` (~20 lines), `workspace/` (+109 lines)
-
-Test memory operations through agent tool calls.
-
-**Fixture:** `memory_tools.json`
-**Tests:**
-- `test_memory_write_and_search` -- write doc, search finds it
-- `test_memory_read_by_path` -- read specific document
-- `test_memory_tree` -- list memory filesystem structure
-
-### Trace: Extension Management
-
-**Covers:** `tools/builtin/extension_tools.rs` (~40 lines)
-
-Test extension lifecycle via agent tool calls.
-
-**Fixture:** `extension_management.json`
-**Tests:**
-- `test_extension_install_via_tool` -- agent installs an extension
-- `test_extension_auth_via_tool` -- agent configures auth
-- `test_extension_activate_via_tool` -- agent activates extension
-
-### Trace: Self-Repair
-
-**Covers:** `agent/self_repair.rs` (~40 lines)
-
-Test stuck job detection and recovery.
-
-**Fixture:** `self_repair.json`
-**Tests:**
-- `test_stuck_job_detected` -- job stuck for > threshold triggers repair
-- `test_stuck_job_recovered` -- recovery restarts job successfully
-- `test_stuck_job_fails_permanently` -- recovery fails, job marked failed
-
-### Trace: Heartbeat
-
-**Covers:** `agent/heartbeat.rs` (+80 lines)
-
-Test periodic proactive execution.
-
-**Fixture:** `heartbeat.json`
-**Tests:**
-- `test_heartbeat_periodic_fire` -- heartbeat triggers at interval
-- `test_heartbeat_reads_checklist` -- reads HEARTBEAT.md, processes items
-- `test_heartbeat_notification` -- sends notification on findings
-
----
-
-## Tier 3 -- Web/Channel Handler Tests (~4,500 lines)
-
-Test HTTP handlers and SSE/WS endpoints using `axum_test` or
-`tower::ServiceExt::oneshot` with a real router and in-memory database.
-
-### `src/channels/web/server.rs` -- 50% -> 95% (+893 lines)
-
-The single biggest web gap. 40+ API endpoints.
-
-**Tests to write:**
-- `test_api_health` -- GET /health returns 200
-- `test_api_chat_submit` -- POST /api/chat sends message
-- `test_api_jobs_list` -- GET /api/jobs returns job list
-- `test_api_jobs_create` -- POST /api/jobs creates job
-- `test_api_routines_crud` -- full CRUD cycle for routines
-- `test_api_settings_get_set` -- GET/PUT settings
-- `test_api_memory_search` -- POST /api/memory/search
-- `test_api_extensions_list` -- GET /api/extensions
-- `test_api_skills_list` -- GET /api/skills
-- `test_api_sse_connect` -- SSE stream connects and receives events
-- `test_api_auth_required` -- endpoints reject missing/bad tokens
-- `test_api_cors_headers` -- verify CORS configuration
-
-### `src/channels/web/handlers/chat.rs` -- 26.1% -> 95% (+388 lines)
-
-Chat message submission and SSE streaming.
-
-**Tests to write:**
-- `test_chat_submit_message` -- submit message, receive response
-- `test_chat_sse_stream` -- verify SSE event format
-- `test_chat_thread_context` -- messages scoped to thread
-- `test_chat_invalid_payload` -- reject malformed requests
-
-### `src/channels/web/handlers/jobs.rs` -- 11.1% -> 95% (+430 lines)
-
-Job CRUD endpoints.
-
-**Tests to write:**
-- `test_jobs_list_empty` -- empty list returns []
-- `test_jobs_create_and_get` -- create, then GET by ID
-- `test_jobs_cancel` -- cancel running job
-- `test_jobs_filter_by_status` -- filter by pending/running/completed
-- `test_jobs_pagination` -- limit/offset parameters
-
-### `src/channels/web/handlers/routines.rs` -- 0% -> 95% (+236 lines)
-
-Routine CRUD endpoints.
-
-**Tests to write:**
-- `test_routines_create` -- POST creates routine
-- `test_routines_list` -- GET lists all routines
-- `test_routines_update` -- PUT updates routine config
-- `test_routines_delete` -- DELETE removes routine
-- `test_routines_history` -- GET history for a routine
-
-### `src/channels/web/handlers/extensions.rs` -- 0% -> 95% (+129 lines)
-
-Extension management endpoints.
-
-**Tests to write:**
-- `test_extensions_list` -- list installed extensions
-- `test_extensions_install` -- install from manifest URL
-- `test_extensions_activate` -- activate/deactivate toggle
-- `test_extensions_remove` -- remove installed extension
-
-### `src/channels/web/handlers/memory.rs` -- 0% -> 95% (+110 lines)
-
-Memory/workspace endpoints.
-
-**Tests to write:**
-- `test_memory_search` -- search returns ranked results
-- `test_memory_write` -- write a document
-- `test_memory_read` -- read by path
-- `test_memory_tree` -- tree returns filesystem structure
-
-### `src/channels/web/handlers/settings.rs` -- 0% -> 95% (+103 lines)
-
-Settings endpoints.
-
-**Tests to write:**
-- `test_settings_get` -- retrieve current settings
-- `test_settings_update` -- update individual setting
-- `test_settings_validation` -- reject invalid setting values
-
-### `src/channels/web/handlers/static_files.rs` -- 0% -> 95% (+97 lines)
-
-Static file serving.
-
-**Tests to write:**
-- `test_static_index_html` -- GET / serves index.html
-- `test_static_css_js` -- serve CSS/JS with correct content types
-- `test_static_404` -- missing file returns 404
-
-### `src/channels/wasm/wrapper.rs` -- 58.2% -> 95% (+822 lines)
-
-WASM channel wrapper (message routing, lifecycle).
-
-**Tests to write:**
-- `test_wasm_channel_start` -- initialize WASM channel module
-- `test_wasm_channel_message_routing` -- route incoming message to WASM
-- `test_wasm_channel_response` -- return WASM response to caller
-- `test_wasm_channel_error_handling` -- handle WASM trap gracefully
-- `test_wasm_channel_lifecycle` -- start, process, shutdown
-
-### `src/channels/wasm/loader.rs` -- 38.1% -> 95% (+141 lines)
-
-WASM channel discovery.
-
-**Tests to write:**
-- `test_channel_loader_scan` -- find channel WASM modules
-- `test_channel_loader_validation` -- reject invalid modules
-- `test_channel_loader_manifest` -- parse channel capabilities
-
-### `src/channels/wasm/storage.rs` -- 0% -> 95% (+172 lines)
-
-WASM channel state persistence.
-
-**Tests to write:**
-- `test_channel_storage_save_load` -- persist and restore channel state
-- `test_channel_storage_isolation` -- per-channel state isolation
-- `test_channel_storage_cleanup` -- remove state on channel uninstall
-
-### `src/channels/signal.rs` -- 74% -> 95% (+381 lines)
-
-Signal protocol channel.
-
-**Tests to write:**
-- `test_signal_message_send` -- send encrypted message
-- `test_signal_message_receive` -- decrypt incoming message
-- `test_signal_attachment_handling` -- handle media attachments
-- `test_signal_group_message` -- group chat routing
-- `test_signal_error_handling` -- handle connection failures
-
-### `src/channels/repl.rs` -- 0% -> 95% (+221 lines)
-
-Simple REPL channel.
-
-**Tests to write:**
-- `test_repl_input_parsing` -- parse user input lines
-- `test_repl_output_formatting` -- format agent responses
-- `test_repl_multiline` -- handle multi-line input
-- `test_repl_special_commands` -- handle /quit, /help
-
----
-
-## Tier 4 -- CLI Tests (~2,100 lines)
-
-CLI subcommands can be tested by invoking clap-parsed command structs directly
-or by calling the handler functions with constructed arguments.
-
-### `src/cli/tool.rs` -- 2.9% -> 95% (+697 lines)
-
-Tool CLI (install, list, remove, build).
-
-**Tests to write:**
-- `test_cli_tool_list` -- list installed tools
-- `test_cli_tool_install_local` -- install from local .wasm file
-- `test_cli_tool_install_registry` -- install from registry
-- `test_cli_tool_remove` -- remove installed tool
-- `test_cli_tool_build` -- scaffold and build tool project
-- `test_cli_tool_info` -- display tool details
-
-### `src/cli/mcp.rs` -- 0.9% -> 95% (+302 lines)
-
-MCP server management CLI.
-
-**Tests to write:**
-- `test_cli_mcp_list` -- list configured MCP servers
-- `test_cli_mcp_add` -- add MCP server config
-- `test_cli_mcp_remove` -- remove MCP server config
-- `test_cli_mcp_tools` -- list tools from MCP server
-- `test_cli_mcp_test_connection` -- verify MCP server reachable
-
-### `src/cli/oauth_defaults.rs` -- 54.1% -> 95% (+298 lines)
-
-OAuth default configurations.
-
-**Tests to write:**
-- `test_oauth_defaults_loading` -- load default OAuth configs
-- `test_oauth_url_construction` -- build auth/token URLs
-- `test_oauth_scope_merging` -- merge requested scopes with defaults
-- `test_oauth_provider_lookup` -- lookup by provider name
-
-### `src/cli/registry.rs` -- 0% -> 95% (+168 lines)
-
-Registry CLI commands.
-
-**Tests to write:**
-- `test_cli_registry_search` -- search for packages
-- `test_cli_registry_install` -- install package from registry
-- `test_cli_registry_info` -- display package details
-
-### `src/cli/status.rs` -- 0% -> 95% (+142 lines)
-
-Status display commands.
-
-**Tests to write:**
-- `test_cli_status_gathering` -- collect system status info
-- `test_cli_status_formatting` -- render status output
-- `test_cli_status_components` -- check individual components
-
-### `src/cli/memory.rs` -- 15.5% -> 95% (+138 lines)
-
-Memory CLI subcommands.
-
-**Tests to write:**
-- `test_cli_memory_search` -- search workspace from CLI
-- `test_cli_memory_write` -- write document from CLI
-- `test_cli_memory_read` -- read document from CLI
-- `test_cli_memory_tree` -- display memory tree
-
-### `src/cli/doctor.rs` -- 28.7% -> 95% (+115 lines)
-
-Diagnostic checks.
-
-**Tests to write:**
-- `test_doctor_check_database` -- verify DB connectivity check
-- `test_doctor_check_llm` -- verify LLM provider check
-- `test_doctor_check_tools` -- verify tool availability check
-- `test_doctor_report_format` -- verify output format
-
-### `src/cli/config.rs` -- 36.5% -> 95% (~100 lines)
-
-Config CLI subcommands.
-
-**Tests to write:**
-- `test_cli_config_get` -- read config value
-- `test_cli_config_set` -- write config value
-- `test_cli_config_list` -- list all config keys
-- `test_cli_config_reset` -- reset to defaults
-
----
-
-## Tier 5 -- Setup/Infra Tests (~2,400 lines)
-
-Hardest to test: interactive wizards, Docker, process spawning. Strategy: extract
-pure logic into testable functions, test the interactive parts by injecting mock
-input.
-
-### `src/setup/wizard.rs` -- 16.8% -> 95% (+1,681 lines)
-
-7-step interactive onboarding wizard. Refactor to extract validation functions,
-step logic, and config generation into testable units.
-
-**Tests to write:**
-- `test_wizard_step_validation` -- each step validates input correctly
-- `test_wizard_config_generation` -- generate config from wizard answers
-- `test_wizard_default_values` -- verify sensible defaults
-- `test_wizard_skip_completed` -- skip already-configured steps
-- `test_wizard_llm_backend_selection` -- provider-specific config paths
-- `test_wizard_channel_setup` -- channel configuration logic
-
-### `src/setup/channels.rs` -- 7.6% -> 95% (+563 lines)
-
-Channel setup helpers.
-
-**Tests to write:**
-- `test_channel_setup_defaults` -- default channel configuration
-- `test_channel_setup_validation` -- reject invalid channel configs
-- `test_channel_setup_telegram` -- Telegram-specific setup logic
-- `test_channel_setup_signal` -- Signal-specific setup logic
-- `test_channel_setup_webhook` -- webhook URL validation
-
-### `src/setup/prompts.rs` -- 24.8% -> 95% (+147 lines)
-
-Terminal prompt utilities.
-
-**Tests to write:**
-- `test_prompt_select` -- selection from list
-- `test_prompt_confirm` -- yes/no confirmation
-- `test_prompt_secret` -- masked input
-- `test_prompt_validation` -- input validation rules
-
-### `src/sandbox/container.rs` -- 22.1% -> 95% (+296 lines)
-
-Docker container lifecycle. Test command construction without actual Docker.
-
-**Tests to write:**
-- `test_container_config_to_docker_args` -- generate correct docker run args
-- `test_container_volume_mounts` -- workspace mount configuration
-- `test_container_env_scrubbing` -- sensitive env vars removed
-- `test_container_resource_limits` -- CPU/memory limit args
-- `test_container_network_config` -- proxy network setup
-
-### `src/sandbox/manager.rs` -- 59% -> 95% (+114 lines)
-
-Sandbox orchestration.
-
-**Tests to write:**
-- `test_sandbox_policy_enforcement` -- policy to container config mapping
-- `test_sandbox_cleanup` -- cleanup on job completion
-- `test_sandbox_concurrent_limit` -- enforce max concurrent containers
-
-### `src/sandbox/proxy/http.rs` -- 37.5% -> 95% (+176 lines)
-
-HTTP proxy for container network access.
-
-**Tests to write:**
-- `test_proxy_allowlist_enforcement` -- block disallowed domains
-- `test_proxy_credential_injection` -- inject auth headers
-- `test_proxy_connect_tunnel` -- HTTPS CONNECT method handling
-- `test_proxy_logging` -- request/response logging
-
-### `src/worker/runtime.rs` -- 5.7% -> 95% (+312 lines)
-
-Worker execution loop (runs inside containers).
-
-**Tests to write:**
-- `test_worker_tool_dispatch` -- dispatch tool call, return result
-- `test_worker_llm_interaction` -- send prompt, receive response
-- `test_worker_turn_limit` -- enforce max turns
-- `test_worker_error_propagation` -- tool error surfaces to agent
-
-### `src/worker/claude_bridge.rs` -- 60.7% -> 95% (+215 lines)
-
-Claude CLI bridge.
-
-**Tests to write:**
-- `test_claude_command_construction` -- build claude CLI command
-- `test_claude_output_parsing` -- parse claude CLI JSON output
-- `test_claude_error_handling` -- handle CLI crashes gracefully
-- `test_claude_config_injection` -- inject config dir and model
-
-### `src/worker/api.rs` -- 19.8% -> 95% (+194 lines)
-
-Worker HTTP client to orchestrator.
-
-**Tests to write:**
-- `test_worker_api_request_building` -- correct endpoint URLs and headers
-- `test_worker_api_response_parsing` -- parse orchestrator responses
-- `test_worker_api_auth_token` -- bearer token injection
-- `test_worker_api_retry` -- retry on transient failures
-
-### `src/main.rs` -- 29.4% -> 95% (+485 lines)
-
-Entry point and startup. Extract startup logic into testable functions.
-
-**Tests to write:**
-- `test_cli_arg_parsing` -- verify clap argument parsing
-- `test_startup_config_loading` -- config from env + file
-- `test_startup_channel_selection` -- select channels from config
-- `test_startup_feature_flags` -- feature-gated code paths
-
----
-
-## Tier 6 -- Remaining Files to 95% (~2,000 lines)
-
-Smaller files that each need a handful of additional tests.
-
-| File | Lines Needed | Test Focus |
-|------|-------------:|------------|
-| `src/tools/builtin/skill_tools.rs` | 110 | skill_list, skill_search, skill_install, skill_remove |
-| `src/hooks/bundled.rs` | 115 | bundled hook execution, hook discovery |
-| `src/registry/installer.rs` | 272 | package download, verification, installation |
-| `src/registry/artifacts.rs` | 72 | artifact packaging, checksums |
-| `src/orchestrator/job_manager.rs` | 249 | container lifecycle, job routing |
-| `src/orchestrator/api.rs` | 125 | LLM proxy, event dispatch endpoints |
-| `src/app.rs` | 137 | AppBuilder configuration, startup sequence |
-| `src/service.rs` | 120 | service lifecycle, signal handling |
-| `src/config/channels.rs` | 55 | channel config parsing |
-| `src/config/sandbox.rs` | 61 | sandbox config parsing |
-| `src/config/tunnel.rs` | 43 | tunnel config parsing |
-| `src/config/mod.rs` | 63 | config merging, env override |
-| `src/config/database.rs` | 38 | database URL parsing |
-| `src/evaluation/success.rs` | 34 | success evaluator logic |
-| `src/evaluation/metrics.rs` | 40 | metrics collection |
-| `src/context/manager.rs` | 57 | concurrent job context isolation |
-| `src/context/memory.rs` | 36 | action recording, conversation memory |
-
----
-
-## Execution Priority
-
-Maximize coverage gain per unit of effort:
-
-| Order | Category | Lines Gained | Effort |
-|------:|----------|-------------:|--------|
-| 1 | Trace tests (Tier 2) | ~7,000 | Medium (high leverage, each test covers many modules) |
-| 2 | Unit tests for 0% files (Tier 1 subset) | ~3,500 | Low (pure logic, no infrastructure) |
-| 3 | Web handler tests (Tier 3) | ~4,500 | Medium (axum_test + in-memory DB) |
-| 4 | Extension/MCP/WASM unit tests (Tier 1 remainder) | ~3,500 | Medium |
-| 5 | CLI subcommand tests (Tier 4) | ~2,100 | Low-Medium |
-| 6 | Setup wizard extraction + tests (Tier 5) | ~2,400 | High (requires refactoring) |
-| 7 | LLM provider tests (Tier 1 subset) | ~800 | Medium |
-| 8 | Remaining small files (Tier 6) | ~2,000 | Low |
-
-## Notes
-
-- All trace tests require `--features libsql` and use `TestRigBuilder` from `tests/support/`
-- Web handler tests can use `axum::test` helpers or build the router directly
-- CLI tests should call handler functions directly, not shell out to the binary
-- Setup wizard tests require extracting pure logic from interactive prompts first
-- Sandbox/container tests should verify command construction, not run Docker
-- Worker tests can use `TraceLlm` for the LLM provider, same as trace tests

Cargo.toml

@@ -18,7 +18,7 @@ exclude = [
 
 [package]
 name = "ironclaw"
-version = "0.16.1"
+version = "0.16.0"
 edition = "2024"
 rust-version = "1.92"
 description = "Secure personal AI assistant that protects your data and expands its capabilities on the fly"
@@ -40,7 +40,7 @@ tokio-stream = { version = "0.1", features = ["sync"] }
 futures = "0.3"
 
 # HTTP client
-reqwest = { version = "0.12", default-features = false, features = ["json", "multipart", "rustls-tls-native-roots", "stream"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots", "stream"] }
 
 # Serialization
 serde = { version = "1", features = ["derive"] }
@@ -56,7 +56,7 @@ rustls = { version = "0.23", optional = true, default-features = false }
 rustls-native-certs = { version = "0.8", optional = true }
 
 # Database - libSQL/Turso (optional embedded database)
-libsql = { version = "0.6", optional = true, default-features = false, features = ["core", "replication", "remote", "tls"] }
+libsql = { version = "0.6", optional = true, default-features = false, features = ["core", "replication"] }
 
 # Error handling
 thiserror = "2"
@@ -73,8 +73,6 @@ toml = "0.8"
 # Core types
 uuid = { version = "1", features = ["v4", "v5", "serde"] }
 chrono = { version = "0.4", features = ["serde"] }
-chrono-tz = "0.10"
-iana-time-zone = "0.1"
 rust_decimal = { version = "1", features = ["serde", "serde-with-str", "maths"] }
 rust_decimal_macros = "1"
 
@@ -125,11 +123,6 @@ open = "5"
 # The postgres feature provides ToSql/FromSql for postgres-types (shared by tokio-postgres)
 pgvector = { version = "0.4", features = ["postgres"], optional = true }
 
-# LanceDB vector store (optional alternative to pgvector/libsql for workspace search)
-lancedb = { version = "0.26", optional = true }
-arrow-array = { version = "57", optional = true }
-arrow-schema = { version = "57", optional = true }
-
 # WASM sandbox for untrusted tool execution
 wasmtime = { version = "28", features = ["component-model"] }
 wasmtime-wasi = "28"  # WASI support for component model
@@ -154,10 +147,6 @@ bollard = "0.18"
 flate2 = "1"
 tar = "0.4"
 
-# Document text extraction
-pdf-extract = "0.7"
-zip = { version = "2", default-features = false, features = ["deflate"] }
-
 # HTTP proxy for sandboxed network access
 hyper = { version = "1.5", features = ["server", "http1", "http2"] }
 hyper-util = { version = "0.1", features = ["server", "tokio", "http1", "http2"] }
@@ -194,7 +183,6 @@ insta = "1.46.3"
 
 [features]
 default = ["postgres", "libsql", "html-to-markdown"]
-lancedb = ["dep:lancedb", "dep:arrow-array", "dep:arrow-schema"]
 postgres = [
     "dep:deadpool-postgres",
     "dep:tokio-postgres",

Dockerfile

@@ -28,7 +28,6 @@ COPY migrations/ migrations/
 COPY registry/ registry/
 COPY channels-src/ channels-src/
 COPY wit/ wit/
-COPY providers.json providers.json
 
 RUN cargo build --release --bin ironclaw
 

FEATURE_PARITY.md

@@ -39,7 +39,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Network modes (loopback/LAN/remote) | ✅ | 🚧 | HTTP only |
 | OpenAI-compatible HTTP API | ✅ | ✅ | /v1/chat/completions, per-request `model` override |
 | Canvas hosting | ✅ | ❌ | Agent-driven UI |
-| Gateway lock (PID-based) | ✅ | ✅ | `fs4` flock-based, acquired in `main.rs` before agent startup |
+| Gateway lock (PID-based) | ✅ | ❌ | |
 | launchd/systemd integration | ✅ | ❌ | |
 | Bonjour/mDNS discovery | ✅ | ❌ | |
 | Tailscale integration | ✅ | ❌ | |
@@ -119,7 +119,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Mention-based activation | ✅ | ✅ | bot_username + respond_to_all_group_messages |
 | Per-group tool policies | ✅ | ❌ | Allow/deny specific tools |
 | Thread isolation | ✅ | ✅ | Separate sessions per thread |
-| Per-channel media limits | ✅ | ✅ | Attachment type in WIT; max 10 per msg, 20MB total, MIME allowlist |
+| Per-channel media limits | ✅ | 🚧 | Caption support for media; no size limits |
 | Typing indicators | ✅ | 🚧 | TUI + Telegram typing/actionable status prompts; richer parity pending |
 | Per-channel ackReaction config | ✅ | ❌ | Customizable acknowledgement reactions |
 | Group session priming | ✅ | ❌ | Member roster injected for context |
@@ -215,13 +215,9 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | NEAR AI | ✅ | ✅ | - | Primary provider |
 | Anthropic (Claude) | ✅ | 🚧 | - | Via NEAR AI proxy; Opus 4.5, Sonnet 4, Sonnet 4.6 |
 | OpenAI | ✅ | 🚧 | - | Via NEAR AI proxy |
-| AWS Bedrock | ✅ | ✅ | P3 | Via `openai_compatible` adapter (e.g. LiteLLM) |
-| Google Gemini | ✅ | ✅ | P3 | Via `gemini` adapter |
-| io.net | ✅ | ✅ | P3 | Via `ionet` adapter |
-| Mistral | ✅ | ✅ | P3 | Via `mistral` adapter |
-| Yandex AI Studio | ✅ | ✅ | P3 | Via `yandex` adapter |
-| Cloudflare Workers AI | ✅ | ✅ | P3 | Via `cloudflare` adapter |
-| NVIDIA API | ✅ | ✅ | P3 | Via `nvidia` adapter and `providers.json` |
+| AWS Bedrock | ✅ | ❌ | P3 | |
+| Google Gemini | ✅ | ❌ | P3 | |
+| NVIDIA API | ✅ | ❌ | P3 | New provider |
 | OpenRouter | ✅ | ✅ | - | Via OpenAI-compatible provider (RigAdapter) |
 | Tinfoil | ❌ | ✅ | - | Private inference provider (IronClaw-only) |
 | OpenAI-compatible | ❌ | ✅ | - | Generic OpenAI-compatible endpoint (RigAdapter) |
@@ -252,32 +248,19 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 | Feature | OpenClaw | IronClaw | Priority | Notes |
 |---------|----------|----------|----------|-------|
-| WIT inbound-attachment type | N/A | ✅ | P1 | `inbound-attachment` record in channel-host (id, mime_type, filename, size_bytes, source_url, storage_key, extracted_text) |
-| WIT outbound attachment type | N/A | ✅ | P1 | `attachment` record in channel (filename, mime_type, data) on `agent-response` |
-| WIT on-broadcast export | N/A | ✅ | P1 | Proactive message sending without prior incoming message |
-| IncomingMessage attachments | N/A | ✅ | P1 | `IncomingAttachment` struct on `IncomingMessage`, populated from WASM channels |
-| OutgoingResponse attachments | N/A | ✅ | P1 | File paths on `OutgoingResponse`, read from disk and sent as WIT attachments |
-| Attachment security (size/MIME) | N/A | ✅ | P1 | Inbound: max 10, 20MB total, MIME allowlist. Outbound: 50MB total |
-| Telegram media parsing | ✅ | ✅ | P1 | Photo, document, audio, video, voice, sticker parsed and emitted as attachments |
-| Telegram media sending | ✅ | ✅ | P1 | sendPhoto/sendDocument multipart upload, auto photo→document fallback >10MB |
-| Slack file parsing | ✅ | ✅ | P1 | `files` array from Events API parsed into attachments |
-| WhatsApp media parsing | ✅ | ✅ | P1 | Image, audio, video, document parsed with caption as extracted_text |
-| Discord attachment parsing | ✅ | ❌ | P2 | Discord interaction payloads don't include file attachments (needs message events) |
-| HTTP tool save_to | N/A | ✅ | P1 | Download binary files to /tmp/ for attachment sending (50MB limit, path traversal protection) |
-| Credential env var fallback | N/A | ✅ | P2 | Channels can use env vars (e.g., TELEGRAM_BOT_TOKEN) when secrets store not configured |
 | Image processing (Sharp) | ✅ | ❌ | P2 | Resize, format convert |
 | Configurable image resize dims | ✅ | ❌ | P2 | Per-agent dimension config |
 | Multiple images per tool call | ✅ | ❌ | P2 | Single tool invocation, multiple images |
 | Audio transcription | ✅ | ❌ | P2 | |
 | Video support | ✅ | ❌ | P3 | |
 | PDF parsing | ✅ | ❌ | P2 | pdfjs-dist |
-| MIME detection | ✅ | ✅ | P2 | MIME allowlist in host validates attachment types |
+| MIME detection | ✅ | ❌ | P2 | |
 | Media caching | ✅ | ❌ | P3 | |
 | Vision model integration | ✅ | ❌ | P2 | Image understanding |
 | TTS (Edge TTS) | ✅ | ❌ | P3 | Text-to-speech |
 | TTS (OpenAI) | ✅ | ❌ | P3 | |
 | Incremental TTS playback | ✅ | ❌ | P3 | iOS progressive playback |
-| Sticker-to-image | ✅ | ✅ | P3 | Telegram stickers emitted as image/webp attachments |
+| Sticker-to-image | ✅ | ❌ | P3 | Telegram stickers |
 
 ### Owner: _Unassigned_
 
@@ -340,7 +323,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Gemini embeddings | ✅ | ❌ | |
 | Local embeddings | ✅ | ❌ | |
 | SQLite-vec backend | ✅ | ❌ | IronClaw uses PostgreSQL |
-| LanceDB backend | ✅ | ✅ | VectorStore trait + LanceDbVectorStore (configured via VECTOR_BACKEND=lancedb) |
+| LanceDB backend | ✅ | ❌ | Configurable auto-capture max length |
 | QMD backend | ✅ | ❌ | |
 | Atomic reindexing | ✅ | ✅ | |
 | Embeddings batching | ✅ | ✅ | `embed_batch` on EmbeddingProvider trait |

channels-src/discord/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "discord-channel"
-version = "0.2.0"
+version = "0.1.0"
 edition = "2021"
 description = "Discord channel for IronClaw"
 license = "MIT OR Apache-2.0"

channels-src/discord/discord.capabilities.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "type": "channel",
   "name": "discord",
   "description": "Discord Gateway/Webhook channel for handling slash commands, buttons, and messages",

channels-src/discord/src/lib.rs

@@ -312,10 +312,6 @@ impl Guest for DiscordChannel {
 
     fn on_status(_update: StatusUpdate) {}
 
-    fn on_broadcast(_user_id: String, _response: AgentResponse) -> Result<(), String> {
-        Err("broadcast not yet implemented for Discord channel".to_string())
-    }
-
     fn on_shutdown() {
         channel_host::log(
             channel_host::LogLevel::Info,
@@ -418,7 +414,6 @@ fn handle_slash_command(interaction: &DiscordInteraction) -> bool {
         content,
         thread_id: None,
         metadata_json,
-        attachments: vec![],
     });
     true
 }
@@ -472,7 +467,6 @@ fn handle_message_component(interaction: &DiscordInteraction, message: &DiscordM
         content: format!("[Button clicked] {}", message.content),
         thread_id: None,
         metadata_json,
-        attachments: vec![],
     });
 }
 
@@ -689,34 +683,4 @@ mod tests {
         assert_eq!(parsed.channel_id, "123");
         assert_eq!(parsed.interaction_id, "456");
     }
-
-    #[test]
-    fn test_parse_slash_command_interaction() {
-        // Verify that a slash command interaction deserializes correctly.
-        let json = r#"{
-            "type": 2,
-            "id": "int_1",
-            "application_id": "app_1",
-            "channel_id": "ch_1",
-            "member": {
-                "user": {
-                    "id": "user_1",
-                    "username": "testuser",
-                    "global_name": "Test User"
-                }
-            },
-            "data": {
-                "id": "cmd_1",
-                "name": "ask",
-                "options": [
-                    {"name": "question", "value": "What is rust?"}
-                ]
-            },
-            "token": "token_abc"
-        }"#;
-
-        let interaction: DiscordInteraction = serde_json::from_str(json).unwrap();
-        assert_eq!(interaction.interaction_type, 2);
-        assert!(interaction.data.is_some());
-    }
 }

channels-src/slack/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "slack-channel"
-version = "0.2.0"
+version = "0.1.0"
 edition = "2021"
 description = "Slack Events API channel for IronClaw"
 license = "MIT OR Apache-2.0"

channels-src/slack/slack.capabilities.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "type": "channel",
   "name": "slack",
   "description": "Slack Events API channel for receiving and responding to Slack messages",

channels-src/slack/src/lib.rs

@@ -29,7 +29,7 @@ use exports::near::agent::channel::{
     AgentResponse, ChannelConfig, Guest, HttpEndpointConfig, IncomingHttpRequest,
     OutgoingHttpResponse, StatusUpdate,
 };
-use near::agent::channel_host::{self, EmittedMessage, InboundAttachment};
+use near::agent::channel_host::{self, EmittedMessage};
 
 /// Slack event wrapper.
 #[derive(Debug, Deserialize)]
@@ -78,25 +78,6 @@ struct SlackEvent {
 
     /// Subtype (bot_message, etc.)
     subtype: Option<String>,
-
-    /// File attachments shared in the message.
-    #[serde(default)]
-    files: Option<Vec<SlackFile>>,
-}
-
-/// Slack file attachment.
-#[derive(Debug, Deserialize)]
-struct SlackFile {
-    /// File ID.
-    id: String,
-    /// MIME type.
-    mimetype: Option<String>,
-    /// Original filename.
-    name: Option<String>,
-    /// File size in bytes.
-    size: Option<u64>,
-    /// URL to download the file (requires auth).
-    url_private: Option<String>,
 }
 
 /// Metadata stored with emitted messages for response routing.
@@ -325,42 +306,13 @@ impl Guest for SlackChannel {
 
     fn on_status(_update: StatusUpdate) {}
 
-    fn on_broadcast(_user_id: String, _response: AgentResponse) -> Result<(), String> {
-        Err("broadcast not yet implemented for Slack channel".to_string())
-    }
-
     fn on_shutdown() {
         channel_host::log(channel_host::LogLevel::Info, "Slack channel shutting down");
     }
 }
 
-/// Extract attachments from Slack file objects.
-fn extract_slack_attachments(files: &Option<Vec<SlackFile>>) -> Vec<InboundAttachment> {
-    let Some(files) = files else {
-        return Vec::new();
-    };
-    files
-        .iter()
-        .map(|f| InboundAttachment {
-            id: f.id.clone(),
-            mime_type: f
-                .mimetype
-                .clone()
-                .unwrap_or_else(|| "application/octet-stream".to_string()),
-            filename: f.name.clone(),
-            size_bytes: f.size,
-            source_url: f.url_private.clone(),
-            storage_key: None,
-            extracted_text: None,
-            extras_json: String::new(),
-        })
-        .collect()
-}
-
 /// Handle a Slack event and emit message if applicable.
 fn handle_slack_event(event: SlackEvent, team_id: Option<String>, _event_id: Option<String>) {
-    let attachments = extract_slack_attachments(&event.files);
-
     match event.event_type.as_str() {
         // Direct mention of the bot (always in a channel, not a DM)
         "app_mention" => {
@@ -374,14 +326,7 @@ fn handle_slack_event(event: SlackEvent, team_id: Option<String>, _event_id: Opt
                 if !check_sender_permission(&user, &channel, false) {
                     return;
                 }
-                emit_message(
-                    user,
-                    text,
-                    channel,
-                    event.thread_ts.or(Some(ts)),
-                    team_id,
-                    attachments,
-                );
+                emit_message(user, text, channel, event.thread_ts.or(Some(ts)), team_id);
             }
         }
 
@@ -403,14 +348,7 @@ fn handle_slack_event(event: SlackEvent, team_id: Option<String>, _event_id: Opt
                     if !check_sender_permission(&user, &channel, true) {
                         return;
                     }
-                    emit_message(
-                        user,
-                        text,
-                        channel,
-                        event.thread_ts.or(Some(ts)),
-                        team_id,
-                        attachments,
-                    );
+                    emit_message(user, text, channel, event.thread_ts.or(Some(ts)), team_id);
                 }
             }
         }
@@ -431,7 +369,6 @@ fn emit_message(
     channel: String,
     thread_ts: Option<String>,
     team_id: Option<String>,
-    attachments: Vec<InboundAttachment>,
 ) {
     let message_ts = thread_ts.clone().unwrap_or_default();
 
@@ -459,7 +396,6 @@ fn emit_message(
         content: cleaned_text,
         thread_id: thread_ts,
         metadata_json,
-        attachments,
     });
 }
 
@@ -615,111 +551,3 @@ fn json_response(status: u16, value: serde_json::Value) -> OutgoingHttpResponse
 
 // Export the component
 export!(SlackChannel);
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_extract_slack_attachments_with_files() {
-        let files = Some(vec![
-            SlackFile {
-                id: "F123".to_string(),
-                mimetype: Some("image/png".to_string()),
-                name: Some("screenshot.png".to_string()),
-                size: Some(50000),
-                url_private: Some("https://files.slack.com/F123".to_string()),
-            },
-            SlackFile {
-                id: "F456".to_string(),
-                mimetype: Some("application/pdf".to_string()),
-                name: Some("doc.pdf".to_string()),
-                size: Some(120000),
-                url_private: None,
-            },
-        ]);
-
-        let attachments = extract_slack_attachments(&files);
-        assert_eq!(attachments.len(), 2);
-
-        assert_eq!(attachments[0].id, "F123");
-        assert_eq!(attachments[0].mime_type, "image/png");
-        assert_eq!(attachments[0].filename, Some("screenshot.png".to_string()));
-        assert_eq!(attachments[0].size_bytes, Some(50000));
-        assert_eq!(
-            attachments[0].source_url,
-            Some("https://files.slack.com/F123".to_string())
-        );
-
-        assert_eq!(attachments[1].id, "F456");
-        assert_eq!(attachments[1].mime_type, "application/pdf");
-        assert!(attachments[1].source_url.is_none());
-    }
-
-    #[test]
-    fn test_extract_slack_attachments_none() {
-        let attachments = extract_slack_attachments(&None);
-        assert!(attachments.is_empty());
-    }
-
-    #[test]
-    fn test_extract_slack_attachments_empty() {
-        let attachments = extract_slack_attachments(&Some(vec![]));
-        assert!(attachments.is_empty());
-    }
-
-    #[test]
-    fn test_extract_slack_attachments_missing_mime() {
-        let files = Some(vec![SlackFile {
-            id: "F789".to_string(),
-            mimetype: None,
-            name: Some("unknown".to_string()),
-            size: None,
-            url_private: None,
-        }]);
-
-        let attachments = extract_slack_attachments(&files);
-        assert_eq!(attachments.len(), 1);
-        assert_eq!(attachments[0].mime_type, "application/octet-stream");
-    }
-
-    #[test]
-    fn test_parse_slack_event_with_files() {
-        let json = r#"{
-            "type": "message",
-            "user": "U123",
-            "channel": "D456",
-            "text": "Check this file",
-            "ts": "1234567890.000001",
-            "files": [
-                {
-                    "id": "F001",
-                    "mimetype": "image/jpeg",
-                    "name": "photo.jpg",
-                    "size": 30000,
-                    "url_private": "https://files.slack.com/F001"
-                }
-            ]
-        }"#;
-
-        let event: SlackEvent = serde_json::from_str(json).unwrap();
-        assert!(event.files.is_some());
-        let files = event.files.unwrap();
-        assert_eq!(files.len(), 1);
-        assert_eq!(files[0].id, "F001");
-    }
-
-    #[test]
-    fn test_parse_slack_event_without_files() {
-        let json = r#"{
-            "type": "message",
-            "user": "U123",
-            "channel": "D456",
-            "text": "Just text",
-            "ts": "1234567890.000001"
-        }"#;
-
-        let event: SlackEvent = serde_json::from_str(json).unwrap();
-        assert!(event.files.is_none());
-    }
-}

channels-src/telegram/Cargo.lock

@@ -212,7 +212,7 @@ dependencies = [
 
 [[package]]
 name = "telegram-channel"
-version = "0.2.0"
+version = "0.1.0"
 dependencies = [
  "serde",
  "serde_json",

channels-src/telegram/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "telegram-channel"
-version = "0.2.0"
+version = "0.1.0"
 edition = "2021"
 description = "Telegram Bot API channel for IronClaw"
 license = "MIT OR Apache-2.0"

channels-src/telegram/telegram.capabilities.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "type": "channel",
   "name": "telegram",
   "description": "Telegram Bot API channel for receiving and responding to Telegram messages",
@@ -17,8 +17,7 @@
   "capabilities": {
     "http": {
       "allowlist": [
-        { "host": "api.telegram.org", "path_prefix": "/bot" },
-        { "host": "api.telegram.org", "path_prefix": "/file/bot" }
+        { "host": "api.telegram.org", "path_prefix": "/bot" }
       ],
       "credentials": {
         "telegram_bot": {
@@ -27,7 +26,6 @@
           "host_patterns": ["api.telegram.org"]
         }
       },
-      "max_response_bytes": 52428800,
       "rate_limit": {
         "requests_per_minute": 30,
         "requests_per_hour": 1000

channels-src/whatsapp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "whatsapp-channel"
-version = "0.2.0"
+version = "0.1.0"
 edition = "2021"
 description = "WhatsApp Cloud API channel for IronClaw"
 

channels-src/whatsapp/src/lib.rs

@@ -32,7 +32,7 @@ use exports::near::agent::channel::{
     AgentResponse, ChannelConfig, Guest, HttpEndpointConfig, IncomingHttpRequest,
     OutgoingHttpResponse, StatusUpdate,
 };
-use near::agent::channel_host::{self, EmittedMessage, InboundAttachment};
+use near::agent::channel_host::{self, EmittedMessage};
 
 // ============================================================================
 // WhatsApp Cloud API Types
@@ -137,46 +137,10 @@ struct WhatsAppMessage {
     /// Text content (if type is "text")
     text: Option<TextContent>,
 
-    /// Image content
-    image: Option<WhatsAppMedia>,
-
-    /// Audio content
-    audio: Option<WhatsAppMedia>,
-
-    /// Video content
-    video: Option<WhatsAppMedia>,
-
-    /// Document content
-    document: Option<WhatsAppDocument>,
-
     /// Context for replies
     context: Option<MessageContext>,
 }
 
-/// WhatsApp media attachment (image, audio, video).
-#[derive(Debug, Deserialize)]
-struct WhatsAppMedia {
-    /// Media ID (use to download via Graph API)
-    id: String,
-    /// MIME type
-    mime_type: Option<String>,
-    /// Caption text
-    caption: Option<String>,
-}
-
-/// WhatsApp document attachment.
-#[derive(Debug, Deserialize)]
-struct WhatsAppDocument {
-    /// Media ID
-    id: String,
-    /// MIME type
-    mime_type: Option<String>,
-    /// Filename
-    filename: Option<String>,
-    /// Caption text
-    caption: Option<String>,
-}
-
 /// Text message content.
 #[derive(Debug, Deserialize)]
 struct TextContent {
@@ -512,10 +476,6 @@ impl Guest for WhatsAppChannel {
 
     fn on_status(_update: StatusUpdate) {}
 
-    fn on_broadcast(_user_id: String, _response: AgentResponse) -> Result<(), String> {
-        Err("broadcast not yet implemented for WhatsApp channel".to_string())
-    }
-
     fn on_shutdown() {
         channel_host::log(
             channel_host::LogLevel::Info,
@@ -658,102 +618,26 @@ fn handle_incoming_message(req: &IncomingHttpRequest) -> OutgoingHttpResponse {
     json_response(200, serde_json::json!({"status": "ok"}))
 }
 
-/// Extract attachments from a WhatsApp message.
-fn extract_whatsapp_attachments(message: &WhatsAppMessage) -> Vec<InboundAttachment> {
-    let mut attachments = Vec::new();
-
-    if let Some(ref img) = message.image {
-        attachments.push(InboundAttachment {
-            id: img.id.clone(),
-            mime_type: img
-                .mime_type
-                .clone()
-                .unwrap_or_else(|| "image/jpeg".to_string()),
-            filename: None,
-            size_bytes: None,
-            source_url: None, // WhatsApp requires Graph API call with media ID to get URL
-            storage_key: None,
-            extracted_text: img.caption.clone(),
-            extras_json: String::new(),
-        });
-    }
-
-    if let Some(ref audio) = message.audio {
-        attachments.push(InboundAttachment {
-            id: audio.id.clone(),
-            mime_type: audio
-                .mime_type
-                .clone()
-                .unwrap_or_else(|| "audio/ogg".to_string()),
-            filename: None,
-            size_bytes: None,
-            source_url: None,
-            storage_key: None,
-            extracted_text: audio.caption.clone(),
-            extras_json: String::new(),
-        });
-    }
-
-    if let Some(ref video) = message.video {
-        attachments.push(InboundAttachment {
-            id: video.id.clone(),
-            mime_type: video
-                .mime_type
-                .clone()
-                .unwrap_or_else(|| "video/mp4".to_string()),
-            filename: None,
-            size_bytes: None,
-            source_url: None,
-            storage_key: None,
-            extracted_text: video.caption.clone(),
-            extras_json: String::new(),
-        });
-    }
-
-    if let Some(ref doc) = message.document {
-        attachments.push(InboundAttachment {
-            id: doc.id.clone(),
-            mime_type: doc
-                .mime_type
-                .clone()
-                .unwrap_or_else(|| "application/octet-stream".to_string()),
-            filename: doc.filename.clone(),
-            size_bytes: None,
-            source_url: None,
-            storage_key: None,
-            extracted_text: doc.caption.clone(),
-            extras_json: String::new(),
-        });
-    }
-
-    attachments
-}
-
 /// Process a single WhatsApp message.
 fn handle_message(
     message: &WhatsAppMessage,
     phone_number_id: &str,
     contact_names: &std::collections::HashMap<String, String>,
 ) {
-    let attachments = extract_whatsapp_attachments(message);
+    // Only handle text messages for now
+    // TODO: Add support for image, audio, video, document, etc.
+    if message.message_type != "text" {
+        channel_host::log(
+            channel_host::LogLevel::Debug,
+            &format!("Skipping non-text message type: {}", message.message_type),
+        );
+        return;
+    }
 
-    // Extract text content (from text body or media captions)
+    // Extract text content
     let text = match &message.text {
         Some(t) if !t.body.is_empty() => t.body.clone(),
-        _ => {
-            // Try to use caption from media messages as content
-            let caption = message
-                .image
-                .as_ref()
-                .and_then(|m| m.caption.clone())
-                .or_else(|| message.video.as_ref().and_then(|m| m.caption.clone()))
-                .or_else(|| message.document.as_ref().and_then(|m| m.caption.clone()));
-            match caption {
-                Some(c) if !c.is_empty() => c,
-                _ if !attachments.is_empty() => String::new(),
-                _ => return,
-            }
-        }
+        _ => return,
     };
 
     // Look up sender's name from contacts
@@ -786,7 +670,6 @@ fn handle_message(
         content: text,
         thread_id: None, // WhatsApp doesn't have threads like Slack/Discord
         metadata_json,
-        attachments,
     });
 
     channel_host::log(
@@ -1064,138 +947,4 @@ mod tests {
         assert_eq!(parsed.phone_number_id, "123456");
         assert_eq!(parsed.sender_phone, "15551234567");
     }
-
-    // === Attachment extraction fixture tests ===
-
-    #[test]
-    fn test_extract_whatsapp_image_attachment() {
-        let msg = WhatsAppMessage {
-            id: "msg1".to_string(),
-            from: "15551234567".to_string(),
-            timestamp: "1234567890".to_string(),
-            message_type: "image".to_string(),
-            text: None,
-            image: Some(WhatsAppMedia {
-                id: "media_img_1".to_string(),
-                mime_type: Some("image/jpeg".to_string()),
-                caption: Some("Look at this".to_string()),
-            }),
-            audio: None,
-            video: None,
-            document: None,
-            context: None,
-        };
-
-        let attachments = extract_whatsapp_attachments(&msg);
-        assert_eq!(attachments.len(), 1);
-        assert_eq!(attachments[0].id, "media_img_1");
-        assert_eq!(attachments[0].mime_type, "image/jpeg");
-        assert_eq!(
-            attachments[0].extracted_text,
-            Some("Look at this".to_string())
-        );
-    }
-
-    #[test]
-    fn test_extract_whatsapp_document_attachment() {
-        let msg = WhatsAppMessage {
-            id: "msg2".to_string(),
-            from: "15551234567".to_string(),
-            timestamp: "1234567890".to_string(),
-            message_type: "document".to_string(),
-            text: None,
-            image: None,
-            audio: None,
-            video: None,
-            document: Some(WhatsAppDocument {
-                id: "media_doc_1".to_string(),
-                mime_type: Some("application/pdf".to_string()),
-                filename: Some("report.pdf".to_string()),
-                caption: None,
-            }),
-            context: None,
-        };
-
-        let attachments = extract_whatsapp_attachments(&msg);
-        assert_eq!(attachments.len(), 1);
-        assert_eq!(attachments[0].id, "media_doc_1");
-        assert_eq!(attachments[0].mime_type, "application/pdf");
-        assert_eq!(
-            attachments[0].filename,
-            Some("report.pdf".to_string())
-        );
-    }
-
-    #[test]
-    fn test_extract_whatsapp_audio_video_attachments() {
-        let msg = WhatsAppMessage {
-            id: "msg3".to_string(),
-            from: "15551234567".to_string(),
-            timestamp: "1234567890".to_string(),
-            message_type: "audio".to_string(),
-            text: None,
-            image: None,
-            audio: Some(WhatsAppMedia {
-                id: "media_audio_1".to_string(),
-                mime_type: Some("audio/ogg".to_string()),
-                caption: None,
-            }),
-            video: Some(WhatsAppMedia {
-                id: "media_video_1".to_string(),
-                mime_type: Some("video/mp4".to_string()),
-                caption: None,
-            }),
-            document: None,
-            context: None,
-        };
-
-        let attachments = extract_whatsapp_attachments(&msg);
-        assert_eq!(attachments.len(), 2);
-        assert_eq!(attachments[0].id, "media_audio_1");
-        assert_eq!(attachments[1].id, "media_video_1");
-    }
-
-    #[test]
-    fn test_extract_whatsapp_text_only_no_attachments() {
-        let msg = WhatsAppMessage {
-            id: "msg4".to_string(),
-            from: "15551234567".to_string(),
-            timestamp: "1234567890".to_string(),
-            message_type: "text".to_string(),
-            text: Some(TextContent {
-                body: "Hello".to_string(),
-            }),
-            image: None,
-            audio: None,
-            video: None,
-            document: None,
-            context: None,
-        };
-
-        let attachments = extract_whatsapp_attachments(&msg);
-        assert!(attachments.is_empty());
-    }
-
-    #[test]
-    fn test_parse_whatsapp_image_message() {
-        let json = r#"{
-            "id": "wamid.123",
-            "from": "15551234567",
-            "timestamp": "1234567890",
-            "type": "image",
-            "image": {
-                "id": "media_img_abc",
-                "mime_type": "image/jpeg",
-                "caption": "Check this"
-            }
-        }"#;
-
-        let msg: WhatsAppMessage = serde_json::from_str(json).unwrap();
-        assert_eq!(msg.message_type, "image");
-        assert!(msg.image.is_some());
-
-        let attachments = extract_whatsapp_attachments(&msg);
-        assert_eq!(attachments.len(), 1);
-        assert_eq!(attachments[0].id, "media_img_abc");
-    }
 }

channels-src/whatsapp/whatsapp.capabilities.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "type": "channel",
   "name": "whatsapp",
   "description": "WhatsApp Cloud API channel for receiving and responding to WhatsApp messages",

docker-compose.yml

@@ -3,7 +3,7 @@ services:
   postgres:
     image: pgvector/pgvector:pg16
     ports:
-      - "127.0.0.1:5432:5432"
+      - "5432:5432"
     environment:
       POSTGRES_DB: ironclaw
       POSTGRES_USER: ironclaw

docs/LLM_PROVIDERS.md

@@ -11,12 +11,6 @@ configurations.
 | NEAR AI | `nearai` | OAuth (browser) | Default; multi-model |
 | Anthropic | `anthropic` | `ANTHROPIC_API_KEY` | Claude models |
 | OpenAI | `openai` | `OPENAI_API_KEY` | GPT models |
-| Google Gemini | `gemini` | `GEMINI_API_KEY` | Gemini models |
-| AWS Bedrock | `bedrock` | `BEDROCK_ACCESS_KEY` | Requires OpenAI proxy (e.g. LiteLLM) |
-| io.net | `ionet` | `IONET_API_KEY` | Intelligence API |
-| Mistral | `mistral` | `MISTRAL_API_KEY` | Mistral models |
-| Yandex AI Studio | `yandex` | `YANDEX_API_KEY` | YandexGPT models |
-| Cloudflare Workers AI | `cloudflare` | `CLOUDFLARE_API_KEY` | Access to Workers AI |
 | Ollama | `ollama` | No | Local inference |
 | OpenRouter | `openai_compatible` | `LLM_API_KEY` | 300+ models |
 | Together AI | `openai_compatible` | `LLM_API_KEY` | Fast inference |

migrations/V11__conversation_unique_indexes.sql

@@ -1,13 +0,0 @@
--- Partial unique indexes to prevent duplicate singleton conversations.
--- These guard against TOCTOU races in get_or_create_routine_conversation
--- and get_or_create_heartbeat_conversation.
-
--- One routine conversation per user per routine_id.
-CREATE UNIQUE INDEX IF NOT EXISTS uq_conv_routine
-ON conversations (user_id, (metadata->>'routine_id'))
-WHERE metadata->>'routine_id' IS NOT NULL;
-
--- One heartbeat conversation per user.
-CREATE UNIQUE INDEX IF NOT EXISTS uq_conv_heartbeat
-ON conversations (user_id)
-WHERE metadata->>'thread_type' = 'heartbeat';

providers.json

@@ -1,403 +0,0 @@
-[
-  {
-    "id": "openai",
-    "aliases": [
-      "open_ai"
-    ],
-    "protocol": "open_ai_completions",
-    "api_key_env": "OPENAI_API_KEY",
-    "api_key_required": true,
-    "base_url_env": "OPENAI_BASE_URL",
-    "model_env": "OPENAI_MODEL",
-    "default_model": "gpt-4o",
-    "description": "OpenAI GPT models (direct API)",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_openai_api_key",
-      "key_url": "https://platform.openai.com/api-keys",
-      "display_name": "OpenAI",
-      "can_list_models": true
-    }
-  },
-  {
-    "id": "anthropic",
-    "aliases": [
-      "claude"
-    ],
-    "protocol": "anthropic",
-    "api_key_env": "ANTHROPIC_API_KEY",
-    "api_key_required": true,
-    "base_url_env": "ANTHROPIC_BASE_URL",
-    "model_env": "ANTHROPIC_MODEL",
-    "default_model": "claude-sonnet-4-20250514",
-    "description": "Anthropic Claude models (direct API)",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_anthropic_api_key",
-      "key_url": "https://console.anthropic.com/settings/keys",
-      "display_name": "Anthropic",
-      "can_list_models": true
-    }
-  },
-  {
-    "id": "ollama",
-    "aliases": [],
-    "protocol": "ollama",
-    "default_base_url": "http://localhost:11434",
-    "base_url_env": "OLLAMA_BASE_URL",
-    "model_env": "OLLAMA_MODEL",
-    "default_model": "llama3",
-    "description": "Local Ollama instance (no API key needed)",
-    "setup": {
-      "kind": "ollama",
-      "display_name": "Ollama",
-      "can_list_models": true
-    }
-  },
-  {
-    "id": "openai_compatible",
-    "aliases": [
-      "openai-compatible",
-      "compatible"
-    ],
-    "protocol": "open_ai_completions",
-    "base_url_env": "LLM_BASE_URL",
-    "base_url_required": true,
-    "api_key_env": "LLM_API_KEY",
-    "api_key_required": false,
-    "model_env": "LLM_MODEL",
-    "default_model": "default",
-    "extra_headers_env": "LLM_EXTRA_HEADERS",
-    "description": "Custom OpenAI-compatible endpoint (vLLM, LiteLLM, etc.)",
-    "setup": {
-      "kind": "open_ai_compatible",
-      "secret_name": "llm_compatible_api_key",
-      "display_name": "OpenAI-compatible",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "tinfoil",
-    "aliases": [],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://inference.tinfoil.sh/v1",
-    "api_key_env": "TINFOIL_API_KEY",
-    "api_key_required": true,
-    "model_env": "TINFOIL_MODEL",
-    "default_model": "kimi-k2-5",
-    "description": "Tinfoil private inference (hardware-attested TEE)",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_tinfoil_api_key",
-      "key_url": "https://tinfoil.sh",
-      "display_name": "Tinfoil",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "openrouter",
-    "aliases": [
-      "open_router"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://openrouter.ai/api/v1",
-    "api_key_env": "OPENROUTER_API_KEY",
-    "api_key_required": true,
-    "model_env": "OPENROUTER_MODEL",
-    "default_model": "openai/gpt-4o",
-    "description": "OpenRouter multi-provider gateway (200+ models)",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_openrouter_api_key",
-      "key_url": "https://openrouter.ai/settings/keys",
-      "display_name": "OpenRouter",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "groq",
-    "aliases": [],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.groq.com/openai/v1",
-    "api_key_env": "GROQ_API_KEY",
-    "api_key_required": true,
-    "model_env": "GROQ_MODEL",
-    "default_model": "llama-3.3-70b-versatile",
-    "description": "Groq LPU inference (ultra-fast)",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_groq_api_key",
-      "key_url": "https://console.groq.com/keys",
-      "display_name": "Groq",
-      "can_list_models": true,
-      "models_filter": "chat"
-    }
-  },
-  {
-    "id": "nvidia",
-    "aliases": [
-      "nvidia_nim",
-      "nim"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://integrate.api.nvidia.com/v1",
-    "api_key_env": "NVIDIA_API_KEY",
-    "api_key_required": true,
-    "model_env": "NVIDIA_MODEL",
-    "default_model": "meta/llama-3.3-70b-instruct",
-    "description": "NVIDIA NIM API (high-performance inference)",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_nvidia_api_key",
-      "key_url": "https://build.nvidia.com",
-      "display_name": "NVIDIA NIM",
-      "can_list_models": true
-    }
-  },
-  {
-    "id": "venice",
-    "aliases": [
-      "venice_ai",
-      "veniceai"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.venice.ai/api/v1",
-    "api_key_env": "VENICE_API_KEY",
-    "api_key_required": true,
-    "model_env": "VENICE_MODEL",
-    "default_model": "llama-3.3-70b",
-    "description": "Venice.ai privacy-focused inference",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_venice_api_key",
-      "key_url": "https://venice.ai/settings/api",
-      "display_name": "Venice.ai",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "together",
-    "aliases": [
-      "together_ai",
-      "togetherai"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.together.xyz/v1",
-    "api_key_env": "TOGETHER_API_KEY",
-    "api_key_required": true,
-    "model_env": "TOGETHER_MODEL",
-    "default_model": "meta-llama/Llama-3-70b-chat-hf",
-    "description": "Together AI inference",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_together_api_key",
-      "key_url": "https://api.together.ai/settings/api-keys",
-      "display_name": "Together AI",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "fireworks",
-    "aliases": [
-      "fireworks_ai"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.fireworks.ai/inference/v1",
-    "api_key_env": "FIREWORKS_API_KEY",
-    "api_key_required": true,
-    "model_env": "FIREWORKS_MODEL",
-    "default_model": "accounts/fireworks/models/llama-v3p1-70b-instruct",
-    "description": "Fireworks AI inference",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_fireworks_api_key",
-      "key_url": "https://fireworks.ai/api-keys",
-      "display_name": "Fireworks AI",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "deepseek",
-    "aliases": [
-      "deep_seek"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.deepseek.com/v1",
-    "api_key_env": "DEEPSEEK_API_KEY",
-    "api_key_required": true,
-    "model_env": "DEEPSEEK_MODEL",
-    "default_model": "deepseek-chat",
-    "description": "DeepSeek inference API",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_deepseek_api_key",
-      "key_url": "https://platform.deepseek.com/api_keys",
-      "display_name": "DeepSeek",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "cerebras",
-    "aliases": [],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.cerebras.ai/v1",
-    "api_key_env": "CEREBRAS_API_KEY",
-    "api_key_required": true,
-    "model_env": "CEREBRAS_MODEL",
-    "default_model": "llama-3.3-70b",
-    "description": "Cerebras wafer-scale inference",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_cerebras_api_key",
-      "key_url": "https://cloud.cerebras.ai",
-      "display_name": "Cerebras",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "sambanova",
-    "aliases": [
-      "samba_nova"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.sambanova.ai/v1",
-    "api_key_env": "SAMBANOVA_API_KEY",
-    "api_key_required": true,
-    "model_env": "SAMBANOVA_MODEL",
-    "default_model": "Meta-Llama-3.1-70B-Instruct",
-    "description": "SambaNova Cloud inference",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_sambanova_api_key",
-      "key_url": "https://cloud.sambanova.ai/apis",
-      "display_name": "SambaNova",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "gemini",
-    "aliases": [
-      "google_gemini",
-      "google"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://generativelanguage.googleapis.com/v1beta/openai",
-    "api_key_env": "GEMINI_API_KEY",
-    "api_key_required": true,
-    "model_env": "GEMINI_MODEL",
-    "default_model": "gemini-2.5-flash",
-    "description": "Google Gemini (via OpenAI-compatible endpoint)",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_gemini_api_key",
-      "key_url": "https://aistudio.google.com/app/apikey",
-      "display_name": "Google Gemini",
-      "can_list_models": true
-    }
-  },
-  {
-    "id": "bedrock",
-    "aliases": [
-      "aws_bedrock",
-      "aws"
-    ],
-    "protocol": "open_ai_completions",
-    "api_key_env": "BEDROCK_ACCESS_KEY",
-    "api_key_required": false,
-    "base_url_env": "BEDROCK_BASE_URL",
-    "model_env": "BEDROCK_MODEL",
-    "default_model": "anthropic.claude-3-5-sonnet-20241022-v2:0",
-    "description": "AWS Bedrock (requires LiteLLM or OpenAI-compatible proxy)",
-    "setup": {
-      "kind": "open_ai_compatible",
-      "secret_name": "llm_bedrock_api_key",
-      "display_name": "AWS Bedrock",
-      "can_list_models": false
-    }
-  },
-  {
-    "id": "ionet",
-    "aliases": [
-      "io_net",
-      "io.net"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.intelligence.io.solutions/api/v1",
-    "api_key_env": "IONET_API_KEY",
-    "api_key_required": true,
-    "model_env": "IONET_MODEL",
-    "default_model": "deepseek-coder-v2-instruct",
-    "description": "io.net Intelligence API",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_ionet_api_key",
-      "key_url": "https://cloud.io.net/intelligence",
-      "display_name": "io.net",
-      "can_list_models": true
-    }
-  },
-  {
-    "id": "mistral",
-    "aliases": [
-      "mistral_ai",
-      "mistralai"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://api.mistral.ai/v1",
-    "api_key_env": "MISTRAL_API_KEY",
-    "api_key_required": true,
-    "model_env": "MISTRAL_MODEL",
-    "default_model": "mistral-large-latest",
-    "description": "Mistral AI API",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_mistral_api_key",
-      "key_url": "https://console.mistral.ai/api-keys",
-      "display_name": "Mistral",
-      "can_list_models": true
-    }
-  },
-  {
-    "id": "yandex",
-    "aliases": [
-      "yandex_ai_studio",
-      "yandexgpt",
-      "yandex_gpt"
-    ],
-    "protocol": "open_ai_completions",
-    "default_base_url": "https://ai.api.cloud.yandex.net/v1",
-    "api_key_env": "YANDEX_API_KEY",
-    "api_key_required": true,
-    "model_env": "YANDEX_MODEL",
-    "extra_headers_env": "YANDEX_EXTRA_HEADERS",
-    "default_model": "yandexgpt-lite",
-    "description": "Yandex AI Studio (YandexGPT)",
-    "setup": {
-      "kind": "api_key",
-      "secret_name": "llm_yandex_api_key",
-      "key_url": "https://aistudio.yandex.ru/platform/folders/",
-      "display_name": "Yandex AI Studio",
-      "can_list_models": true
-    }
-  },
-  {
-    "id": "cloudflare",
-    "aliases": [
-      "cloudflare_ai",
-      "cf_ai"
-    ],
-    "protocol": "open_ai_completions",
-    "api_key_env": "CLOUDFLARE_API_KEY",
-    "api_key_required": true,
-    "base_url_env": "CLOUDFLARE_BASE_URL",
-    "model_env": "CLOUDFLARE_MODEL",
-    "default_model": "@cf/meta/llama-3.3-70b-instruct-fp8-fast",
-    "description": "Cloudflare Workers AI",
-    "setup": {
-      "kind": "open_ai_compatible",
-      "secret_name": "llm_cloudflare_api_key",
-      "display_name": "Cloudflare Workers AI",
-      "can_list_models": false
-    }
-  }
-]

registry/channels/discord.json

@@ -2,8 +2,8 @@
   "name": "discord",
   "display_name": "Discord Channel",
   "kind": "channel",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Talk to your agent in Discord",
   "keywords": [
     "messaging",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/discord-wasm32-wasip2.tar.gz",
-      "sha256": "030707431717bca3411a48f311c6ab5f92a45c747de26cafe4f6e3e23a8b3b2d"
+      "sha256": "56b8d92e3e0f32d9cfaf0dc1ac8aa8c42b98cda4d92cd42a74e0af01eeee60a1"
     }
   },
   "auth_summary": {

registry/channels/slack.json

@@ -2,8 +2,8 @@
   "name": "slack",
   "display_name": "Slack Channel",
   "kind": "channel",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Talk to your agent in Slack",
   "keywords": [
     "messaging",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/slack-wasm32-wasip2.tar.gz",
-      "sha256": "6ed36077b67ac70a041f06f760f93ba79b33269885413c3c3f2c8c87ee60807e"
+      "sha256": "536b52179094d228e18d51b203286c80f800e0132b42fa08ce292c76a13a70e8"
     }
   },
   "auth_summary": {

registry/channels/telegram.json

@@ -2,8 +2,8 @@
   "name": "telegram",
   "display_name": "Telegram Channel",
   "kind": "channel",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Talk to your agent through a Telegram bot",
   "keywords": [
     "messaging",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/telegram-wasm32-wasip2.tar.gz",
-      "sha256": "98c86895a9c4b0a1e19fe8a47f1ccbfe7e972e112b05e584bc897130dc32283a"
+      "sha256": "9bcc39d717c2b7e4e3327d31fc0032fbe4bf666852622c69b88dbaee236f77ee"
     }
   },
   "auth_summary": {

registry/channels/whatsapp.json

@@ -2,8 +2,8 @@
   "name": "whatsapp",
   "display_name": "WhatsApp Channel",
   "kind": "channel",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Talk to your agent through WhatsApp",
   "keywords": [
     "messaging",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/whatsapp-wasm32-wasip2.tar.gz",
-      "sha256": "bd35cad18d87292ea8d2f52db9b514ed9f814a414de910f59073d475c26c4c14"
+      "sha256": "54dc4a6c2b4e07bce6de54cab415920be518c94a096df45f1104f0fa5c8f6382"
     }
   },
   "auth_summary": {

registry/tools/github.json

@@ -2,8 +2,8 @@
   "name": "github",
   "display_name": "GitHub",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "GitHub integration for issues, PRs, repos, and code search",
   "keywords": [
     "git",
@@ -20,7 +20,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/github-wasm32-wasip2.tar.gz",
-      "sha256": "6fcd32719a4ff15641a4b50fff8984686550f0c491dce60518f4126857d0c544"
+      "sha256": "a068208d454be34585e8809816991c1853c255cd6f04c6ca9277e21219b745bc"
     }
   },
   "auth_summary": {

registry/tools/gmail.json

@@ -2,8 +2,8 @@
   "name": "gmail",
   "display_name": "Gmail",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Read, send, and manage Gmail messages and threads",
   "keywords": [
     "email",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/gmail-wasm32-wasip2.tar.gz",
-      "sha256": "023da7000b17568bf0e64b2e5013c8a042b2f323c85f1632339231c73d500e39"
+      "sha256": "557e3d485de337340e059948b3099dcacae1c2e937e2bf66bad52b105c5be9bc"
     }
   },
   "auth_summary": {

registry/tools/google-calendar.json

@@ -2,8 +2,8 @@
   "name": "google-calendar",
   "display_name": "Google Calendar",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Create, read, update, and delete Google Calendar events",
   "keywords": [
     "calendar",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-calendar-wasm32-wasip2.tar.gz",
-      "sha256": "fc42277b65881d6e9bcc5403dc54c7f5b3ddeaaaf04617fce2c5da05d76325f0"
+      "sha256": "787d57cb55cf492af013b69bfed8472a1cdd349fbb137f6084c0adcb51a467a6"
     }
   },
   "auth_summary": {

registry/tools/google-docs.json

@@ -2,8 +2,8 @@
   "name": "google-docs",
   "display_name": "Google Docs",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Create and edit Google Docs documents",
   "keywords": [
     "documents",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-docs-wasm32-wasip2.tar.gz",
-      "sha256": "385c04abd1e6b8011ccc330e1f4bd7ce58577e488959b51594aa04eb26cbe7cc"
+      "sha256": "64407e650b6b8fcf9892255ef237a7683469fd465e3ba84e709fd71cd77fcbab"
     }
   },
   "auth_summary": {

registry/tools/google-drive.json

@@ -2,8 +2,8 @@
   "name": "google-drive",
   "display_name": "Google Drive",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Upload, download, search, and manage Google Drive files and folders",
   "keywords": [
     "storage",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-drive-wasm32-wasip2.tar.gz",
-      "sha256": "1b107d575a5d52cc8c76d9a681802190f4373fb485f7f54f445533f097fa37c0"
+      "sha256": "3618689278d9e8546e37490c7ba05ee4dffb0acfaa89f0865161616326c41ee8"
     }
   },
   "auth_summary": {

registry/tools/google-sheets.json

@@ -2,8 +2,8 @@
   "name": "google-sheets",
   "display_name": "Google Sheets",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Read and write Google Sheets spreadsheet data",
   "keywords": [
     "spreadsheets",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-sheets-wasm32-wasip2.tar.gz",
-      "sha256": "c4f6b1e8c5126ac2c8a4b98e4283a3afa32223d2488fc3c3a609758c0c9beb90"
+      "sha256": "e486d228891a5b431b9993cebe0820c5331130916555ac3ba33b5b23bfd4ad75"
     }
   },
   "auth_summary": {

registry/tools/google-slides.json

@@ -2,8 +2,8 @@
   "name": "google-slides",
   "display_name": "Google Slides",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Create and edit Google Slides presentations",
   "keywords": [
     "presentations",
@@ -18,7 +18,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/google-slides-wasm32-wasip2.tar.gz",
-      "sha256": "7110b8565340c888e51f99e9c013bf4de8f8a7f7b33bace00eb8fc47831ff20b"
+      "sha256": "9f2ba32c6d43cf87f50e2ae6720a1e9d89c00666aab2047080aadb503968c66a"
     }
   },
   "auth_summary": {

registry/tools/slack.json

@@ -2,8 +2,8 @@
   "name": "slack-tool",
   "display_name": "Slack Tool",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Your agent uses Slack to post and read messages in your workspace",
   "keywords": [
     "messaging",
@@ -18,7 +18,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/slack-tool-wasm32-wasip2.tar.gz",
-      "sha256": "6ed36077b67ac70a041f06f760f93ba79b33269885413c3c3f2c8c87ee60807e"
+      "sha256": "536b52179094d228e18d51b203286c80f800e0132b42fa08ce292c76a13a70e8"
     }
   },
   "auth_summary": {

registry/tools/telegram.json

@@ -2,8 +2,8 @@
   "name": "telegram-mtproto",
   "display_name": "Telegram Tool",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Your agent uses your Telegram account to read and send messages",
   "keywords": [
     "messaging",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/telegram-mtproto-wasm32-wasip2.tar.gz",
-      "sha256": "98c86895a9c4b0a1e19fe8a47f1ccbfe7e972e112b05e584bc897130dc32283a"
+      "sha256": "9bcc39d717c2b7e4e3327d31fc0032fbe4bf666852622c69b88dbaee236f77ee"
     }
   },
   "auth_summary": {

registry/tools/web-search.json

@@ -2,8 +2,8 @@
   "name": "web-search",
   "display_name": "Web Search",
   "kind": "tool",
-  "version": "0.2.0",
-  "wit_version": "0.3.0",
+  "version": "0.1.0",
+  "wit_version": "0.2.0",
   "description": "Search the web using Brave Search API",
   "keywords": [
     "search",
@@ -19,7 +19,7 @@
   "artifacts": {
     "wasm32-wasip2": {
       "url": "https://github.com/nearai/ironclaw/releases/latest/download/web-search-wasm32-wasip2.tar.gz",
-      "sha256": "66cb2b9b00652385e9f30f17c74902b9222c17c53e9d3bd1ef42f5cab705bcf6"
+      "sha256": "003b0667878035ba0e6029ec322bf5e6e7bab06c3022d5fe897ce288d2d156e0"
     }
   },
   "auth_summary": {

scripts/check-boundaries.sh

@@ -1,223 +0,0 @@
-#!/usr/bin/env bash
-# Architecture boundary checks for IronClaw.
-# Run as: bash scripts/check-boundaries.sh
-# Returns non-zero if hard violations are found.
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$REPO_ROOT"
-
-violations=0
-
-echo "=== Architecture Boundary Checks ==="
-echo
-
-# --------------------------------------------------------------------------
-# Check 1: Direct database driver usage outside the db layer
-# --------------------------------------------------------------------------
-# tokio_postgres:: and libsql:: types should only appear in:
-#   - src/db/           (the database abstraction layer)
-#   - src/workspace/repository.rs (workspace's own DB layer)
-#   - src/error.rs      (needs From impls for driver error types)
-#   - src/app.rs        (bootstraps/initialises the database)
-#   - src/testing.rs    (test infrastructure)
-#   - src/cli/          (CLI commands that bootstrap DB connections)
-#   - src/setup/        (onboarding wizard bootstraps DB)
-#   - src/main.rs       (entry point)
-#
-# Everything else is a boundary violation -- those modules should go through
-# the Database trait, not touch driver types directly.
-# --------------------------------------------------------------------------
-
-echo "--- Check 1: Direct database driver usage outside db layer ---"
-
-results=$(grep -rn 'tokio_postgres::\|libsql::' src/ \
-    --include='*.rs' \
-    | grep -v 'src/db/' \
-    | grep -v 'src/workspace/repository.rs' \
-    | grep -v 'src/error.rs' \
-    | grep -v 'src/app.rs' \
-    | grep -v 'src/testing.rs' \
-    | grep -v 'src/cli/' \
-    | grep -v 'src/setup/' \
-    | grep -v 'src/main.rs' \
-    | grep -v '^\s*//' \
-    | grep -v '//.*tokio_postgres\|//.*libsql' \
-    || true)
-
-if [ -n "$results" ]; then
-    echo "VIOLATION: Direct database driver usage found outside db layer:"
-    echo "$results"
-    echo
-    count=$(echo "$results" | wc -l | tr -d ' ')
-    echo "($count occurrence(s) -- these modules should use the Database trait)"
-    violations=$((violations + 1))
-else
-    echo "OK"
-fi
-echo
-
-# --------------------------------------------------------------------------
-# Check 2: .unwrap() / .expect() in production code (heuristic)
-# --------------------------------------------------------------------------
-# We cannot perfectly distinguish test vs production code with grep alone
-# (test modules span many lines). Instead we:
-#   1. Exclude files that are entirely test infrastructure
-#   2. Exclude lines that are clearly in test code (assert, #[test], etc.)
-#   3. Report a per-file summary so reviewers can focus on the worst files
-#
-# This is a WARNING, not a hard violation.
-# --------------------------------------------------------------------------
-
-echo "--- Check 2: .unwrap() / .expect() in production code ---"
-
-# Collect raw matches excluding obvious test-only files and lines
-raw_results=$(grep -rn '\.unwrap()\|\.expect(' src/ \
-    --include='*.rs' \
-    | grep -v 'src/main.rs' \
-    | grep -v 'src/testing.rs' \
-    | grep -v 'src/setup/' \
-    || true)
-
-if [ -n "$raw_results" ]; then
-    total=$(echo "$raw_results" | wc -l | tr -d ' ')
-    echo "WARNING: ~$total .unwrap()/.expect() calls found in src/ (excluding main/testing/setup)."
-    echo "Many are in test modules; a per-file breakdown helps triage:"
-    echo
-    # Show per-file counts, sorted by count descending, top 15
-    file_counts=$(echo "$raw_results" | cut -d: -f1 | sort | uniq -c | sort -rn)
-    echo "$file_counts" | head -15
-    fc_total=$(echo "$file_counts" | wc -l | tr -d ' ')
-    if [ "$fc_total" -gt 15 ]; then
-        echo "    ... and $((fc_total - 15)) more files"
-    fi
-    echo
-    echo "(This is a warning for gradual cleanup, not a blocking violation.)"
-    echo "(Many of these are inside #[cfg(test)] modules which is acceptable.)"
-else
-    echo "OK"
-fi
-echo
-
-# --------------------------------------------------------------------------
-# Check 3: std::env::var reads outside config/bootstrap layers
-# --------------------------------------------------------------------------
-# Sensitive values should come through Config or the secrets module.
-# Direct std::env::var / env::var() reads are allowed in:
-#   - src/config/       (the config layer itself)
-#   - src/main.rs       (entry point)
-#   - src/setup/        (onboarding wizard)
-#   - src/testing.rs    (test infrastructure)
-#   - src/cli/          (CLI commands that read env for bootstrap)
-#   - src/bootstrap.rs  (bootstrap logic)
-# --------------------------------------------------------------------------
-
-echo "--- Check 3: Direct env var reads outside config layer ---"
-
-results=$(grep -rn 'std::env::var\|env::var(' src/ \
-    --include='*.rs' \
-    | grep -v 'src/config/' \
-    | grep -v 'src/main.rs' \
-    | grep -v 'src/setup/' \
-    | grep -v 'src/testing.rs' \
-    | grep -v 'src/cli/' \
-    | grep -v 'src/bootstrap.rs' \
-    | grep -v '#\[cfg(test)\]' \
-    | grep -v '#\[test\]' \
-    | grep -v 'mod tests' \
-    | grep -v 'fn test_' \
-    | grep -v '//.*env::var' \
-    || true)
-
-if [ -n "$results" ]; then
-    count=$(echo "$results" | wc -l | tr -d ' ')
-    echo "WARNING: Direct env var reads found outside config layer ($count occurrences):"
-    echo "$results"
-    echo
-    echo "(Review these -- secrets/config should come through Config or the secrets module)"
-else
-    echo "OK"
-fi
-echo
-
-# --------------------------------------------------------------------------
-# Check 4: Test tier gating — integration tests must use feature flags
-# --------------------------------------------------------------------------
-# Files in tests/ that connect to PostgreSQL or use DATABASE_URL must be
-# gated behind #![cfg(all(feature = "postgres", feature = "integration"))].
-# This ensures `cargo test` (no flags) never requires external services.
-#
-# Heuristic: any test file referencing DATABASE_URL, connect(), PgPool,
-# or tokio_postgres should have the cfg gate on the first few lines.
-# --------------------------------------------------------------------------
-
-echo "--- Check 4: Test tier gating for integration tests ---"
-
-tier_violations=()
-for test_file in tests/*.rs; do
-    [ -f "$test_file" ] || continue
-
-    # Check if the file actually connects to a database (imports DB types
-    # or calls pool/connect). Mere string references like "DATABASE_URL"
-    # in config tests don't count.
-    needs_gate=false
-    if grep -q 'PgPool\|tokio_postgres::\|create_pool\|\.connect(' "$test_file" 2>/dev/null; then
-        needs_gate=true
-    fi
-
-    if [ "$needs_gate" = true ]; then
-        # Check first 5 lines for the cfg gate
-        if ! head -5 "$test_file" | grep -q 'cfg.*feature.*integration' 2>/dev/null; then
-            tier_violations+=("  $test_file: needs '#![cfg(all(feature = \"postgres\", feature = \"integration\"))]'")
-        fi
-    fi
-done
-
-if [ ${#tier_violations[@]} -gt 0 ]; then
-    echo "VIOLATION: Integration tests missing feature gate:"
-    printf '%s\n' "${tier_violations[@]}"
-    echo
-    echo "(Tests requiring external services must be gated behind the 'integration' feature)"
-    violations=$((violations + 1))
-else
-    echo "OK"
-fi
-echo
-
-# --------------------------------------------------------------------------
-# Check 5: No silent test-skip patterns (try_connect, is_available, etc.)
-# --------------------------------------------------------------------------
-# Tests must fail loudly when prerequisites are missing, not silently skip.
-# The correct approach is feature-flag gating (#![cfg(feature = "integration")]).
-# Patterns like try_connect().is_none() { return; } hide broken tests.
-# --------------------------------------------------------------------------
-
-echo "--- Check 5: No silent test-skip patterns ---"
-
-skip_results=$(grep -rn 'try_connect\|is_available.*return\|is_none.*return\|is_err.*return.*//.*skip' tests/ \
-    --include='*.rs' \
-    || true)
-
-if [ -n "$skip_results" ]; then
-    echo "VIOLATION: Silent test-skip patterns found (use feature gates instead):"
-    echo "$skip_results"
-    echo
-    violations=$((violations + 1))
-else
-    echo "OK"
-fi
-echo
-
-# --------------------------------------------------------------------------
-# Summary
-# --------------------------------------------------------------------------
-
-echo "=== Summary ==="
-if [ "$violations" -gt 0 ]; then
-    echo "FAILED: $violations hard violation(s) found"
-    exit 1
-else
-    echo "PASSED: No hard violations found (review warnings above)"
-    exit 0
-fi

scripts/dev-setup.sh

@@ -51,11 +51,9 @@ echo "[6/6] Installing git hooks..."
 HOOKS_DIR=$(git rev-parse --git-path hooks 2>/dev/null) || true
 if [ -n "$HOOKS_DIR" ]; then
     mkdir -p "$HOOKS_DIR"
-    SCRIPTS_ABS="$(cd "$(dirname "$0")" && pwd)"
-    ln -sf "$SCRIPTS_ABS/commit-msg-regression.sh" "$HOOKS_DIR/commit-msg"
+    SCRIPT_ABS="$(cd "$(dirname "$0")" && pwd)/commit-msg-regression.sh"
+    ln -sf "$SCRIPT_ABS" "$HOOKS_DIR/commit-msg"
     echo "  commit-msg hook installed (regression test enforcement)"
-    ln -sf "$SCRIPTS_ABS/pre-commit-safety.sh" "$HOOKS_DIR/pre-commit"
-    echo "  pre-commit hook installed (UTF-8, case-sensitivity, /tmp, redaction checks)"
 else
     echo "  Skipped: not a git repository"
 fi

scripts/pre-commit-safety.sh

@@ -1,136 +0,0 @@
-#!/usr/bin/env bash
-# Pre-commit safety checks for common issues caught by AI code reviewers.
-#
-# Can be run standalone: bash scripts/pre-commit-safety.sh
-# Or installed as a git pre-commit hook via dev-setup.sh.
-#
-# Checks staged .rs files for:
-#   1. Unsafe UTF-8 byte slicing (panics on multi-byte chars)
-#   2. Case-sensitive file extension comparisons
-#   3. Hardcoded /tmp paths in tests (flaky in parallel runs)
-#   4. Tool parameters logged without redaction (secret leaks)
-#   5. Multi-step DB operations without transaction wrapping
-#
-# Suppress individual lines with an inline "// safety: <reason>" comment.
-
-set -euo pipefail
-
-# Determine a suitable base ref for standalone diffs.
-resolve_base_ref() {
-    local candidates=(
-        "@{upstream}"
-        "origin/HEAD"
-        "origin/main"
-        "origin/master"
-        "main"
-        "master"
-    )
-
-    for ref in "${candidates[@]}"; do
-        if git rev-parse --verify --quiet "$ref" >/dev/null 2>&1; then
-            echo "$ref"
-            return 0
-        fi
-    done
-
-    echo "pre-commit-safety: could not determine a base Git ref for diff (tried: ${candidates[*]})." >&2
-    echo "pre-commit-safety: ensure your repository has an upstream or a local main/master branch." >&2
-    exit 1
-}
-
-# Support both pre-commit hook (staged files) and standalone (all changed vs base)
-if git diff --cached --quiet 2>/dev/null; then
-    # No staged changes -- compare working tree against a resolved base ref
-    BASE_REF="$(resolve_base_ref)"
-    DIFF_OUTPUT=$(git diff "$BASE_REF" -- '*.rs' 2>/dev/null || true)
-else
-    DIFF_OUTPUT=$(git diff --cached -U0 -- '*.rs' 2>/dev/null || true)
-fi
-
-# Early exit if there are no relevant .rs changes
-if [ -z "$DIFF_OUTPUT" ]; then
-    exit 0
-fi
-
-WARNINGS=0
-
-warn() {
-    if [ "$WARNINGS" -eq 0 ]; then
-        echo ""
-        echo "=== Pre-commit Safety Checks ==="
-        echo ""
-    fi
-    WARNINGS=$((WARNINGS + 1))
-    echo "  [$1] $2"
-}
-
-# 1. Unsafe UTF-8 byte slicing: &s[..N] or &s[..some_var] on strings
-#    Safe patterns: is_char_boundary, char_indices, // safety:
-if echo "$DIFF_OUTPUT" | grep -nE '^\+' | grep -E '\[\.\..*\]' | grep -vE 'is_char_boundary|char_indices|// safety:|as_bytes|Vec<|&\[u8\]|\[u8\]|bytes\(\)|&bytes' | head -3 | grep -q .; then
-    warn "UTF8" "Possible unsafe byte-index string slicing. Use is_char_boundary() or char_indices()."
-    echo "$DIFF_OUTPUT" | grep -nE '^\+' | grep -E '\[\.\..*\]' | grep -vE 'is_char_boundary|char_indices|// safety:|as_bytes|Vec<|&\[u8\]|\[u8\]|bytes\(\)|&bytes' | head -3 | sed 's/^/    /'
-fi
-
-# 2. Case-sensitive file extension checks
-#    Match: .ends_with(".png") without prior to_lowercase
-if echo "$DIFF_OUTPUT" | grep -nE '^\+.*ends_with\("\.([pP][nN][gG]|[jJ][pP][eE]?[gG]|[gG][iI][fF]|[wW][eE][bB][pP]|[mM][dD])"\)' | grep -vE 'to_lowercase|to_ascii_lowercase|// safety:' | head -3 | grep -q .; then
-    warn "CASE" "Case-sensitive file extension comparison. Normalize to lowercase first."
-    echo "$DIFF_OUTPUT" | grep -nE '^\+.*ends_with\("\.([pP][nN][gG]|[jJ][pP][eE]?[gG]|[gG][iI][fF]|[wW][eE][bB][pP]|[mM][dD])"\)' | grep -vE 'to_lowercase|to_ascii_lowercase|// safety:' | head -3 | sed 's/^/    /'
-fi
-
-# 3. Hardcoded /tmp paths in test files
-if echo "$DIFF_OUTPUT" | grep -nE '^\+.*"/tmp/' | grep -vE 'tempfile|tempdir|// safety:' | head -3 | grep -q .; then
-    warn "TMPDIR" "Hardcoded /tmp path. Use tempfile::tempdir() for parallel-safe tests."
-    echo "$DIFF_OUTPUT" | grep -nE '^\+.*"/tmp/' | grep -vE 'tempfile|tempdir|// safety:' | head -3 | sed 's/^/    /'
-fi
-
-# 4. Logging tool parameters without redaction
-if echo "$DIFF_OUTPUT" | grep -nE '^\+.*tracing::(info|debug|warn|error).*param' | grep -vE 'redact|// safety:' | head -3 | grep -q .; then
-    warn "REDACT" "Logging tool parameters without redaction. Use redact_params() first."
-    echo "$DIFF_OUTPUT" | grep -nE '^\+.*tracing::(info|debug|warn|error).*param' | grep -vE 'redact|// safety:' | head -3 | sed 's/^/    /'
-fi
-
-# 5. Multi-step DB operations without transaction
-#    Uses -W (function context) to reduce false positives from existing transactions.
-#    Suppressible with "// safety:" in the hunk.
-DIFF_W_OUTPUT=$(git diff --cached -W -- '*.rs' 2>/dev/null || git diff "$(resolve_base_ref)" -W -- '*.rs' 2>/dev/null || true)
-if [ -n "$DIFF_W_OUTPUT" ]; then
-    HUNK_COUNT=$(echo "$DIFF_W_OUTPUT" | awk '
-        /^@@/ {
-            if (count >= 2 && !has_tx && !has_safety) found++
-            count=0; has_tx=0; has_safety=0
-        }
-        /^\+.*\.(execute|query)\(/ { count++ }
-        /^\+.*(transaction|\.tx\.|\.begin\()/ { has_tx=1 }
-        / .*(transaction|\.tx\.|\.begin\()/ { has_tx=1 }
-        /\/\/ safety:/ { has_safety=1 }
-        END {
-            if (count >= 2 && !has_tx && !has_safety) found++
-            print found+0
-        }
-    ')
-    if [ "$HUNK_COUNT" -gt 0 ]; then
-        warn "TX" "Multiple DB operations in same function without transaction. Wrap in a transaction for atomicity."
-        echo "$DIFF_W_OUTPUT" | awk '
-            /^@@/ {
-                if (count >= 2 && !has_tx && !has_safety) { print buf }
-                buf=""; count=0; has_tx=0; has_safety=0
-            }
-            /^\+.*\.(execute|query)\(/ { count++ }
-            /^\+.*(transaction|\.tx\.|\.begin\()/ { has_tx=1 }
-            / .*(transaction|\.tx\.|\.begin\()/ { has_tx=1 }
-            /\/\/ safety:/ { has_safety=1 }
-            { buf = buf "\n" $0 }
-            END {
-                if (count >= 2 && !has_tx && !has_safety) { print buf }
-            }
-        ' | grep -E '^\+.*\.(execute|query)\(' | head -4 | sed 's/^/    /'
-    fi
-fi
-
-if [ "$WARNINGS" -gt 0 ]; then
-    echo ""
-    echo "Found $WARNINGS potential issue(s). Fix them or add '// safety: <reason>' to suppress."
-    echo ""
-    exit 1
-fi

skills/review-checklist/SKILL.md

@@ -1,54 +0,0 @@
----
-name: review-checklist
-version: 0.1.0
-description: Pre-merge review checklist based on recurring AI reviewer feedback patterns
-activation:
-  patterns:
-    - "review.*checklist"
-    - "ready to merge"
-    - "pre-merge check"
-    - "check.*before.*merge"
-  keywords:
-    - review
-    - checklist
-    - merge
-    - pre-merge
-  max_context_tokens: 1500
----
-
-# Pre-Merge Review Checklist
-
-Before merging, verify these items. They represent the most common issues caught by automated code reviewers (Copilot, Gemini) on IronClaw PRs.
-
-## Database Operations
-- [ ] Multi-step DB operations are wrapped in transactions (INSERT+INSERT, UPDATE+DELETE, read-modify-write)
-- [ ] Both postgres AND libsql backends updated for any new Database trait methods
-- [ ] Migrations are atomic (SQL execution + version recording in same transaction)
-
-## Security & Data Safety
-- [ ] Tool parameters are redacted via `redact_params()` before logging or SSE/WebSocket broadcast
-- [ ] URL validation resolves DNS before checking for private/loopback IPs (anti-SSRF via DNS rebinding)
-- [ ] Destructive tools have `requires_approval()` returning `Always` or `UnlessAutoApproved`
-- [ ] Data from worker containers is treated as untrusted (tool domain checks, server-side nesting depth)
-- [ ] No secrets or credentials in error messages, logs, or SSE events
-
-## String Safety
-- [ ] No byte-index slicing (`&s[..n]`) on external/user strings -- use `is_char_boundary()` or `char_indices()`
-- [ ] File extension and media type comparisons are case-insensitive (`.to_ascii_lowercase()` before matching)
-- [ ] Path comparisons are case-insensitive where needed (macOS/Windows filesystems)
-
-## Trait Wrappers & Decorator Chain
-- [ ] New `LlmProvider` trait methods are delegated in ALL wrapper types (grep `impl LlmProvider for`)
-- [ ] New trait methods are tested through the full decorator/provider chain, not just the base impl
-- [ ] Default trait method implementations are intentional -- wrappers that silently return defaults are bugs
-
-## Tests
-- [ ] Temporary files/dirs use `tempfile` crate, no hardcoded `/tmp/` paths
-- [ ] Tests don't mutate global statics without synchronization (use per-test state or `serial_test`)
-- [ ] Tests don't make real network requests (use mocks, stubs, or RFC 5737 TEST-NET IPs like 192.0.2.1)
-- [ ] Test names and comments match actual test behavior and assertions
-
-## Comments & Documentation
-- [ ] Code comments match actual behavior (especially route paths, tool names, function semantics)
-- [ ] Spec/README files updated if module behavior changed
-- [ ] Error messages are clear and non-redundant (don't nest tool name inside tool error that already contains it)

src/agent/CLAUDE.md

@@ -1,171 +0,0 @@
-# Agent Module
-
-Core agent logic. This is the most complex subsystem — read this before working in `src/agent/`.
-
-## Module Map
-
-| File | Role |
-|------|------|
-| `agent_loop.rs` | `Agent` struct, `AgentDeps`, main `run()` event loop. Delegates to siblings. |
-| `dispatcher.rs` | Agentic loop for conversational turns: LLM call → tool execution → repeat. Injects skill context. Returns `Response` or `NeedApproval`. |
-| `thread_ops.rs` | Thread/session operations: `process_user_input`, undo/redo, approval, auth-mode interception, DB hydration, compaction. |
-| `commands.rs` | System command handlers (`/help`, `/model`, `/status`, `/skills`, etc.) and job intent handlers. |
-| `session.rs` | Data model: `Session` → `Thread` → `Turn`. State machines for threads and turns. |
-| `session_manager.rs` | Lifecycle: create/lookup sessions, map external thread IDs to internal UUIDs, prune stale sessions, manage undo managers. |
-| `router.rs` | Routes explicit `/commands` to `MessageIntent`. Natural language bypasses the router entirely. |
-| `scheduler.rs` | Parallel job scheduling. Maintains `jobs` map (full LLM-driven) and `subtasks` map (tool-exec/background). |
-| `worker.rs` | Per-job execution for background scheduler jobs: calls LLM, runs tools, handles the reasoning loop. Distinct from `dispatcher.rs`. |
-| `compaction.rs` | Context window management: summarize old turns, write to workspace daily log, trim context. Three strategies. |
-| `context_monitor.rs` | Detects memory pressure. Suggests `CompactionStrategy` based on usage level. |
-| `self_repair.rs` | Detects stuck jobs and broken tools, attempts recovery. |
-| `heartbeat.rs` | Proactive periodic execution. Reads `HEARTBEAT.md`, notifies via channel if findings. |
-| `submission.rs` | Parses all user submissions into typed variants before routing. |
-| `undo.rs` | Turn-based undo/redo with checkpoints. Checkpoints store message lists (max 20 by default). |
-| `routine.rs` | `Routine` types: `Trigger` (cron/event/webhook/manual) + `RoutineAction` (lightweight/full_job) + `RoutineGuardrails`. |
-| `routine_engine.rs` | Cron ticker and event matcher. Fires routines when triggers match. Lightweight runs inline; full_job dispatches to `Scheduler`. |
-| `task.rs` | Task types for the scheduler: `Job`, `ToolExec`, `Background`. Used by `spawn_subtask` and `spawn_batch`. |
-| `cost_guard.rs` | LLM spend and action-rate enforcement. Tracks daily budget (cents) and hourly call rate. Lives in `AgentDeps`. |
-| `job_monitor.rs` | Subscribes to SSE broadcast and injects Claude Code (container) output back into the agent loop as `IncomingMessage`. |
-
-## Session / Thread / Turn Model
-
-```
-Session (per user)
-└── Thread (per conversation — can have many)
-    └── Turn (per request/response pair)
-        ├── user_input: String
-        ├── response: Option<String>
-        ├── tool_calls: Vec<ToolCall>
-        └── state: TurnState (Pending | Running | Complete | Failed)
-```
-
-- A session has one **active thread** at a time; threads can be switched.
-- Turns are append-only. Undo rolls back by restoring a prior checkpoint (message list, not a full thread snapshot).
-- `UndoManager` is per-thread, stored in `SessionManager`, not on `Session` itself. Max 20 checkpoints (oldest dropped when exceeded).
-- Group chat detection: if `metadata.chat_type` is `group`/`channel`/`supergroup`, `MEMORY.md` is excluded from the system prompt to prevent leaking personal context.
-- **Auth mode**: if a thread has `pending_auth` set (e.g. from `tool_auth` returning `awaiting_token`), the next user message is intercepted before any turn creation, logging, or safety validation and sent directly to the credential store. Any control submission (undo, interrupt, etc.) cancels auth mode.
-- `ThreadState` values: `Idle`, `Processing`, `AwaitingApproval`, `Completed`, `Interrupted`.
-- `SessionManager` maps `(user_id, channel, external_thread_id)` → internal UUID. Prunes idle sessions every 10 minutes (warns at 1000 sessions).
-
-## Agentic Loop (dispatcher.rs)
-
-The `dispatcher.rs` module handles **direct conversational turns** (user messages processed inline by the main agent). Background scheduler jobs use `worker.rs` instead — these are two separate execution paths.
-
-```
-run_agentic_loop()  [dispatcher.rs — conversational turns]
-  1. Load workspace system prompt (identity files: AGENTS.md, SOUL.md, etc.)
-  2. Detect group chat from metadata; exclude MEMORY.md if group chat
-  3. Select active skills (keyword/pattern scoring against message content)
-  4. Build skill context block (injected before user message)
-  5. LLM call → text response OR tool calls
-  6. If tool calls:
-     a. Check tool approval (session auto-approvals, pending approval queue)
-     b. Execute tools (parallel via JoinSet)
-     c. Sanitize results through SafetyLayer
-     d. Feed results back → goto 5
-  7. Return AgenticLoopResult::Response or NeedApproval
-```
-
-**Tool approval:** Tools flagged `requires_approval` pause the loop and return `NeedApproval`. The web gateway stores the `PendingApproval` in session state and sends an `approval_needed` SSE event. The user's approval/deny resumes the loop.
-
-**worker.rs vs dispatcher.rs:** `dispatcher.rs` runs the agentic loop for user-initiated conversational turns (holds session lock, tracks turns). `worker.rs` is spawned by the `Scheduler` for background jobs created via `CreateJob` / `/job` — it runs independently of the session and has its own LLM reasoning loop with planning support (`use_planning` flag).
-
-## Command Routing (router.rs)
-
-The `Router` handles explicit `/commands` (prefix `/`). It parses them into `MessageIntent` variants: `CreateJob`, `CheckJobStatus`, `CancelJob`, `ListJobs`, `HelpJob`, `Command`. Natural language messages bypass the router entirely — they go directly to `dispatcher.rs` via `process_user_input`. Note: most user-facing commands (undo, compact, etc.) are handled by `SubmissionParser` before the router runs, so `Router` only sees unrecognized `/xxx` patterns that haven't already been claimed by `submission.rs`.
-
-## Compaction
-
-Triggered by `ContextMonitor` when token usage approaches the model's context limit.
-
-**Token estimation**: Word-count × 1.3 + 4 overhead per message. Default context limit: 100,000 tokens. Compaction threshold: 80% (configurable).
-
-Three strategies, chosen by `ContextMonitor.suggest_compaction()` based on usage ratio:
-- **MoveToWorkspace** — Writes full turn transcript to workspace daily log, keeps 10 recent turns. Used when usage is 80–85% (moderate). Falls back to `Truncate(5)` if no workspace.
-- **Summarize** (`keep_recent: N`) — LLM generates a summary of old turns, writes it to workspace daily log (`daily/YYYY-MM-DD.md`), removes old turns. Used when usage is 85–95%.
-- **Truncate** (`keep_recent: N`) — Removes oldest turns without summarization (fast path). Used when usage >95% (critical).
-
-If the LLM call for summarization fails, the error propagates — turns are **not** truncated on failure.
-
-Manual trigger: user sends `/compact` (parsed by `submission.rs`).
-
-## Scheduler
-
-`Scheduler` maintains two maps under `Arc<RwLock<HashMap>>`:
-- `jobs` — full LLM-driven jobs, each with a `Worker` and an `mpsc` channel for `WorkerMessage` (`Start`, `Stop`, `Ping`, `UserMessage`).
-- `subtasks` — lightweight `ToolExec` or `Background` tasks spawned via `spawn_subtask()` / `spawn_batch()`.
-
-**Preferred entry point**: `dispatch_job()` — creates context, optionally sets metadata, persists to DB (so FK references from `job_actions`/`llm_calls` are valid immediately), then calls `schedule()`. Don't call `schedule()` directly unless you've already persisted.
-
-Check-insert is done under a single write lock to prevent TOCTOU races. A cleanup task polls every second for job completion and removes the entry from the map.
-
-`spawn_subtask()` returns a `oneshot::Receiver` — callers must await it to get the result. `spawn_batch()` runs all tasks concurrently and returns results in input order.
-
-## Self-Repair
-
-`DefaultSelfRepair` runs on `repair_check_interval` (from `AgentConfig`). It:
-1. Calls `ContextManager::find_stuck_jobs()` to find jobs in `JobState::Stuck`.
-2. Attempts `ctx.attempt_recovery()` (transitions back to `InProgress`).
-3. Returns `ManualRequired` if `repair_attempts >= max_repair_attempts`.
-4. Detects broken tools via `store.get_broken_tools(5)` (threshold: 5 failures). Requires `with_store()` to be called; returns empty without a store.
-5. Attempts to rebuild broken tools via `SoftwareBuilder`. Requires `with_builder()` to be called; returns `ManualRequired` without a builder.
-
-Note: the `stuck_threshold` duration is stored but currently unused (marked `#[allow(dead_code)]`). Stuck detection relies on `JobState::Stuck` being set by the state machine, not wall-clock time comparison.
-
-Repair results: `Success`, `Retry`, `Failed`, `ManualRequired`. `Retry` does NOT notify the user (to avoid spam).
-
-## Key Invariants
-
-- Never call `.unwrap()` or `.expect()` — use `?` with proper error mapping.
-- All state mutations on `Session`/`Thread` happen under `Arc<Mutex<Session>>` lock.
-- The agent loop is single-threaded per thread; parallel execution happens at the job/scheduler level.
-- Skills are selected **deterministically** (no LLM call) — see `skills/selector.rs`.
-- Tool results pass through `SafetyLayer` before returning to LLM (sanitizer → validator → policy → leak detector).
-- `SessionManager` uses double-checked locking for session creation. Read lock first (fast path), then write lock with re-check to prevent duplicate sessions.
-- `Scheduler.schedule()` holds the write lock for the entire check-insert sequence — don't hold any other locks when calling it.
-- `cheap_llm` in `AgentDeps` is used for heartbeat and other lightweight tasks. Falls back to main `llm` if `None`. Use `agent.cheap_llm()` accessor, not `deps.cheap_llm` directly.
-- `CostGuard.check_allowed()` must be called **before** LLM calls; `record_llm_call()` must be called **after**. Both calls are separate — the guard does not auto-record.
-- `BeforeInbound` and `BeforeOutbound` hooks run for every user message and agent response respectively. Hooks can modify content or reject. Hook errors are logged but **fail-open** (processing continues).
-
-## Complete Submission Command Reference
-
-All commands parsed by `SubmissionParser::parse()`:
-
-| Input | Variant | Notes |
-|-------|---------|-------|
-| `/undo` | `Undo` | |
-| `/redo` | `Redo` | |
-| `/interrupt`, `/stop` | `Interrupt` | |
-| `/compact` | `Compact` | |
-| `/clear` | `Clear` | |
-| `/heartbeat` | `Heartbeat` | |
-| `/summarize`, `/summary` | `Summarize` | |
-| `/suggest` | `Suggest` | |
-| `/new`, `/thread new` | `NewThread` | |
-| `/thread <uuid>` | `SwitchThread` | Must be valid UUID |
-| `/resume <uuid>` | `Resume` | Must be valid UUID |
-| `/status [id]`, `/progress [id]`, `/list` | `JobStatus` | `/list` = all jobs |
-| `/cancel <id>` | `JobCancel` | |
-| `/quit`, `/exit`, `/shutdown` | `Quit` | |
-| `yes/y/approve/ok` and aliases | `ApprovalResponse { approved: true, always: false }` | |
-| `always/a` and aliases | `ApprovalResponse { approved: true, always: true }` | |
-| `no/n/deny/reject/cancel` and aliases | `ApprovalResponse { approved: false }` | |
-| JSON `ExecApproval{...}` | `ExecApproval` | From web gateway approval endpoint |
-| `/help`, `/?` | `SystemCommand { "help" }` | Bypasses thread-state checks |
-| `/version` | `SystemCommand { "version" }` | |
-| `/tools` | `SystemCommand { "tools" }` | |
-| `/skills [search <q>]` | `SystemCommand { "skills" }` | |
-| `/ping` | `SystemCommand { "ping" }` | |
-| `/debug` | `SystemCommand { "debug" }` | |
-| `/model [name]` | `SystemCommand { "model" }` | |
-| Everything else | `UserInput` | Starts a new agentic turn |
-
-**`SystemCommand` vs control**: `SystemCommand` variants bypass thread-state checks entirely (no session lock, no turn creation). `Quit` returns `Ok(None)` from `handle_message` which breaks the main loop.
-
-## Adding a New Submission Command
-
-Submissions are special messages parsed in `submission.rs` before the agentic loop runs. To add a new one:
-1. Add a variant to `Submission` enum in `submission.rs`
-2. Add parsing in `SubmissionParser::parse()`
-3. Handle in `agent_loop.rs` where `SubmissionResult` is matched (the `match submission { ... }` block in `handle_message`)
-4. Implement the handler method (usually in `thread_ops.rs` for session operations, or `commands.rs` for system commands)

src/agent/agent_loop.rs

@@ -77,10 +77,6 @@ pub struct AgentDeps {
     pub sse_tx: Option<tokio::sync::broadcast::Sender<crate::channels::web::types::SseEvent>>,
     /// HTTP interceptor for trace recording/replay.
     pub http_interceptor: Option<Arc<dyn crate::llm::recording::HttpInterceptor>>,
-    /// Audio transcription middleware for voice messages.
-    pub transcription: Option<Arc<crate::transcription::TranscriptionMiddleware>>,
-    /// Document text extraction middleware for PDF, DOCX, PPTX, etc.
-    pub document_extraction: Option<Arc<crate::document_extraction::DocumentExtractionMiddleware>>,
 }
 
 /// The main agent that coordinates all components.
@@ -96,9 +92,6 @@ pub struct Agent {
     pub(super) heartbeat_config: Option<HeartbeatConfig>,
     pub(super) hygiene_config: Option<crate::config::HygieneConfig>,
     pub(super) routine_config: Option<RoutineConfig>,
-    /// Optional slot to expose the routine engine to the gateway for manual triggering.
-    pub(super) routine_engine_slot:
-        Option<Arc<tokio::sync::RwLock<Option<Arc<crate::agent::routine_engine::RoutineEngine>>>>>,
 }
 
 impl Agent {
@@ -134,9 +127,6 @@ impl Agent {
         if let Some(ref tx) = deps.sse_tx {
             scheduler.set_sse_sender(tx.clone());
         }
-        if let Some(ref interceptor) = deps.http_interceptor {
-            scheduler.set_http_interceptor(Arc::clone(interceptor));
-        }
         let scheduler = Arc::new(scheduler);
 
         Self {
@@ -151,18 +141,9 @@ impl Agent {
             heartbeat_config,
             hygiene_config,
             routine_config,
-            routine_engine_slot: None,
         }
     }
 
-    /// Set the routine engine slot for exposing the engine to the gateway.
-    pub fn set_routine_engine_slot(
-        &mut self,
-        slot: Arc<tokio::sync::RwLock<Option<Arc<crate::agent::routine_engine::RoutineEngine>>>>,
-    ) {
-        self.routine_engine_slot = Some(slot);
-    }
-
     // Convenience accessors
 
     /// Get the scheduler (for external wiring, e.g. CreateJobTool).
@@ -354,19 +335,8 @@ impl Agent {
         let heartbeat_handle = if let Some(ref hb_config) = self.heartbeat_config {
             if hb_config.enabled {
                 if let Some(workspace) = self.workspace() {
-                    let mut config = AgentHeartbeatConfig::default()
+                    let config = AgentHeartbeatConfig::default()
                         .with_interval(std::time::Duration::from_secs(hb_config.interval_secs));
-                    config.quiet_hours_start = hb_config.quiet_hours_start;
-                    config.quiet_hours_end = hb_config.quiet_hours_end;
-                    config.timezone = hb_config
-                        .timezone
-                        .clone()
-                        .or_else(|| Some(self.config.default_timezone.clone()));
-                    if let (Some(user), Some(channel)) =
-                        (&hb_config.notify_user, &hb_config.notify_channel)
-                    {
-                        config = config.with_notify(user, channel);
-                    }
 
                     // Set up notification channel
                     let (notify_tx, mut notify_rx) =
@@ -417,8 +387,8 @@ impl Agent {
                         hygiene,
                         workspace.clone(),
                         self.cheap_llm().clone(),
+                        self.safety().clone(),
                         Some(notify_tx),
-                        self.store().map(Arc::clone),
                     ))
                 } else {
                     tracing::warn!("Heartbeat enabled but no workspace available");
@@ -509,11 +479,6 @@ impl Agent {
                     // SAFETY: self is consumed by run(), we can smuggle the engine in
                     // via a local to use in the message loop below.
 
-                    // Expose engine to gateway for manual triggering
-                    if let Some(ref slot) = self.routine_engine_slot {
-                        *slot.write().await = Some(Arc::clone(&engine));
-                    }
-
                     tracing::info!(
                         "Routines enabled: cron ticker every {}s, max {} concurrent",
                         rt_config.cron_check_interval_secs,
@@ -556,20 +521,6 @@ impl Agent {
                 }
             };
 
-            // Apply transcription middleware to audio attachments
-            let mut message = message;
-            if let Some(ref transcription) = self.deps.transcription {
-                transcription.process(&mut message).await;
-            }
-
-            // Apply document extraction middleware to document attachments
-            if let Some(ref doc_extraction) = self.deps.document_extraction {
-                doc_extraction.process(&mut message).await;
-            }
-
-            // Store successfully extracted document text in workspace for indexing
-            self.store_extracted_documents(&message).await;
-
             match self.handle_message(&message).await {
                 Ok(Some(response)) if !response.is_empty() => {
                     // Hook: BeforeOutbound — allow hooks to modify or suppress outbound
@@ -668,73 +619,6 @@ impl Agent {
         Ok(())
     }
 
-    /// Store extracted document text in workspace memory for future search/recall.
-    async fn store_extracted_documents(&self, message: &IncomingMessage) {
-        let workspace = match self.workspace() {
-            Some(ws) => ws,
-            None => return,
-        };
-
-        for attachment in &message.attachments {
-            if attachment.kind != crate::channels::AttachmentKind::Document {
-                continue;
-            }
-            let text = match &attachment.extracted_text {
-                Some(t) if !t.starts_with('[') => t, // skip error messages like "[Failed to..."
-                _ => continue,
-            };
-
-            // Sanitize filename: strip path separators to prevent directory traversal
-            let raw_name = attachment.filename.as_deref().unwrap_or("unnamed_document");
-            let filename: String = raw_name
-                .chars()
-                .map(|c| {
-                    if c == '/' || c == '\\' || c == '\0' {
-                        '_'
-                    } else {
-                        c
-                    }
-                })
-                .collect();
-            let filename = filename.trim_start_matches('.');
-            let filename = if filename.is_empty() {
-                "unnamed_document"
-            } else {
-                filename
-            };
-            let date = chrono::Utc::now().format("%Y-%m-%d");
-            let path = format!("documents/{date}/{filename}");
-
-            let header = format!(
-                "# {filename}\n\n\
-                 > Uploaded by **{}** via **{}** on {date}\n\
-                 > MIME: {} | Size: {} bytes\n\n---\n\n",
-                message.user_id,
-                message.channel,
-                attachment.mime_type,
-                attachment.size_bytes.unwrap_or(0),
-            );
-            let content = format!("{header}{text}");
-
-            match workspace.write(&path, &content).await {
-                Ok(_) => {
-                    tracing::info!(
-                        path = %path,
-                        text_len = text.len(),
-                        "Stored extracted document in workspace memory"
-                    );
-                }
-                Err(e) => {
-                    tracing::warn!(
-                        path = %path,
-                        error = %e,
-                        "Failed to store extracted document in workspace"
-                    );
-                }
-            }
-        }
-    }
-
     async fn handle_message(&self, message: &IncomingMessage) -> Result<Option<String>, Error> {
         // Set message tool context for this turn (current channel and target)
         // For Signal, use signal_target from metadata (group:ID or phone number),

src/agent/attachments.rs

@@ -1,307 +0,0 @@
-//! Augment user message content with structured attachment context.
-
-use base64::Engine;
-
-use crate::channels::{AttachmentKind, IncomingAttachment};
-use crate::llm::{ContentPart, ImageUrl};
-
-/// Result of processing attachments for the LLM pipeline.
-pub struct AugmentResult {
-    /// Augmented text content with attachment metadata appended.
-    pub text: String,
-    /// Image content parts to include as multimodal input.
-    pub image_parts: Vec<ContentPart>,
-}
-
-/// Process attachments into augmented text and multimodal image parts.
-///
-/// Returns `None` if `attachments` is empty (caller should use original content).
-/// Returns `Some(AugmentResult)` with:
-/// - `text`: original content + `<attachments>` block (metadata, transcripts, etc.)
-/// - `image_parts`: `ContentPart::ImageUrl` entries for images with data
-pub fn augment_with_attachments(
-    content: &str,
-    attachments: &[IncomingAttachment],
-) -> Option<AugmentResult> {
-    if attachments.is_empty() {
-        return None;
-    }
-
-    let mut text = content.to_string();
-    text.push_str("\n\n<attachments>");
-
-    let mut image_parts = Vec::new();
-
-    for (i, att) in attachments.iter().enumerate() {
-        text.push('\n');
-        text.push_str(&format_attachment(i + 1, att));
-
-        // Build multimodal image part when image data is available
-        if att.kind == AttachmentKind::Image && !att.data.is_empty() {
-            let b64 = base64::engine::general_purpose::STANDARD.encode(&att.data);
-            let data_url = format!("data:{};base64,{}", att.mime_type, b64);
-            image_parts.push(ContentPart::ImageUrl {
-                image_url: ImageUrl {
-                    url: data_url,
-                    detail: None,
-                },
-            });
-        }
-    }
-
-    text.push_str("\n</attachments>");
-    Some(AugmentResult { text, image_parts })
-}
-
-/// Escape a string for use as an XML attribute value.
-fn escape_xml_attr(s: &str) -> String {
-    s.replace('&', "&amp;")
-        .replace('"', "&quot;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
-}
-
-/// Escape a string for use as XML text content.
-fn escape_xml_text(s: &str) -> String {
-    s.replace('&', "&amp;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
-}
-
-fn format_attachment(index: usize, att: &IncomingAttachment) -> String {
-    let filename = escape_xml_attr(att.filename.as_deref().unwrap_or("unknown"));
-    let mime = escape_xml_attr(&att.mime_type);
-
-    match &att.kind {
-        AttachmentKind::Audio => {
-            let duration_attr = att
-                .duration_secs
-                .map(|d| format!(" duration=\"{d}s\""))
-                .unwrap_or_default();
-
-            let body = match &att.extracted_text {
-                Some(text) => format!("Transcript: {}", escape_xml_text(text)),
-                None => "Audio transcript unavailable.".to_string(),
-            };
-
-            format!(
-                "<attachment index=\"{index}\" type=\"audio\" filename=\"{filename}\"{duration_attr}>\n\
-                 {body}\n\
-                 </attachment>"
-            )
-        }
-        AttachmentKind::Image => {
-            let size_attr = att
-                .size_bytes
-                .map(|s| format!(" size=\"{}\"", format_size(s)))
-                .unwrap_or_default();
-
-            let body = if att.data.is_empty() {
-                "[Image attached — visual content not available in this conversation]"
-            } else {
-                "[Image attached — sent as visual content]"
-            };
-
-            format!(
-                "<attachment index=\"{index}\" type=\"image\" filename=\"{filename}\" mime=\"{mime}\"{size_attr}>\n\
-                 {body}\n\
-                 </attachment>"
-            )
-        }
-        AttachmentKind::Document => {
-            let body: String = match &att.extracted_text {
-                Some(text) => escape_xml_text(text),
-                None => {
-                    let size_info = att
-                        .size_bytes
-                        .map(|s| format!(" size=\"{}\"", format_size(s)))
-                        .unwrap_or_default();
-                    return format!(
-                        "<attachment index=\"{index}\" type=\"document\" filename=\"{filename}\" mime=\"{mime}\"{size_info}>\n\
-                         [Document attached — text extraction unavailable]\n\
-                         </attachment>"
-                    );
-                }
-            };
-
-            let size_attr = att
-                .size_bytes
-                .map(|s| format!(" size=\"{}\"", format_size(s)))
-                .unwrap_or_default();
-
-            format!(
-                "<attachment index=\"{index}\" type=\"document\" filename=\"{filename}\" mime=\"{mime}\"{size_attr}>\n\
-                 {body}\n\
-                 </attachment>"
-            )
-        }
-    }
-}
-
-fn format_size(bytes: u64) -> String {
-    if bytes < 1024 {
-        format!("{bytes}B")
-    } else if bytes < 1024 * 1024 {
-        format!("{}KB", bytes / 1024)
-    } else {
-        format!("{:.1}MB", bytes as f64 / (1024.0 * 1024.0))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn make_attachment(kind: AttachmentKind) -> IncomingAttachment {
-        IncomingAttachment {
-            id: "test-id".to_string(),
-            kind,
-            mime_type: "application/octet-stream".to_string(),
-            filename: None,
-            size_bytes: None,
-            source_url: None,
-            storage_key: None,
-            extracted_text: None,
-            data: vec![],
-            duration_secs: None,
-        }
-    }
-
-    #[test]
-    fn empty_attachments_returns_none() {
-        assert!(augment_with_attachments("hello", &[]).is_none());
-    }
-
-    #[test]
-    fn audio_with_transcript() {
-        let mut att = make_attachment(AttachmentKind::Audio);
-        att.filename = Some("voice.ogg".to_string());
-        att.extracted_text = Some("Hello, can you help me?".to_string());
-        att.duration_secs = Some(5);
-
-        let result = augment_with_attachments("hi", &[att]).unwrap();
-        assert!(result.text.starts_with("hi\n\n<attachments>"));
-        assert!(result.text.contains("type=\"audio\""));
-        assert!(result.text.contains("filename=\"voice.ogg\""));
-        assert!(result.text.contains("duration=\"5s\""));
-        assert!(result.text.contains("Transcript: Hello, can you help me?"));
-        assert!(result.text.ends_with("</attachments>"));
-        assert!(result.image_parts.is_empty());
-    }
-
-    #[test]
-    fn audio_without_transcript() {
-        let mut att = make_attachment(AttachmentKind::Audio);
-        att.filename = Some("voice.ogg".to_string());
-        att.duration_secs = Some(10);
-
-        let result = augment_with_attachments("hi", &[att]).unwrap();
-        assert!(result.text.contains("Audio transcript unavailable."));
-        assert!(result.text.contains("duration=\"10s\""));
-    }
-
-    #[test]
-    fn image_without_data_no_visual() {
-        let mut att = make_attachment(AttachmentKind::Image);
-        att.filename = Some("screenshot.png".to_string());
-        att.mime_type = "image/png".to_string();
-        att.size_bytes = Some(245_000);
-
-        let result = augment_with_attachments("check this", &[att]).unwrap();
-        assert!(result.text.contains("type=\"image\""));
-        assert!(result.text.contains("filename=\"screenshot.png\""));
-        assert!(result.text.contains("mime=\"image/png\""));
-        assert!(result.text.contains("size=\"239KB\""));
-        assert!(
-            result
-                .text
-                .contains("[Image attached — visual content not available in this conversation]")
-        );
-        assert!(result.image_parts.is_empty());
-    }
-
-    #[test]
-    fn image_with_data_produces_content_part() {
-        let mut att = make_attachment(AttachmentKind::Image);
-        att.filename = Some("photo.jpg".to_string());
-        att.mime_type = "image/jpeg".to_string();
-        att.data = vec![0xFF, 0xD8, 0xFF]; // fake JPEG header
-
-        let result = augment_with_attachments("look", &[att]).unwrap();
-        assert!(
-            result
-                .text
-                .contains("[Image attached — sent as visual content]")
-        );
-        assert_eq!(result.image_parts.len(), 1);
-        match &result.image_parts[0] {
-            ContentPart::ImageUrl { image_url } => {
-                assert!(image_url.url.starts_with("data:image/jpeg;base64,"));
-            }
-            other => panic!("Expected ImageUrl, got: {:?}", other),
-        }
-    }
-
-    #[test]
-    fn document_with_extracted_text() {
-        let mut att = make_attachment(AttachmentKind::Document);
-        att.filename = Some("report.pdf".to_string());
-        att.extracted_text = Some("Executive summary: Q3 results".to_string());
-
-        let result = augment_with_attachments("review", &[att]).unwrap();
-        assert!(result.text.contains("type=\"document\""));
-        assert!(result.text.contains("filename=\"report.pdf\""));
-        assert!(result.text.contains("Executive summary: Q3 results"));
-    }
-
-    #[test]
-    fn document_without_extracted_text() {
-        let mut att = make_attachment(AttachmentKind::Document);
-        att.filename = Some("data.csv".to_string());
-        att.mime_type = "text/csv".to_string();
-        att.size_bytes = Some(1024);
-
-        let result = augment_with_attachments("analyze", &[att]).unwrap();
-        assert!(result.text.contains("type=\"document\""));
-        assert!(result.text.contains("mime=\"text/csv\""));
-        assert!(
-            result
-                .text
-                .contains("[Document attached — text extraction unavailable]")
-        );
-    }
-
-    #[test]
-    fn multiple_attachments_with_mixed_images() {
-        let mut audio = make_attachment(AttachmentKind::Audio);
-        audio.filename = Some("voice.ogg".to_string());
-        audio.extracted_text = Some("Hello".to_string());
-
-        let mut image_with_data = make_attachment(AttachmentKind::Image);
-        image_with_data.filename = Some("photo.jpg".to_string());
-        image_with_data.mime_type = "image/jpeg".to_string();
-        image_with_data.data = vec![0xFF, 0xD8];
-
-        let mut image_no_data = make_attachment(AttachmentKind::Image);
-        image_no_data.filename = Some("remote.png".to_string());
-        image_no_data.mime_type = "image/png".to_string();
-
-        let result =
-            augment_with_attachments("msg", &[audio, image_with_data, image_no_data]).unwrap();
-        assert!(result.text.contains("index=\"1\""));
-        assert!(result.text.contains("index=\"2\""));
-        assert!(result.text.contains("index=\"3\""));
-        // Only the image with data produces a content part
-        assert_eq!(result.image_parts.len(), 1);
-    }
-
-    #[test]
-    fn original_content_preserved() {
-        let original = "Please help me with this task";
-        let mut att = make_attachment(AttachmentKind::Audio);
-        att.extracted_text = Some("transcript".to_string());
-
-        let result = augment_with_attachments(original, &[att]).unwrap();
-        assert!(result.text.starts_with(original));
-    }
-}

src/agent/commands.rs

@@ -345,6 +345,7 @@ impl Agent {
             crate::workspace::hygiene::HygieneConfig::default(),
             workspace.clone(),
             self.llm().clone(),
+            self.safety().clone(),
         );
 
         match runner.check_heartbeat().await {
@@ -405,7 +406,7 @@ impl Agent {
             .with_max_tokens(512)
             .with_temperature(0.3);
 
-        let reasoning = Reasoning::new(self.llm().clone());
+        let reasoning = Reasoning::new(self.llm().clone(), self.safety().clone());
         match reasoning.complete(request).await {
             Ok((text, _usage)) => Ok(SubmissionResult::response(format!(
                 "Thread Summary:\n\n{}",
@@ -453,7 +454,7 @@ impl Agent {
             .with_max_tokens(512)
             .with_temperature(0.5);
 
-        let reasoning = Reasoning::new(self.llm().clone());
+        let reasoning = Reasoning::new(self.llm().clone(), self.safety().clone());
         match reasoning.complete(request).await {
             Ok((text, _usage)) => Ok(SubmissionResult::response(format!(
                 "Suggested Next Steps:\n\n{}",
@@ -662,14 +663,10 @@ impl Agent {
                     }
 
                     match self.llm().set_model(requested) {
-                        Ok(()) => {
-                            // Persist the model choice so it survives restarts.
-                            self.persist_selected_model(requested).await;
-                            Ok(SubmissionResult::response(format!(
-                                "Switched model to: {}",
-                                requested
-                            )))
-                        }
+                        Ok(()) => Ok(SubmissionResult::response(format!(
+                            "Switched model to: {}",
+                            requested
+                        ))),
                         Err(e) => Ok(SubmissionResult::error(format!(
                             "Failed to switch model: {}",
                             e
@@ -825,42 +822,4 @@ impl Agent {
             _ => Ok(None),
         }
     }
-
-    /// Persist the selected model to the settings store (DB and/or TOML config).
-    ///
-    /// Best-effort: logs warnings on failure but does not propagate errors,
-    /// since the in-memory model switch already succeeded.
-    async fn persist_selected_model(&self, model: &str) {
-        // 1. Persist to DB if available.
-        if let Some(store) = self.store() {
-            let value = serde_json::Value::String(model.to_string());
-            if let Err(e) = store.set_setting("default", "selected_model", &value).await {
-                tracing::warn!("Failed to persist model to DB: {}", e);
-            }
-        }
-
-        // 2. Update TOML config file if it exists (sync I/O in spawn_blocking).
-        let model_owned = model.to_string();
-        if let Err(e) = tokio::task::spawn_blocking(move || {
-            let toml_path = crate::settings::Settings::default_toml_path();
-            match crate::settings::Settings::load_toml(&toml_path) {
-                Ok(Some(mut settings)) => {
-                    settings.selected_model = Some(model_owned);
-                    if let Err(e) = settings.save_toml(&toml_path) {
-                        tracing::warn!("Failed to persist model to config.toml: {}", e);
-                    }
-                }
-                Ok(None) => {
-                    // No config file on disk; nothing to update.
-                }
-                Err(e) => {
-                    tracing::warn!("Failed to load config.toml for model persistence: {}", e);
-                }
-            }
-        })
-        .await
-        {
-            tracing::warn!("Model TOML persistence task failed: {}", e);
-        }
-    }
 }

src/agent/compaction.rs

@@ -13,6 +13,7 @@ use crate::agent::context_monitor::{CompactionStrategy, ContextBreakdown};
 use crate::agent::session::Thread;
 use crate::error::Error;
 use crate::llm::{ChatMessage, CompletionRequest, LlmProvider, Reasoning};
+use crate::safety::SafetyLayer;
 use crate::workspace::Workspace;
 
 /// Result of a compaction operation.
@@ -33,12 +34,13 @@ pub struct CompactionResult {
 /// Compacts conversation context to stay within limits.
 pub struct ContextCompactor {
     llm: Arc<dyn LlmProvider>,
+    safety: Arc<SafetyLayer>,
 }
 
 impl ContextCompactor {
     /// Create a new context compactor.
-    pub fn new(llm: Arc<dyn LlmProvider>) -> Self {
-        Self { llm }
+    pub fn new(llm: Arc<dyn LlmProvider>, safety: Arc<SafetyLayer>) -> Self {
+        Self { llm, safety }
     }
 
     /// Compact a thread's context using the given strategy.
@@ -231,7 +233,7 @@ Be brief but capture all important details. Use bullet points."#,
             .with_max_tokens(1024)
             .with_temperature(0.3);
 
-        let reasoning = Reasoning::new(self.llm.clone());
+        let reasoning = Reasoning::new(self.llm.clone(), self.safety.clone());
         let (text, _) = reasoning.complete(request).await?;
         Ok(text)
     }
@@ -344,11 +346,17 @@ mod tests {
     // === QA Plan - Compaction strategy tests ===
 
     use crate::agent::context_monitor::CompactionStrategy;
+    use crate::config::SafetyConfig;
+    use crate::safety::SafetyLayer;
     use crate::testing::StubLlm;
 
     /// Helper: build a `ContextCompactor` with the given `StubLlm`.
     fn make_compactor(llm: Arc<StubLlm>) -> ContextCompactor {
-        ContextCompactor::new(llm)
+        let safety = Arc::new(SafetyLayer::new(&SafetyConfig {
+            max_output_length: 100_000,
+            injection_check_enabled: false,
+        }));
+        ContextCompactor::new(llm, safety)
     }
 
     /// Helper: build a thread with `n` completed turns.

src/agent/cost_guard.rs

@@ -131,12 +131,10 @@ impl CostGuard {
         // Check hourly rate
         if let Some(limit) = self.config.max_actions_per_hour {
             let mut window = self.action_window.lock().await;
-            // checked_sub avoids panic when system uptime < 1 hour (Windows)
-            if let Some(cutoff) = Instant::now().checked_sub(std::time::Duration::from_secs(3600)) {
-                // Drain expired entries
-                while window.front().is_some_and(|t| *t < cutoff) {
-                    window.pop_front();
-                }
+            let cutoff = Instant::now() - std::time::Duration::from_secs(3600);
+            // Drain expired entries
+            while window.front().is_some_and(|t| *t < cutoff) {
+                window.pop_front();
             }
             let count = window.len() as u64;
             if count >= limit {
@@ -153,46 +151,21 @@ impl CostGuard {
     /// Record a completed LLM action: its token costs and the action timestamp.
     ///
     /// Call this AFTER an LLM call completes so that costs are tracked.
-    /// - `cache_read_input_tokens`: tokens served from cache.
-    /// - `cache_creation_input_tokens`: tokens written to cache.
-    /// - `cache_read_discount`: divisor for cache-read cost (e.g. 10 for Anthropic 90% off, 2 for OpenAI 50% off).
-    /// - `cache_write_multiplier`: cost multiplier for cache writes (1.25 for 5m, 2.0 for 1h).
     ///
     /// When `cost_per_token` is `Some`, those rates are used directly (provider-
     /// sourced pricing). When `None`, falls back to the static `costs::model_cost`
     /// lookup table, then `costs::default_cost`.
-    #[allow(clippy::too_many_arguments)]
     pub async fn record_llm_call(
         &self,
         model: &str,
         input_tokens: u32,
         output_tokens: u32,
-        cache_read_input_tokens: u32,
-        cache_creation_input_tokens: u32,
-        cache_read_discount: Decimal,
-        cache_write_multiplier: Decimal,
         cost_per_token: Option<(Decimal, Decimal)>,
     ) -> Decimal {
         let (input_rate, output_rate) = cost_per_token
             .unwrap_or_else(|| costs::model_cost(model).unwrap_or_else(costs::default_cost));
-        // Cached read tokens cost input_rate / cache_read_discount (provider-specific).
-        // Cached write tokens cost write_multiplier × input_rate (e.g. 1.25× for 5m, 2× for 1h).
-        // Uncached tokens = total input - cache reads - cache writes.
-        let cached_total = cache_read_input_tokens.saturating_add(cache_creation_input_tokens);
-        let uncached_input = input_tokens.saturating_sub(cached_total);
-        let effective_discount = if cache_read_discount.is_zero() {
-            Decimal::ONE
-        } else {
-            cache_read_discount
-        };
-        let cache_read_cost =
-            input_rate * Decimal::from(cache_read_input_tokens) / effective_discount;
-        let cache_write_cost =
-            input_rate * Decimal::from(cache_creation_input_tokens) * cache_write_multiplier;
-        let cost = input_rate * Decimal::from(uncached_input)
-            + cache_read_cost
-            + cache_write_cost
-            + output_rate * Decimal::from(output_tokens);
+        let cost =
+            input_rate * Decimal::from(input_tokens) + output_rate * Decimal::from(output_tokens);
 
         // Update daily cost (reset if new day)
         {
@@ -262,11 +235,9 @@ impl CostGuard {
     /// Number of actions in the current hourly window.
     pub async fn actions_this_hour(&self) -> u64 {
         let mut window = self.action_window.lock().await;
-        // checked_sub avoids panic when system uptime < 1 hour (Windows)
-        if let Some(cutoff) = Instant::now().checked_sub(std::time::Duration::from_secs(3600)) {
-            while window.front().is_some_and(|t| *t < cutoff) {
-                window.pop_front();
-            }
+        let cutoff = Instant::now() - std::time::Duration::from_secs(3600);
+        while window.front().is_some_and(|t| *t < cutoff) {
+            window.pop_front();
         }
         window.len() as u64
     }
@@ -296,16 +267,7 @@ mod tests {
 
         // Record a big call, still allowed
         guard
-            .record_llm_call(
-                "gpt-4o",
-                100_000,
-                100_000,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
+            .record_llm_call("gpt-4o", 100_000, 100_000, None)
             .await;
         assert!(guard.check_allowed().await.is_ok());
     }
@@ -323,18 +285,7 @@ mod tests {
         // Record a call that costs more than $0.01
         // gpt-4o: input=$0.0000025/tok, output=$0.00001/tok
         // 10000 input + 10000 output = $0.025 + $0.10 = $0.125
-        guard
-            .record_llm_call(
-                "gpt-4o",
-                10_000,
-                10_000,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
-            .await;
+        guard.record_llm_call("gpt-4o", 10_000, 10_000, None).await;
 
         // Now should be blocked
         let result = guard.check_allowed().await;
@@ -357,9 +308,7 @@ mod tests {
         // First 3 actions allowed
         for _ in 0..3 {
             assert!(guard.check_allowed().await.is_ok());
-            guard
-                .record_llm_call("gpt-4o", 10, 10, 0, 0, Decimal::ONE, Decimal::ONE, None)
-                .await;
+            guard.record_llm_call("gpt-4o", 10, 10, None).await;
         }
 
         // 4th should be blocked
@@ -380,9 +329,7 @@ mod tests {
 
         assert_eq!(guard.daily_spend().await, Decimal::ZERO);
 
-        let cost = guard
-            .record_llm_call("gpt-4o", 1000, 500, 0, 0, Decimal::ONE, Decimal::ONE, None)
-            .await;
+        let cost = guard.record_llm_call("gpt-4o", 1000, 500, None).await;
         assert!(cost > Decimal::ZERO);
         assert_eq!(guard.daily_spend().await, cost);
     }
@@ -393,12 +340,8 @@ mod tests {
 
         assert_eq!(guard.actions_this_hour().await, 0);
 
-        guard
-            .record_llm_call("gpt-4o", 10, 10, 0, 0, Decimal::ONE, Decimal::ONE, None)
-            .await;
-        guard
-            .record_llm_call("gpt-4o", 10, 10, 0, 0, Decimal::ONE, Decimal::ONE, None)
-            .await;
+        guard.record_llm_call("gpt-4o", 10, 10, None).await;
+        guard.record_llm_call("gpt-4o", 10, 10, None).await;
 
         assert_eq!(guard.actions_this_hour().await, 2);
     }
@@ -435,23 +378,10 @@ mod tests {
         assert!(guard.model_usage().await.is_empty());
 
         // Record calls for two different models
+        guard.record_llm_call("gpt-4o", 1000, 500, None).await;
+        guard.record_llm_call("gpt-4o", 2000, 1000, None).await;
         guard
-            .record_llm_call("gpt-4o", 1000, 500, 0, 0, Decimal::ONE, Decimal::ONE, None)
-            .await;
-        guard
-            .record_llm_call("gpt-4o", 2000, 1000, 0, 0, Decimal::ONE, Decimal::ONE, None)
-            .await;
-        guard
-            .record_llm_call(
-                "claude-3-5-sonnet-20241022",
-                500,
-                200,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
+            .record_llm_call("claude-3-5-sonnet-20241022", 500, 200, None)
             .await;
 
         let usage = guard.model_usage().await;
@@ -472,188 +402,4 @@ mod tests {
         // Costs should differ since models have different pricing
         assert_ne!(gpt.cost, claude.cost);
     }
-
-    #[tokio::test]
-    async fn test_cache_discount_reduces_cost() {
-        let guard = CostGuard::new(CostGuardConfig::default());
-
-        // Full price: 1000 input + 500 output, no cache
-        let full_cost = guard
-            .record_llm_call(
-                "claude-opus-4-6",
-                1000,
-                500,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
-            .await;
-
-        let guard2 = CostGuard::new(CostGuardConfig::default());
-
-        // Same tokens but all input cached (90% discount on input)
-        let cached_cost = guard2
-            .record_llm_call(
-                "claude-opus-4-6",
-                1000,
-                500,
-                1000,
-                0,
-                dec!(10),
-                Decimal::ONE,
-                None,
-            )
-            .await;
-
-        // Cached cost must be strictly less than full cost
-        assert!(
-            cached_cost < full_cost,
-            "cached_cost ({}) should be less than full_cost ({})",
-            cached_cost,
-            full_cost
-        );
-
-        // The difference should be exactly 90% of the input cost
-        let (input_rate, _) = costs::model_cost("claude-opus-4-6").unwrap();
-        let expected_savings = input_rate * Decimal::from(1000u32) * dec!(9) / dec!(10);
-        let actual_savings = full_cost - cached_cost;
-        assert_eq!(
-            actual_savings, expected_savings,
-            "savings should be 90% of input cost for fully-cached request"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_cache_write_surcharge_increases_cost() {
-        let guard = CostGuard::new(CostGuardConfig::default());
-
-        // Full price: 1000 input + 500 output, no cache activity
-        let full_cost = guard
-            .record_llm_call(
-                "claude-opus-4-6",
-                1000,
-                500,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
-            .await;
-
-        let guard2 = CostGuard::new(CostGuardConfig::default());
-
-        // Same tokens, but all input tokens are cache writes (1.25x surcharge for 5m TTL)
-        let short_multiplier = Decimal::new(125, 2); // 1.25
-        let write_cost = guard2
-            .record_llm_call(
-                "claude-opus-4-6",
-                1000,
-                500,
-                0,
-                1000,
-                Decimal::ONE,
-                short_multiplier,
-                None,
-            )
-            .await;
-
-        // Write cost must be strictly greater than full cost
-        assert!(
-            write_cost > full_cost,
-            "write_cost ({}) should be greater than full_cost ({})",
-            write_cost,
-            full_cost
-        );
-
-        // The difference should be exactly 25% of the input cost
-        let (input_rate, _) = costs::model_cost("claude-opus-4-6").unwrap();
-        let expected_surcharge = input_rate * Decimal::from(1000u32) * dec!(0.25);
-        let actual_surcharge = write_cost - full_cost;
-        assert_eq!(
-            actual_surcharge, expected_surcharge,
-            "surcharge should be 25% of input cost for 5m cache writes"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_cache_write_surcharge_long_ttl() {
-        let guard = CostGuard::new(CostGuardConfig::default());
-
-        // Full price: 1000 input + 500 output
-        let full_cost = guard
-            .record_llm_call(
-                "claude-opus-4-6",
-                1000,
-                500,
-                0,
-                0,
-                Decimal::ONE,
-                Decimal::ONE,
-                None,
-            )
-            .await;
-
-        let guard2 = CostGuard::new(CostGuardConfig::default());
-
-        // All input tokens are cache writes with 2.0x multiplier (1h TTL)
-        let long_multiplier = Decimal::TWO;
-        let write_cost = guard2
-            .record_llm_call(
-                "claude-opus-4-6",
-                1000,
-                500,
-                0,
-                1000,
-                Decimal::ONE,
-                long_multiplier,
-                None,
-            )
-            .await;
-
-        // Write cost > full cost
-        assert!(write_cost > full_cost);
-
-        // Surcharge should be 100% of input cost (2.0x - 1.0x = 1.0x)
-        let (input_rate, _) = costs::model_cost("claude-opus-4-6").unwrap();
-        let expected_surcharge = input_rate * Decimal::from(1000u32);
-        let actual_surcharge = write_cost - full_cost;
-        assert_eq!(
-            actual_surcharge, expected_surcharge,
-            "surcharge should be 100% of input cost for 1h cache writes"
-        );
-    }
-
-    /// Regression test for #657: Instant::now() - Duration panics on Windows
-    /// when system uptime is less than the subtracted duration.
-    #[tokio::test]
-    async fn test_checked_sub_no_panic_on_fresh_guard() {
-        // A fresh CostGuard with rate limits should not panic even if
-        // checked_sub returns None (simulating short uptime).
-        let guard = CostGuard::new(CostGuardConfig {
-            max_cost_per_day_cents: None,
-            max_actions_per_hour: Some(100),
-        });
-
-        // These must not panic regardless of system uptime
-        assert!(guard.check_allowed().await.is_ok());
-        assert_eq!(guard.actions_this_hour().await, 0);
-
-        // Record some actions and verify again
-        guard
-            .record_llm_call("gpt-4o", 10, 10, 0, 0, Decimal::ONE, Decimal::ONE, None)
-            .await;
-        assert!(guard.check_allowed().await.is_ok());
-        assert_eq!(guard.actions_this_hour().await, 1);
-    }
-
-    /// Verify that checked_sub itself behaves as expected for the pattern we use.
-    #[test]
-    fn test_instant_checked_sub_returns_none_for_overflow() {
-        // Duration::MAX will always exceed uptime, so checked_sub must return None
-        let result = Instant::now().checked_sub(std::time::Duration::MAX);
-        assert!(result.is_none());
-    }
 }

src/agent/dispatcher.rs

@@ -50,18 +50,8 @@ impl Agent {
 
         // Load workspace system prompt (identity files: AGENTS.md, SOUL.md, etc.)
         // In group chats, MEMORY.md is excluded to prevent leaking personal context.
-        // Resolve the user's timezone
-        let user_tz = crate::timezone::resolve_timezone(
-            message.timezone.as_deref(),
-            None, // user setting lookup can be added later
-            &self.config.default_timezone,
-        );
-
         let system_prompt = if let Some(ws) = self.workspace() {
-            match ws
-                .system_prompt_for_context_tz(is_group_chat, user_tz)
-                .await
-            {
+            match ws.system_prompt_for_context(is_group_chat).await {
                 Ok(prompt) if !prompt.is_empty() => Some(prompt),
                 Ok(_) => None,
                 Err(e) => {
@@ -113,7 +103,7 @@ impl Agent {
             None
         };
 
-        let mut reasoning = Reasoning::new(self.llm().clone())
+        let mut reasoning = Reasoning::new(self.llm().clone(), self.safety().clone())
             .with_channel(message.channel.clone())
             .with_model_name(self.llm().active_model_name())
             .with_group_chat(is_group_chat);
@@ -140,18 +130,6 @@ impl Agent {
         let mut job_ctx =
             JobContext::with_user(&message.user_id, "chat", "Interactive chat session");
         job_ctx.http_interceptor = self.deps.http_interceptor.clone();
-        job_ctx.user_timezone = user_tz.name().to_string();
-
-        // Build system prompts once for this turn. Two variants: with tools
-        // (normal iterations) and without (force_text final iteration).
-        let initial_tool_defs = self.tools().tool_definitions().await;
-        let initial_tool_defs = if !active_skills.is_empty() {
-            crate::skills::attenuate_tools(&initial_tool_defs, &active_skills).tools
-        } else {
-            initial_tool_defs
-        };
-        let cached_prompt = reasoning.build_system_prompt_with_tools(&initial_tool_defs);
-        let cached_prompt_no_tools = reasoning.build_system_prompt_with_tools(&[]);
 
         let max_tool_iterations = self.config.max_tool_iterations;
         // Force a text-only response on the last iteration to guarantee termination
@@ -160,8 +138,6 @@ impl Agent {
         let force_text_at = max_tool_iterations;
         let nudge_at = max_tool_iterations.saturating_sub(1);
         let mut iteration = 0;
-        const MAX_TOOL_INTENT_NUDGES: u32 = 2;
-        let mut consecutive_tool_intent_nudges: u32 = 0;
         loop {
             iteration += 1;
             // Hard ceiling one past the forced-text iteration (should never be reached
@@ -230,16 +206,10 @@ impl Agent {
             };
 
             // Call LLM with current context; force_text drops tools to guarantee a
-            // text response on the final iteration. The pre-built system prompt
-            // avoids rebuilding the same ~1,500-token string each iteration.
+            // text response on the final iteration.
             let mut context = ReasoningContext::new()
                 .with_messages(context_messages.clone())
                 .with_tools(tool_defs)
-                .with_system_prompt(if force_text {
-                    cached_prompt_no_tools.clone()
-                } else {
-                    cached_prompt.clone()
-                })
                 .with_metadata({
                     let mut m = std::collections::HashMap::new();
                     m.insert("thread_id".to_string(), thread_id.to_string());
@@ -276,7 +246,7 @@ impl Agent {
                     // Compact: keep system messages + last user message + current turn
                     context_messages = compact_messages_for_retry(&context_messages);
 
-                    // Rebuild context with compacted messages, reusing cached prompt
+                    // Rebuild context with compacted messages
                     let mut retry_context = ReasoningContext::new()
                         .with_messages(context_messages.clone())
                         .with_tools(if force_text {
@@ -286,7 +256,6 @@ impl Agent {
                         })
                         .with_metadata(context.metadata.clone());
                     retry_context.force_text = force_text;
-                    retry_context.system_prompt = context.system_prompt.clone();
 
                     reasoning
                         .respond_with_tools(&retry_context)
@@ -307,18 +276,12 @@ impl Agent {
 
             // Record cost and track token usage
             let model_name = self.llm().active_model_name();
-            let read_discount = self.llm().cache_read_discount();
-            let write_multiplier = self.llm().cache_write_multiplier();
             let call_cost = self
                 .cost_guard()
                 .record_llm_call(
                     &model_name,
                     output.usage.input_tokens,
                     output.usage.output_tokens,
-                    output.usage.cache_read_input_tokens,
-                    output.usage.cache_creation_input_tokens,
-                    read_discount,
-                    write_multiplier,
                     Some(self.llm().cost_per_token()),
                 )
                 .await;
@@ -331,24 +294,6 @@ impl Agent {
 
             match output.result {
                 RespondResult::Text(text) => {
-                    // Nudge the LLM if it expressed tool intent without calling tools.
-                    // This is common with non-Anthropic models (e.g. GLM-5 via NEAR AI)
-                    // that output "Let me search…" but don't issue tool_calls.
-                    if !force_text
-                        && !context.available_tools.is_empty()
-                        && consecutive_tool_intent_nudges < MAX_TOOL_INTENT_NUDGES
-                        && crate::llm::llm_signals_tool_intent(&text)
-                    {
-                        consecutive_tool_intent_nudges += 1;
-                        tracing::info!(
-                            iteration,
-                            "LLM expressed tool intent without calling a tool, nudging"
-                        );
-                        context_messages.push(ChatMessage::assistant(&text));
-                        context_messages.push(ChatMessage::user(crate::llm::TOOL_INTENT_NUDGE));
-                        continue;
-                    }
-
                     // Strip internal "[Called tool ...]" text that can leak when
                     // provider flattening (e.g. NEAR AI) converts tool_calls to
                     // plain text and the LLM echoes it back.
@@ -359,7 +304,6 @@ impl Agent {
                     tool_calls,
                     content,
                 } => {
-                    consecutive_tool_intent_nudges = 0;
                     // Add the assistant message with tool_calls to context.
                     // OpenAI protocol requires this before tool-result messages.
                     context_messages.push(ChatMessage::assistant_with_tool_calls(
@@ -764,7 +708,7 @@ impl Agent {
                                             sanitized.was_modified,
                                         )
                                     }
-                                    Err(e) => format!("Tool '{}' failed: {}", tc.name, e),
+                                    Err(e) => format!("Error: {}", e),
                                 };
 
                                 context_messages.push(ChatMessage::tool_result(
@@ -796,7 +740,6 @@ impl Agent {
                             tool_call_id: tc.id.clone(),
                             context_messages: context_messages.clone(),
                             deferred_tool_calls: tool_calls[approval_idx + 1..].to_vec(),
-                            user_timezone: Some(user_tz.name().to_string()),
                         };
 
                         return Ok(AgenticLoopResult::NeedApproval { pending });
@@ -1098,8 +1041,6 @@ mod tests {
                 input_tokens: 0,
                 output_tokens: 0,
                 finish_reason: FinishReason::Stop,
-                cache_read_input_tokens: 0,
-                cache_creation_input_tokens: 0,
             })
         }
 
@@ -1113,8 +1054,6 @@ mod tests {
                 input_tokens: 0,
                 output_tokens: 0,
                 finish_reason: FinishReason::Stop,
-                cache_read_input_tokens: 0,
-                cache_creation_input_tokens: 0,
             })
         }
     }
@@ -1139,8 +1078,6 @@ mod tests {
             cost_guard: Arc::new(CostGuard::new(CostGuardConfig::default())),
             sse_tx: None,
             http_interceptor: None,
-            transcription: None,
-            document_extraction: None,
         };
 
         Agent::new(
@@ -1158,7 +1095,6 @@ mod tests {
                 max_actions_per_hour: None,
                 max_tool_iterations: 50,
                 auto_approve_tools: false,
-                default_timezone: "UTC".to_string(),
             },
             deps,
             Arc::new(ChannelManager::new()),
@@ -1261,7 +1197,6 @@ mod tests {
                     arguments: serde_json::json!({"message": "done"}),
                 },
             ],
-            user_timezone: None,
         };
 
         let json = serde_json::to_string(&pending).expect("serialize");
@@ -1609,8 +1544,12 @@ mod tests {
         use crate::testing::StubLlm;
 
         let stub = Arc::new(StubLlm::failing_non_transient("ctx-bomb"));
+        let safety = Arc::new(SafetyLayer::new(&SafetyConfig {
+            max_output_length: 100_000,
+            injection_check_enabled: false,
+        }));
 
-        let reasoning = Reasoning::new(stub.clone());
+        let reasoning = Reasoning::new(stub.clone(), safety);
 
         // Build a fat context with lots of history.
         let messages = vec![
@@ -1675,8 +1614,6 @@ mod tests {
                 input_tokens: 0,
                 output_tokens: 5,
                 finish_reason: FinishReason::Stop,
-                cache_read_input_tokens: 0,
-                cache_creation_input_tokens: 0,
             })
         }
 
@@ -1692,8 +1629,6 @@ mod tests {
                     input_tokens: 0,
                     output_tokens: 5,
                     finish_reason: FinishReason::Stop,
-                    cache_read_input_tokens: 0,
-                    cache_creation_input_tokens: 0,
                 });
             }
             // Tools available: always call one.
@@ -1707,8 +1642,6 @@ mod tests {
                 input_tokens: 0,
                 output_tokens: 5,
                 finish_reason: FinishReason::ToolUse,
-                cache_read_input_tokens: 0,
-                cache_creation_input_tokens: 0,
             })
         }
     }
@@ -1720,7 +1653,11 @@ mod tests {
         use crate::llm::{Reasoning, ReasoningContext, RespondResult, ToolDefinition};
 
         let provider = Arc::new(AlwaysToolCallProvider);
-        let reasoning = Reasoning::new(provider);
+        let safety = Arc::new(SafetyLayer::new(&SafetyConfig {
+            max_output_length: 100_000,
+            injection_check_enabled: false,
+        }));
+        let reasoning = Reasoning::new(provider, safety);
 
         let tool_def = ToolDefinition {
             name: "echo".to_string(),
@@ -1829,8 +1766,6 @@ mod tests {
                 input_tokens: 0,
                 output_tokens: 2,
                 finish_reason: FinishReason::Stop,
-                cache_read_input_tokens: 0,
-                cache_creation_input_tokens: 0,
             })
         }
 
@@ -1845,8 +1780,6 @@ mod tests {
                     input_tokens: 0,
                     output_tokens: 2,
                     finish_reason: FinishReason::Stop,
-                    cache_read_input_tokens: 0,
-                    cache_creation_input_tokens: 0,
                 });
             }
             // Always call a tool that does not exist in the registry.
@@ -1860,8 +1793,6 @@ mod tests {
                 input_tokens: 0,
                 output_tokens: 5,
                 finish_reason: FinishReason::ToolUse,
-                cache_read_input_tokens: 0,
-                cache_creation_input_tokens: 0,
             })
         }
     }
@@ -1887,8 +1818,6 @@ mod tests {
             cost_guard: Arc::new(CostGuard::new(CostGuardConfig::default())),
             sse_tx: None,
             http_interceptor: None,
-            transcription: None,
-            document_extraction: None,
         };
 
         Agent::new(
@@ -1906,7 +1835,6 @@ mod tests {
                 max_actions_per_hour: None,
                 max_tool_iterations,
                 auto_approve_tools: true,
-                default_timezone: "UTC".to_string(),
             },
             deps,
             Arc::new(ChannelManager::new()),
@@ -2003,8 +1931,6 @@ mod tests {
                 cost_guard: Arc::new(CostGuard::new(CostGuardConfig::default())),
                 sse_tx: None,
                 http_interceptor: None,
-                transcription: None,
-                document_extraction: None,
             };
 
             Agent::new(
@@ -2022,7 +1948,6 @@ mod tests {
                     max_actions_per_hour: None,
                     max_tool_iterations: max_iter,
                     auto_approve_tools: true,
-                    default_timezone: "UTC".to_string(),
                 },
                 deps,
                 Arc::new(ChannelManager::new()),
@@ -2103,25 +2028,4 @@ mod tests {
         let result = super::strip_internal_tool_call_text(input);
         assert_eq!(result, input);
     }
-
-    #[test]
-    fn test_tool_error_format_includes_tool_name() {
-        // Regression test for issue #487: tool errors sent to the LLM should
-        // include the tool name so the model can reason about which tool failed
-        // and try alternatives.
-        let tool_name = "http";
-        let err = crate::error::ToolError::ExecutionFailed {
-            name: tool_name.to_string(),
-            reason: "connection refused".to_string(),
-        };
-        let formatted = format!("Tool '{}' failed: {}", tool_name, err);
-        assert!(
-            formatted.contains("Tool 'http' failed:"),
-            "Error should identify the tool by name, got: {formatted}"
-        );
-        assert!(
-            formatted.contains("connection refused"),
-            "Error should include the underlying reason, got: {formatted}"
-        );
-    }
 }

src/agent/heartbeat.rs

@@ -29,8 +29,8 @@ use std::time::Duration;
 use tokio::sync::mpsc;
 
 use crate::channels::OutgoingResponse;
-use crate::db::Database;
 use crate::llm::{ChatMessage, CompletionRequest, LlmProvider, Reasoning};
+use crate::safety::SafetyLayer;
 use crate::workspace::Workspace;
 use crate::workspace::hygiene::HygieneConfig;
 
@@ -47,12 +47,6 @@ pub struct HeartbeatConfig {
     pub notify_user_id: Option<String>,
     /// Channel to notify on heartbeat findings.
     pub notify_channel: Option<String>,
-    /// Hour (0-23) when quiet hours start.
-    pub quiet_hours_start: Option<u32>,
-    /// Hour (0-23) when quiet hours end.
-    pub quiet_hours_end: Option<u32>,
-    /// Timezone for quiet hours evaluation (IANA name).
-    pub timezone: Option<String>,
 }
 
 impl Default for HeartbeatConfig {
@@ -63,9 +57,6 @@ impl Default for HeartbeatConfig {
             max_failures: 3,
             notify_user_id: None,
             notify_channel: None,
-            quiet_hours_start: None,
-            quiet_hours_end: None,
-            timezone: None,
         }
     }
 }
@@ -83,26 +74,6 @@ impl HeartbeatConfig {
         self
     }
 
-    /// Check whether the current time falls within configured quiet hours.
-    pub fn is_quiet_hours(&self) -> bool {
-        use chrono::Timelike;
-        let (Some(start), Some(end)) = (self.quiet_hours_start, self.quiet_hours_end) else {
-            return false;
-        };
-        let tz = self
-            .timezone
-            .as_deref()
-            .and_then(crate::timezone::parse_timezone)
-            .unwrap_or(chrono_tz::UTC);
-        let now_hour = crate::timezone::now_in_tz(tz).hour();
-        if start <= end {
-            now_hour >= start && now_hour < end
-        } else {
-            // Wraps midnight, e.g. 22..06
-            now_hour >= start || now_hour < end
-        }
-    }
-
     /// Set the notification target.
     pub fn with_notify(mut self, user_id: impl Into<String>, channel: impl Into<String>) -> Self {
         self.notify_user_id = Some(user_id.into());
@@ -130,8 +101,8 @@ pub struct HeartbeatRunner {
     hygiene_config: HygieneConfig,
     workspace: Arc<Workspace>,
     llm: Arc<dyn LlmProvider>,
+    safety: Arc<SafetyLayer>,
     response_tx: Option<mpsc::Sender<OutgoingResponse>>,
-    store: Option<Arc<dyn Database>>,
     consecutive_failures: u32,
 }
 
@@ -142,14 +113,15 @@ impl HeartbeatRunner {
         hygiene_config: HygieneConfig,
         workspace: Arc<Workspace>,
         llm: Arc<dyn LlmProvider>,
+        safety: Arc<SafetyLayer>,
     ) -> Self {
         Self {
             config,
             hygiene_config,
             workspace,
             llm,
+            safety,
             response_tx: None,
-            store: None,
             consecutive_failures: 0,
         }
     }
@@ -160,12 +132,6 @@ impl HeartbeatRunner {
         self
     }
 
-    /// Set the database store for persistent heartbeat conversations.
-    pub fn with_store(mut self, store: Arc<dyn Database>) -> Self {
-        self.store = Some(store);
-        self
-    }
-
     /// Run the heartbeat loop.
     ///
     /// This runs forever, checking periodically based on the configured interval.
@@ -187,12 +153,6 @@ impl HeartbeatRunner {
         loop {
             interval.tick().await;
 
-            // Skip during quiet hours
-            if self.config.is_quiet_hours() {
-                tracing::debug!("Heartbeat skipped: quiet hours");
-                continue;
-            }
-
             // Run memory hygiene in the background so it never delays the
             // heartbeat checklist. Failures are logged inside run_if_due.
             let hygiene_workspace = Arc::clone(&self.workspace);
@@ -204,7 +164,6 @@ impl HeartbeatRunner {
                 if report.had_work() {
                     tracing::info!(
                         daily_logs_deleted = report.daily_logs_deleted,
-                        conversation_docs_deleted = report.conversation_docs_deleted,
                         "heartbeat: memory hygiene deleted stale documents"
                     );
                 }
@@ -303,7 +262,7 @@ impl HeartbeatRunner {
             .with_max_tokens(max_tokens)
             .with_temperature(0.3);
 
-        let reasoning = Reasoning::new(self.llm.clone());
+        let reasoning = Reasoning::new(self.llm.clone(), self.safety.clone());
         let (content, _usage) = match reasoning.complete(request).await {
             Ok(r) => r,
             Err(e) => return HeartbeatResult::Failed(format!("LLM call failed: {}", e)),
@@ -332,32 +291,9 @@ impl HeartbeatRunner {
             return;
         };
 
-        let user_id = self.config.notify_user_id.as_deref().unwrap_or("default");
-
-        // Persist to heartbeat conversation and get thread_id
-        let thread_id = if let Some(ref store) = self.store {
-            match store.get_or_create_heartbeat_conversation(user_id).await {
-                Ok(conv_id) => {
-                    if let Err(e) = store
-                        .add_conversation_message(conv_id, "assistant", message)
-                        .await
-                    {
-                        tracing::error!("Failed to persist heartbeat message: {}", e);
-                    }
-                    Some(conv_id.to_string())
-                }
-                Err(e) => {
-                    tracing::error!("Failed to get heartbeat conversation: {}", e);
-                    None
-                }
-            }
-        } else {
-            None
-        };
-
         let response = OutgoingResponse {
             content: format!("🔔 *Heartbeat Alert*\n\n{}", message),
-            thread_id,
+            thread_id: None,
             attachments: Vec::new(),
             metadata: serde_json::json!({
                 "source": "heartbeat",
@@ -417,16 +353,13 @@ pub fn spawn_heartbeat(
     hygiene_config: HygieneConfig,
     workspace: Arc<Workspace>,
     llm: Arc<dyn LlmProvider>,
+    safety: Arc<SafetyLayer>,
     response_tx: Option<mpsc::Sender<OutgoingResponse>>,
-    store: Option<Arc<dyn Database>>,
 ) -> tokio::task::JoinHandle<()> {
-    let mut runner = HeartbeatRunner::new(config, hygiene_config, workspace, llm);
+    let mut runner = HeartbeatRunner::new(config, hygiene_config, workspace, llm, safety);
     if let Some(tx) = response_tx {
         runner = runner.with_response_channel(tx);
     }
-    if let Some(s) = store {
-        runner = runner.with_store(s);
-    }
 
     tokio::spawn(async move {
         runner.run().await;
@@ -561,98 +494,4 @@ mod tests {
         let content = "<!-- comment -->\nActual task here";
         assert!(!is_effectively_empty(content));
     }
-
-    // ==================== quiet hours ====================
-
-    #[test]
-    fn test_quiet_hours_inside() {
-        use chrono::{Timelike, Utc};
-
-        let now_utc = Utc::now();
-        let hour = now_utc.hour();
-        let start = hour;
-        let end = (hour + 1) % 24;
-
-        let config = HeartbeatConfig {
-            quiet_hours_start: Some(start),
-            quiet_hours_end: Some(end),
-            timezone: Some("UTC".to_string()),
-            ..HeartbeatConfig::default()
-        };
-        // Current UTC hour is inside [start, end) by construction
-        assert!(config.is_quiet_hours());
-    }
-
-    #[test]
-    fn test_quiet_hours_outside() {
-        use chrono::{Timelike, Utc};
-
-        let now_utc = Utc::now();
-        let hour = now_utc.hour();
-        let start = (hour + 1) % 24;
-        let end = (hour + 2) % 24;
-
-        let config = HeartbeatConfig {
-            quiet_hours_start: Some(start),
-            quiet_hours_end: Some(end),
-            timezone: Some("UTC".to_string()),
-            ..HeartbeatConfig::default()
-        };
-        // Current UTC hour is outside [start, end) by construction
-        assert!(!config.is_quiet_hours());
-    }
-
-    #[test]
-    fn test_quiet_hours_wraparound_excludes_now() {
-        use chrono::{Timelike, Utc};
-
-        let now_utc = Utc::now();
-        let hour = now_utc.hour();
-        // Window covers all hours except the current one
-        let start = (hour + 1) % 24;
-        let end = hour;
-
-        let config = HeartbeatConfig {
-            quiet_hours_start: Some(start),
-            quiet_hours_end: Some(end),
-            timezone: Some("UTC".to_string()),
-            ..HeartbeatConfig::default()
-        };
-        assert!(!config.is_quiet_hours());
-    }
-
-    #[test]
-    fn test_quiet_hours_none_configured() {
-        let config = HeartbeatConfig::default();
-        assert!(!config.is_quiet_hours());
-    }
-
-    #[test]
-    fn test_quiet_hours_same_start_end() {
-        let config = HeartbeatConfig {
-            quiet_hours_start: Some(10),
-            quiet_hours_end: Some(10),
-            timezone: Some("UTC".to_string()),
-            ..HeartbeatConfig::default()
-        };
-        // start == end means zero-width window, should be false
-        assert!(!config.is_quiet_hours());
-    }
-
-    #[test]
-    fn test_spawn_heartbeat_accepts_store_param() {
-        // Regression: spawn_heartbeat must accept an optional Database store
-        // for persisting heartbeat notifications to a dedicated conversation.
-        // Compile-time check: the 7th parameter is `Option<Arc<dyn Database>>`.
-        #[allow(clippy::type_complexity)]
-        let _fn_ptr: fn(
-            HeartbeatConfig,
-            HygieneConfig,
-            Arc<crate::workspace::Workspace>,
-            Arc<dyn crate::llm::LlmProvider>,
-            Option<tokio::sync::mpsc::Sender<crate::channels::OutgoingResponse>>,
-            Option<Arc<dyn crate::db::Database>>,
-        ) -> tokio::task::JoinHandle<()> = spawn_heartbeat;
-        let _ = _fn_ptr;
-    }
 }

src/agent/mod.rs

@@ -11,7 +11,6 @@
 //! - Context compaction for long conversations
 
 mod agent_loop;
-mod attachments;
 mod commands;
 pub mod compaction;
 pub mod context_monitor;

src/agent/routine.rs

@@ -57,11 +57,7 @@ pub struct Routine {
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum Trigger {
     /// Fire on a cron schedule (e.g. "0 9 * * MON-FRI" or "every 2h").
-    Cron {
-        schedule: String,
-        #[serde(default)]
-        timezone: Option<String>,
-    },
+    Cron { schedule: String },
     /// Fire when a channel message matches a pattern.
     Event {
         /// Optional channel filter (e.g. "telegram", "slack").
@@ -103,21 +99,7 @@ impl Trigger {
                         field: "schedule".into(),
                     })?
                     .to_string();
-                let timezone = config
-                    .get("timezone")
-                    .and_then(|v| v.as_str())
-                    .and_then(|tz| {
-                        if crate::timezone::parse_timezone(tz).is_some() {
-                            Some(tz.to_string())
-                        } else {
-                            tracing::warn!(
-                                "Ignoring invalid timezone '{}' from DB for cron trigger",
-                                tz
-                            );
-                            None
-                        }
-                    });
-                Ok(Trigger::Cron { schedule, timezone })
+                Ok(Trigger::Cron { schedule })
             }
             "event" => {
                 let pattern = config
@@ -155,10 +137,7 @@ impl Trigger {
     /// Serialize trigger-specific config to JSON for DB storage.
     pub fn to_config_json(&self) -> serde_json::Value {
         match self {
-            Trigger::Cron { schedule, timezone } => serde_json::json!({
-                "schedule": schedule,
-                "timezone": timezone,
-            }),
+            Trigger::Cron { schedule } => serde_json::json!({ "schedule": schedule }),
             Trigger::Event { channel, pattern } => serde_json::json!({
                 "pattern": pattern,
                 "channel": channel,
@@ -196,11 +175,6 @@ pub enum RoutineAction {
         /// Max reasoning iterations (default: 10).
         #[serde(default = "default_max_iterations")]
         max_iterations: u32,
-        /// Tool names pre-authorized for `Always`-approval tools (e.g. destructive
-        /// shell commands, cross-channel messaging). `UnlessAutoApproved` tools are
-        /// automatically permitted in routine jobs without listing them here.
-        #[serde(default)]
-        tool_permissions: Vec<String>,
     },
 }
 
@@ -212,19 +186,6 @@ fn default_max_iterations() -> u32 {
     10
 }
 
-/// Parse a `tool_permissions` JSON array into a `Vec<String>`.
-pub fn parse_tool_permissions(value: &serde_json::Value) -> Vec<String> {
-    value
-        .get("tool_permissions")
-        .and_then(|v| v.as_array())
-        .map(|arr| {
-            arr.iter()
-                .filter_map(|v| v.as_str().map(String::from))
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
 impl RoutineAction {
     /// The string tag stored in the DB action_type column.
     pub fn type_tag(&self) -> &'static str {
@@ -287,12 +248,10 @@ impl RoutineAction {
                     .and_then(|v| v.as_u64())
                     .unwrap_or(default_max_iterations() as u64)
                     as u32;
-                let tool_permissions = parse_tool_permissions(&config);
                 Ok(RoutineAction::FullJob {
                     title,
                     description,
                     max_iterations,
-                    tool_permissions,
                 })
             }
             other => Err(RoutineError::UnknownActionType {
@@ -317,12 +276,10 @@ impl RoutineAction {
                 title,
                 description,
                 max_iterations,
-                tool_permissions,
             } => serde_json::json!({
                 "title": title,
                 "description": description,
                 "max_iterations": max_iterations,
-                "tool_permissions": tool_permissions,
             }),
         }
     }
@@ -436,25 +393,12 @@ pub fn content_hash(content: &str) -> u64 {
 }
 
 /// Parse a cron expression and compute the next fire time from now.
-///
-/// When `timezone` is provided and valid, the schedule is evaluated in that
-/// timezone and the result is converted back to UTC. Otherwise UTC is used.
-pub fn next_cron_fire(
-    schedule: &str,
-    timezone: Option<&str>,
-) -> Result<Option<DateTime<Utc>>, RoutineError> {
+pub fn next_cron_fire(schedule: &str) -> Result<Option<DateTime<Utc>>, RoutineError> {
     let cron_schedule =
         cron::Schedule::from_str(schedule).map_err(|e| RoutineError::InvalidCron {
             reason: e.to_string(),
         })?;
-    if let Some(tz) = timezone.and_then(crate::timezone::parse_timezone) {
-        Ok(cron_schedule
-            .upcoming(tz)
-            .next()
-            .map(|dt| dt.with_timezone(&Utc)))
-    } else {
-        Ok(cron_schedule.upcoming(Utc).next())
-    }
+    Ok(cron_schedule.upcoming(Utc).next())
 }
 
 #[cfg(test)]
@@ -467,11 +411,10 @@ mod tests {
     fn test_trigger_roundtrip() {
         let trigger = Trigger::Cron {
             schedule: "0 9 * * MON-FRI".to_string(),
-            timezone: None,
         };
         let json = trigger.to_config_json();
         let parsed = Trigger::from_db("cron", json).expect("parse cron");
-        assert!(matches!(parsed, Trigger::Cron { schedule, .. } if schedule == "0 9 * * MON-FRI"));
+        assert!(matches!(parsed, Trigger::Cron { schedule } if schedule == "0 9 * * MON-FRI"));
     }
 
     #[test]
@@ -507,13 +450,12 @@ mod tests {
             title: "Deploy review".to_string(),
             description: "Review and deploy pending changes".to_string(),
             max_iterations: 5,
-            tool_permissions: vec!["shell".to_string()],
         };
         let json = action.to_config_json();
         let parsed = RoutineAction::from_db("full_job", json).expect("parse full_job");
         assert!(
-            matches!(parsed, RoutineAction::FullJob { title, max_iterations, tool_permissions, .. }
-            if title == "Deploy review" && max_iterations == 5 && tool_permissions == vec!["shell".to_string()])
+            matches!(parsed, RoutineAction::FullJob { title, max_iterations, .. }
+            if title == "Deploy review" && max_iterations == 5)
         );
     }
 
@@ -544,58 +486,16 @@ mod tests {
     #[test]
     fn test_next_cron_fire_valid() {
         // Every minute should always have a next fire
-        let next = next_cron_fire("* * * * * *", None).expect("valid cron");
+        let next = next_cron_fire("* * * * * *").expect("valid cron");
         assert!(next.is_some());
     }
 
     #[test]
     fn test_next_cron_fire_invalid() {
-        let result = next_cron_fire("not a cron", None);
+        let result = next_cron_fire("not a cron");
         assert!(result.is_err());
     }
 
-    #[test]
-    fn test_trigger_cron_timezone_roundtrip() {
-        let trigger = Trigger::Cron {
-            schedule: "0 9 * * MON-FRI".to_string(),
-            timezone: Some("America/New_York".to_string()),
-        };
-        let json = trigger.to_config_json();
-        let parsed = Trigger::from_db("cron", json).expect("parse cron");
-        assert!(matches!(parsed, Trigger::Cron { schedule, timezone }
-                if schedule == "0 9 * * MON-FRI"
-                && timezone.as_deref() == Some("America/New_York")));
-    }
-
-    #[test]
-    fn test_trigger_cron_no_timezone_backward_compat() {
-        let json = serde_json::json!({"schedule": "0 9 * * *"});
-        let parsed = Trigger::from_db("cron", json).expect("parse cron");
-        assert!(matches!(parsed, Trigger::Cron { timezone, .. } if timezone.is_none()));
-    }
-
-    #[test]
-    fn test_trigger_cron_invalid_timezone_coerced_to_none() {
-        let json = serde_json::json!({"schedule": "0 9 * * *", "timezone": "Fake/Zone"});
-        let parsed = Trigger::from_db("cron", json).expect("parse cron");
-        assert!(
-            matches!(parsed, Trigger::Cron { timezone, .. } if timezone.is_none()),
-            "invalid timezone should be coerced to None"
-        );
-    }
-
-    #[test]
-    fn test_next_cron_fire_with_timezone() {
-        let next_utc = next_cron_fire("0 0 9 * * * *", None)
-            .expect("valid cron")
-            .expect("has next");
-        let next_est = next_cron_fire("0 0 9 * * * *", Some("America/New_York"))
-            .expect("valid cron")
-            .expect("has next");
-        // EST is UTC-5 (or EDT UTC-4), so the UTC result should differ
-        assert_ne!(next_utc, next_est, "timezone should shift the fire time");
-    }
-
     #[test]
     fn test_guardrails_default() {
         let g = RoutineGuardrails::default();
@@ -608,8 +508,7 @@ mod tests {
     fn test_trigger_type_tag() {
         assert_eq!(
             Trigger::Cron {
-                schedule: String::new(),
-                timezone: None,
+                schedule: String::new()
             }
             .type_tag(),
             "cron"

src/agent/routine_engine.rs

@@ -28,7 +28,6 @@ use crate::config::RoutineConfig;
 use crate::db::Database;
 use crate::error::RoutineError;
 use crate::llm::{ChatMessage, CompletionRequest, FinishReason, LlmProvider};
-use crate::tools::ApprovalContext;
 use crate::workspace::Workspace;
 
 /// The routine execution engine.
@@ -170,7 +169,7 @@ impl RoutineEngine {
                 continue;
             }
 
-            let detail = if let Trigger::Cron { ref schedule, .. } = routine.trigger {
+            let detail = if let Trigger::Cron { ref schedule } = routine.trigger {
                 Some(schedule.clone())
             } else {
                 None
@@ -181,14 +180,7 @@ impl RoutineEngine {
     }
 
     /// Fire a routine manually (from tool call or CLI).
-    ///
-    /// Bypasses cooldown checks (those only apply to cron/event triggers).
-    /// Still enforces enabled check and concurrent run limit.
-    pub async fn fire_manual(
-        &self,
-        routine_id: Uuid,
-        user_id: Option<&str>,
-    ) -> Result<Uuid, RoutineError> {
+    pub async fn fire_manual(&self, routine_id: Uuid) -> Result<Uuid, RoutineError> {
         let routine = self
             .store
             .get_routine(routine_id)
@@ -198,13 +190,6 @@ impl RoutineEngine {
             })?
             .ok_or(RoutineError::NotFound { id: routine_id })?;
 
-        // Enforce ownership when a user_id is provided (gateway calls).
-        if let Some(uid) = user_id
-            && routine.user_id != uid
-        {
-            return Err(RoutineError::NotAuthorized { id: routine_id });
-        }
-
         if !routine.enabled {
             return Err(RoutineError::Disabled {
                 name: routine.name.clone(),
@@ -342,19 +327,7 @@ async fn execute_routine(ctx: EngineContext, routine: Routine, run: RoutineRun)
             title,
             description,
             max_iterations,
-            tool_permissions,
-        } => {
-            execute_full_job(
-                &ctx,
-                &routine,
-                &run,
-                title,
-                description,
-                *max_iterations,
-                tool_permissions,
-            )
-            .await
-        }
+        } => execute_full_job(&ctx, &routine, &run, title, description, *max_iterations).await,
     };
 
     // Decrement running count
@@ -380,12 +353,8 @@ async fn execute_routine(ctx: EngineContext, routine: Routine, run: RoutineRun)
 
     // Update routine runtime state
     let now = Utc::now();
-    let next_fire = if let Trigger::Cron {
-        ref schedule,
-        ref timezone,
-    } = routine.trigger
-    {
-        next_cron_fire(schedule, timezone.as_deref()).unwrap_or(None)
+    let next_fire = if let Trigger::Cron { ref schedule } = routine.trigger {
+        next_cron_fire(schedule).unwrap_or(None)
     } else {
         None
     };
@@ -411,39 +380,6 @@ async fn execute_routine(ctx: EngineContext, routine: Routine, run: RoutineRun)
         tracing::error!(routine = %routine.name, "Failed to update runtime state: {}", e);
     }
 
-    // Persist routine result to its dedicated conversation thread
-    let thread_id = match ctx
-        .store
-        .get_or_create_routine_conversation(routine.id, &routine.name, &routine.user_id)
-        .await
-    {
-        Ok(conv_id) => {
-            tracing::debug!(
-                routine = %routine.name,
-                routine_id = %routine.id,
-                conversation_id = %conv_id,
-                "Resolved routine conversation thread"
-            );
-            // Record the run result as a conversation message
-            let msg = match (&summary, status) {
-                (Some(s), _) => format!("[{}] {}: {}", run.trigger_type, status, s),
-                (None, _) => format!("[{}] {}", run.trigger_type, status),
-            };
-            if let Err(e) = ctx
-                .store
-                .add_conversation_message(conv_id, "assistant", &msg)
-                .await
-            {
-                tracing::error!(routine = %routine.name, "Failed to persist routine message: {}", e);
-            }
-            Some(conv_id.to_string())
-        }
-        Err(e) => {
-            tracing::error!(routine = %routine.name, "Failed to get routine conversation: {}", e);
-            None
-        }
-    };
-
     // Send notifications based on config
     send_notification(
         &ctx.notify_tx,
@@ -451,7 +387,6 @@ async fn execute_routine(ctx: EngineContext, routine: Routine, run: RoutineRun)
         &routine.name,
         status,
         summary.as_deref(),
-        thread_id.as_deref(),
     )
     .await;
 }
@@ -483,7 +418,6 @@ async fn execute_full_job(
     title: &str,
     description: &str,
     max_iterations: u32,
-    tool_permissions: &[String],
 ) -> Result<(RunStatus, Option<String>, Option<i32>), RoutineError> {
     let scheduler = ctx
         .scheduler
@@ -492,26 +426,10 @@ async fn execute_full_job(
             reason: "scheduler not available".to_string(),
         })?;
 
-    let mut metadata = serde_json::json!({ "max_iterations": max_iterations });
-    // Carry the routine's notify config in job metadata so the message tool
-    // can resolve channel/target per-job without global state mutation.
-    if let Some(channel) = &routine.notify.channel {
-        metadata["notify_channel"] = serde_json::json!(channel);
-    }
-    metadata["notify_user"] = serde_json::json!(&routine.notify.user);
-
-    // Build approval context: UnlessAutoApproved tools are auto-approved for routines;
-    // Always tools require explicit listing in tool_permissions.
-    let approval_context = ApprovalContext::autonomous_with_tools(tool_permissions.iter().cloned());
+    let metadata = serde_json::json!({ "max_iterations": max_iterations });
 
     let job_id = scheduler
-        .dispatch_job_with_context(
-            &routine.user_id,
-            title,
-            description,
-            Some(metadata),
-            approval_context,
-        )
+        .dispatch_job(&routine.user_id, title, description, Some(metadata))
         .await
         .map_err(|e| RoutineError::JobDispatchFailed {
             reason: format!("failed to dispatch job: {e}"),
@@ -655,7 +573,6 @@ async fn send_notification(
     routine_name: &str,
     status: RunStatus,
     summary: Option<&str>,
-    thread_id: Option<&str>,
 ) {
     let should_notify = match status {
         RunStatus::Ok => notify.on_success,
@@ -682,7 +599,7 @@ async fn send_notification(
 
     let response = OutgoingResponse {
         content: message,
-        thread_id: thread_id.map(String::from),
+        thread_id: None,
         attachments: Vec::new(),
         metadata: serde_json::json!({
             "source": "routine",

src/agent/scheduler.rs

@@ -18,7 +18,7 @@ use crate::error::{Error, JobError};
 use crate::hooks::HookRegistry;
 use crate::llm::LlmProvider;
 use crate::safety::SafetyLayer;
-use crate::tools::{ApprovalContext, ToolRegistry};
+use crate::tools::ToolRegistry;
 
 /// Message to send to a worker.
 #[derive(Debug)]
@@ -56,8 +56,6 @@ pub struct Scheduler {
     hooks: Arc<HookRegistry>,
     /// SSE broadcast sender for live job event streaming.
     sse_tx: Option<tokio::sync::broadcast::Sender<SseEvent>>,
-    /// HTTP interceptor for trace recording/replay (propagated to workers).
-    http_interceptor: Option<Arc<dyn crate::llm::recording::HttpInterceptor>>,
     /// Running jobs (main LLM-driven jobs).
     jobs: Arc<RwLock<HashMap<Uuid, ScheduledJob>>>,
     /// Running sub-tasks (tool executions, background tasks).
@@ -84,7 +82,6 @@ impl Scheduler {
             store,
             hooks,
             sse_tx: None,
-            http_interceptor: None,
             jobs: Arc::new(RwLock::new(HashMap::new())),
             subtasks: Arc::new(RwLock::new(HashMap::new())),
         }
@@ -95,14 +92,6 @@ impl Scheduler {
         self.sse_tx = Some(tx);
     }
 
-    /// Set the HTTP interceptor for trace recording/replay.
-    pub fn set_http_interceptor(
-        &mut self,
-        interceptor: Arc<dyn crate::llm::recording::HttpInterceptor>,
-    ) {
-        self.http_interceptor = Some(interceptor);
-    }
-
     /// Create, persist, and schedule a job in one shot.
     ///
     /// This is the preferred entry point for dispatching new jobs. It:
@@ -119,41 +108,6 @@ impl Scheduler {
         title: &str,
         description: &str,
         metadata: Option<serde_json::Value>,
-    ) -> Result<Uuid, JobError> {
-        self.dispatch_job_inner(user_id, title, description, metadata, None)
-            .await
-    }
-
-    /// Dispatch a job with an explicit approval context for autonomous execution.
-    ///
-    /// Same as `dispatch_job`, but the worker will use the given `ApprovalContext`
-    /// to determine which tools are pre-approved (instead of blocking all non-`Never` tools).
-    pub async fn dispatch_job_with_context(
-        &self,
-        user_id: &str,
-        title: &str,
-        description: &str,
-        metadata: Option<serde_json::Value>,
-        approval_context: ApprovalContext,
-    ) -> Result<Uuid, JobError> {
-        self.dispatch_job_inner(
-            user_id,
-            title,
-            description,
-            metadata,
-            Some(approval_context),
-        )
-        .await
-    }
-
-    /// Shared implementation for `dispatch_job` and `dispatch_job_with_context`.
-    async fn dispatch_job_inner(
-        &self,
-        user_id: &str,
-        title: &str,
-        description: &str,
-        metadata: Option<serde_json::Value>,
-        approval_context: Option<ApprovalContext>,
     ) -> Result<Uuid, JobError> {
         let job_id = self
             .context_manager
@@ -178,21 +132,12 @@ impl Scheduler {
             })?;
         }
 
-        self.schedule_with_context(job_id, approval_context).await?;
+        self.schedule(job_id).await?;
         Ok(job_id)
     }
 
     /// Schedule a job for execution.
     pub async fn schedule(&self, job_id: Uuid) -> Result<(), JobError> {
-        self.schedule_with_context(job_id, None).await
-    }
-
-    /// Schedule a job with an optional approval context.
-    async fn schedule_with_context(
-        &self,
-        job_id: Uuid,
-        approval_context: Option<ApprovalContext>,
-    ) -> Result<(), JobError> {
         // Hold write lock for the entire check-insert sequence to prevent
         // TOCTOU races where two concurrent calls both pass the checks.
         {
@@ -236,8 +181,6 @@ impl Scheduler {
                 timeout: self.config.job_timeout,
                 use_planning: self.config.use_planning,
                 sse_tx: self.sse_tx.clone(),
-                approval_context,
-                http_interceptor: self.http_interceptor.clone(),
             };
             let worker = Worker::new(job_id, deps);
 
@@ -314,14 +257,11 @@ impl Scheduler {
                 let context_manager = self.context_manager.clone();
                 let safety = self.safety.clone();
 
-                // TODO: propagate parent job's ApprovalContext here when subtasks
-                // are used in autonomous/routine paths (currently only used in tests).
                 tokio::spawn(async move {
                     let result = Self::execute_tool_task(
                         tools,
                         context_manager,
                         safety,
-                        None,
                         tool_parent_id,
                         &tool_name,
                         params,
@@ -450,7 +390,6 @@ impl Scheduler {
         tools: Arc<ToolRegistry>,
         context_manager: Arc<ContextManager>,
         safety: Arc<SafetyLayer>,
-        approval_context: Option<ApprovalContext>,
         job_id: Uuid,
         tool_name: &str,
         params: serde_json::Value,
@@ -474,10 +413,7 @@ impl Scheduler {
             .into());
         }
 
-        let requirement = tool.requires_approval(&params);
-        let blocked =
-            ApprovalContext::is_blocked_or_default(&approval_context, tool_name, requirement);
-        if blocked {
+        if tool.requires_approval(&params).is_required() {
             return Err(crate::error::ToolError::AuthRequired {
                 name: tool_name.to_string(),
             }
@@ -681,11 +617,6 @@ impl Scheduler {
 
 #[cfg(test)]
 mod tests {
-    use super::*;
-    use crate::config::SafetyConfig;
-    use crate::safety::SafetyLayer;
-    use crate::tools::{ApprovalRequirement, Tool, ToolError, ToolOutput};
-
     #[test]
     fn test_scheduler_creation() {
         // Would need to mock dependencies for proper testing
@@ -696,202 +627,4 @@ mod tests {
         // This test would need mock dependencies.
         // For now just verify the empty case doesn't panic.
     }
-
-    /// A tool that returns `UnlessAutoApproved`.
-    struct SoftApprovalTool;
-
-    #[async_trait::async_trait]
-    impl Tool for SoftApprovalTool {
-        fn name(&self) -> &str {
-            "soft_gate"
-        }
-        fn description(&self) -> &str {
-            "needs soft approval"
-        }
-        fn parameters_schema(&self) -> serde_json::Value {
-            serde_json::json!({"type": "object", "properties": {}})
-        }
-        async fn execute(
-            &self,
-            _params: serde_json::Value,
-            _ctx: &JobContext,
-        ) -> Result<ToolOutput, ToolError> {
-            Ok(ToolOutput::text(
-                "soft_ok",
-                std::time::Instant::now().elapsed(),
-            ))
-        }
-        fn requires_approval(&self, _params: &serde_json::Value) -> ApprovalRequirement {
-            ApprovalRequirement::UnlessAutoApproved
-        }
-        fn requires_sanitization(&self) -> bool {
-            false
-        }
-    }
-
-    /// A tool that returns `Always`.
-    struct HardApprovalTool;
-
-    #[async_trait::async_trait]
-    impl Tool for HardApprovalTool {
-        fn name(&self) -> &str {
-            "hard_gate"
-        }
-        fn description(&self) -> &str {
-            "needs hard approval"
-        }
-        fn parameters_schema(&self) -> serde_json::Value {
-            serde_json::json!({"type": "object", "properties": {}})
-        }
-        async fn execute(
-            &self,
-            _params: serde_json::Value,
-            _ctx: &JobContext,
-        ) -> Result<ToolOutput, ToolError> {
-            Ok(ToolOutput::text(
-                "hard_ok",
-                std::time::Instant::now().elapsed(),
-            ))
-        }
-        fn requires_approval(&self, _params: &serde_json::Value) -> ApprovalRequirement {
-            ApprovalRequirement::Always
-        }
-        fn requires_sanitization(&self) -> bool {
-            false
-        }
-    }
-
-    async fn setup_tools_and_job() -> (
-        Arc<ToolRegistry>,
-        Arc<ContextManager>,
-        Arc<SafetyLayer>,
-        Uuid,
-    ) {
-        let registry = ToolRegistry::new();
-        registry.register(Arc::new(SoftApprovalTool)).await;
-        registry.register(Arc::new(HardApprovalTool)).await;
-
-        let cm = Arc::new(ContextManager::new(5));
-        let job_id = cm.create_job("test", "approval test").await.unwrap();
-        cm.update_context(job_id, |ctx| ctx.transition_to(JobState::InProgress, None))
-            .await
-            .unwrap()
-            .unwrap();
-
-        let safety = Arc::new(SafetyLayer::new(&SafetyConfig {
-            max_output_length: 100_000,
-            injection_check_enabled: false,
-        }));
-
-        (Arc::new(registry), cm, safety, job_id)
-    }
-
-    #[tokio::test]
-    async fn test_execute_tool_task_blocks_without_context() {
-        let (tools, cm, safety, job_id) = setup_tools_and_job().await;
-
-        // Without approval context, UnlessAutoApproved is blocked
-        let result = Scheduler::execute_tool_task(
-            tools.clone(),
-            cm.clone(),
-            safety.clone(),
-            None,
-            job_id,
-            "soft_gate",
-            serde_json::json!({}),
-        )
-        .await;
-        assert!(
-            result.is_err(),
-            "soft_gate should be blocked without context"
-        );
-
-        // Always is also blocked
-        let result = Scheduler::execute_tool_task(
-            tools,
-            cm,
-            safety,
-            None,
-            job_id,
-            "hard_gate",
-            serde_json::json!({}),
-        )
-        .await;
-        assert!(
-            result.is_err(),
-            "hard_gate should be blocked without context"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_execute_tool_task_autonomous_unblocks_soft() {
-        let (tools, cm, safety, job_id) = setup_tools_and_job().await;
-
-        // Autonomous context auto-approves UnlessAutoApproved
-        let result = Scheduler::execute_tool_task(
-            tools.clone(),
-            cm.clone(),
-            safety.clone(),
-            Some(ApprovalContext::autonomous()),
-            job_id,
-            "soft_gate",
-            serde_json::json!({}),
-        )
-        .await;
-        assert!(
-            result.is_ok(),
-            "soft_gate should pass with autonomous context"
-        );
-
-        // But still blocks Always
-        let result = Scheduler::execute_tool_task(
-            tools,
-            cm,
-            safety,
-            Some(ApprovalContext::autonomous()),
-            job_id,
-            "hard_gate",
-            serde_json::json!({}),
-        )
-        .await;
-        assert!(
-            result.is_err(),
-            "hard_gate should still be blocked without explicit permission"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_execute_tool_task_autonomous_with_permissions() {
-        let (tools, cm, safety, job_id) = setup_tools_and_job().await;
-
-        // Autonomous context with explicit permission for hard_gate
-        let ctx = ApprovalContext::autonomous_with_tools(["hard_gate".to_string()]);
-
-        let result = Scheduler::execute_tool_task(
-            tools.clone(),
-            cm.clone(),
-            safety.clone(),
-            Some(ctx.clone()),
-            job_id,
-            "soft_gate",
-            serde_json::json!({}),
-        )
-        .await;
-        assert!(result.is_ok(), "soft_gate should pass");
-
-        let result = Scheduler::execute_tool_task(
-            tools,
-            cm,
-            safety,
-            Some(ctx),
-            job_id,
-            "hard_gate",
-            serde_json::json!({}),
-        )
-        .await;
-        assert!(
-            result.is_ok(),
-            "hard_gate should pass with explicit permission"
-        );
-    }
 }

src/agent/session.rs

@@ -164,10 +164,6 @@ pub struct PendingApproval {
     /// executed yet when approval was requested.
     #[serde(default)]
     pub deferred_tool_calls: Vec<ToolCall>,
-    /// User timezone at the time the approval was requested, so it persists
-    /// through the approval flow even if the approval message lacks timezone.
-    #[serde(default)]
-    pub user_timezone: Option<String>,
 }
 
 /// A conversation thread within a session.
@@ -324,14 +320,7 @@ impl Thread {
     pub fn messages(&self) -> Vec<ChatMessage> {
         let mut messages = Vec::new();
         for turn in &self.turns {
-            if turn.image_content_parts.is_empty() {
-                messages.push(ChatMessage::user(&turn.user_input));
-            } else {
-                messages.push(ChatMessage::user_with_parts(
-                    &turn.user_input,
-                    turn.image_content_parts.clone(),
-                ));
-            }
+            messages.push(ChatMessage::user(&turn.user_input));
             if let Some(ref response) = turn.response {
                 messages.push(ChatMessage::assistant(response));
             }
@@ -418,11 +407,6 @@ pub struct Turn {
     pub completed_at: Option<DateTime<Utc>>,
     /// Error message (if failed).
     pub error: Option<String>,
-    /// Transient image content parts for multimodal LLM input.
-    /// Not serialized — images are only needed for the current LLM call.
-    /// The text description in `user_input` persists for compaction/context.
-    #[serde(skip)]
-    pub image_content_parts: Vec<crate::llm::ContentPart>,
 }
 
 impl Turn {
@@ -437,7 +421,6 @@ impl Turn {
             started_at: Utc::now(),
             completed_at: None,
             error: None,
-            image_content_parts: Vec::new(),
         }
     }
 
@@ -446,8 +429,6 @@ impl Turn {
         self.response = Some(response.into());
         self.state = TurnState::Completed;
         self.completed_at = Some(Utc::now());
-        // Free image data — only needed for the initial LLM call, not subsequent turns
-        self.image_content_parts.clear();
     }
 
     /// Fail this turn.
@@ -455,14 +436,12 @@ impl Turn {
         self.error = Some(error.into());
         self.state = TurnState::Failed;
         self.completed_at = Some(Utc::now());
-        self.image_content_parts.clear();
     }
 
     /// Interrupt this turn.
     pub fn interrupt(&mut self) {
         self.state = TurnState::Interrupted;
         self.completed_at = Some(Utc::now());
-        self.image_content_parts.clear();
     }
 
     /// Record a tool call.
@@ -980,7 +959,6 @@ mod tests {
             tool_call_id: "call_123".to_string(),
             context_messages: vec![ChatMessage::user("do it")],
             deferred_tool_calls: vec![],
-            user_timezone: None,
         };
 
         thread.await_approval(approval);
@@ -1006,7 +984,6 @@ mod tests {
             tool_call_id: "call_456".to_string(),
             context_messages: vec![],
             deferred_tool_calls: vec![],
-            user_timezone: None,
         };
 
         thread.await_approval(approval);

src/agent/thread_ops.rs

@@ -230,7 +230,7 @@ impl Agent {
                     )
                     .await;
 
-                let compactor = ContextCompactor::new(self.llm().clone());
+                let compactor = ContextCompactor::new(self.llm().clone(), self.safety().clone());
                 if let Err(e) = compactor
                     .compact(thread, strategy, self.workspace().map(|w| w.as_ref()))
                     .await
@@ -257,14 +257,6 @@ impl Agent {
             );
         }
 
-        // Augment content with attachment context (transcripts, metadata, images)
-        let augmented =
-            crate::agent::attachments::augment_with_attachments(content, &message.attachments);
-        let (effective_content, image_parts) = match &augmented {
-            Some(result) => (result.text.as_str(), result.image_parts.clone()),
-            None => (content, Vec::new()),
-        };
-
         // Start the turn and get messages
         let turn_messages = {
             let mut sess = session.lock().await;
@@ -272,13 +264,12 @@ impl Agent {
                 .threads
                 .get_mut(&thread_id)
                 .ok_or_else(|| Error::from(crate::error::JobError::NotFound { id: thread_id }))?;
-            let turn = thread.start_turn(effective_content);
-            turn.image_content_parts = image_parts;
+            thread.start_turn(content);
             thread.messages()
         };
 
         // Persist user message to DB immediately so it survives crashes
-        self.persist_user_message(thread_id, &message.user_id, effective_content)
+        self.persist_user_message(thread_id, &message.user_id, content)
             .await;
 
         // Send thinking status
@@ -627,7 +618,7 @@ impl Agent {
                 crate::agent::context_monitor::CompactionStrategy::Summarize { keep_recent: 5 },
             );
 
-        let compactor = ContextCompactor::new(self.llm().clone());
+        let compactor = ContextCompactor::new(self.llm().clone(), self.safety().clone());
         match compactor
             .compact(thread, strategy, self.workspace().map(|w| w.as_ref()))
             .await
@@ -746,16 +737,6 @@ impl Agent {
             let mut job_ctx =
                 JobContext::with_user(&message.user_id, "chat", "Interactive chat session");
             job_ctx.http_interceptor = self.deps.http_interceptor.clone();
-            // Prefer a valid timezone from the approval message, fall back to the
-            // resolved timezone stored when the approval was originally requested.
-            let tz_candidate = message
-                .timezone
-                .as_deref()
-                .filter(|tz| crate::timezone::parse_timezone(tz).is_some())
-                .or(pending.user_timezone.as_deref());
-            if let Some(tz) = tz_candidate {
-                job_ctx.user_timezone = tz.to_string();
-            }
 
             let _ = self
                 .channels
@@ -1121,8 +1102,6 @@ impl Agent {
                     tool_call_id: tc.id.clone(),
                     context_messages: context_messages.clone(),
                     deferred_tool_calls: deferred_tool_calls[approval_idx + 1..].to_vec(),
-                    // Carry forward the resolved timezone from the original pending approval
-                    user_timezone: pending.user_timezone.clone(),
                 };
 
                 let request_id = new_pending.request_id;

src/agent/worker.rs

@@ -15,12 +15,11 @@ use crate::db::Database;
 use crate::error::Error;
 use crate::hooks::HookRegistry;
 use crate::llm::{
-    ActionPlan, ChatMessage, LlmProvider, Reasoning, ReasoningContext, RespondResult, ToolCall,
-    ToolSelection,
+    ActionPlan, ChatMessage, LlmProvider, Reasoning, ReasoningContext, RespondResult, ToolSelection,
 };
 use crate::safety::SafetyLayer;
 use crate::tools::rate_limiter::RateLimitResult;
-use crate::tools::{ApprovalContext, ToolRegistry, redact_params};
+use crate::tools::{ToolRegistry, redact_params};
 
 /// Shared dependencies for worker execution.
 ///
@@ -38,12 +37,6 @@ pub struct WorkerDeps {
     pub use_planning: bool,
     /// SSE broadcast sender for live job event streaming to the web gateway.
     pub sse_tx: Option<tokio::sync::broadcast::Sender<SseEvent>>,
-    /// Approval context for tool execution. When `None`, all non-`Never` tools are
-    /// blocked (legacy behavior). When `Some`, the context determines which tools
-    /// are pre-approved for autonomous execution.
-    pub approval_context: Option<ApprovalContext>,
-    /// HTTP interceptor for trace recording/replay (propagated to JobContext).
-    pub http_interceptor: Option<Arc<dyn crate::llm::recording::HttpInterceptor>>,
 }
 
 /// Worker that executes a single job.
@@ -212,7 +205,7 @@ impl Worker {
         let job_ctx = self.context_manager().get_context(self.job_id).await?;
 
         // Create reasoning engine
-        let reasoning = Reasoning::new(self.llm().clone());
+        let reasoning = Reasoning::new(self.llm().clone(), self.safety().clone());
 
         // Build initial reasoning context (tool definitions refreshed each iteration in execution_loop)
         let mut reason_ctx = ReasoningContext::new().with_job(&job_ctx.description);
@@ -253,9 +246,6 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                         // Already in a terminal state (e.g. execution_loop
                         // called mark_completed itself).
                     }
-                    Ok(JobState::Completed) => {
-                        // execution_loop already called mark_completed.
-                    }
                     Ok(JobState::Stuck) => {
                         // execution_loop marked this as stuck (e.g. "plan
                         // completed but work remains"); leave for self-repair.
@@ -306,8 +296,6 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
         let mut iteration = 0;
         const MAX_CONSECUTIVE_RATE_LIMITS: usize = 10;
         let mut consecutive_rate_limits = 0usize;
-        const MAX_TOOL_INTENT_NUDGES: u32 = 2;
-        let mut consecutive_tool_intent_nudges: u32 = 0;
 
         // Initial tool definitions for planning (will be refreshed in loop)
         reason_ctx.available_tools = self.tools().tool_definitions().await;
@@ -365,13 +353,11 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
         if let Some(ref plan) = plan {
             self.execute_plan(rx, reasoning, reason_ctx, plan).await?;
 
-            // If the plan marked the job completed, terminal, or stuck, we're
-            // done. Only fall through to the direct selection loop if the
-            // plan was interrupted or explicitly left the job in-progress.
+            // If the plan marked the job terminal, we're done. Only fall
+            // through to the direct selection loop if the plan was
+            // interrupted or explicitly left the job in-progress.
             if let Ok(ctx) = self.context_manager().get_context(self.job_id).await
-                && (ctx.state.is_terminal()
-                    || ctx.state == JobState::Stuck
-                    || ctx.state == JobState::Completed)
+                && (ctx.state.is_terminal() || ctx.state == JobState::Stuck)
             {
                 return Ok(());
             }
@@ -505,34 +491,17 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                             }),
                         );
 
-                        // Nudge the LLM if it expressed tool intent without calling tools
-                        let signals_intent = !reason_ctx.available_tools.is_empty()
-                            && crate::llm::llm_signals_tool_intent(&response);
-                        if signals_intent && consecutive_tool_intent_nudges < MAX_TOOL_INTENT_NUDGES
-                        {
-                            consecutive_tool_intent_nudges += 1;
-                            tracing::info!(
-                                job_id = %self.job_id,
-                                "LLM expressed tool intent without calling a tool, nudging"
-                            );
-                            reason_ctx
-                                .messages
-                                .push(ChatMessage::user(crate::llm::TOOL_INTENT_NUDGE));
-                        } else if !signals_intent {
-                            consecutive_tool_intent_nudges = 0;
-                            if iteration > 3 && iteration % 5 == 0 {
-                                // Generic fallback nudge
-                                reason_ctx.messages.push(ChatMessage::user(
-                                    "Are you stuck? Do you need help completing this job?",
-                                ));
-                            }
+                        // Give it one more chance to select a tool
+                        if iteration > 3 && iteration % 5 == 0 {
+                            reason_ctx.messages.push(ChatMessage::user(
+                                "Are you stuck? Do you need help completing this job?",
+                            ));
                         }
                     }
                     RespondResult::ToolCalls {
                         tool_calls,
                         content,
                     } => {
-                        consecutive_tool_intent_nudges = 0;
                         // Model returned tool calls - execute them
                         tracing::debug!(
                             "Job {} respond_with_tools returned {} tool calls",
@@ -577,54 +546,36 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                         }
                     }
                 }
+            } else if selections.len() == 1 {
+                // Single tool: execute directly
+                let selection = &selections[0];
+                tracing::debug!(
+                    "Job {} selecting tool: {} - {}",
+                    self.job_id,
+                    selection.tool_name,
+                    selection.reasoning
+                );
+
+                let result = self
+                    .execute_tool(&selection.tool_name, &selection.parameters)
+                    .await;
+
+                self.process_tool_result(reason_ctx, selection, result)
+                    .await?;
             } else {
-                consecutive_tool_intent_nudges = 0;
+                // Multiple tools: execute in parallel
+                tracing::debug!(
+                    "Job {} executing {} tools in parallel",
+                    self.job_id,
+                    selections.len()
+                );
 
-                // Record the assistant tool_calls message so that tool_result
-                // messages have a matching parent (prevents orphaned rewrites).
-                let tool_calls: Vec<ToolCall> = selections
-                    .iter()
-                    .map(|s| ToolCall {
-                        id: s.tool_call_id.clone(),
-                        name: s.tool_name.clone(),
-                        arguments: s.parameters.clone(),
-                    })
-                    .collect();
-                reason_ctx
-                    .messages
-                    .push(ChatMessage::assistant_with_tool_calls(None, tool_calls));
+                let results = self.execute_tools_parallel(&selections).await;
 
-                if selections.len() == 1 {
-                    // Single tool: execute directly
-                    let selection = &selections[0];
-                    tracing::debug!(
-                        "Job {} selecting tool: {} - {}",
-                        self.job_id,
-                        selection.tool_name,
-                        selection.reasoning
-                    );
-
-                    let result = self
-                        .execute_tool(&selection.tool_name, &selection.parameters)
-                        .await;
-
-                    self.process_tool_result(reason_ctx, selection, result)
+                // Process all results
+                for (selection, result) in selections.iter().zip(results) {
+                    self.process_tool_result(reason_ctx, selection, result.result)
                         .await?;
-                } else {
-                    // Multiple tools: execute in parallel
-                    tracing::debug!(
-                        "Job {} executing {} tools in parallel",
-                        self.job_id,
-                        selections.len()
-                    );
-
-                    let results = self.execute_tools_parallel(&selections).await;
-
-                    // Process all results
-                    for (selection, result) in selections.iter().zip(results) {
-                        self.process_tool_result(reason_ctx, selection, result.result)
-                            .await?;
-                    }
                 }
             }
 
@@ -720,11 +671,8 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                     name: tool_name.to_string(),
                 })?;
 
-        // Check approval: use context-aware check if available, else block all non-Never tools
-        let requirement = tool.requires_approval(params);
-        let blocked =
-            ApprovalContext::is_blocked_or_default(&deps.approval_context, tool_name, requirement);
-        if blocked {
+        // Tools requiring approval are blocked in autonomous jobs
+        if tool.requires_approval(params).is_required() {
             return Err(crate::error::ToolError::AuthRequired {
                 name: tool_name.to_string(),
             }
@@ -732,11 +680,7 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
         }
 
         // Fetch job context early so we have the real user_id for hooks and rate limiting
-        let mut job_ctx = deps.context_manager.get_context(job_id).await?;
-        // Propagate http_interceptor for trace recording/replay
-        if job_ctx.http_interceptor.is_none() {
-            job_ctx.http_interceptor = deps.http_interceptor.clone();
-        }
+        let job_ctx = deps.context_manager.get_context(job_id).await?;
 
         // Check per-tool rate limit before running hooks or executing (cheaper check first)
         if let Some(config) = tool.rate_limit_config()
@@ -1105,6 +1049,11 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                 action.reasoning
             );
 
+            // Execute the planned tool
+            let result = self
+                .execute_tool(&action.tool_name, &action.parameters)
+                .await;
+
             // Create a synthetic ToolSelection for process_tool_result.
             // Plan actions don't originate from an LLM tool_call response so
             // there is no real tool_call_id; generate a unique one.
@@ -1116,24 +1065,6 @@ Report when the job is complete or if you encounter issues you cannot resolve."#
                 tool_call_id: format!("plan_{}_{}", self.job_id, i),
             };
 
-            // Record the assistant tool_calls message so that the tool_result
-            // has a matching parent (prevents orphaned rewrites).
-            reason_ctx
-                .messages
-                .push(ChatMessage::assistant_with_tool_calls(
-                    None,
-                    vec![ToolCall {
-                        id: selection.tool_call_id.clone(),
-                        name: selection.tool_name.clone(),
-                        arguments: selection.parameters.clone(),
-                    }],
-                ));
-
-            // Execute the planned tool
-            let result = self
-                .execute_tool(&action.tool_name, &action.parameters)
-                .await;
-
             // Process the result
             let completed = self
                 .process_tool_result(reason_ctx, &selection, result)
@@ -1367,8 +1298,6 @@ mod tests {
             timeout: Duration::from_secs(30),
             use_planning: false,
             sse_tx: None,
-            approval_context: None,
-            http_interceptor: None,
         };
 
         Worker::new(job_id, deps)
@@ -1485,11 +1414,9 @@ mod tests {
             assert!(r.result.is_ok(), "Tool should succeed");
         }
         // Parallel should complete well under the sequential 600ms threshold.
-        // Use a generous bound (800ms) to avoid flaky failures on slow CI runners,
-        // while still proving parallelism (sequential would be >= 600ms on any machine).
         assert!(
-            elapsed < Duration::from_millis(800),
-            "Parallel execution took {:?}, expected < 800ms (sequential would be ~600ms)",
+            elapsed < Duration::from_millis(500),
+            "Parallel execution took {:?}, expected < 500ms",
             elapsed
         );
     }
@@ -1567,199 +1494,4 @@ mod tests {
             "Missing tool should produce an error, not a panic"
         );
     }
-
-    /// Verify that calling mark_completed on an already-Completed job returns
-    /// an error (Completed → Completed is an invalid state transition).
-    #[tokio::test]
-    async fn test_mark_completed_twice_returns_error() {
-        let worker = make_worker(vec![]).await;
-
-        // Transition to InProgress first (required by state machine)
-        worker
-            .context_manager()
-            .update_context(worker.job_id, |ctx| {
-                ctx.transition_to(JobState::InProgress, None)
-            })
-            .await
-            .unwrap()
-            .unwrap();
-
-        // First mark_completed should succeed
-        worker.mark_completed().await.unwrap();
-
-        // Verify state is Completed
-        let ctx = worker
-            .context_manager()
-            .get_context(worker.job_id)
-            .await
-            .unwrap();
-        assert_eq!(ctx.state, JobState::Completed);
-
-        // Second mark_completed should fail (Completed → Completed is invalid)
-        let result = worker.mark_completed().await;
-        assert!(
-            result.is_err(),
-            "Completed → Completed transition should be rejected by state machine"
-        );
-    }
-
-    /// Build a Worker with the given approval context.
-    async fn make_worker_with_approval(
-        tools: Vec<Arc<dyn Tool>>,
-        approval_context: Option<crate::tools::ApprovalContext>,
-    ) -> Worker {
-        let registry = ToolRegistry::new();
-        for t in tools {
-            registry.register(t).await;
-        }
-
-        let cm = Arc::new(crate::context::ContextManager::new(5));
-        let job_id = cm.create_job("test", "test job").await.unwrap();
-
-        let deps = WorkerDeps {
-            context_manager: cm,
-            llm: Arc::new(StubLlm),
-            safety: Arc::new(SafetyLayer::new(&SafetyConfig {
-                max_output_length: 100_000,
-                injection_check_enabled: false,
-            })),
-            tools: Arc::new(registry),
-            store: None,
-            hooks: Arc::new(crate::hooks::HookRegistry::new()),
-            timeout: Duration::from_secs(30),
-            use_planning: false,
-            sse_tx: None,
-            approval_context,
-            http_interceptor: None,
-        };
-
-        Worker::new(job_id, deps)
-    }
-
-    /// A tool that requires approval (UnlessAutoApproved).
-    struct ApprovalTool;
-
-    #[async_trait::async_trait]
-    impl Tool for ApprovalTool {
-        fn name(&self) -> &str {
-            "needs_approval"
-        }
-        fn description(&self) -> &str {
-            "Tool requiring approval"
-        }
-        fn parameters_schema(&self) -> serde_json::Value {
-            serde_json::json!({"type": "object", "properties": {}})
-        }
-        async fn execute(
-            &self,
-            _params: serde_json::Value,
-            _ctx: &crate::context::JobContext,
-        ) -> Result<ToolOutput, crate::tools::ToolError> {
-            Ok(ToolOutput::text(
-                "approved",
-                std::time::Instant::now().elapsed(),
-            ))
-        }
-        fn requires_approval(
-            &self,
-            _params: &serde_json::Value,
-        ) -> crate::tools::ApprovalRequirement {
-            crate::tools::ApprovalRequirement::UnlessAutoApproved
-        }
-        fn requires_sanitization(&self) -> bool {
-            false
-        }
-    }
-
-    /// A tool that always requires approval.
-    struct AlwaysApprovalTool;
-
-    #[async_trait::async_trait]
-    impl Tool for AlwaysApprovalTool {
-        fn name(&self) -> &str {
-            "always_approval"
-        }
-        fn description(&self) -> &str {
-            "Tool always requiring approval"
-        }
-        fn parameters_schema(&self) -> serde_json::Value {
-            serde_json::json!({"type": "object", "properties": {}})
-        }
-        async fn execute(
-            &self,
-            _params: serde_json::Value,
-            _ctx: &crate::context::JobContext,
-        ) -> Result<ToolOutput, crate::tools::ToolError> {
-            Ok(ToolOutput::text(
-                "always",
-                std::time::Instant::now().elapsed(),
-            ))
-        }
-        fn requires_approval(
-            &self,
-            _params: &serde_json::Value,
-        ) -> crate::tools::ApprovalRequirement {
-            crate::tools::ApprovalRequirement::Always
-        }
-        fn requires_sanitization(&self) -> bool {
-            false
-        }
-    }
-
-    #[tokio::test]
-    async fn test_approval_context_unblocks_unless_auto_approved() {
-        // Without approval context, UnlessAutoApproved is blocked
-        let worker_blocked = make_worker_with_approval(vec![Arc::new(ApprovalTool)], None).await;
-        let result = worker_blocked
-            .execute_tool("needs_approval", &serde_json::json!({}))
-            .await;
-        assert!(
-            result.is_err(),
-            "Should be blocked without approval context"
-        );
-
-        // With autonomous approval context, UnlessAutoApproved is allowed
-        let worker_allowed = make_worker_with_approval(
-            vec![Arc::new(ApprovalTool)],
-            Some(crate::tools::ApprovalContext::autonomous()),
-        )
-        .await;
-        let result = worker_allowed
-            .execute_tool("needs_approval", &serde_json::json!({}))
-            .await;
-        assert!(result.is_ok(), "Should be allowed with autonomous context");
-    }
-
-    #[tokio::test]
-    async fn test_approval_context_blocks_always_unless_permitted() {
-        // Autonomous context without tool_permissions blocks Always tools
-        let worker_blocked = make_worker_with_approval(
-            vec![Arc::new(AlwaysApprovalTool)],
-            Some(crate::tools::ApprovalContext::autonomous()),
-        )
-        .await;
-        let result = worker_blocked
-            .execute_tool("always_approval", &serde_json::json!({}))
-            .await;
-        assert!(
-            result.is_err(),
-            "Always tool should be blocked without permission"
-        );
-
-        // Autonomous context with tool_permissions allows Always tools
-        let worker_allowed = make_worker_with_approval(
-            vec![Arc::new(AlwaysApprovalTool)],
-            Some(crate::tools::ApprovalContext::autonomous_with_tools([
-                "always_approval".to_string(),
-            ])),
-        )
-        .await;
-        let result = worker_allowed
-            .execute_tool("always_approval", &serde_json::json!({}))
-            .await;
-        assert!(
-            result.is_ok(),
-            "Always tool should be allowed with permission"
-        );
-    }
 }

src/app.rs

@@ -244,31 +244,11 @@ impl AppBuilder {
         let master_key = match self.config.secrets.master_key() {
             Some(k) => k,
             None => {
-                // No secrets DB available, but we can still load tokens from
-                // OS credential stores (e.g., Anthropic OAuth via Claude Code's
-                // macOS Keychain / Linux ~/.claude/.credentials.json).
-                crate::config::inject_os_credentials();
-
                 // Consume unused handles
                 #[cfg(feature = "libsql")]
                 {
                     self.libsql_db.take();
                 }
-
-                // Re-resolve only the LLM config with OS credentials.
-                let store: Option<&(dyn crate::db::SettingsStore + Sync)> =
-                    self.db.as_ref().map(|db| db.as_ref() as _);
-                let toml_path = self.toml_path.as_deref();
-                if let Err(e) = self
-                    .config
-                    .re_resolve_llm(store, "default", toml_path)
-                    .await
-                {
-                    tracing::warn!(
-                        "Failed to re-resolve LLM config after OS credential injection: {e}"
-                    );
-                }
-
                 return Ok(());
             }
         };
@@ -311,16 +291,18 @@ impl AppBuilder {
             // Inject LLM API keys from encrypted storage
             crate::config::inject_llm_keys_from_secrets(secrets.as_ref(), "default").await;
 
-            // Re-resolve only the LLM config with newly available keys.
-            let store: Option<&(dyn crate::db::SettingsStore + Sync)> =
-                self.db.as_ref().map(|db| db.as_ref() as _);
-            let toml_path = self.toml_path.as_deref();
-            if let Err(e) = self
-                .config
-                .re_resolve_llm(store, "default", toml_path)
-                .await
-            {
-                tracing::warn!("Failed to re-resolve LLM config after secret injection: {e}");
+            // Re-resolve config with newly available keys
+            if let Some(ref db) = self.db {
+                let toml_path = self.toml_path.as_deref();
+                match Config::from_db_with_toml(db.as_ref(), "default", toml_path).await {
+                    Ok(refreshed) => {
+                        self.config = refreshed;
+                        tracing::debug!("LlmConfig re-resolved after secret injection");
+                    }
+                    Err(e) => {
+                        tracing::warn!("Failed to re-resolve config after secret injection: {}", e);
+                    }
+                }
             }
         }
 
@@ -386,43 +368,20 @@ impl AppBuilder {
             .embeddings
             .create_provider(&self.config.llm.nearai.base_url, self.session.clone());
 
-        // Create optional external vector store for workspace semantic search
-        let vector_store: Option<Arc<dyn crate::workspace::VectorStore>> = {
-            #[cfg(feature = "lancedb")]
-            {
-                if self.config.database.vector_backend == crate::config::VectorBackend::LanceDb {
-                    let path = self
-                        .config
-                        .database
-                        .lancedb_path
-                        .clone()
-                        .unwrap_or_else(crate::config::default_lancedb_path);
-                    let dim = embeddings.as_ref().map(|p| p.dimension());
-                    match crate::workspace::LanceDbVectorStore::new(path, dim).await {
-                        Ok(store) => {
-                            tracing::info!("LanceDB vector store connected for workspace search");
-                            Some(Arc::new(store) as Arc<dyn crate::workspace::VectorStore>)
-                        }
-                        Err(e) => {
-                            tracing::warn!("Failed to initialize LanceDB: {}", e);
-                            None
-                        }
-                    }
-                } else {
-                    None
-                }
-            }
-            #[cfg(not(feature = "lancedb"))]
-            {
-                if self.config.database.vector_backend == crate::config::VectorBackend::LanceDb {
-                    tracing::warn!(
-                        "VECTOR_BACKEND=lancedb but 'lancedb' feature not enabled; \
-                         falling back to built-in vector search"
-                    );
-                }
-                None
-            }
-        };
+        // Warn if libSQL backend is used with non-1536 embedding dimension.
+        if self.config.database.backend == crate::config::DatabaseBackend::LibSql
+            && self.config.embeddings.enabled
+            && self.config.embeddings.dimension != 1536
+        {
+            tracing::warn!(
+                configured_dimension = self.config.embeddings.dimension,
+                "Embedding dimension {} is not 1536. The libSQL schema uses \
+                 F32_BLOB(1536) which requires exactly 1536 dimensions. \
+                 Embedding storage will fail. Use PostgreSQL or set \
+                 EMBEDDING_DIMENSION=1536.",
+                self.config.embeddings.dimension
+            );
+        }
 
         // Register memory tools if database is available
         let workspace = if let Some(ref db) = self.db {
@@ -430,9 +389,6 @@ impl AppBuilder {
             if let Some(ref emb) = embeddings {
                 ws = ws.with_embeddings(emb.clone());
             }
-            if let Some(ref vs) = vector_store {
-                ws = ws.with_vector_store(vs.clone());
-            }
             let ws = Arc::new(ws);
             tools.register_memory_tools(Arc::clone(&ws));
             Some(ws)
@@ -445,7 +401,11 @@ impl AppBuilder {
             && (self.config.agent.allow_local_tools || !self.config.sandbox.enabled)
         {
             tools
-                .register_builder_tool(llm.clone(), Some(self.config.builder.to_builder_config()))
+                .register_builder_tool(
+                    llm.clone(),
+                    safety.clone(),
+                    Some(self.config.builder.to_builder_config()),
+                )
                 .await;
             tracing::info!("Builder mode enabled");
         }
@@ -720,17 +680,6 @@ impl AppBuilder {
         self.init_database().await?;
         self.init_secrets().await?;
 
-        // Post-init validation: if a non-nearai backend was selected but
-        // credentials were never resolved (deferred resolution found no keys),
-        // fail early with a clear error instead of a confusing runtime failure.
-        if self.config.llm.backend != "nearai" && self.config.llm.provider.is_none() {
-            let backend = &self.config.llm.backend;
-            anyhow::bail!(
-                "LLM_BACKEND={backend} is configured but no credentials were found. \
-                 Set the appropriate API key environment variable or run the setup wizard."
-            );
-        }
-
         let (llm, cheap_llm, recording_handle) = if let Some(llm) = self.llm_override.take() {
             (llm, None, None)
         } else {

src/bootstrap.rs

@@ -414,103 +414,10 @@ pub enum MigrationError {
     Io(String),
 }
 
-// ── PID Lock ──────────────────────────────────────────────────────────────
-
-/// Path to the PID lock file: `~/.ironclaw/ironclaw.pid`.
-pub fn pid_lock_path() -> PathBuf {
-    ironclaw_base_dir().join("ironclaw.pid")
-}
-
-/// A PID-based lock that prevents multiple IronClaw instances from running
-/// simultaneously.
-///
-/// Uses `fs4::try_lock_exclusive()` for atomic locking (no TOCTOU race),
-/// then writes the current PID into the locked file for diagnostics.
-/// The OS-level lock is held for the lifetime of this struct and
-/// automatically released on drop (along with the PID file cleanup).
-#[derive(Debug)]
-pub struct PidLock {
-    path: PathBuf,
-    /// Held open to maintain the OS-level exclusive lock.
-    _file: std::fs::File,
-}
-
-/// Errors from PID lock acquisition.
-#[derive(Debug, thiserror::Error)]
-pub enum PidLockError {
-    #[error("Another IronClaw instance is already running (PID {pid})")]
-    AlreadyRunning { pid: u32 },
-    #[error("Failed to acquire PID lock: {0}")]
-    Io(#[from] std::io::Error),
-}
-
-impl PidLock {
-    /// Try to acquire the PID lock.
-    ///
-    /// Uses an exclusive file lock (`flock`/`LockFileEx`) so that two
-    /// concurrent processes cannot both acquire the lock — no TOCTOU race.
-    /// If the lock file exists but the holding process is gone (stale),
-    /// the lock is reclaimed automatically by the OS.
-    pub fn acquire() -> Result<Self, PidLockError> {
-        Self::acquire_at(pid_lock_path())
-    }
-
-    /// Acquire at a specific path (for testing).
-    fn acquire_at(path: PathBuf) -> Result<Self, PidLockError> {
-        use fs4::FileExt;
-        use std::fs::OpenOptions;
-        use std::io::Write;
-
-        // Ensure parent directory exists
-        if let Some(parent) = path.parent() {
-            std::fs::create_dir_all(parent)?;
-        }
-
-        // Open (or create) the lock file
-        let mut file = OpenOptions::new()
-            .read(true)
-            .write(true)
-            .create(true)
-            .truncate(false)
-            .open(&path)?;
-
-        // Try non-blocking exclusive lock — if another process holds it,
-        // this fails immediately instead of blocking.
-        if let Err(e) = file.try_lock_exclusive() {
-            if e.kind() == std::io::ErrorKind::WouldBlock {
-                // Lock held by another process — read its PID for the error message
-                let pid = std::fs::read_to_string(&path)
-                    .ok()
-                    .and_then(|s| s.trim().parse::<u32>().ok())
-                    .unwrap_or(0);
-                return Err(PidLockError::AlreadyRunning { pid });
-            }
-            // Other errors (permissions, unsupported filesystem, etc.)
-            return Err(PidLockError::Io(e));
-        }
-
-        // We hold the exclusive lock — write our PID
-        file.set_len(0)?; // truncate
-        write!(file, "{}", std::process::id())?;
-
-        Ok(PidLock { path, _file: file })
-    }
-}
-
-impl Drop for PidLock {
-    fn drop(&mut self) {
-        // Remove the PID file; the OS-level lock is released when _file is dropped.
-        let _ = std::fs::remove_file(&self.path);
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::process::Command;
     use std::sync::Mutex;
-    use std::thread;
-    use std::time::{Duration, Instant};
     use tempfile::tempdir;
 
     static ENV_MUTEX: Mutex<()> = Mutex::new(());
@@ -1079,162 +986,4 @@ INJECTED="pwned"#;
             unsafe { std::env::remove_var("IRONCLAW_BASE_DIR") };
         }
     }
-
-    // ── PID Lock tests ───────────────────────────────────────────────
-
-    #[test]
-    fn test_pid_lock_acquire_and_drop() {
-        let dir = tempdir().unwrap();
-        let pid_path = dir.path().join("ironclaw.pid");
-
-        // Acquire lock
-        let lock = PidLock::acquire_at(pid_path.clone()).unwrap();
-        assert!(pid_path.exists());
-
-        // PID file should contain our PID
-        let contents = std::fs::read_to_string(&pid_path).unwrap();
-        assert_eq!(contents.trim().parse::<u32>().unwrap(), std::process::id());
-
-        // Drop should remove the file
-        drop(lock);
-        assert!(!pid_path.exists());
-    }
-
-    #[test]
-    fn test_pid_lock_rejects_second_acquire() {
-        let dir = tempdir().unwrap();
-        let pid_path = dir.path().join("ironclaw.pid");
-
-        // First lock succeeds
-        let _lock1 = PidLock::acquire_at(pid_path.clone()).unwrap();
-
-        // Second acquire on same file must fail (exclusive flock held)
-        let result = PidLock::acquire_at(pid_path.clone());
-        assert!(result.is_err());
-        match result.unwrap_err() {
-            PidLockError::AlreadyRunning { pid } => {
-                assert_eq!(pid, std::process::id());
-            }
-            other => panic!("expected AlreadyRunning, got: {}", other),
-        }
-    }
-
-    #[test]
-    fn test_pid_lock_reclaims_after_drop() {
-        let dir = tempdir().unwrap();
-        let pid_path = dir.path().join("ironclaw.pid");
-
-        // Acquire and release
-        let lock = PidLock::acquire_at(pid_path.clone()).unwrap();
-        drop(lock);
-
-        // Should succeed — OS lock was released on drop
-        let lock2 = PidLock::acquire_at(pid_path).unwrap();
-        drop(lock2);
-    }
-
-    #[test]
-    fn test_pid_lock_reclaims_stale_file_without_flock() {
-        let dir = tempdir().unwrap();
-        let pid_path = dir.path().join("ironclaw.pid");
-
-        // Write a stale PID file manually (no flock held)
-        std::fs::write(&pid_path, "4294967294").unwrap();
-
-        // Should succeed because no OS lock is held on the file
-        let lock = PidLock::acquire_at(pid_path.clone()).unwrap();
-        let contents = std::fs::read_to_string(&pid_path).unwrap();
-        assert_eq!(contents.trim().parse::<u32>().unwrap(), std::process::id());
-        drop(lock);
-    }
-
-    #[test]
-    fn test_pid_lock_handles_corrupt_pid_file() {
-        let dir = tempdir().unwrap();
-        let pid_path = dir.path().join("ironclaw.pid");
-
-        // Write garbage (no flock held)
-        std::fs::write(&pid_path, "not-a-number").unwrap();
-
-        // Should succeed — no OS lock held, file is reclaimed
-        let lock = PidLock::acquire_at(pid_path).unwrap();
-        drop(lock);
-    }
-
-    #[test]
-    fn test_pid_lock_creates_parent_dirs() {
-        let dir = tempdir().unwrap();
-        let pid_path = dir.path().join("nested").join("deep").join("ironclaw.pid");
-
-        let lock = PidLock::acquire_at(pid_path.clone()).unwrap();
-        assert!(pid_path.exists());
-        drop(lock);
-    }
-
-    #[test]
-    fn test_pid_lock_child_helper_holds_lock() {
-        if std::env::var("IRONCLAW_PID_LOCK_CHILD").ok().as_deref() != Some("1") {
-            return;
-        }
-
-        let pid_path = PathBuf::from(
-            std::env::var("IRONCLAW_PID_LOCK_PATH").expect("IRONCLAW_PID_LOCK_PATH missing"),
-        );
-        let hold_ms = std::env::var("IRONCLAW_PID_LOCK_HOLD_MS")
-            .ok()
-            .and_then(|s| s.parse::<u64>().ok())
-            .unwrap_or(3000);
-
-        let _lock = PidLock::acquire_at(pid_path).expect("child failed to acquire pid lock");
-        thread::sleep(Duration::from_millis(hold_ms));
-    }
-
-    #[test]
-    fn test_pid_lock_rejects_lock_held_by_other_process() {
-        let dir = tempdir().unwrap();
-        let pid_path = dir.path().join("ironclaw.pid");
-
-        let current_exe = std::env::current_exe().unwrap();
-        let mut child = Command::new(current_exe)
-            .args([
-                "--exact",
-                "bootstrap::tests::test_pid_lock_child_helper_holds_lock",
-                "--nocapture",
-                "--test-threads=1",
-            ])
-            .env("IRONCLAW_PID_LOCK_CHILD", "1")
-            .env("IRONCLAW_PID_LOCK_PATH", pid_path.display().to_string())
-            .env("IRONCLAW_PID_LOCK_HOLD_MS", "3000")
-            .spawn()
-            .unwrap();
-
-        let started = Instant::now();
-        while started.elapsed() < Duration::from_secs(2) {
-            if pid_path.exists() {
-                break;
-            }
-            if let Some(status) = child.try_wait().unwrap() {
-                panic!("child exited before acquiring lock: {}", status);
-            }
-            thread::sleep(Duration::from_millis(20));
-        }
-        assert!(
-            pid_path.exists(),
-            "child did not create lock file in time: {}",
-            pid_path.display()
-        );
-
-        let result = PidLock::acquire_at(pid_path.clone());
-        match result.unwrap_err() {
-            PidLockError::AlreadyRunning { .. } => {}
-            other => panic!("expected AlreadyRunning, got: {}", other),
-        }
-
-        let status = child.wait().unwrap();
-        assert!(status.success(), "child process failed: {}", status);
-
-        // After the child exits, lock should be released and reacquirable.
-        let lock = PidLock::acquire_at(pid_path).unwrap();
-        drop(lock);
-    }
 }

src/channels/channel.rs

@@ -10,56 +10,6 @@ use uuid::Uuid;
 
 use crate::error::ChannelError;
 
-/// Kind of attachment carried on an incoming message.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum AttachmentKind {
-    /// Audio content (voice notes, audio files).
-    Audio,
-    /// Image content (photos, screenshots).
-    Image,
-    /// Document content (PDFs, files).
-    Document,
-}
-
-impl AttachmentKind {
-    /// Infer attachment kind from MIME type.
-    pub fn from_mime_type(mime: &str) -> Self {
-        let base = mime.split(';').next().unwrap_or(mime).trim();
-        if base.starts_with("audio/") {
-            Self::Audio
-        } else if base.starts_with("image/") {
-            Self::Image
-        } else {
-            Self::Document
-        }
-    }
-}
-
-/// A file or media attachment on an incoming message.
-#[derive(Debug, Clone)]
-pub struct IncomingAttachment {
-    /// Unique identifier within the channel (e.g., Telegram file_id).
-    pub id: String,
-    /// What kind of content this is.
-    pub kind: AttachmentKind,
-    /// MIME type (e.g., "image/jpeg", "audio/ogg", "application/pdf").
-    pub mime_type: String,
-    /// Original filename, if known.
-    pub filename: Option<String>,
-    /// File size in bytes, if known.
-    pub size_bytes: Option<u64>,
-    /// URL to download the file from the channel's API.
-    pub source_url: Option<String>,
-    /// Opaque key for host-side storage (e.g., after download/caching).
-    pub storage_key: Option<String>,
-    /// Extracted text content (e.g., OCR result, PDF text, audio transcript).
-    pub extracted_text: Option<String>,
-    /// Raw file bytes (for small files downloaded by the channel).
-    pub data: Vec<u8>,
-    /// Duration in seconds (for audio/video).
-    pub duration_secs: Option<u32>,
-}
-
 /// A message received from an external channel.
 #[derive(Debug, Clone)]
 pub struct IncomingMessage {
@@ -79,10 +29,6 @@ pub struct IncomingMessage {
     pub received_at: DateTime<Utc>,
     /// Channel-specific metadata.
     pub metadata: serde_json::Value,
-    /// IANA timezone string from the client (e.g. "America/New_York").
-    pub timezone: Option<String>,
-    /// File or media attachments on this message.
-    pub attachments: Vec<IncomingAttachment>,
 }
 
 impl IncomingMessage {
@@ -101,8 +47,6 @@ impl IncomingMessage {
             thread_id: None,
             received_at: Utc::now(),
             metadata: serde_json::Value::Null,
-            timezone: None,
-            attachments: Vec::new(),
         }
     }
 
@@ -123,18 +67,6 @@ impl IncomingMessage {
         self.user_name = Some(name.into());
         self
     }
-
-    /// Set the client timezone.
-    pub fn with_timezone(mut self, tz: impl Into<String>) -> Self {
-        self.timezone = Some(tz.into());
-        self
-    }
-
-    /// Set attachments.
-    pub fn with_attachments(mut self, attachments: Vec<IncomingAttachment>) -> Self {
-        self.attachments = attachments;
-        self
-    }
 }
 
 /// Stream of incoming messages.
@@ -463,10 +395,4 @@ mod tests {
             panic!("expected ToolCompleted variant");
         }
     }
-
-    #[test]
-    fn test_incoming_message_with_timezone() {
-        let msg = IncomingMessage::new("test", "user1", "hello").with_timezone("America/New_York");
-        assert_eq!(msg.timezone.as_deref(), Some("America/New_York"));
-    }
 }

src/channels/manager.rs

@@ -235,106 +235,3 @@ impl Default for ChannelManager {
         Self::new()
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::channels::IncomingMessage;
-    use crate::testing::StubChannel;
-    use futures::StreamExt;
-
-    #[tokio::test]
-    async fn test_add_and_start_all() {
-        let manager = ChannelManager::new();
-        let (stub, sender) = StubChannel::new("test");
-
-        manager.add(Box::new(stub)).await;
-
-        let mut stream = manager.start_all().await.expect("start_all failed");
-
-        // Inject a message through the stub
-        sender
-            .send(IncomingMessage::new("test", "user1", "hello"))
-            .await
-            .expect("send failed");
-
-        // Should appear in the merged stream
-        let msg = stream.next().await.expect("stream ended");
-        assert_eq!(msg.content, "hello");
-        assert_eq!(msg.channel, "test");
-    }
-
-    #[tokio::test]
-    async fn test_respond_routes_to_correct_channel() {
-        let manager = ChannelManager::new();
-        let (stub, _sender) = StubChannel::new("alpha");
-
-        // Keep a reference for response inspection
-        let responses = stub.captured_responses_handle();
-        manager.add(Box::new(stub)).await;
-
-        let msg = IncomingMessage::new("alpha", "user1", "request");
-        manager
-            .respond(&msg, OutgoingResponse::text("reply"))
-            .await
-            .expect("respond failed");
-
-        // Verify the stub captured the response
-        let captured = responses.lock().expect("poisoned");
-        assert_eq!(captured.len(), 1);
-        assert_eq!(captured[0].1.content, "reply");
-    }
-
-    #[tokio::test]
-    async fn test_respond_unknown_channel_errors() {
-        let manager = ChannelManager::new();
-        let msg = IncomingMessage::new("nonexistent", "user1", "test");
-        let result = manager.respond(&msg, OutgoingResponse::text("hi")).await;
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn test_health_check_all() {
-        let manager = ChannelManager::new();
-        let (stub1, _) = StubChannel::new("healthy");
-        let (stub2, _) = StubChannel::new("sick");
-        stub2.set_healthy(false);
-
-        manager.add(Box::new(stub1)).await;
-        manager.add(Box::new(stub2)).await;
-
-        let results = manager.health_check_all().await;
-        assert!(results["healthy"].is_ok());
-        assert!(results["sick"].is_err());
-    }
-
-    #[tokio::test]
-    async fn test_start_all_no_channels_errors() {
-        let manager = ChannelManager::new();
-        let result = manager.start_all().await;
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn test_injection_channel_merges() {
-        let manager = ChannelManager::new();
-        let (stub, _sender) = StubChannel::new("real");
-        manager.add(Box::new(stub)).await;
-
-        let mut stream = manager.start_all().await.expect("start_all failed");
-
-        // Use the injection channel (simulating background task)
-        let inject_tx = manager.inject_sender();
-        inject_tx
-            .send(IncomingMessage::new(
-                "injected",
-                "system",
-                "background alert",
-            ))
-            .await
-            .expect("inject failed");
-
-        let msg = stream.next().await.expect("stream ended");
-        assert_eq!(msg.content, "background alert");
-    }
-}

src/channels/mod.rs

@@ -36,10 +36,7 @@ pub mod wasm;
 pub mod web;
 mod webhook_server;
 
-pub use channel::{
-    AttachmentKind, Channel, IncomingAttachment, IncomingMessage, MessageStream, OutgoingResponse,
-    StatusUpdate,
-};
+pub use channel::{Channel, IncomingMessage, MessageStream, OutgoingResponse, StatusUpdate};
 pub use http::HttpChannel;
 pub use manager::ChannelManager;
 pub use repl::ReplChannel;

src/channels/repl.rs

@@ -18,7 +18,7 @@
 //! - `Esc` - Interrupt current operation
 
 use std::borrow::Cow;
-use std::io::{self, IsTerminal, Write};
+use std::io::{self, Write};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 
@@ -297,15 +297,10 @@ impl Channel for ReplChannel {
         let esc_interrupt_triggered_for_thread = Arc::new(AtomicBool::new(false));
 
         std::thread::spawn(move || {
-            let sys_tz = crate::timezone::detect_system_timezone().name().to_string();
-
             // Single message mode: send it and return
             if let Some(msg) = single_message {
-                let incoming = IncomingMessage::new("repl", "default", &msg).with_timezone(&sys_tz);
+                let incoming = IncomingMessage::new("repl", "default", &msg);
                 let _ = tx.blocking_send(incoming);
-                // Ensure the agent exits after handling exactly one turn in -m mode,
-                // even when other channels (gateway/http) are enabled.
-                let _ = tx.blocking_send(IncomingMessage::new("repl", "default", "/quit"));
                 return;
             }
 
@@ -366,8 +361,7 @@ impl Channel for ReplChannel {
                             "/quit" | "/exit" => {
                                 // Forward shutdown command so the agent loop exits even
                                 // when other channels (e.g. web gateway) are still active.
-                                let msg = IncomingMessage::new("repl", "default", "/quit")
-                                    .with_timezone(&sys_tz);
+                                let msg = IncomingMessage::new("repl", "default", "/quit");
                                 let _ = tx.blocking_send(msg);
                                 break;
                             }
@@ -388,8 +382,7 @@ impl Channel for ReplChannel {
                             _ => {}
                         }
 
-                        let msg =
-                            IncomingMessage::new("repl", "default", line).with_timezone(&sys_tz);
+                        let msg = IncomingMessage::new("repl", "default", line);
                         if tx.blocking_send(msg).is_err() {
                             break;
                         }
@@ -397,29 +390,21 @@ impl Channel for ReplChannel {
                     Err(ReadlineError::Interrupted) => {
                         if esc_interrupt_triggered_for_thread.swap(false, Ordering::Relaxed) {
                             // Esc: interrupt current operation and keep REPL open.
-                            let msg = IncomingMessage::new("repl", "default", "/interrupt")
-                                .with_timezone(&sys_tz);
+                            let msg = IncomingMessage::new("repl", "default", "/interrupt");
                             if tx.blocking_send(msg).is_err() {
                                 break;
                             }
                         } else {
                             // Ctrl+C (VINTR): request graceful shutdown.
-                            let msg = IncomingMessage::new("repl", "default", "/quit")
-                                .with_timezone(&sys_tz);
+                            let msg = IncomingMessage::new("repl", "default", "/quit");
                             let _ = tx.blocking_send(msg);
                             break;
                         }
                     }
                     Err(ReadlineError::Eof) => {
-                        // Ctrl+D in interactive mode: graceful shutdown.
-                        // In daemon mode (stdin = /dev/null, no TTY), EOF arrives
-                        // immediately — just drop the REPL thread silently so other
-                        // channels (gateway, telegram, …) keep running.
-                        if std::io::stdin().is_terminal() {
-                            let msg = IncomingMessage::new("repl", "default", "/quit")
-                                .with_timezone(&sys_tz);
-                            let _ = tx.blocking_send(msg);
-                        }
+                        // Ctrl+D: send /quit so the agent loop runs graceful shutdown
+                        let msg = IncomingMessage::new("repl", "default", "/quit");
+                        let _ = tx.blocking_send(msg);
                         break;
                     }
                     Err(e) => {
@@ -629,29 +614,3 @@ impl Channel for ReplChannel {
         Ok(())
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use futures::StreamExt;
-
-    use super::*;
-
-    #[tokio::test]
-    async fn single_message_mode_sends_message_then_quit() {
-        let repl = ReplChannel::with_message("hi".to_string());
-        let mut stream = repl.start().await.expect("repl start should succeed");
-
-        let first = stream.next().await.expect("first message missing");
-        assert_eq!(first.channel, "repl");
-        assert_eq!(first.content, "hi");
-
-        let second = stream.next().await.expect("quit message missing");
-        assert_eq!(second.channel, "repl");
-        assert_eq!(second.content, "/quit");
-
-        assert!(
-            stream.next().await.is_none(),
-            "stream should end after /quit"
-        );
-    }
-}

src/channels/wasm/host.rs

@@ -5,7 +5,6 @@
 //! - Workspace write access (scoped to channel namespace)
 //! - Rate limiting for message emission
 
-use std::collections::HashMap;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use crate::channels::wasm::capabilities::{ChannelCapabilities, EmitRateLimitConfig};
@@ -18,52 +17,6 @@ const MAX_EMITS_PER_EXECUTION: usize = 100;
 /// Maximum message content size (64 KB).
 const MAX_MESSAGE_CONTENT_SIZE: usize = 64 * 1024;
 
-/// A file or media attachment on an incoming message.
-#[derive(Debug, Clone)]
-pub struct Attachment {
-    /// Unique identifier within the channel (e.g., Telegram file_id).
-    pub id: String,
-    /// MIME type (e.g., "image/jpeg", "audio/ogg", "application/pdf").
-    pub mime_type: String,
-    /// Original filename, if known.
-    pub filename: Option<String>,
-    /// File size in bytes, if known.
-    pub size_bytes: Option<u64>,
-    /// URL to download the file from the channel's API.
-    pub source_url: Option<String>,
-    /// Opaque key for host-side storage (e.g., after download/caching).
-    pub storage_key: Option<String>,
-    /// Extracted text content (e.g., OCR result, PDF text, audio transcript).
-    pub extracted_text: Option<String>,
-    /// Raw file bytes (for small files downloaded by the channel).
-    pub data: Vec<u8>,
-    /// Duration in seconds (for audio/video).
-    pub duration_secs: Option<u32>,
-}
-
-/// Maximum total attachment size per message (20 MB).
-const MAX_ATTACHMENT_TOTAL_SIZE: u64 = 20 * 1024 * 1024;
-
-/// Maximum number of attachments per message.
-const MAX_ATTACHMENTS_PER_MESSAGE: usize = 10;
-
-/// Allowed MIME type prefixes for attachments.
-const ALLOWED_MIME_PREFIXES: &[&str] = &[
-    "image/",
-    "audio/",
-    "video/",
-    "application/pdf",
-    "application/vnd.",
-    "application/msword",
-    "application/rtf",
-    "text/",
-    "application/json",
-    "application/zip",
-    "application/gzip",
-    "application/x-tar",
-    "application/octet-stream",
-];
-
 /// A message emitted by a WASM channel to be sent to the agent.
 #[derive(Debug, Clone)]
 pub struct EmittedMessage {
@@ -82,9 +35,6 @@ pub struct EmittedMessage {
     /// Channel-specific metadata as JSON string.
     pub metadata_json: String,
 
-    /// File or media attachments on this message.
-    pub attachments: Vec<Attachment>,
-
     /// Timestamp when the message was emitted.
     pub emitted_at_millis: u64,
 }
@@ -98,7 +48,6 @@ impl EmittedMessage {
             content: content.into(),
             thread_id: None,
             metadata_json: "{}".to_string(),
-            attachments: Vec::new(),
             emitted_at_millis: SystemTime::now()
                 .duration_since(UNIX_EPOCH)
                 .map(|d| d.as_millis() as u64)
@@ -123,12 +72,6 @@ impl EmittedMessage {
         self.metadata_json = metadata_json.into();
         self
     }
-
-    /// Set attachments.
-    pub fn with_attachments(mut self, attachments: Vec<Attachment>) -> Self {
-        self.attachments = attachments;
-        self
-    }
 }
 
 /// A pending workspace write operation.
@@ -169,13 +112,6 @@ pub struct ChannelHostState {
 
     /// Count of emits dropped due to rate limiting.
     emits_dropped: usize,
-
-    /// Binary data stored for attachments via `store-attachment-data`.
-    /// Keyed by attachment ID, cleared after callback completes.
-    attachment_data: HashMap<String, Vec<u8>>,
-
-    /// Total bytes stored in attachment_data (for enforcing limits).
-    attachment_data_total: u64,
 }
 
 impl std::fmt::Debug for ChannelHostState {
@@ -205,8 +141,6 @@ impl ChannelHostState {
             emit_count: 0,
             emit_enabled: true,
             emits_dropped: 0,
-            attachment_data: HashMap::new(),
-            attachment_data_total: 0,
         }
     }
 
@@ -234,7 +168,6 @@ impl ChannelHostState {
     ///
     /// Messages are queued and delivered after callback execution completes.
     /// Rate limiting is enforced per-execution and globally.
-    /// Attachments are validated for count, total size, and MIME type.
     pub fn emit_message(&mut self, msg: EmittedMessage) -> Result<(), WasmChannelError> {
         // Check per-execution limit
         if !self.emit_enabled {
@@ -253,9 +186,6 @@ impl ChannelHostState {
             return Ok(());
         }
 
-        // Validate attachments
-        let msg = self.validate_attachments(msg);
-
         // Validate message content size
         if msg.content.len() > MAX_MESSAGE_CONTENT_SIZE {
             tracing::warn!(
@@ -279,71 +209,6 @@ impl ChannelHostState {
         Ok(())
     }
 
-    /// Validate and sanitize attachments on an emitted message.
-    ///
-    /// Enforces count limits, total size limits, and MIME type allowlist.
-    /// Invalid attachments are dropped with a warning.
-    fn validate_attachments(&self, mut msg: EmittedMessage) -> EmittedMessage {
-        if msg.attachments.is_empty() {
-            return msg;
-        }
-
-        // Enforce attachment count limit
-        if msg.attachments.len() > MAX_ATTACHMENTS_PER_MESSAGE {
-            tracing::warn!(
-                channel = %self.channel_name,
-                count = msg.attachments.len(),
-                max = MAX_ATTACHMENTS_PER_MESSAGE,
-                "Too many attachments, truncating"
-            );
-            msg.attachments.truncate(MAX_ATTACHMENTS_PER_MESSAGE);
-        }
-
-        // Filter by MIME type and enforce total size limit
-        let mut total_size: u64 = 0;
-        msg.attachments.retain(|att| {
-            let mime_ok = ALLOWED_MIME_PREFIXES
-                .iter()
-                .any(|prefix| att.mime_type.starts_with(prefix));
-            if !mime_ok {
-                tracing::warn!(
-                    channel = %self.channel_name,
-                    mime_type = %att.mime_type,
-                    "Attachment MIME type not allowed, dropping"
-                );
-                return false;
-            }
-
-            // Use the larger of reported size_bytes and actual stored data size
-            // to prevent WASM channels from under-reporting to bypass limits.
-            let stored_size = self
-                .attachment_data
-                .get(&att.id)
-                .map(|d| d.len() as u64)
-                .unwrap_or(att.data.len() as u64);
-            let size = att
-                .size_bytes
-                .map(|reported| reported.max(stored_size))
-                .unwrap_or(stored_size);
-            if size > 0 {
-                total_size = total_size.saturating_add(size);
-                if total_size > MAX_ATTACHMENT_TOTAL_SIZE {
-                    tracing::warn!(
-                        channel = %self.channel_name,
-                        total_size,
-                        max = MAX_ATTACHMENT_TOTAL_SIZE,
-                        "Attachment total size exceeded, dropping"
-                    );
-                    return false;
-                }
-            }
-
-            true
-        });
-
-        msg
-    }
-
     /// Take all emitted messages (clears the queue).
     pub fn take_emitted_messages(&mut self) -> Vec<EmittedMessage> {
         std::mem::take(&mut self.emitted_messages)
@@ -359,69 +224,6 @@ impl ChannelHostState {
         self.emits_dropped
     }
 
-    /// Store binary data for an attachment.
-    ///
-    /// Called by WASM channels to associate downloaded bytes with an attachment ID.
-    /// The data is retrieved after callback completion and merged into `Attachment::data`.
-    pub fn store_attachment_data(
-        &mut self,
-        attachment_id: &str,
-        data: Vec<u8>,
-    ) -> Result<(), WasmChannelError> {
-        const MAX_PER_ATTACHMENT: u64 = 20 * 1024 * 1024; // 20 MB
-        const MAX_TOTAL: u64 = 50 * 1024 * 1024; // 50 MB
-
-        let size = data.len() as u64;
-        if size > MAX_PER_ATTACHMENT {
-            return Err(WasmChannelError::CallbackFailed {
-                name: self.channel_name.clone(),
-                reason: format!(
-                    "Attachment data too large: {} bytes (max {})",
-                    size, MAX_PER_ATTACHMENT
-                ),
-            });
-        }
-
-        // Subtract the old entry size (if overwriting) before adding new size
-        let old_size = self
-            .attachment_data
-            .get(attachment_id)
-            .map(|d| d.len() as u64)
-            .unwrap_or(0);
-        let adjusted_total = self.attachment_data_total.saturating_sub(old_size);
-        let new_total = adjusted_total.saturating_add(size);
-        if new_total > MAX_TOTAL {
-            return Err(WasmChannelError::CallbackFailed {
-                name: self.channel_name.clone(),
-                reason: format!(
-                    "Total attachment data too large: {} bytes (max {})",
-                    new_total, MAX_TOTAL
-                ),
-            });
-        }
-
-        self.attachment_data_total = new_total;
-        self.attachment_data.insert(attachment_id.to_string(), data);
-        Ok(())
-    }
-
-    /// Remove stored binary data for a specific attachment ID.
-    pub fn remove_attachment_data(&mut self, id: &str) -> Option<Vec<u8>> {
-        if let Some(data) = self.attachment_data.remove(id) {
-            self.attachment_data_total =
-                self.attachment_data_total.saturating_sub(data.len() as u64);
-            Some(data)
-        } else {
-            None
-        }
-    }
-
-    /// Take all stored attachment data (clears the store).
-    pub fn take_attachment_data(&mut self) -> HashMap<String, Vec<u8>> {
-        self.attachment_data_total = 0;
-        std::mem::take(&mut self.attachment_data)
-    }
-
     /// Write to workspace (scoped to channel namespace).
     ///
     /// Writes are queued and committed after callback execution completes.
@@ -629,8 +431,7 @@ impl ChannelEmitRateLimiter {
 mod tests {
     use crate::channels::wasm::capabilities::{ChannelCapabilities, EmitRateLimitConfig};
     use crate::channels::wasm::host::{
-        Attachment, ChannelEmitRateLimiter, ChannelHostState, EmittedMessage,
-        MAX_ATTACHMENT_TOTAL_SIZE, MAX_ATTACHMENTS_PER_MESSAGE, MAX_EMITS_PER_EXECUTION,
+        ChannelEmitRateLimiter, ChannelHostState, EmittedMessage, MAX_EMITS_PER_EXECUTION,
     };
 
     #[test]
@@ -959,133 +760,4 @@ mod tests {
             Some("200".to_string())
         );
     }
-
-    // === Attachment validation tests ===
-
-    fn make_attachment(id: &str, mime: &str, size: Option<u64>) -> Attachment {
-        Attachment {
-            id: id.to_string(),
-            mime_type: mime.to_string(),
-            filename: None,
-            size_bytes: size,
-            source_url: None,
-            storage_key: None,
-            extracted_text: None,
-            data: Vec::new(),
-            duration_secs: None,
-        }
-    }
-
-    #[test]
-    fn test_emit_message_with_attachments() {
-        let caps = ChannelCapabilities::for_channel("test");
-        let mut state = ChannelHostState::new("test", caps);
-
-        let msg = EmittedMessage::new("user1", "Check this image")
-            .with_attachments(vec![make_attachment("file1", "image/jpeg", Some(1024))]);
-
-        state.emit_message(msg).unwrap();
-
-        let messages = state.take_emitted_messages();
-        assert_eq!(messages.len(), 1);
-        assert_eq!(messages[0].attachments.len(), 1);
-        assert_eq!(messages[0].attachments[0].id, "file1");
-        assert_eq!(messages[0].attachments[0].mime_type, "image/jpeg");
-        assert_eq!(messages[0].attachments[0].size_bytes, Some(1024));
-    }
-
-    #[test]
-    fn test_emit_message_no_attachments_backward_compat() {
-        let caps = ChannelCapabilities::for_channel("test");
-        let mut state = ChannelHostState::new("test", caps);
-
-        let msg = EmittedMessage::new("user1", "Just text");
-        state.emit_message(msg).unwrap();
-
-        let messages = state.take_emitted_messages();
-        assert_eq!(messages.len(), 1);
-        assert!(messages[0].attachments.is_empty());
-    }
-
-    #[test]
-    fn test_attachment_count_limit() {
-        let caps = ChannelCapabilities::for_channel("test");
-        let mut state = ChannelHostState::new("test", caps);
-
-        let attachments: Vec<Attachment> = (0..MAX_ATTACHMENTS_PER_MESSAGE + 5)
-            .map(|i| make_attachment(&format!("file{}", i), "image/png", Some(100)))
-            .collect();
-
-        let msg = EmittedMessage::new("user1", "Many files").with_attachments(attachments);
-        state.emit_message(msg).unwrap();
-
-        let messages = state.take_emitted_messages();
-        assert_eq!(messages[0].attachments.len(), MAX_ATTACHMENTS_PER_MESSAGE);
-    }
-
-    #[test]
-    fn test_attachment_total_size_limit() {
-        let caps = ChannelCapabilities::for_channel("test");
-        let mut state = ChannelHostState::new("test", caps);
-
-        // Each file is 1/3 of the limit, so 3 fit but 4th does not
-        let chunk_size = MAX_ATTACHMENT_TOTAL_SIZE / 3;
-        let attachments = vec![
-            make_attachment("file1", "image/png", Some(chunk_size)),
-            make_attachment("file2", "image/png", Some(chunk_size)),
-            make_attachment("file3", "image/png", Some(chunk_size)),
-            make_attachment("file4", "image/png", Some(chunk_size)),
-        ];
-
-        let msg = EmittedMessage::new("user1", "Big files").with_attachments(attachments);
-        state.emit_message(msg).unwrap();
-
-        let messages = state.take_emitted_messages();
-        // Only first 3 fit within the total size limit
-        assert_eq!(messages[0].attachments.len(), 3);
-    }
-
-    #[test]
-    fn test_attachment_mime_type_filtering() {
-        let caps = ChannelCapabilities::for_channel("test");
-        let mut state = ChannelHostState::new("test", caps);
-
-        let attachments = vec![
-            make_attachment("ok1", "image/jpeg", Some(100)),
-            make_attachment("bad1", "application/x-executable", Some(100)),
-            make_attachment("ok2", "application/pdf", Some(100)),
-            make_attachment("bad2", "application/x-msdos-program", Some(100)),
-            make_attachment("ok3", "text/plain", Some(100)),
-            make_attachment("ok4", "audio/mpeg", Some(100)),
-            make_attachment("ok5", "video/mp4", Some(100)),
-        ];
-
-        let msg = EmittedMessage::new("user1", "Mixed files").with_attachments(attachments);
-        state.emit_message(msg).unwrap();
-
-        let messages = state.take_emitted_messages();
-        let ids: Vec<&str> = messages[0]
-            .attachments
-            .iter()
-            .map(|a| a.id.as_str())
-            .collect();
-        assert_eq!(ids, vec!["ok1", "ok2", "ok3", "ok4", "ok5"]);
-    }
-
-    #[test]
-    fn test_attachment_unknown_size_allowed() {
-        let caps = ChannelCapabilities::for_channel("test");
-        let mut state = ChannelHostState::new("test", caps);
-
-        let attachments = vec![
-            make_attachment("file1", "image/jpeg", None),
-            make_attachment("file2", "image/png", None),
-        ];
-
-        let msg = EmittedMessage::new("user1", "No sizes").with_attachments(attachments);
-        state.emit_message(msg).unwrap();
-
-        let messages = state.take_emitted_messages();
-        assert_eq!(messages[0].attachments.len(), 2);
-    }
 }

src/channels/wasm/runtime.rs

@@ -153,16 +153,7 @@ impl WasmChannelRuntime {
         // Enable persistent compilation cache. Wasmtime serializes compiled native
         // code to disk (~/.cache/wasmtime by default), so subsequent startups
         // deserialize instead of recompiling — typically 10-50x faster.
-        //
-        // On Windows, each Engine gets its own cache subdirectory to avoid
-        // OS error 33 (ERROR_LOCK_VIOLATION) when multiple engines share the
-        // default cache and Windows holds exclusive locks on memory-mapped
-        // files. See #448.
-        if let Err(e) = crate::tools::wasm::enable_compilation_cache(
-            &mut wasmtime_config,
-            "channels",
-            config.cache_dir.as_deref(),
-        ) {
+        if let Err(e) = wasmtime_config.cache_config_load_default() {
             tracing::warn!("Failed to enable wasmtime compilation cache: {}", e);
         }
 

src/channels/wasm/wrapper.rs

@@ -532,45 +532,9 @@ impl near::agent::channel_host::Host for ChannelStoreData {
             user_id = %msg.user_id,
             user_name = ?msg.user_name,
             content_len = msg.content.len(),
-            attachment_count = msg.attachments.len(),
             "WASM emit_message called"
         );
 
-        let attachments: Vec<crate::channels::wasm::host::Attachment> = msg
-            .attachments
-            .into_iter()
-            .map(|a| {
-                // Parse extras-json for well-known fields
-                let extras: serde_json::Value = if a.extras_json.is_empty() {
-                    serde_json::Value::Null
-                } else {
-                    serde_json::from_str(&a.extras_json).unwrap_or(serde_json::Value::Null)
-                };
-                let duration_secs = extras
-                    .get("duration_secs")
-                    .and_then(|v| v.as_u64())
-                    .map(|v| v as u32);
-
-                // Merge stored binary data (from store-attachment-data host call)
-                let data = self
-                    .host_state
-                    .remove_attachment_data(&a.id)
-                    .unwrap_or_default();
-
-                crate::channels::wasm::host::Attachment {
-                    id: a.id,
-                    mime_type: a.mime_type,
-                    filename: a.filename,
-                    size_bytes: a.size_bytes,
-                    source_url: a.source_url,
-                    storage_key: a.storage_key,
-                    extracted_text: a.extracted_text,
-                    data,
-                    duration_secs,
-                }
-            })
-            .collect();
-
         let mut emitted = EmittedMessage::new(msg.user_id.clone(), msg.content.clone());
         if let Some(name) = msg.user_name {
             emitted = emitted.with_user_name(name);
@@ -579,7 +543,6 @@ impl near::agent::channel_host::Host for ChannelStoreData {
             emitted = emitted.with_thread_id(tid);
         }
         emitted = emitted.with_metadata(msg.metadata_json);
-        emitted = emitted.with_attachments(attachments);
 
         match self.host_state.emit_message(emitted) {
             Ok(()) => {
@@ -591,21 +554,6 @@ impl near::agent::channel_host::Host for ChannelStoreData {
         }
     }
 
-    fn store_attachment_data(
-        &mut self,
-        attachment_id: String,
-        data: Vec<u8>,
-    ) -> Result<(), String> {
-        tracing::debug!(
-            attachment_id = %attachment_id,
-            size = data.len(),
-            "WASM store_attachment_data called"
-        );
-        self.host_state
-            .store_attachment_data(&attachment_id, data)
-            .map_err(|e| e.to_string())
-    }
-
     fn pairing_upsert_request(
         &mut self,
         channel: String,
@@ -1379,14 +1327,12 @@ impl WasmChannel {
         content: &str,
         thread_id: Option<&str>,
         metadata_json: &str,
-        attachments: &[String],
     ) -> Result<(), WasmChannelError> {
         tracing::info!(
             channel = %self.name,
             message_id = %message_id,
             content_len = content.len(),
             thread_id = ?thread_id,
-            attachment_count = attachments.len(),
             "call_on_respond invoked"
         );
 
@@ -1424,21 +1370,12 @@ impl WasmChannel {
         let content = content.to_string();
         let thread_id = thread_id.map(|s| s.to_string());
         let metadata_json = metadata_json.to_string();
-        let attachments = attachments.to_vec();
 
         // Execute in blocking task with timeout
         tracing::info!(channel = %channel_name, "Starting on_respond WASM execution");
 
         let result = tokio::time::timeout(timeout, async move {
             tokio::task::spawn_blocking(move || {
-                // Read attachment files from disk before entering WASM
-                let wit_attachments = read_attachments(&attachments).map_err(|e| {
-                    WasmChannelError::CallbackFailed {
-                        name: prepared.name.clone(),
-                        reason: e,
-                    }
-                })?;
-
                 tracing::info!("Creating WASM store for on_respond");
                 let mut store = Self::create_store(
                     &runtime,
@@ -1458,7 +1395,6 @@ impl WasmChannel {
                     content: content.clone(),
                     thread_id,
                     metadata_json,
-                    attachments: wit_attachments,
                 };
 
                 // Truncate at char boundary for logging (avoid panic on multi-byte UTF-8)
@@ -1522,124 +1458,6 @@ impl WasmChannel {
         }
     }
 
-    /// Execute the on_broadcast callback.
-    ///
-    /// Called to send a proactive message to a user without a prior incoming message.
-    pub async fn call_on_broadcast(
-        &self,
-        user_id: &str,
-        content: &str,
-        thread_id: Option<&str>,
-        attachments: &[String],
-    ) -> Result<(), WasmChannelError> {
-        tracing::info!(
-            channel = %self.name,
-            user_id = %user_id,
-            content_len = content.len(),
-            attachment_count = attachments.len(),
-            "call_on_broadcast invoked"
-        );
-
-        // If no WASM bytes, do nothing (for testing)
-        if self.prepared.component().is_none() {
-            tracing::debug!(
-                channel = %self.name,
-                "WASM channel on_broadcast called (no WASM module)"
-            );
-            return Ok(());
-        }
-
-        let runtime = Arc::clone(&self.runtime);
-        let prepared = Arc::clone(&self.prepared);
-        let capabilities = self.capabilities.clone();
-        let timeout = self.runtime.config().callback_timeout;
-        let channel_name = self.name.clone();
-        let credentials = self.get_credentials().await;
-        let host_credentials =
-            resolve_channel_host_credentials(&self.capabilities, self.secrets_store.as_deref())
-                .await;
-        let pairing_store = self.pairing_store.clone();
-
-        let user_id = user_id.to_string();
-        let content = content.to_string();
-        let thread_id = thread_id.map(|s| s.to_string());
-        let attachments = attachments.to_vec();
-
-        let result = tokio::time::timeout(timeout, async move {
-            tokio::task::spawn_blocking(move || {
-                // Read attachment files from disk
-                let wit_attachments = read_attachments(&attachments).map_err(|e| {
-                    WasmChannelError::CallbackFailed {
-                        name: prepared.name.clone(),
-                        reason: e,
-                    }
-                })?;
-
-                let mut store = Self::create_store(
-                    &runtime,
-                    &prepared,
-                    &capabilities,
-                    credentials,
-                    host_credentials,
-                    pairing_store,
-                )?;
-
-                let instance = Self::instantiate_component(&runtime, &prepared, &mut store)?;
-
-                let wit_response = wit_channel::AgentResponse {
-                    message_id: String::new(),
-                    content: content.clone(),
-                    thread_id,
-                    metadata_json: String::new(),
-                    attachments: wit_attachments,
-                };
-
-                let channel_iface = instance.near_agent_channel();
-                let wasm_result = channel_iface
-                    .call_on_broadcast(&mut store, &user_id, &wit_response)
-                    .map_err(|e| {
-                        tracing::error!(error = %e, "WASM on_broadcast call failed");
-                        Self::map_wasm_error(e, &prepared.name, prepared.limits.fuel)
-                    })?;
-
-                if let Err(ref err_msg) = wasm_result {
-                    tracing::error!(error = %err_msg, "WASM on_broadcast returned error");
-                    return Err(WasmChannelError::CallbackFailed {
-                        name: prepared.name.clone(),
-                        reason: err_msg.clone(),
-                    });
-                }
-
-                let host_state =
-                    Self::extract_host_state(&mut store, &prepared.name, &capabilities);
-                tracing::info!("on_broadcast WASM execution completed successfully");
-                Ok(((), host_state))
-            })
-            .await
-            .map_err(|e| WasmChannelError::ExecutionPanicked {
-                name: channel_name.clone(),
-                reason: e.to_string(),
-            })?
-        })
-        .await;
-
-        let channel_name = self.name.clone();
-        match result {
-            Ok(Ok(((), _host_state))) => {
-                tracing::debug!(
-                    channel = %channel_name,
-                    "WASM channel on_broadcast completed"
-                );
-                Ok(())
-            }
-            Ok(Err(e)) => Err(e),
-            Err(_) => Err(WasmChannelError::Timeout {
-                name: channel_name,
-                callback: "on_broadcast".to_string(),
-            }),
-        }
-    }
-
     /// Execute the on_status callback.
     ///
     /// Called to notify the WASM channel of agent status changes (e.g., typing).
@@ -1927,7 +1745,7 @@ impl WasmChannel {
 
                 let metadata_json = serde_json::to_string(metadata).unwrap_or_default();
                 if let Err(e) = self
-                    .call_on_respond(uuid::Uuid::new_v4(), &prompt, None, &metadata_json, &[])
+                    .call_on_respond(uuid::Uuid::new_v4(), &prompt, None, &metadata_json)
                     .await
                 {
                     tracing::warn!(
@@ -2029,27 +1847,6 @@ impl WasmChannel {
                 msg = msg.with_thread(thread_id);
             }
 
-            // Convert attachments
-            if !emitted.attachments.is_empty() {
-                let incoming_attachments = emitted
-                    .attachments
-                    .iter()
-                    .map(|a| crate::channels::IncomingAttachment {
-                        id: a.id.clone(),
-                        kind: crate::channels::AttachmentKind::from_mime_type(&a.mime_type),
-                        mime_type: a.mime_type.clone(),
-                        filename: a.filename.clone(),
-                        size_bytes: a.size_bytes,
-                        source_url: a.source_url.clone(),
-                        storage_key: a.storage_key.clone(),
-                        extracted_text: a.extracted_text.clone(),
-                        data: a.data.clone(),
-                        duration_secs: a.duration_secs,
-                    })
-                    .collect();
-                msg = msg.with_attachments(incoming_attachments);
-            }
-
             // Parse metadata JSON
             if let Ok(metadata) = serde_json::from_str(&emitted.metadata_json) {
                 msg = msg.with_metadata(metadata);
@@ -2062,7 +1859,6 @@ impl WasmChannel {
                 channel = %self.name,
                 user_id = %emitted.user_id,
                 content_len = emitted.content.len(),
-                attachment_count = msg.attachments.len(),
                 "Sending emitted message to agent"
             );
 
@@ -2316,27 +2112,6 @@ impl WasmChannel {
                 msg = msg.with_thread(thread_id);
             }
 
-            // Convert attachments
-            if !emitted.attachments.is_empty() {
-                let incoming_attachments = emitted
-                    .attachments
-                    .iter()
-                    .map(|a| crate::channels::IncomingAttachment {
-                        id: a.id.clone(),
-                        kind: crate::channels::AttachmentKind::from_mime_type(&a.mime_type),
-                        mime_type: a.mime_type.clone(),
-                        filename: a.filename.clone(),
-                        size_bytes: a.size_bytes,
-                        source_url: a.source_url.clone(),
-                        storage_key: a.storage_key.clone(),
-                        extracted_text: a.extracted_text.clone(),
-                        data: a.data.clone(),
-                        duration_secs: a.duration_secs,
-                    })
-                    .collect();
-                msg = msg.with_attachments(incoming_attachments);
-            }
-
             // Parse metadata JSON
             if let Ok(metadata) = serde_json::from_str(&emitted.metadata_json) {
                 msg = msg.with_metadata(metadata);
@@ -2355,7 +2130,6 @@ impl WasmChannel {
                 channel = %channel_name,
                 user_id = %emitted.user_id,
                 content_len = emitted.content.len(),
-                attachment_count = msg.attachments.len(),
                 "Sending polled message to agent"
             );
 
@@ -2483,7 +2257,6 @@ impl Channel for WasmChannel {
             &response.content,
             response.thread_id.as_deref(),
             &metadata_json,
-            &response.attachments,
         )
         .await
         .map_err(|e| ChannelError::SendFailed {
@@ -2496,15 +2269,24 @@ impl Channel for WasmChannel {
 
     async fn broadcast(
         &self,
-        user_id: &str,
+        _user_id: &str,
         response: OutgoingResponse,
     ) -> Result<(), ChannelError> {
-        self.cancel_typing_task().await;
-        self.call_on_broadcast(
-            user_id,
+        let metadata_json = self
+            .last_broadcast_metadata
+            .read()
+            .await
+            .clone()
+            .ok_or_else(|| ChannelError::SendFailed {
+                name: self.name.clone(),
+                reason: "No messages received yet — no chat_id available for broadcast".into(),
+            })?;
+
+        self.call_on_respond(
+            uuid::Uuid::new_v4(),
             &response.content,
             response.thread_id.as_deref(),
-            &response.attachments,
+            &metadata_json,
         )
         .await
         .map_err(|e| ChannelError::SendFailed {
@@ -2967,79 +2749,6 @@ async fn resolve_channel_host_credentials(
     resolved
 }
 
-// ============================================================================
-// Attachment Helpers
-// ============================================================================
-
-/// Maximum total attachment size (50 MB).
-const MAX_TOTAL_ATTACHMENT_BYTES: u64 = 50 * 1024 * 1024;
-
-/// Detect MIME type from file extension using the `mime_guess` crate.
-fn mime_from_extension(path: &str) -> String {
-    mime_guess::from_path(path)
-        .first_or_octet_stream()
-        .to_string()
-}
-
-/// Read attachment files from disk and build WIT attachment records.
-///
-/// Validates total size against `MAX_TOTAL_ATTACHMENT_BYTES`.
-fn read_attachments(paths: &[String]) -> Result<Vec<wit_channel::Attachment>, String> {
-    if paths.is_empty() {
-        return Ok(Vec::new());
-    }
-
-    let mut attachments = Vec::with_capacity(paths.len());
-    let mut total_bytes: u64 = 0;
-    let tmp_base = std::path::Path::new("/tmp");
-    let home_base = dirs::home_dir()
-        .map(|h| h.join(".ironclaw"))
-        .unwrap_or_default();
-
-    for path in paths {
-        // Validate paths are under /tmp/ or ~/.ironclaw/ to prevent arbitrary file reads
-        let validated = crate::tools::builtin::path_utils::validate_path(path, Some(tmp_base))
-            .or_else(|_| crate::tools::builtin::path_utils::validate_path(path, Some(&home_base)));
-        let validated = validated.map_err(|e| {
-            format!(
-                "Invalid attachment path '{}': must be under /tmp/ or ~/.ironclaw/: {}",
-                path, e
-            )
-        })?;
-
-        // Pre-check file size before reading into memory to avoid OOM
-        let file_size = std::fs::metadata(&validated)
-            .map_err(|e| format!("Failed to stat attachment '{}': {}", validated.display(), e))?
-            .len();
-        total_bytes += file_size;
-        if total_bytes > MAX_TOTAL_ATTACHMENT_BYTES {
-            return Err(format!(
-                "Total attachment size exceeds {} MB limit",
-                MAX_TOTAL_ATTACHMENT_BYTES / (1024 * 1024)
-            ));
-        }
-
-        let data = std::fs::read(&validated)
-            .map_err(|e| format!("Failed to read attachment '{}': {}", validated.display(), e))?;
-
-        let filename = validated
-            .file_name()
-            .and_then(|n| n.to_str())
-            .unwrap_or("file")
-            .to_string();
-
-        let mime_type = mime_from_extension(path);
-
-        attachments.push(wit_channel::Attachment {
-            filename,
-            mime_type,
-            data,
-        });
-    }
-
-    Ok(attachments)
-}
-
 #[cfg(test)]
 mod tests {
     use std::sync::Arc;
@@ -4162,139 +3871,4 @@ mod tests {
         // 404 because "000" is not a valid bot token
         assert_eq!(result, 404);
     }
-
-    #[tokio::test]
-    async fn test_dispatch_emitted_messages_preserves_attachments() {
-        use crate::channels::wasm::host::{Attachment, EmittedMessage};
-
-        let (tx, mut rx) = tokio::sync::mpsc::channel(10);
-        let message_tx = Arc::new(tokio::sync::RwLock::new(Some(tx)));
-
-        let rate_limiter = Arc::new(tokio::sync::RwLock::new(
-            crate::channels::wasm::host::ChannelEmitRateLimiter::new(
-                crate::channels::wasm::capabilities::EmitRateLimitConfig::default(),
-            ),
-        ));
-
-        let attachments = vec![
-            Attachment {
-                id: "photo123".to_string(),
-                mime_type: "image/jpeg".to_string(),
-                filename: Some("cat.jpg".to_string()),
-                size_bytes: Some(50_000),
-                source_url: Some("https://api.telegram.org/file/photo123".to_string()),
-                storage_key: None,
-                extracted_text: None,
-                data: Vec::new(),
-                duration_secs: None,
-            },
-            Attachment {
-                id: "doc456".to_string(),
-                mime_type: "application/pdf".to_string(),
-                filename: Some("report.pdf".to_string()),
-                size_bytes: Some(120_000),
-                source_url: None,
-                storage_key: Some("store/doc456".to_string()),
-                extracted_text: Some("Report contents...".to_string()),
-                data: Vec::new(),
-                duration_secs: None,
-            },
-        ];
-
-        let messages =
-            vec![EmittedMessage::new("user1", "Check these files").with_attachments(attachments)];
-
-        let last_broadcast_metadata = Arc::new(tokio::sync::RwLock::new(None));
-        let result = WasmChannel::dispatch_emitted_messages(
-            "test-channel",
-            messages,
-            &message_tx,
-            &rate_limiter,
-            &last_broadcast_metadata,
-            None,
-        )
-        .await;
-
-        assert!(result.is_ok());
-
-        let msg = rx.try_recv().expect("Should receive message");
-        assert_eq!(msg.content, "Check these files");
-        assert_eq!(msg.attachments.len(), 2);
-
-        // Verify first attachment
-        assert_eq!(msg.attachments[0].id, "photo123");
-        assert_eq!(msg.attachments[0].mime_type, "image/jpeg");
-        assert_eq!(msg.attachments[0].filename, Some("cat.jpg".to_string()));
-        assert_eq!(msg.attachments[0].size_bytes, Some(50_000));
-        assert_eq!(
-            msg.attachments[0].source_url,
-            Some("https://api.telegram.org/file/photo123".to_string())
-        );
-
-        // Verify second attachment
-        assert_eq!(msg.attachments[1].id, "doc456");
-        assert_eq!(msg.attachments[1].mime_type, "application/pdf");
-        assert_eq!(
-            msg.attachments[1].extracted_text,
-            Some("Report contents...".to_string())
-        );
-        assert_eq!(
-            msg.attachments[1].storage_key,
-            Some("store/doc456".to_string())
-        );
-    }
-
-    #[tokio::test]
-    async fn test_dispatch_emitted_messages_no_attachments_backward_compat() {
-        use crate::channels::wasm::host::EmittedMessage;
-
-        let (tx, mut rx) = tokio::sync::mpsc::channel(10);
-        let message_tx = Arc::new(tokio::sync::RwLock::new(Some(tx)));
-
-        let rate_limiter = Arc::new(tokio::sync::RwLock::new(
-            crate::channels::wasm::host::ChannelEmitRateLimiter::new(
-                crate::channels::wasm::capabilities::EmitRateLimitConfig::default(),
-            ),
-        ));
-
-        let messages = vec![EmittedMessage::new("user1", "Just text, no attachments")];
-
-        let last_broadcast_metadata = Arc::new(tokio::sync::RwLock::new(None));
-        let result = WasmChannel::dispatch_emitted_messages(
-            "test-channel",
-            messages,
-            &message_tx,
-            &rate_limiter,
-            &last_broadcast_metadata,
-            None,
-        )
-        .await;
-
-        assert!(result.is_ok());
-
-        let msg = rx.try_recv().expect("Should receive message");
-        assert_eq!(msg.content, "Just text, no attachments");
-        assert!(msg.attachments.is_empty());
-    }
-
-    #[test]
-    fn test_mime_from_extension() {
-        use super::mime_from_extension;
-        assert_eq!(mime_from_extension("screenshot.png"), "image/png");
-        assert_eq!(mime_from_extension("photo.JPG"), "image/jpeg");
-        assert_eq!(mime_from_extension("photo.jpeg"), "image/jpeg");
-        assert_eq!(mime_from_extension("animation.gif"), "image/gif");
-        assert_eq!(mime_from_extension("doc.pdf"), "application/pdf");
-        assert_eq!(mime_from_extension("video.mp4"), "video/mp4");
-        assert_eq!(mime_from_extension("data.csv"), "text/csv");
-        assert_eq!(
-            mime_from_extension("unknown.qqqzzz"),
-            "application/octet-stream"
-        );
-        assert_eq!(mime_from_extension("noext"), "application/octet-stream");
-        assert_eq!(
-            mime_from_extension("/home/user/.ironclaw/screenshot.png"),
-            "image/png"
-        );
-    }
 }

src/channels/web/CLAUDE.md

@@ -1,212 +0,0 @@
-# Web Gateway Module
-
-Browser-facing HTTP API and SSE/WebSocket real-time streaming. Axum-based, single-user with bearer token auth.
-
-## File Map
-
-| File | Role |
-|------|------|
-| `mod.rs` | Gateway builder, startup, `WebChannel` implementation, `with_*` builder methods |
-| `server.rs` | `GatewayState`, `start_server()`, all Axum route registrations, inline handlers |
-| `types.rs` | Request/response DTOs and `SseEvent` enum (source of truth for SSE contract) |
-| `sse.rs` | `SseManager` — broadcast channel that fans out `SseEvent` to all connected SSE clients |
-| `ws.rs` | WebSocket handler (`handle_ws_connection`) + `WsConnectionTracker` |
-| `auth.rs` | Bearer token middleware (`Authorization: Bearer <GATEWAY_AUTH_TOKEN>`) |
-| `log_layer.rs` | Tracing layer that tees log lines to the `/api/logs/events` SSE stream |
-| `handlers/` | Handler functions split by domain: `chat`, `extensions`, `jobs`, `memory`, `routines`, `settings`, `skills`, `static_files` |
-| `openai_compat.rs` | OpenAI-compatible proxy (`/v1/chat/completions`, `/v1/models`) |
-| `util.rs` | Shared helpers (`build_turns_from_db_messages`, `truncate_preview`) |
-| `static/` | Single-page app (HTML/CSS/JS) — embedded at compile time via `include_str!`/`include_bytes!` |
-
-## API Routes
-
-### Public (no auth)
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/health` | Health check |
-| GET | `/oauth/callback` | OAuth callback for extension auth |
-
-### Chat
-| Method | Path | Description |
-|--------|------|-------------|
-| POST | `/api/chat/send` | Send message → queues to agent loop |
-| GET | `/api/chat/events` | SSE stream of agent events |
-| GET | `/api/chat/ws` | WebSocket alternative to SSE |
-| GET | `/api/chat/history` | Paginated turn history for a thread |
-| GET | `/api/chat/threads` | List threads (returns `assistant_thread` + regular threads) |
-| POST | `/api/chat/thread/new` | Create new thread |
-| POST | `/api/chat/approval` | Approve/deny/always a pending tool call |
-| POST | `/api/chat/auth-token` | Submit auth token for an extension |
-| POST | `/api/chat/auth-cancel` | Cancel pending auth flow |
-
-### Memory
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/memory/tree` | Workspace directory tree |
-| GET | `/api/memory/list` | List files at a path |
-| GET | `/api/memory/read` | Read a workspace file |
-| POST | `/api/memory/write` | Write a workspace file |
-| POST | `/api/memory/search` | Hybrid FTS + vector search |
-
-### Jobs (sandbox)
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/jobs` | List sandbox jobs |
-| GET | `/api/jobs/summary` | Aggregated stats |
-| GET | `/api/jobs/{id}` | Job detail |
-| POST | `/api/jobs/{id}/cancel` | Cancel a running job |
-| POST | `/api/jobs/{id}/restart` | Restart a failed job |
-| POST | `/api/jobs/{id}/prompt` | Send follow-up prompt to Claude Code bridge |
-| GET | `/api/jobs/{id}/events` | SSE stream for a specific job |
-| GET | `/api/jobs/{id}/files/list` | List files in job workspace |
-| GET | `/api/jobs/{id}/files/read` | Read a file from job workspace |
-
-### Skills
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/skills` | List installed skills |
-| POST | `/api/skills/search` | Search ClawHub registry + local skills |
-| POST | `/api/skills/install` | Install a skill from ClawHub or by URL/content |
-| DELETE | `/api/skills/{name}` | Remove an installed skill |
-
-### Extensions
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/extensions` | Installed extensions |
-| GET | `/api/extensions/tools` | All registered tools (from tool registry) |
-| POST | `/api/extensions/install` | Install extension |
-| GET | `/api/extensions/registry` | Available extensions from registry manifests |
-| POST | `/api/extensions/{name}/activate` | Activate installed extension |
-| POST | `/api/extensions/{name}/remove` | Remove extension |
-| GET/POST | `/api/extensions/{name}/setup` | Extension setup wizard |
-
-### Routines
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/routines` | List routines |
-| GET | `/api/routines/summary` | Aggregated stats (total/enabled/disabled/failing/runs_today) |
-| GET | `/api/routines/{id}` | Routine detail with recent run history |
-| POST | `/api/routines/{id}/trigger` | Manually trigger a routine |
-| POST | `/api/routines/{id}/toggle` | Enable/disable a routine |
-| DELETE | `/api/routines/{id}` | Delete a routine |
-| GET | `/api/routines/{id}/runs` | List runs for a specific routine |
-
-### Settings
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/settings` | List all settings |
-| GET | `/api/settings/export` | Export all settings as a map |
-| POST | `/api/settings/import` | Bulk-import settings from a map |
-| GET | `/api/settings/{key}` | Get a single setting |
-| PUT | `/api/settings/{key}` | Set a single setting |
-| DELETE | `/api/settings/{key}` | Delete a setting |
-
-### Other
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/api/logs/events` | Live log stream (SSE) |
-| GET/PUT | `/api/logs/level` | Get/set log level at runtime |
-| GET | `/api/pairing/{channel}` | List pending pairing requests |
-| POST | `/api/pairing/{channel}/approve` | Approve a pairing request |
-| GET | `/api/gateway/status` | Server uptime, connected clients, config |
-| POST | `/v1/chat/completions` | OpenAI-compatible LLM proxy |
-| GET | `/v1/models` | OpenAI-compatible model list |
-
-### Static / Project files
-| Method | Path | Description |
-|--------|------|-------------|
-| GET | `/` | Single-page app HTML |
-| GET | `/style.css` | App stylesheet |
-| GET | `/app.js` | App JavaScript |
-| GET | `/favicon.ico` | Favicon (cached 1 day) |
-| GET | `/projects/{project_id}/` | Job workspace browser (redirects) |
-| GET | `/projects/{project_id}/{*path}` | Serve file from job workspace (auth required) |
-
-## SSE Event Types (`SseEvent` in `types.rs`)
-
-The SSE contract — every field is `#[serde(tag = "type")]`:
-
-| Type | When emitted |
-|------|-------------|
-| `response` | Final text response from agent |
-| `stream_chunk` | Streaming token (partial response) |
-| `thinking` | Agent status update during reasoning |
-| `tool_started` | Tool call began |
-| `tool_completed` | Tool call finished (includes success/error) |
-| `tool_result` | Tool output preview |
-| `status` | Generic status message |
-| `job_started` | Sandbox job created |
-| `job_message` | Message from sandbox worker |
-| `job_tool_use` | Tool invoked inside sandbox |
-| `job_tool_result` | Tool result from sandbox |
-| `job_status` | Sandbox job status update |
-| `job_result` | Sandbox job final result |
-| `approval_needed` | Tool requires user approval (pauses agent) |
-| `auth_required` | Extension needs auth credentials |
-| `auth_completed` | Extension auth flow finished |
-| `extension_status` | WASM channel activation status changed |
-| `error` | Error from agent or gateway |
-| `heartbeat` | SSE keepalive (empty payload) |
-
-**SSE serialization:** Events use `#[serde(tag = "type")]` — the wire format is `{"type":"<variant>", ...fields}`. The SSE frame's `event:` field is set to the same string as `type` for easy `addEventListener` use in the browser.
-
-**WebSocket envelope:** Over WebSocket, SSE events are wrapped as `{"type":"event","event_type":"<variant>","data":{...}}`. Ping/pong uses `{"type":"ping"}` / `{"type":"pong"}`. Client-to-server messages (`message`, `approval`, `auth_token`, `auth_cancel`) are defined in `WsClientMessage` in `types.rs`.
-
-**To add a new SSE event:** Use the `add-sse-event` skill (`/add-sse-event`). It scaffolds the Rust variant, serialization, broadcast call, and frontend handler. Also add a matching arm to `WsServerMessage::from_sse_event()` in `types.rs`.
-
-## Auth
-
-All protected routes require `Authorization: Bearer <GATEWAY_AUTH_TOKEN>`. The token is set via `GATEWAY_AUTH_TOKEN` env var. Missing/wrong token → 401. The `Bearer` prefix is compared case-insensitively (RFC 6750).
-
-**Query-string token auth (`?token=xxx`):** Because `EventSource` and WebSocket upgrades cannot set custom headers from the browser, three endpoints also accept the token as a URL query parameter: `/api/chat/events`, `/api/logs/events`, and `/api/chat/ws`. All other endpoints reject query-string tokens. If you add a new SSE or WebSocket endpoint, register its path in `allows_query_token_auth()` in `auth.rs`.
-
-**If no `GATEWAY_AUTH_TOKEN` is configured**, a random 32-character alphanumeric token is generated at startup and printed to the console.
-
-Rate limiting: chat send endpoints are capped at **30 messages per 60 seconds** (sliding window, not per-IP).
-
-## GatewayState
-
-The shared state struct (`server.rs`) holds refs to all subsystems. Fields are `Option<Arc<T>>` so the gateway can start even when optional subsystems (workspace, sandbox, skills) are disabled. Always null-check before use in handlers.
-
-Key fields:
-- `msg_tx` — `RwLock<Option<mpsc::Sender<IncomingMessage>>>` — sends messages to the agent loop; set when `start()` is called on the `Channel`.
-- `sse` — `SseManager` — broadcast hub; call `state.sse.broadcast(event)` from any handler.
-- `ws_tracker` — `Option<Arc<WsConnectionTracker>>` — tracks WS connection count separately from SSE.
-- `chat_rate_limiter` — `RateLimiter` — 30 req/60 s sliding window shared across all chat send callers.
-- `scheduler` — `Option<SchedulerSlot>` — used to inject follow-up messages into running agent jobs.
-- `cost_guard` — `Option<Arc<CostGuard>>` — exposes token usage / cost totals in the status endpoint.
-- `startup_time` — `Instant` — used to compute uptime in the gateway status response.
-- `registry_entries` — `Vec<RegistryEntry>` — loaded once at startup from registry manifests; used by the available extensions API without hitting the network.
-
-Subsystems are wired via `with_*` builder methods on `GatewayChannel` (`mod.rs`). Each call rebuilds `Arc<GatewayState>` — safe to call before `start()`, not after.
-
-## SSE / WebSocket Connection Limits
-
-Both SSE and WebSocket share the same `SseManager` broadcast channel. Key characteristics:
-
-- **Broadcast buffer:** 256 events. A slow client that falls behind will miss events — the `BroadcastStream` silently drops lagged events. SSE clients are expected to reconnect and re-fetch history.
-- **Max connections:** 100 total (SSE + WebSocket combined). Connections beyond the limit receive a 503 / are immediately dropped.
-- **SSE keepalive:** Axum's `KeepAlive` sends an empty event every **30 seconds** to prevent proxy timeouts.
-- **WebSocket:** Two tasks per connection — a sender task (broadcast → WS frames) and a receiver loop (WS frames → agent). When the client disconnects, the sender is aborted and both the SSE connection counter and WS tracker counter are decremented.
-
-## CORS and Security Headers
-
-CORS is restricted to the gateway's own origin (same IP+port and `localhost`+port). Allowed methods: GET, POST, PUT, DELETE. Allowed headers: `Content-Type`, `Authorization`. Credentials are allowed.
-
-All responses include:
-- `X-Content-Type-Options: nosniff`
-- `X-Frame-Options: DENY`
-
-**Request body limit:** 1 MB (`DefaultBodyLimit::max(1024 * 1024)`). Larger payloads return 413.
-
-## Pending Approvals
-
-Tool approval state is **in-memory only** (not persisted to DB). Server restart clears all pending approvals. The `pending_approval` field in `HistoryResponse` is re-populated on thread switch from in-memory state.
-
-## Adding a New API Endpoint
-
-1. Define request/response types in `types.rs`.
-2. Implement the handler in the appropriate `handlers/*.rs` file (or inline in `server.rs` for simple handlers).
-3. Register the route in `start_server()` in `server.rs` under the correct router (`public`, `protected`, or `statics`).
-4. If it is an SSE or WebSocket endpoint, add its path to `allows_query_token_auth()` in `auth.rs`.
-5. If it requires a new `GatewayState` field, add it to the struct and to both the `GatewayChannel::new()` initializer and `rebuild_state()` in `mod.rs`, then add a `with_*` builder method.

src/channels/web/handlers/chat.rs

@@ -426,7 +426,7 @@ pub async fn chat_threads_handler(
             .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
         if let Ok(summaries) = store
-            .list_conversations_all_channels(&state.user_id, 50)
+            .list_conversations_with_preview(&state.user_id, "gateway", 50)
             .await
         {
             let mut assistant_thread = None;
@@ -441,7 +441,6 @@ pub async fn chat_threads_handler(
                     updated_at: s.last_activity.to_rfc3339(),
                     title: s.title.clone(),
                     thread_type: s.thread_type.clone(),
-                    channel: Some(s.channel.clone()),
                 };
 
                 if s.id == assistant_id {
@@ -461,7 +460,6 @@ pub async fn chat_threads_handler(
                     updated_at: chrono::Utc::now().to_rfc3339(),
                     title: None,
                     thread_type: Some("assistant".to_string()),
-                    channel: Some("gateway".to_string()),
                 });
             }
 
@@ -474,10 +472,9 @@ pub async fn chat_threads_handler(
     }
 
     // Fallback: in-memory only (no assistant thread without DB)
-    let mut sorted_threads: Vec<_> = sess.threads.values().collect();
-    sorted_threads.sort_by(|a, b| b.updated_at.cmp(&a.updated_at));
-    let threads: Vec<ThreadInfo> = sorted_threads
-        .into_iter()
+    let threads: Vec<ThreadInfo> = sess
+        .threads
+        .values()
         .map(|t| ThreadInfo {
             id: t.id,
             state: format!("{:?}", t.state),
@@ -486,7 +483,6 @@ pub async fn chat_threads_handler(
             updated_at: t.updated_at.to_rfc3339(),
             title: None,
             thread_type: None,
-            channel: Some("gateway".to_string()),
         })
         .collect();
 
@@ -506,39 +502,38 @@ pub async fn chat_new_thread_handler(
     ))?;
 
     let session = session_manager.get_or_create_session(&state.user_id).await;
-    let (thread_id, info) = {
-        let mut sess = session.lock().await;
-        let thread = sess.create_thread();
-        let id = thread.id;
-        let info = ThreadInfo {
-            id: thread.id,
-            state: format!("{:?}", thread.state),
-            turn_count: thread.turns.len(),
-            created_at: thread.created_at.to_rfc3339(),
-            updated_at: thread.updated_at.to_rfc3339(),
-            title: None,
-            thread_type: Some("thread".to_string()),
-            channel: Some("gateway".to_string()),
-        };
-        (id, info)
+    let mut sess = session.lock().await;
+    let thread = sess.create_thread();
+    let thread_id = thread.id;
+    let info = ThreadInfo {
+        id: thread.id,
+        state: format!("{:?}", thread.state),
+        turn_count: thread.turns.len(),
+        created_at: thread.created_at.to_rfc3339(),
+        updated_at: thread.updated_at.to_rfc3339(),
+        title: None,
+        thread_type: Some("thread".to_string()),
     };
 
-    // Persist the empty conversation row with thread_type metadata synchronously
-    // so that the subsequent loadThreads() call from the frontend sees it.
+    // Persist the empty conversation row with thread_type metadata
     if let Some(ref store) = state.store {
-        if let Err(e) = store
-            .ensure_conversation(thread_id, "gateway", &state.user_id, None)
-            .await
-        {
-            tracing::warn!("Failed to persist new thread: {}", e);
-        }
-        let metadata_val = serde_json::json!("thread");
-        if let Err(e) = store
-            .update_conversation_metadata_field(thread_id, "thread_type", &metadata_val)
-            .await
-        {
-            tracing::warn!("Failed to set thread_type metadata: {}", e);
-        }
+        let store = Arc::clone(store);
+        let user_id = state.user_id.clone();
+        tokio::spawn(async move {
+            if let Err(e) = store
+                .ensure_conversation(thread_id, "gateway", &user_id, None)
+                .await
+            {
+                tracing::warn!("Failed to persist new thread: {}", e);
+            }
+            let metadata_val = serde_json::json!("thread");
+            if let Err(e) = store
+                .update_conversation_metadata_field(thread_id, "thread_type", &metadata_val)
+                .await
+            {
+                tracing::warn!("Failed to set thread_type metadata: {}", e);
+            }
+        });
     }
 
     Ok(Json(info))

src/channels/web/handlers/extensions.rs

@@ -62,7 +62,6 @@ pub async fn extensions_list_handler(
                 has_auth: ext.has_auth,
                 activation_status,
                 activation_error: ext.activation_error,
-                version: ext.version,
             }
         })
         .collect();

src/channels/web/handlers/routines.rs

@@ -10,9 +10,9 @@ use axum::{
 use serde::Deserialize;
 use uuid::Uuid;
 
+use crate::channels::IncomingMessage;
 use crate::channels::web::server::GatewayState;
 use crate::channels::web::types::*;
-use crate::error::RoutineError;
 
 pub async fn routines_list_handler(
     State(state): State<Arc<GatewayState>>,
@@ -133,27 +133,56 @@ pub async fn routines_trigger_handler(
     State(state): State<Arc<GatewayState>>,
     Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
-    // Clone the Arc out of the lock to avoid holding the RwLock across .await.
-    let engine = {
-        let guard = state.routine_engine.read().await;
-        guard.as_ref().cloned().ok_or((
-            StatusCode::SERVICE_UNAVAILABLE,
-            "Routine engine not available".to_string(),
-        ))?
-    };
+    let store = state.store.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "Database not available".to_string(),
+    ))?;
 
     let routine_id = Uuid::parse_str(&id)
         .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid routine ID".to_string()))?;
 
-    let run_id = engine
-        .fire_manual(routine_id, Some(&state.user_id))
+    let routine = store
+        .get_routine(routine_id)
         .await
-        .map_err(|e| (routine_error_status(&e), e.to_string()))?;
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Routine not found".to_string()))?;
+
+    if routine.user_id != state.user_id {
+        return Err((StatusCode::FORBIDDEN, "Access denied".to_string()));
+    }
+
+    // Send the routine prompt through the message pipeline as a manual trigger.
+    let prompt = match &routine.action {
+        crate::agent::routine::RoutineAction::Lightweight { prompt, .. } => prompt.clone(),
+        crate::agent::routine::RoutineAction::FullJob {
+            title, description, ..
+        } => format!("{}: {}", title, description),
+    };
+
+    let content = format!("[routine:{}] {}", routine.name, prompt);
+    let thread_id = format!(
+        "routine-{}-{}",
+        routine_id,
+        chrono::Utc::now().timestamp_millis()
+    );
+    let msg = IncomingMessage::new("gateway", &state.user_id, content).with_thread(thread_id);
+
+    let tx_guard = state.msg_tx.read().await;
+    let tx = tx_guard.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "Channel not started".to_string(),
+    ))?;
+
+    tx.send(msg).await.map_err(|_| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Channel closed".to_string(),
+        )
+    })?;
 
     Ok(Json(serde_json::json!({
         "status": "triggered",
         "routine_id": routine_id,
-        "run_id": run_id,
     })))
 }
 
@@ -264,7 +293,7 @@ pub async fn routines_runs_handler(
 /// Convert a Routine to the trimmed RoutineInfo for list display.
 fn routine_to_info(r: &crate::agent::routine::Routine) -> RoutineInfo {
     let (trigger_type, trigger_summary) = match &r.trigger {
-        crate::agent::routine::Trigger::Cron { schedule, .. } => {
+        crate::agent::routine::Trigger::Cron { schedule } => {
             ("cron".to_string(), format!("cron: {}", schedule))
         }
         crate::agent::routine::Trigger::Event {
@@ -308,13 +337,3 @@ fn routine_to_info(r: &crate::agent::routine::Routine) -> RoutineInfo {
         status: status.to_string(),
     }
 }
-
-/// Map `RoutineError` variants to appropriate HTTP status codes.
-fn routine_error_status(err: &RoutineError) -> StatusCode {
-    match err {
-        RoutineError::NotFound { .. } => StatusCode::NOT_FOUND,
-        RoutineError::NotAuthorized { .. } => StatusCode::FORBIDDEN,
-        RoutineError::Disabled { .. } | RoutineError::MaxConcurrent { .. } => StatusCode::CONFLICT,
-        _ => StatusCode::INTERNAL_SERVER_ERROR,
-    }
-}

src/channels/web/mod.rs

@@ -24,13 +24,6 @@ pub mod types;
 pub(crate) mod util;
 pub mod ws;
 
-/// Test helpers for gateway integration tests.
-///
-/// Always compiled (not behind `#[cfg(test)]`) so that integration tests in
-/// `tests/` -- which import this crate as a regular dependency -- can use
-/// [`TestGatewayBuilder`](test_helpers::TestGatewayBuilder).
-pub mod test_helpers;
-
 use std::net::SocketAddr;
 use std::sync::Arc;
 
@@ -99,7 +92,6 @@ impl GatewayChannel {
             chat_rate_limiter: server::RateLimiter::new(30, 60),
             registry_entries: Vec::new(),
             cost_guard: None,
-            routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
             startup_time: std::time::Instant::now(),
         });
 
@@ -135,7 +127,6 @@ impl GatewayChannel {
             chat_rate_limiter: server::RateLimiter::new(30, 60),
             registry_entries: self.state.registry_entries.clone(),
             cost_guard: self.state.cost_guard.clone(),
-            routine_engine: Arc::clone(&self.state.routine_engine),
             startup_time: self.state.startup_time,
         };
         mutate(&mut new_state);
@@ -283,15 +274,7 @@ impl Channel for GatewayChannel {
         msg: &IncomingMessage,
         response: OutgoingResponse,
     ) -> Result<(), ChannelError> {
-        let thread_id = match &msg.thread_id {
-            Some(tid) => tid.clone(),
-            None => {
-                tracing::warn!(
-                    "Gateway respond with no thread_id — skipping (clients would drop it)"
-                );
-                return Ok(());
-            }
-        };
+        let thread_id = msg.thread_id.clone().unwrap_or_default();
 
         self.state.sse.broadcast(SseEvent::Response {
             content: response.content,
@@ -397,18 +380,9 @@ impl Channel for GatewayChannel {
         _user_id: &str,
         response: OutgoingResponse,
     ) -> Result<(), ChannelError> {
-        let thread_id = match response.thread_id {
-            Some(tid) => tid,
-            None => {
-                tracing::warn!(
-                    "Gateway broadcast with no thread_id — skipping (clients would drop it)"
-                );
-                return Ok(());
-            }
-        };
         self.state.sse.broadcast(SseEvent::Response {
             content: response.content,
-            thread_id,
+            thread_id: String::new(),
         });
         Ok(())
     }

src/channels/web/openai_compat.rs

@@ -244,7 +244,6 @@ pub fn convert_messages(messages: &[OpenAiMessage]) -> Result<Vec<ChatMessage>,
                 _ => Ok(ChatMessage {
                     role,
                     content: m.content.as_deref().unwrap_or("").to_string(),
-                    content_parts: Vec::new(),
                     tool_call_id: None,
                     name: m.name.clone(),
                     tool_calls: None,

src/channels/web/server.rs

@@ -57,10 +57,6 @@ pub type PromptQueue = Arc<
     >,
 >;
 
-/// Slot for the routine engine, filled at runtime after the agent starts.
-pub type RoutineEngineSlot =
-    Arc<tokio::sync::RwLock<Option<Arc<crate::agent::routine_engine::RoutineEngine>>>>;
-
 /// Simple sliding-window rate limiter.
 ///
 /// Tracks the number of requests in the current window. Resets when the window expires.
@@ -169,8 +165,6 @@ pub struct GatewayState {
     pub registry_entries: Vec<crate::extensions::RegistryEntry>,
     /// Cost guard for token/cost tracking.
     pub cost_guard: Option<Arc<crate::agent::cost_guard::CostGuard>>,
-    /// Routine engine slot for manual routine triggering (filled at runtime).
-    pub routine_engine: RoutineEngineSlot,
     /// Server startup time for uptime calculation.
     pub startup_time: std::time::Instant,
 }
@@ -610,7 +604,6 @@ async fn oauth_callback_handler(
 
 async fn chat_send_handler(
     State(state): State<Arc<GatewayState>>,
-    headers: axum::http::HeaderMap,
     Json(req): Json<SendMessageRequest>,
 ) -> Result<(StatusCode, Json<SendMessageResponse>), (StatusCode, String)> {
     tracing::debug!(
@@ -627,14 +620,6 @@ async fn chat_send_handler(
     }
 
     let mut msg = IncomingMessage::new("gateway", &state.user_id, &req.content);
-    // Prefer timezone from JSON body, fall back to X-Timezone header
-    let tz = req
-        .timezone
-        .as_deref()
-        .or_else(|| headers.get("X-Timezone").and_then(|v| v.to_str().ok()));
-    if let Some(tz) = tz {
-        msg = msg.with_timezone(tz);
-    }
 
     if let Some(ref thread_id) = req.thread_id {
         msg = msg.with_thread(thread_id);
@@ -1052,7 +1037,7 @@ async fn chat_threads_handler(
             .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
         if let Ok(summaries) = store
-            .list_conversations_all_channels(&state.user_id, 50)
+            .list_conversations_with_preview(&state.user_id, "gateway", 50)
             .await
         {
             let mut assistant_thread = None;
@@ -1067,7 +1052,6 @@ async fn chat_threads_handler(
                     updated_at: s.last_activity.to_rfc3339(),
                     title: s.title.clone(),
                     thread_type: s.thread_type.clone(),
-                    channel: Some(s.channel.clone()),
                 };
 
                 if s.id == assistant_id {
@@ -1087,7 +1071,6 @@ async fn chat_threads_handler(
                     updated_at: chrono::Utc::now().to_rfc3339(),
                     title: None,
                     thread_type: Some("assistant".to_string()),
-                    channel: Some("gateway".to_string()),
                 });
             }
 
@@ -1100,10 +1083,9 @@ async fn chat_threads_handler(
     }
 
     // Fallback: in-memory only (no assistant thread without DB)
-    let mut sorted_threads: Vec<_> = sess.threads.values().collect();
-    sorted_threads.sort_by(|a, b| b.updated_at.cmp(&a.updated_at));
-    let threads: Vec<ThreadInfo> = sorted_threads
-        .into_iter()
+    let threads: Vec<ThreadInfo> = sess
+        .threads
+        .values()
         .map(|t| ThreadInfo {
             id: t.id,
             state: format!("{:?}", t.state),
@@ -1112,7 +1094,6 @@ async fn chat_threads_handler(
             updated_at: t.updated_at.to_rfc3339(),
             title: None,
             thread_type: None,
-            channel: Some("gateway".to_string()),
         })
         .collect();
 
@@ -1132,39 +1113,38 @@ async fn chat_new_thread_handler(
     ))?;
 
     let session = session_manager.get_or_create_session(&state.user_id).await;
-    let (thread_id, info) = {
-        let mut sess = session.lock().await;
-        let thread = sess.create_thread();
-        let id = thread.id;
-        let info = ThreadInfo {
-            id: thread.id,
-            state: format!("{:?}", thread.state),
-            turn_count: thread.turns.len(),
-            created_at: thread.created_at.to_rfc3339(),
-            updated_at: thread.updated_at.to_rfc3339(),
-            title: None,
-            thread_type: Some("thread".to_string()),
-            channel: Some("gateway".to_string()),
-        };
-        (id, info)
+    let mut sess = session.lock().await;
+    let thread = sess.create_thread();
+    let thread_id = thread.id;
+    let info = ThreadInfo {
+        id: thread.id,
+        state: format!("{:?}", thread.state),
+        turn_count: thread.turns.len(),
+        created_at: thread.created_at.to_rfc3339(),
+        updated_at: thread.updated_at.to_rfc3339(),
+        title: None,
+        thread_type: Some("thread".to_string()),
     };
 
-    // Persist the empty conversation row with thread_type metadata synchronously
-    // so that the subsequent loadThreads() call from the frontend sees it.
+    // Persist the empty conversation row with thread_type metadata
     if let Some(ref store) = state.store {
-        if let Err(e) = store
-            .ensure_conversation(thread_id, "gateway", &state.user_id, None)
-            .await
-        {
-            tracing::warn!("Failed to persist new thread: {}", e);
-        }
-        let metadata_val = serde_json::json!("thread");
-        if let Err(e) = store
-            .update_conversation_metadata_field(thread_id, "thread_type", &metadata_val)
-            .await
-        {
-            tracing::warn!("Failed to set thread_type metadata: {}", e);
-        }
+        let store = Arc::clone(store);
+        let user_id = state.user_id.clone();
+        tokio::spawn(async move {
+            if let Err(e) = store
+                .ensure_conversation(thread_id, "gateway", &user_id, None)
+                .await
+            {
+                tracing::warn!("Failed to persist new thread: {}", e);
+            }
+            let metadata_val = serde_json::json!("thread");
+            if let Err(e) = store
+                .update_conversation_metadata_field(thread_id, "thread_type", &metadata_val)
+                .await
+            {
+                tracing::warn!("Failed to set thread_type metadata: {}", e);
+            }
+        });
     }
 
     Ok(Json(info))
@@ -1458,7 +1438,6 @@ async fn extensions_list_handler(
                 has_auth: ext.has_auth,
                 activation_status,
                 activation_error: ext.activation_error,
-                version: ext.version,
             }
         })
         .collect();
@@ -1752,7 +1731,6 @@ async fn extensions_registry_handler(
                 kind: kind_str,
                 description: e.description.clone(),
                 keywords: e.keywords.clone(),
-                version: e.version.clone(),
             }
         })
         .collect();
@@ -1985,35 +1963,47 @@ async fn routines_trigger_handler(
     State(state): State<Arc<GatewayState>>,
     Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
-    let engine = {
-        let guard = state.routine_engine.read().await;
-        guard.as_ref().cloned().ok_or((
-            StatusCode::SERVICE_UNAVAILABLE,
-            "Routine engine not available".to_string(),
-        ))?
-    };
+    let store = state.store.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "Database not available".to_string(),
+    ))?;
 
     let routine_id = Uuid::parse_str(&id)
         .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid routine ID".to_string()))?;
 
-    let run_id = engine
-        .fire_manual(routine_id, Some(&state.user_id))
+    let routine = store
+        .get_routine(routine_id)
         .await
-        .map_err(|e| {
-            let status = match &e {
-                crate::error::RoutineError::NotFound { .. } => StatusCode::NOT_FOUND,
-                crate::error::RoutineError::NotAuthorized { .. } => StatusCode::FORBIDDEN,
-                crate::error::RoutineError::Disabled { .. }
-                | crate::error::RoutineError::MaxConcurrent { .. } => StatusCode::CONFLICT,
-                _ => StatusCode::INTERNAL_SERVER_ERROR,
-            };
-            (status, e.to_string())
-        })?;
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+        .ok_or((StatusCode::NOT_FOUND, "Routine not found".to_string()))?;
+
+    // Send the routine prompt through the message pipeline as a manual trigger.
+    let prompt = match &routine.action {
+        crate::agent::routine::RoutineAction::Lightweight { prompt, .. } => prompt.clone(),
+        crate::agent::routine::RoutineAction::FullJob {
+            title, description, ..
+        } => format!("{}: {}", title, description),
+    };
+
+    let content = format!("[routine:{}] {}", routine.name, prompt);
+    let msg = IncomingMessage::new("gateway", &state.user_id, content);
+
+    let tx_guard = state.msg_tx.read().await;
+    let tx = tx_guard.as_ref().ok_or((
+        StatusCode::SERVICE_UNAVAILABLE,
+        "Channel not started".to_string(),
+    ))?;
+
+    tx.send(msg).await.map_err(|_| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Channel closed".to_string(),
+        )
+    })?;
 
     Ok(Json(serde_json::json!({
         "status": "triggered",
         "routine_id": routine_id,
-        "run_id": run_id,
     })))
 }
 
@@ -2124,7 +2114,7 @@ async fn routines_runs_handler(
 /// Convert a Routine to the trimmed RoutineInfo for list display.
 fn routine_to_info(r: &crate::agent::routine::Routine) -> RoutineInfo {
     let (trigger_type, trigger_summary) = match &r.trigger {
-        crate::agent::routine::Trigger::Cron { schedule, .. } => {
+        crate::agent::routine::Trigger::Cron { schedule } => {
             ("cron".to_string(), format!("cron: {}", schedule))
         }
         crate::agent::routine::Trigger::Event {
@@ -2329,7 +2319,6 @@ async fn gateway_status_handler(
         .unwrap_or(false);
 
     Json(GatewayStatusResponse {
-        version: env!("CARGO_PKG_VERSION").to_string(),
         sse_connections,
         ws_connections,
         total_connections: sse_connections + ws_connections,
@@ -2351,7 +2340,6 @@ struct ModelUsageEntry {
 
 #[derive(serde::Serialize)]
 struct GatewayStatusResponse {
-    version: String,
     sse_connections: u64,
     ws_connections: u64,
     total_connections: u64,
@@ -2471,7 +2459,6 @@ mod tests {
             chat_rate_limiter: RateLimiter::new(30, 60),
             registry_entries: vec![],
             cost_guard: None,
-            routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
             startup_time: std::time::Instant::now(),
         })
     }
@@ -2629,9 +2616,7 @@ mod tests {
             secrets,
             sse_sender: None,
             gateway_token: None,
-            created_at: std::time::Instant::now()
-                .checked_sub(std::time::Duration::from_secs(600))
-                .expect("System uptime is too low to run expired flow test"),
+            created_at: std::time::Instant::now() - std::time::Duration::from_secs(600),
         };
 
         ext_mgr
@@ -2738,9 +2723,7 @@ mod tests {
             sse_sender: None,
             gateway_token: None,
             // Expired — handler will reject after lookup (no network I/O)
-            created_at: std::time::Instant::now()
-                .checked_sub(std::time::Duration::from_secs(600))
-                .expect("System uptime is too low to run expired flow test"),
+            created_at: std::time::Instant::now() - std::time::Duration::from_secs(600),
         };
 
         ext_mgr

src/channels/web/static/app.js

@@ -5,7 +5,6 @@ let eventSource = null;
 let logEventSource = null;
 let currentTab = 'chat';
 let currentThreadId = null;
-let currentThreadIsReadOnly = false;
 let assistantThreadId = null;
 let hasMore = false;
 let oldestTimestamp = null;
@@ -14,8 +13,6 @@ let sseHasConnectedBefore = false;
 let jobEvents = new Map(); // job_id -> Array of events
 let jobListRefreshTimer = null;
 let pairingPollInterval = null;
-let unreadThreads = new Map(); // thread_id -> unread count
-let _loadThreadsTimer = null;
 const JOB_EVENTS_CAP = 500;
 const MEMORY_SEARCH_QUERY_MAX_LENGTH = 100;
 
@@ -181,7 +178,6 @@ function confirmRestart() {
     body: {
       content: '/restart',
       thread_id: currentThreadId,
-      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
     },
   })
     .then((response) => {
@@ -277,13 +273,7 @@ function connectSSE() {
 
   eventSource.addEventListener('response', (e) => {
     const data = JSON.parse(e.data);
-    if (!isCurrentThread(data.thread_id)) {
-      if (data.thread_id) {
-        unreadThreads.set(data.thread_id, (unreadThreads.get(data.thread_id) || 0) + 1);
-        debouncedLoadThreads();
-      }
-      return;
-    }
+    if (!isCurrentThread(data.thread_id)) return;
     finalizeActivityGroup();
     addMessage('assistant', data.content);
     enableChatInput();
@@ -298,10 +288,7 @@ function connectSSE() {
 
   eventSource.addEventListener('thinking', (e) => {
     const data = JSON.parse(e.data);
-    if (!isCurrentThread(data.thread_id)) {
-      if (data.thread_id) debouncedLoadThreads();
-      return;
-    }
+    if (!isCurrentThread(data.thread_id)) return;
     showActivityThinking(data.message);
   });
 
@@ -337,10 +324,7 @@ function connectSSE() {
 
   eventSource.addEventListener('status', (e) => {
     const data = JSON.parse(e.data);
-    if (!isCurrentThread(data.thread_id)) {
-      if (data.thread_id) debouncedLoadThreads();
-      return;
-    }
+    if (!isCurrentThread(data.thread_id)) return;
     // "Done" and "Awaiting approval" are terminal signals from the agent:
     // the agentic loop finished, so re-enable input as a safety net in case
     // the response SSE event is empty or lost.
@@ -430,9 +414,9 @@ function connectSSE() {
 }
 
 // Check if an SSE event belongs to the currently viewed thread.
-// Events without a thread_id are dropped (prevents notification leaking).
+// Events without a thread_id (legacy) are always shown.
 function isCurrentThread(threadId) {
-  if (!threadId) return false;
+  if (!threadId) return true;
   if (!currentThreadId) return true;
   return threadId === currentThreadId;
 }
@@ -455,21 +439,14 @@ function sendMessage() {
 
   apiFetch('/api/chat/send', {
     method: 'POST',
-    body: { content, thread_id: currentThreadId || undefined, timezone: Intl.DateTimeFormat().resolvedOptions().timeZone },
+    body: { content, thread_id: currentThreadId || undefined },
   }).catch((err) => {
     addMessage('system', 'Failed to send: ' + err.message);
   });
 }
 
 function enableChatInput() {
-  if (currentThreadIsReadOnly) return;
-  const input = document.getElementById('chat-input');
-  const btn = document.getElementById('send-btn');
-  if (input) {
-    input.disabled = false;
-    input.placeholder = 'Message or / for commands...';
-  }
-  if (btn) btn.disabled = false;
+  // no-op: input and send button are always enabled
 }
 
 // --- Slash Autocomplete ---
@@ -564,13 +541,6 @@ function sendApprovalAction(requestId, action) {
 
 function renderMarkdown(text) {
   if (typeof marked !== 'undefined') {
-    // Escape raw HTML error pages instead of rendering them as markup.
-    // Only triggers when the text *starts with* a doctype or <html> tag
-    // (after optional whitespace), so normal messages that mention HTML
-    // tags in prose or code fences are not affected.  See #263.
-    if (/^\s*<!doctype\s/i.test(text) || /^\s*<html[\s>]/i.test(text)) {
-      return escapeHtml(text);
-    }
     let html = marked.parse(text);
     // Sanitize HTML output to prevent XSS from tool output or LLM responses.
     html = sanitizeRenderedHtml(html);
@@ -1164,9 +1134,7 @@ function loadHistory(before) {
       // Fresh load: clear and render
       container.innerHTML = '';
       for (const turn of data.turns) {
-        if (turn.user_input) {
-          addMessage('user', turn.user_input);
-        }
+        addMessage('user', turn.user_input);
         if (turn.tool_calls && turn.tool_calls.length > 0) {
           addToolCallsSummary(turn.tool_calls);
         }
@@ -1188,10 +1156,8 @@ function loadHistory(before) {
       const savedHeight = container.scrollHeight;
       const fragment = document.createDocumentFragment();
       for (const turn of data.turns) {
-        if (turn.user_input) {
-          const userDiv = createMessageElement('user', turn.user_input);
-          fragment.appendChild(userDiv);
-        }
+        const userDiv = createMessageElement('user', turn.user_input);
+        fragment.appendChild(userDiv);
         if (turn.tool_calls && turn.tool_calls.length > 0) {
           fragment.appendChild(createToolCallsSummaryElement(turn.tool_calls));
         }
@@ -1290,37 +1256,6 @@ function removeScrollSpinner() {
 
 // --- Threads ---
 
-function threadTitle(thread) {
-  if (thread.title) return thread.title;
-  const ch = thread.channel || 'gateway';
-  if (thread.thread_type === 'heartbeat') return 'Heartbeat Alerts';
-  if (thread.thread_type === 'routine') return 'Routine';
-  if (ch !== 'gateway') return ch.charAt(0).toUpperCase() + ch.slice(1);
-  if (thread.turn_count === 0) return 'New chat';
-  return thread.id.substring(0, 8);
-}
-
-function relativeTime(isoStr) {
-  if (!isoStr) return '';
-  const diff = Date.now() - new Date(isoStr).getTime();
-  const mins = Math.floor(diff / 60000);
-  if (mins < 1) return 'now';
-  if (mins < 60) return mins + 'm ago';
-  const hrs = Math.floor(mins / 60);
-  if (hrs < 24) return hrs + 'h ago';
-  const days = Math.floor(hrs / 24);
-  return days + 'd ago';
-}
-
-function isReadOnlyChannel(channel) {
-  return channel && channel !== 'gateway' && channel !== 'routine' && channel !== 'heartbeat';
-}
-
-function debouncedLoadThreads() {
-  if (_loadThreadsTimer) clearTimeout(_loadThreadsTimer);
-  _loadThreadsTimer = setTimeout(() => { _loadThreadsTimer = null; loadThreads(); }, 500);
-}
-
 function loadThreads() {
   apiFetch('/api/chat/threads').then((data) => {
     // Pinned assistant thread
@@ -1329,13 +1264,9 @@ function loadThreads() {
       const el = document.getElementById('assistant-thread');
       const isActive = currentThreadId === assistantThreadId;
       el.className = 'assistant-item' + (isActive ? ' active' : '');
-      const labelEl = document.getElementById('assistant-label');
-      if (labelEl) {
-        const at = data.assistant_thread;
-        labelEl.textContent = 'Assistant';
-      }
       const meta = document.getElementById('assistant-meta');
-      meta.textContent = relativeTime(data.assistant_thread.updated_at);
+      const count = data.assistant_thread.turn_count || 0;
+      meta.textContent = count > 0 ? count + ' turns' : '';
     }
 
     // Regular threads
@@ -1344,38 +1275,16 @@ function loadThreads() {
     const threads = data.threads || [];
     for (const thread of threads) {
       const item = document.createElement('div');
-      const isActive = thread.id === currentThreadId;
-      item.className = 'thread-item' + (isActive ? ' active' : '');
-
-      // Channel badge for non-gateway threads
-      const ch = thread.channel || 'gateway';
-      if (ch !== 'gateway') {
-        const badge = document.createElement('span');
-        badge.className = 'thread-badge thread-badge-' + ch;
-        badge.textContent = ch;
-        item.appendChild(badge);
-      }
-
+      item.className = 'thread-item' + (thread.id === currentThreadId ? ' active' : '');
       const label = document.createElement('span');
       label.className = 'thread-label';
-      label.textContent = threadTitle(thread);
-      label.title = (thread.title || '') + ' (' + thread.id + ')';
+      label.textContent = thread.title || thread.id.substring(0, 8);
+      label.title = thread.title ? thread.title + ' (' + thread.id + ')' : thread.id;
       item.appendChild(label);
-
       const meta = document.createElement('span');
       meta.className = 'thread-meta';
-      meta.textContent = relativeTime(thread.updated_at);
+      meta.textContent = (thread.turn_count || 0) + ' turns';
       item.appendChild(meta);
-
-      // Unread dot
-      const unread = unreadThreads.get(thread.id) || 0;
-      if (unread > 0 && !isActive) {
-        const dot = document.createElement('span');
-        dot.className = 'thread-unread';
-        dot.textContent = unread > 9 ? '9+' : String(unread);
-        item.appendChild(dot);
-      }
-
       item.addEventListener('click', () => switchThread(thread.id));
       list.appendChild(item);
     }
@@ -1385,36 +1294,17 @@ function loadThreads() {
       switchToAssistant();
     }
 
-    // Enable/disable chat input based on channel type
+    // Enable chat input once a thread is available
     if (currentThreadId) {
-      const currentThread = threads.find(t => t.id === currentThreadId);
-      const ch = currentThread ? currentThread.channel : 'gateway';
-      currentThreadIsReadOnly = isReadOnlyChannel(ch);
-      if (currentThreadIsReadOnly) {
-        disableChatInputReadOnly();
-      } else {
-        enableChatInput();
-      }
+      enableChatInput();
     }
   }).catch(() => {});
 }
 
-function disableChatInputReadOnly() {
-  const input = document.getElementById('chat-input');
-  const btn = document.getElementById('send-btn');
-  if (input) {
-    input.disabled = true;
-    input.placeholder = 'Read-only thread (external channel)';
-  }
-  if (btn) btn.disabled = true;
-}
-
 function switchToAssistant() {
   if (!assistantThreadId) return;
   finalizeActivityGroup();
   currentThreadId = assistantThreadId;
-  currentThreadIsReadOnly = false;
-  unreadThreads.delete(assistantThreadId);
   hasMore = false;
   oldestTimestamp = null;
   loadHistory();
@@ -1424,7 +1314,6 @@ function switchToAssistant() {
 function switchThread(threadId) {
   finalizeActivityGroup();
   currentThreadId = threadId;
-  unreadThreads.delete(threadId);
   hasMore = false;
   oldestTimestamp = null;
   loadHistory();
@@ -1481,7 +1370,7 @@ chatInput.addEventListener('keydown', (e) => {
     }
   }
 
-  if (e.key === 'Enter' && !e.shiftKey && !e.isComposing) {
+  if (e.key === 'Enter' && !e.shiftKey) {
     e.preventDefault();
     hideSlashAutocomplete();
     sendMessage();
@@ -2000,13 +1889,6 @@ function renderAvailableExtensionCard(entry) {
   kind.textContent = kindLabels[entry.kind] || entry.kind;
   header.appendChild(kind);
 
-  if (entry.version) {
-    const ver = document.createElement('span');
-    ver.className = 'ext-version';
-    ver.textContent = 'v' + entry.version;
-    header.appendChild(ver);
-  }
-
   card.appendChild(header);
 
   const desc = document.createElement('div');
@@ -2167,13 +2049,6 @@ function renderExtensionCard(ext) {
   kind.textContent = kindLabels[ext.kind] || ext.kind;
   header.appendChild(kind);
 
-  if (ext.version) {
-    const ver = document.createElement('span');
-    ver.className = 'ext-version';
-    ver.textContent = 'v' + ext.version;
-    header.appendChild(ver);
-  }
-
   // Auth dot only for non-WASM-channel extensions (channels use the stepper instead)
   if (ext.kind !== 'wasm_channel') {
     const authDot = document.createElement('span');
@@ -3419,12 +3294,6 @@ function fetchGatewayStatus() {
     var popover = document.getElementById('gateway-popover');
     var html = '';
 
-    // Version
-    if (data.version) {
-      html += '<div class="gw-section-label">IronClaw v' + escapeHtml(data.version) + '</div>';
-      html += '<div class="gw-divider"></div>';
-    }
-
     // Connection info
     html += '<div class="gw-section-label">Connections</div>';
     html += '<div class="gw-stat"><span>SSE</span><span>' + (data.sse_connections || 0) + '</span></div>';

src/channels/web/static/index.html

@@ -113,12 +113,12 @@
     <div class="tab-panel active" id="tab-chat">
       <div class="thread-sidebar" id="thread-sidebar">
         <div class="thread-sidebar-header">
+          <span>Threads</span>
           <button class="thread-new-btn" onclick="createNewThread()" title="New thread (Ctrl/Cmd+N)">+</button>
-          <div class="spacer"></div>
           <button class="thread-toggle-btn" id="thread-toggle-btn" onclick="toggleThreadSidebar()" title="Toggle sidebar">&laquo;</button>
         </div>
         <div class="assistant-item" id="assistant-thread" onclick="switchToAssistant()">
-          <span class="assistant-label" id="assistant-label">Assistant</span>
+          <span class="assistant-label">Assistant</span>
           <span class="assistant-meta" id="assistant-meta"></span>
         </div>
         <div class="threads-section-header">

src/channels/web/static/style.css

@@ -2438,12 +2438,6 @@ body {
   color: var(--warning);
 }
 
-.ext-version {
-  font-size: 11px;
-  color: var(--text-muted);
-  font-family: var(--font-mono);
-}
-
 .ext-auth-dot {
   width: 8px;
   height: 8px;
@@ -3074,7 +3068,7 @@ mark {
 }
 
 .thread-sidebar {
-  width: 240px;
+  width: 200px;
   background: var(--bg-secondary);
   border-right: 1px solid var(--border);
   display: flex;
@@ -3082,8 +3076,6 @@ mark {
   flex-shrink: 0;
   transition: width 0.2s ease;
   overflow: hidden;
-  padding: 6px;
-  gap: 2px;
 }
 
 .thread-sidebar.collapsed {
@@ -3101,7 +3093,8 @@ mark {
 .thread-sidebar-header {
   display: flex;
   align-items: center;
-  padding: 10px 10px;
+  padding: 10px 12px;
+  border-bottom: 1px solid var(--border);
   font-size: 13px;
   font-weight: 600;
   gap: 8px;
@@ -3135,22 +3128,21 @@ mark {
   display: flex;
   align-items: center;
   justify-content: space-between;
-  padding: 12px 14px;
+  padding: 10px 12px;
   cursor: pointer;
   font-size: 13px;
   font-weight: 600;
   color: var(--text);
-  background: var(--bg-tertiary);
-  border-radius: var(--radius);
-  margin-bottom: 2px;
+  border-bottom: 1px solid var(--border);
+  background: var(--bg-secondary);
 }
 
 .assistant-item:hover {
-  background: rgba(255, 255, 255, 0.06);
+  background: var(--bg-tertiary);
 }
 
 .assistant-item.active {
-  background: rgba(52, 211, 153, 0.1);
+  background: rgba(52, 211, 153, 0.08);
   color: var(--accent);
   border-left: 2px solid var(--accent);
 }
@@ -3168,7 +3160,7 @@ mark {
 }
 
 .threads-section-header {
-  padding: 10px 10px 4px;
+  padding: 8px 12px 4px;
   font-size: 11px;
   font-weight: 500;
   text-transform: uppercase;
@@ -3198,11 +3190,11 @@ mark {
   display: flex;
   align-items: center;
   justify-content: space-between;
-  padding: 10px 14px;
+  padding: 8px 12px;
   cursor: pointer;
   font-size: 13px;
   color: var(--text-secondary);
-  border-radius: var(--radius);
+  border-bottom: 1px solid rgba(255, 255, 255, 0.03);
 }
 
 .thread-item:hover {
@@ -3224,43 +3216,6 @@ mark {
 .thread-meta {
   font-size: 11px;
   color: var(--text-secondary);
-  flex-shrink: 0;
-}
-
-.thread-badge {
-  display: inline-block;
-  font-size: 9px;
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.5px;
-  padding: 1px 5px;
-  border-radius: 3px;
-  background: rgba(255, 255, 255, 0.08);
-  color: var(--text-secondary);
-  margin-right: 6px;
-  flex-shrink: 0;
-}
-
-.thread-badge-routine { background: rgba(52, 211, 153, 0.15); color: var(--accent); }
-.thread-badge-heartbeat { background: rgba(245, 166, 35, 0.15); color: var(--warning); }
-.thread-badge-telegram { background: rgba(0, 136, 204, 0.15); color: #0088cc; }
-.thread-badge-signal { background: rgba(59, 118, 240, 0.15); color: #3b76f0; }
-.thread-badge-slack { background: rgba(74, 21, 75, 0.15); color: #e01e5a; }
-
-.thread-unread {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  min-width: 16px;
-  height: 16px;
-  font-size: 10px;
-  font-weight: 700;
-  background: var(--accent);
-  color: var(--bg);
-  border-radius: 8px;
-  padding: 0 4px;
-  margin-left: auto;
-  flex-shrink: 0;
 }
 
 /* --- Memory editing --- */
@@ -3659,7 +3614,7 @@ mark {
     left: 0;
     top: 0;
     bottom: 0;
-    width: 240px;
+    width: 200px;
     z-index: 50;
   }
 

src/channels/web/test_helpers.rs

@@ -1,105 +0,0 @@
-//! Shared test utilities for gateway integration tests.
-//!
-//! This module is always compiled (not `#[cfg(test)]`) because integration tests
-//! in `tests/` import the crate as a regular dependency and `cfg(test)` is only
-//! set when compiling *this* crate's unit tests.
-
-use std::net::SocketAddr;
-use std::sync::Arc;
-
-use tokio::sync::mpsc;
-
-use crate::channels::IncomingMessage;
-use crate::channels::web::server::{GatewayState, RateLimiter, start_server};
-use crate::channels::web::sse::SseManager;
-use crate::channels::web::ws::WsConnectionTracker;
-
-/// Builder for constructing a [`GatewayState`] with sensible test defaults.
-///
-/// Every optional field defaults to `None` and can be overridden via builder
-/// methods.  Call [`build`](Self::build) to get the `Arc<GatewayState>`, or
-/// [`start`](Self::start) to also bind an Axum server on a random port.
-pub struct TestGatewayBuilder {
-    msg_tx: Option<mpsc::Sender<IncomingMessage>>,
-    llm_provider: Option<Arc<dyn crate::llm::LlmProvider>>,
-    user_id: String,
-}
-
-impl Default for TestGatewayBuilder {
-    fn default() -> Self {
-        Self {
-            msg_tx: None,
-            llm_provider: None,
-            user_id: "test-user".to_string(),
-        }
-    }
-}
-
-impl TestGatewayBuilder {
-    /// Create a new builder with all defaults.
-    pub fn new() -> Self {
-        Self::default()
-    }
-
-    /// Set the agent message sender (the channel the gateway forwards
-    /// incoming chat messages to).
-    pub fn msg_tx(mut self, tx: mpsc::Sender<IncomingMessage>) -> Self {
-        self.msg_tx = Some(tx);
-        self
-    }
-
-    /// Set the LLM provider (needed for OpenAI-compatible API tests).
-    pub fn llm_provider(mut self, provider: Arc<dyn crate::llm::LlmProvider>) -> Self {
-        self.llm_provider = Some(provider);
-        self
-    }
-
-    /// Override the user ID (default: `"test-user"`).
-    pub fn user_id(mut self, id: impl Into<String>) -> Self {
-        self.user_id = id.into();
-        self
-    }
-
-    /// Build the `Arc<GatewayState>` without starting a server.
-    pub fn build(self) -> Arc<GatewayState> {
-        Arc::new(GatewayState {
-            msg_tx: tokio::sync::RwLock::new(self.msg_tx),
-            sse: SseManager::new(),
-            workspace: None,
-            session_manager: None,
-            log_broadcaster: None,
-            log_level_handle: None,
-            extension_manager: None,
-            tool_registry: None,
-            store: None,
-            job_manager: None,
-            prompt_queue: None,
-            user_id: self.user_id,
-            shutdown_tx: tokio::sync::RwLock::new(None),
-            ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
-            llm_provider: self.llm_provider,
-            skill_registry: None,
-            skill_catalog: None,
-            scheduler: None,
-            chat_rate_limiter: RateLimiter::new(30, 60),
-            registry_entries: Vec::new(),
-            cost_guard: None,
-            routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
-            startup_time: std::time::Instant::now(),
-        })
-    }
-
-    /// Build the state and start a gateway server on `127.0.0.1:0` (random
-    /// port).  Returns the bound address and the shared state.
-    pub async fn start(
-        self,
-        auth_token: &str,
-    ) -> Result<(SocketAddr, Arc<GatewayState>), crate::error::ChannelError> {
-        let state = self.build();
-        let addr: SocketAddr = "127.0.0.1:0"
-            .parse()
-            .expect("hard-coded address must parse");
-        let bound = start_server(addr, state.clone(), auth_token.to_string()).await?;
-        Ok((bound, state))
-    }
-}

src/channels/web/types.rs

@@ -9,7 +9,6 @@ use uuid::Uuid;
 pub struct SendMessageRequest {
     pub content: String,
     pub thread_id: Option<String>,
-    pub timezone: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -29,8 +28,6 @@ pub struct ThreadInfo {
     pub title: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub thread_type: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub channel: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -404,9 +401,6 @@ pub struct ExtensionInfo {
     /// Human-readable error when activation_status is "failed".
     #[serde(skip_serializing_if = "Option::is_none")]
     pub activation_error: Option<String>,
-    /// Extension version (semver).
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -509,8 +503,6 @@ pub struct RegistryEntryInfo {
     pub description: String,
     pub keywords: Vec<String>,
     pub installed: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub version: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -614,7 +606,6 @@ pub enum WsClientMessage {
     Message {
         content: String,
         thread_id: Option<String>,
-        timezone: Option<String>,
     },
     /// Approve or deny a pending tool execution.
     #[serde(rename = "approval")]
@@ -800,9 +791,7 @@ mod tests {
         let json = r#"{"type":"message","content":"hello","thread_id":"t1"}"#;
         let msg: WsClientMessage = serde_json::from_str(json).unwrap();
         match msg {
-            WsClientMessage::Message {
-                content, thread_id, ..
-            } => {
+            WsClientMessage::Message { content, thread_id } => {
                 assert_eq!(content, "hello");
                 assert_eq!(thread_id.as_deref(), Some("t1"));
             }
@@ -815,9 +804,7 @@ mod tests {
         let json = r#"{"type":"message","content":"hi"}"#;
         let msg: WsClientMessage = serde_json::from_str(json).unwrap();
         match msg {
-            WsClientMessage::Message {
-                content, thread_id, ..
-            } => {
+            WsClientMessage::Message { content, thread_id } => {
                 assert_eq!(content, "hi");
                 assert!(thread_id.is_none());
             }
@@ -1071,40 +1058,4 @@ mod tests {
         let req: AuthCancelRequest = serde_json::from_str(json).unwrap();
         assert_eq!(req.extension_name, "telegram");
     }
-
-    // ---- ThreadInfo channel field tests ----
-
-    #[test]
-    fn test_thread_info_channel_serialized() {
-        let info = ThreadInfo {
-            id: Uuid::nil(),
-            state: "Idle".to_string(),
-            turn_count: 0,
-            created_at: "2026-01-01T00:00:00Z".to_string(),
-            updated_at: "2026-01-01T00:00:00Z".to_string(),
-            title: None,
-            thread_type: None,
-            channel: Some("telegram".to_string()),
-        };
-        let json = serde_json::to_string(&info).unwrap();
-        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
-        assert_eq!(parsed["channel"], "telegram");
-    }
-
-    #[test]
-    fn test_thread_info_channel_omitted_when_none() {
-        let info = ThreadInfo {
-            id: Uuid::nil(),
-            state: "Idle".to_string(),
-            turn_count: 0,
-            created_at: "2026-01-01T00:00:00Z".to_string(),
-            updated_at: "2026-01-01T00:00:00Z".to_string(),
-            title: None,
-            thread_type: None,
-            channel: None,
-        };
-        let json = serde_json::to_string(&info).unwrap();
-        let parsed: serde_json::Value = serde_json::from_str(&json).unwrap();
-        assert!(parsed.get("channel").is_none());
-    }
 }

src/channels/web/util.rs

@@ -83,19 +83,6 @@ pub fn build_turns_from_db_messages(
 
             turns.push(turn);
             turn_number += 1;
-        } else if msg.role == "assistant" {
-            // Standalone assistant message (e.g. routine output, heartbeat)
-            // with no preceding user message — render as a turn with empty input.
-            turns.push(TurnInfo {
-                turn_number,
-                user_input: String::new(),
-                response: Some(msg.content.clone()),
-                state: "Completed".to_string(),
-                started_at: msg.created_at.to_rfc3339(),
-                completed_at: Some(msg.created_at.to_rfc3339()),
-                tool_calls: Vec::new(),
-            });
-            turn_number += 1;
         }
     }
 
@@ -233,29 +220,6 @@ mod tests {
         assert_eq!(turns[0].response.as_deref(), Some("Done"));
     }
 
-    #[test]
-    fn test_build_turns_standalone_assistant_messages() {
-        // Routine conversations only have assistant messages (no user messages).
-        let messages = vec![
-            make_msg("assistant", "Routine executed: all checks passed", 0),
-            make_msg("assistant", "Routine executed: found 2 issues", 5000),
-        ];
-        let turns = build_turns_from_db_messages(&messages);
-        assert_eq!(turns.len(), 2);
-        // Standalone assistant messages should have empty user_input
-        assert_eq!(turns[0].user_input, "");
-        assert_eq!(
-            turns[0].response.as_deref(),
-            Some("Routine executed: all checks passed")
-        );
-        assert_eq!(turns[0].state, "Completed");
-        assert_eq!(turns[1].user_input, "");
-        assert_eq!(
-            turns[1].response.as_deref(),
-            Some("Routine executed: found 2 issues")
-        );
-    }
-
     #[test]
     fn test_build_turns_backward_compatible() {
         let messages = vec![

src/channels/web/ws.rs

@@ -156,15 +156,8 @@ async fn handle_client_message(
     direct_tx: &mpsc::Sender<WsServerMessage>,
 ) {
     match msg {
-        WsClientMessage::Message {
-            content,
-            thread_id,
-            timezone,
-        } => {
+        WsClientMessage::Message { content, thread_id } => {
             let mut incoming = IncomingMessage::new("gateway", user_id, &content);
-            if let Some(ref tz) = timezone {
-                incoming = incoming.with_timezone(tz);
-            }
             if let Some(ref tid) = thread_id {
                 incoming = incoming.with_thread(tid);
             }
@@ -356,7 +349,6 @@ mod tests {
             WsClientMessage::Message {
                 content: "hello agent".to_string(),
                 thread_id: Some("t1".to_string()),
-                timezone: None,
             },
             &state,
             "user1",
@@ -381,7 +373,6 @@ mod tests {
             WsClientMessage::Message {
                 content: "hello".to_string(),
                 thread_id: None,
-                timezone: None,
             },
             &state,
             "user1",
@@ -502,7 +493,6 @@ mod tests {
             chat_rate_limiter: crate::channels::web::server::RateLimiter::new(30, 60),
             registry_entries: Vec::new(),
             cost_guard: None,
-            routine_engine: Arc::new(tokio::sync::RwLock::new(None)),
             startup_time: std::time::Instant::now(),
         }
     }

src/cli/mod.rs

@@ -86,7 +86,7 @@ pub enum Command {
     /// Interactive onboarding wizard
     #[command(
         about = "Run interactive setup wizard",
-        long_about = "Guides through initial configuration.\nExamples:\n  ironclaw onboard --skip-auth  # Skip auth step\n  ironclaw onboard --channels-only  # Reconfigure channels\n  ironclaw onboard --provider-only  # Change LLM provider and model"
+        long_about = "Guides through initial configuration.\nExamples:\n  ironclaw onboard --skip-auth  # Skip auth step\n  ironclaw onboard --channels-only  # Reconfigure channels"
     )]
     Onboard {
         /// Skip authentication (use existing session)
@@ -94,12 +94,8 @@ pub enum Command {
         skip_auth: bool,
 
         /// Reconfigure channels only
-        #[arg(long, conflicts_with = "provider_only")]
+        #[arg(long)]
         channels_only: bool,
-
-        /// Reconfigure LLM provider and model only
-        #[arg(long, conflicts_with = "channels_only")]
-        provider_only: bool,
     },
 
     /// Manage configuration settings

src/cli/status.rs

@@ -8,35 +8,9 @@ use std::path::PathBuf;
 use crate::bootstrap::ironclaw_base_dir;
 use crate::settings::Settings;
 
-/// Load settings from JSON and TOML config files, matching the runtime
-/// priority: TOML overlay > settings.json > defaults.
-///
-/// This mirrors the loading chain in `Config::from_env_with_toml()` but
-/// without resolving the full `Config` (which requires async + secrets).
-fn load_settings() -> Settings {
-    load_settings_from(&Settings::default_path(), &Settings::default_toml_path())
-}
-
-/// Inner implementation with injectable paths (testable).
-fn load_settings_from(json_path: &std::path::Path, toml_path: &std::path::Path) -> Settings {
-    let mut settings = Settings::load_from(json_path);
-
-    match Settings::load_toml(toml_path) {
-        Ok(Some(toml_settings)) => {
-            settings.merge_from(&toml_settings);
-        }
-        Ok(None) => {} // File not found — fine for default path
-        Err(e) => {
-            eprintln!("Warning: failed to parse {}: {}", toml_path.display(), e);
-        }
-    }
-
-    settings
-}
-
 /// Run the status command, printing system health info.
 pub async fn run_status_command() -> anyhow::Result<()> {
-    let settings = load_settings();
+    let settings = Settings::default();
 
     println!("IronClaw Status");
     println!("===============\n");
@@ -235,99 +209,3 @@ fn default_tools_dir() -> PathBuf {
 fn default_channels_dir() -> PathBuf {
     ironclaw_base_dir().join("channels")
 }
-
-#[cfg(test)]
-mod tests {
-    use super::load_settings_from;
-
-    /// Regression test for #354: load_settings_from must read config.toml.
-    #[test]
-    fn reads_toml_heartbeat_enabled() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let json_path = dir.path().join("settings.json");
-        let toml_path = dir.path().join("config.toml");
-
-        // No JSON file — only TOML
-        std::fs::write(
-            &toml_path,
-            "[heartbeat]\nenabled = true\ninterval_secs = 600",
-        )
-        .expect("write toml");
-
-        let settings = load_settings_from(&json_path, &toml_path);
-        assert!(settings.heartbeat.enabled);
-        assert_eq!(settings.heartbeat.interval_secs, 600);
-    }
-
-    /// Without any config files, defaults are returned.
-    #[test]
-    fn defaults_without_config_files() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let settings = load_settings_from(
-            &dir.path().join("nonexistent.json"),
-            &dir.path().join("nonexistent.toml"),
-        );
-        assert!(!settings.heartbeat.enabled);
-    }
-
-    /// settings.json is respected.
-    #[test]
-    fn reads_json_heartbeat_enabled() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let json_path = dir.path().join("settings.json");
-        let toml_path = dir.path().join("nonexistent.toml");
-
-        std::fs::write(
-            &json_path,
-            r#"{"heartbeat":{"enabled":true,"interval_secs":900}}"#,
-        )
-        .expect("write json");
-
-        let settings = load_settings_from(&json_path, &toml_path);
-        assert!(settings.heartbeat.enabled);
-        assert_eq!(settings.heartbeat.interval_secs, 900);
-    }
-
-    /// TOML overlay wins over JSON settings.
-    #[test]
-    fn toml_overlay_wins_over_json() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let json_path = dir.path().join("settings.json");
-        let toml_path = dir.path().join("config.toml");
-
-        std::fs::write(
-            &json_path,
-            r#"{"heartbeat":{"enabled":false,"interval_secs":100}}"#,
-        )
-        .expect("write json");
-        std::fs::write(
-            &toml_path,
-            "[heartbeat]\nenabled = true\ninterval_secs = 200",
-        )
-        .expect("write toml");
-
-        let settings = load_settings_from(&json_path, &toml_path);
-        assert!(settings.heartbeat.enabled);
-        assert_eq!(settings.heartbeat.interval_secs, 200);
-    }
-
-    /// Invalid TOML is warned but doesn't crash; falls back to JSON/defaults.
-    #[test]
-    fn invalid_toml_falls_back_gracefully() {
-        let dir = tempfile::tempdir().expect("tempdir");
-        let json_path = dir.path().join("settings.json");
-        let toml_path = dir.path().join("config.toml");
-
-        std::fs::write(
-            &json_path,
-            r#"{"heartbeat":{"enabled":true,"interval_secs":500}}"#,
-        )
-        .expect("write json");
-        std::fs::write(&toml_path, "this is not valid toml [[[").expect("write bad toml");
-
-        let settings = load_settings_from(&json_path, &toml_path);
-        // Should fall back to JSON values, not crash
-        assert!(settings.heartbeat.enabled);
-        assert_eq!(settings.heartbeat.interval_secs, 500);
-    }
-}

src/config/agent.rs

@@ -27,8 +27,6 @@ pub struct AgentConfig {
     pub max_tool_iterations: usize,
     /// When true, skip tool approval checks entirely. For benchmarks/CI.
     pub auto_approve_tools: bool,
-    /// Default timezone for new sessions (IANA name, e.g. "America/New_York").
-    pub default_timezone: String,
 }
 
 impl AgentConfig {
@@ -49,7 +47,6 @@ impl AgentConfig {
             max_actions_per_hour: None,
             max_tool_iterations: 10,
             auto_approve_tools: true,
-            default_timezone: "UTC".to_string(),
         }
     }
 
@@ -92,40 +89,6 @@ impl AgentConfig {
                 "AGENT_AUTO_APPROVE_TOOLS",
                 settings.agent.auto_approve_tools,
             )?,
-            default_timezone: {
-                let tz: String = parse_optional_env(
-                    "DEFAULT_TIMEZONE",
-                    settings.agent.default_timezone.clone(),
-                )?;
-                if crate::timezone::parse_timezone(&tz).is_none() {
-                    return Err(ConfigError::InvalidValue {
-                        key: "DEFAULT_TIMEZONE".into(),
-                        message: format!("invalid IANA timezone: '{tz}'"),
-                    });
-                }
-                tz
-            },
         })
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_default_timezone_rejects_invalid() {
-        let mut settings = Settings::default();
-        settings.agent.default_timezone = "Fake/Zone".to_string();
-
-        let result = AgentConfig::resolve(&settings);
-        assert!(result.is_err(), "invalid IANA timezone should be rejected");
-    }
-
-    #[test]
-    fn test_default_timezone_accepts_valid() {
-        let settings = Settings::default(); // default is "UTC"
-        let config = AgentConfig::resolve(&settings).expect("resolve");
-        assert_eq!(config.default_timezone, "UTC");
-    }
-}

src/config/channels.rs

@@ -204,162 +204,3 @@ impl ChannelsConfig {
 fn default_channels_dir() -> PathBuf {
     ironclaw_base_dir().join("channels")
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::config::channels::*;
-
-    #[test]
-    fn cli_config_fields() {
-        let cfg = CliConfig { enabled: true };
-        assert!(cfg.enabled);
-
-        let disabled = CliConfig { enabled: false };
-        assert!(!disabled.enabled);
-    }
-
-    #[test]
-    fn http_config_fields() {
-        let cfg = HttpConfig {
-            host: "0.0.0.0".to_string(),
-            port: 8080,
-            webhook_secret: None,
-            user_id: "http".to_string(),
-        };
-        assert_eq!(cfg.host, "0.0.0.0");
-        assert_eq!(cfg.port, 8080);
-        assert!(cfg.webhook_secret.is_none());
-        assert_eq!(cfg.user_id, "http");
-    }
-
-    #[test]
-    fn http_config_with_secret() {
-        let cfg = HttpConfig {
-            host: "127.0.0.1".to_string(),
-            port: 9090,
-            webhook_secret: Some(secrecy::SecretString::from("s3cret".to_string())),
-            user_id: "webhook-bot".to_string(),
-        };
-        assert!(cfg.webhook_secret.is_some());
-        assert_eq!(cfg.port, 9090);
-    }
-
-    #[test]
-    fn gateway_config_fields() {
-        let cfg = GatewayConfig {
-            host: "127.0.0.1".to_string(),
-            port: 3000,
-            auth_token: Some("tok-abc".to_string()),
-            user_id: "default".to_string(),
-        };
-        assert_eq!(cfg.host, "127.0.0.1");
-        assert_eq!(cfg.port, 3000);
-        assert_eq!(cfg.auth_token.as_deref(), Some("tok-abc"));
-        assert_eq!(cfg.user_id, "default");
-    }
-
-    #[test]
-    fn gateway_config_no_auth_token() {
-        let cfg = GatewayConfig {
-            host: "0.0.0.0".to_string(),
-            port: 3001,
-            auth_token: None,
-            user_id: "anon".to_string(),
-        };
-        assert!(cfg.auth_token.is_none());
-    }
-
-    #[test]
-    fn signal_config_fields_and_defaults() {
-        let cfg = SignalConfig {
-            http_url: "http://127.0.0.1:8080".to_string(),
-            account: "+1234567890".to_string(),
-            allow_from: vec!["+1234567890".to_string()],
-            allow_from_groups: vec![],
-            dm_policy: "pairing".to_string(),
-            group_policy: "allowlist".to_string(),
-            group_allow_from: vec![],
-            ignore_attachments: false,
-            ignore_stories: true,
-        };
-        assert_eq!(cfg.http_url, "http://127.0.0.1:8080");
-        assert_eq!(cfg.account, "+1234567890");
-        assert_eq!(cfg.allow_from, vec!["+1234567890"]);
-        assert!(cfg.allow_from_groups.is_empty());
-        assert_eq!(cfg.dm_policy, "pairing");
-        assert_eq!(cfg.group_policy, "allowlist");
-        assert!(cfg.group_allow_from.is_empty());
-        assert!(!cfg.ignore_attachments);
-        assert!(cfg.ignore_stories);
-    }
-
-    #[test]
-    fn signal_config_open_policies() {
-        let cfg = SignalConfig {
-            http_url: "http://localhost:7583".to_string(),
-            account: "+0000000000".to_string(),
-            allow_from: vec!["*".to_string()],
-            allow_from_groups: vec!["*".to_string()],
-            dm_policy: "open".to_string(),
-            group_policy: "open".to_string(),
-            group_allow_from: vec![],
-            ignore_attachments: true,
-            ignore_stories: false,
-        };
-        assert_eq!(cfg.allow_from, vec!["*"]);
-        assert_eq!(cfg.allow_from_groups, vec!["*"]);
-        assert_eq!(cfg.dm_policy, "open");
-        assert_eq!(cfg.group_policy, "open");
-        assert!(cfg.ignore_attachments);
-        assert!(!cfg.ignore_stories);
-    }
-
-    #[test]
-    fn channels_config_fields() {
-        let cfg = ChannelsConfig {
-            cli: CliConfig { enabled: true },
-            http: None,
-            gateway: None,
-            signal: None,
-            wasm_channels_dir: PathBuf::from("/tmp/channels"),
-            wasm_channels_enabled: true,
-            wasm_channel_owner_ids: HashMap::new(),
-        };
-        assert!(cfg.cli.enabled);
-        assert!(cfg.http.is_none());
-        assert!(cfg.gateway.is_none());
-        assert!(cfg.signal.is_none());
-        assert_eq!(cfg.wasm_channels_dir, PathBuf::from("/tmp/channels"));
-        assert!(cfg.wasm_channels_enabled);
-        assert!(cfg.wasm_channel_owner_ids.is_empty());
-    }
-
-    #[test]
-    fn channels_config_with_owner_ids() {
-        let mut ids = HashMap::new();
-        ids.insert("telegram".to_string(), 12345_i64);
-        ids.insert("slack".to_string(), 67890_i64);
-
-        let cfg = ChannelsConfig {
-            cli: CliConfig { enabled: false },
-            http: None,
-            gateway: None,
-            signal: None,
-            wasm_channels_dir: PathBuf::from("/opt/channels"),
-            wasm_channels_enabled: false,
-            wasm_channel_owner_ids: ids,
-        };
-        assert_eq!(cfg.wasm_channel_owner_ids.get("telegram"), Some(&12345));
-        assert_eq!(cfg.wasm_channel_owner_ids.get("slack"), Some(&67890));
-        assert!(!cfg.wasm_channels_enabled);
-    }
-
-    #[test]
-    fn default_channels_dir_ends_with_channels() {
-        let dir = default_channels_dir();
-        assert!(
-            dir.ends_with("channels"),
-            "expected path ending in 'channels', got: {dir:?}"
-        );
-    }
-}

src/config/database.rs

@@ -82,31 +82,6 @@ impl std::str::FromStr for SslMode {
     }
 }
 
-/// Which vector store backend to use for workspace semantic search.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
-pub enum VectorBackend {
-    /// Use the database's built-in vector support (pgvector or libsql_vector_idx).
-    #[default]
-    Builtin,
-    /// Use LanceDB as an external vector store (requires `lancedb` feature).
-    LanceDb,
-}
-
-impl std::str::FromStr for VectorBackend {
-    type Err = String;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        match s.to_lowercase().as_str() {
-            "" | "builtin" | "pgvector" | "libsql" => Ok(Self::Builtin),
-            "lancedb" | "lance" => Ok(Self::LanceDb),
-            _ => Err(format!(
-                "invalid vector backend '{}', expected 'builtin' or 'lancedb'",
-                s
-            )),
-        }
-    }
-}
-
 /// Database configuration.
 #[derive(Debug, Clone)]
 pub struct DatabaseConfig {
@@ -126,12 +101,6 @@ pub struct DatabaseConfig {
     pub libsql_url: Option<String>,
     /// Turso auth token (required when libsql_url is set).
     pub libsql_auth_token: Option<SecretString>,
-
-    // -- Vector store fields --
-    /// Which vector store to use for workspace semantic search (default: Builtin).
-    pub vector_backend: VectorBackend,
-    /// Path to LanceDB directory (default: ~/.ironclaw/lancedb when vector_backend is LanceDb).
-    pub lancedb_path: Option<PathBuf>,
 }
 
 impl DatabaseConfig {
@@ -190,25 +159,6 @@ impl DatabaseConfig {
             });
         }
 
-        let vector_backend: VectorBackend = if let Some(s) = optional_env("VECTOR_BACKEND")? {
-            s.parse().map_err(|e| ConfigError::InvalidValue {
-                key: "VECTOR_BACKEND".to_string(),
-                message: e,
-            })?
-        } else {
-            VectorBackend::default()
-        };
-
-        let lancedb_path = optional_env("LANCEDB_PATH")?
-            .map(PathBuf::from)
-            .or_else(|| {
-                if vector_backend == VectorBackend::LanceDb {
-                    Some(default_lancedb_path())
-                } else {
-                    None
-                }
-            });
-
         Ok(Self {
             backend,
             url: SecretString::from(url),
@@ -217,8 +167,6 @@ impl DatabaseConfig {
             libsql_path,
             libsql_url,
             libsql_auth_token,
-            vector_backend,
-            lancedb_path,
         })
     }
 
@@ -247,11 +195,6 @@ pub fn default_libsql_path() -> PathBuf {
     ironclaw_base_dir().join("ironclaw.db")
 }
 
-/// Default LanceDB directory (~/.ironclaw/lancedb).
-pub fn default_lancedb_path() -> PathBuf {
-    ironclaw_base_dir().join("lancedb")
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -281,39 +224,4 @@ mod tests {
     fn ssl_mode_parse_invalid() {
         assert!("invalid".parse::<SslMode>().is_err());
     }
-
-    #[test]
-    fn vector_backend_parse() {
-        assert_eq!(
-            "builtin".parse::<VectorBackend>().unwrap(),
-            VectorBackend::Builtin
-        );
-        assert_eq!(
-            "pgvector".parse::<VectorBackend>().unwrap(),
-            VectorBackend::Builtin
-        );
-        assert_eq!(
-            "libsql".parse::<VectorBackend>().unwrap(),
-            VectorBackend::Builtin
-        );
-        assert_eq!("".parse::<VectorBackend>().unwrap(), VectorBackend::Builtin);
-
-        assert_eq!(
-            "lancedb".parse::<VectorBackend>().unwrap(),
-            VectorBackend::LanceDb
-        );
-        assert_eq!(
-            "lance".parse::<VectorBackend>().unwrap(),
-            VectorBackend::LanceDb
-        );
-
-        assert!("invalid".parse::<VectorBackend>().is_err());
-    }
-
-    #[test]
-    fn default_lancedb_path_under_ironclaw() {
-        let path = super::default_lancedb_path();
-        assert!(path.to_string_lossy().contains("ironclaw"));
-        assert!(path.to_string_lossy().ends_with("lancedb"));
-    }
 }

src/config/heartbeat.rs

@@ -1,4 +1,4 @@
-use crate::config::helpers::{optional_env, parse_bool_env, parse_option_env, parse_optional_env};
+use crate::config::helpers::{optional_env, parse_bool_env, parse_optional_env};
 use crate::error::ConfigError;
 use crate::settings::Settings;
 
@@ -13,12 +13,6 @@ pub struct HeartbeatConfig {
     pub notify_channel: Option<String>,
     /// User ID to notify on heartbeat findings.
     pub notify_user: Option<String>,
-    /// Hour (0-23) when quiet hours start.
-    pub quiet_hours_start: Option<u32>,
-    /// Hour (0-23) when quiet hours end.
-    pub quiet_hours_end: Option<u32>,
-    /// Timezone for quiet hours evaluation (IANA name).
-    pub timezone: Option<String>,
 }
 
 impl Default for HeartbeatConfig {
@@ -28,9 +22,6 @@ impl Default for HeartbeatConfig {
             interval_secs: 1800, // 30 minutes
             notify_channel: None,
             notify_user: None,
-            quiet_hours_start: None,
-            quiet_hours_end: None,
-            timezone: None,
         }
     }
 }
@@ -47,98 +38,6 @@ impl HeartbeatConfig {
                 .or_else(|| settings.heartbeat.notify_channel.clone()),
             notify_user: optional_env("HEARTBEAT_NOTIFY_USER")?
                 .or_else(|| settings.heartbeat.notify_user.clone()),
-            quiet_hours_start: parse_option_env::<u32>("HEARTBEAT_QUIET_START")?
-                .or(settings.heartbeat.quiet_hours_start)
-                .map(|h| {
-                    if h > 23 {
-                        return Err(ConfigError::InvalidValue {
-                            key: "HEARTBEAT_QUIET_START".into(),
-                            message: "must be 0-23".into(),
-                        });
-                    }
-                    Ok(h)
-                })
-                .transpose()?,
-            quiet_hours_end: parse_option_env::<u32>("HEARTBEAT_QUIET_END")?
-                .or(settings.heartbeat.quiet_hours_end)
-                .map(|h| {
-                    if h > 23 {
-                        return Err(ConfigError::InvalidValue {
-                            key: "HEARTBEAT_QUIET_END".into(),
-                            message: "must be 0-23".into(),
-                        });
-                    }
-                    Ok(h)
-                })
-                .transpose()?,
-            timezone: {
-                let tz = optional_env("HEARTBEAT_TIMEZONE")?
-                    .or_else(|| settings.heartbeat.timezone.clone());
-                if let Some(ref tz_str) = tz
-                    && crate::timezone::parse_timezone(tz_str).is_none()
-                {
-                    return Err(ConfigError::InvalidValue {
-                        key: "HEARTBEAT_TIMEZONE".into(),
-                        message: format!("invalid IANA timezone: '{tz_str}'"),
-                    });
-                }
-                tz
-            },
         })
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_quiet_hours_settings_fallback() {
-        // When env vars are not set, settings values should be used
-        let mut settings = Settings::default();
-        settings.heartbeat.quiet_hours_start = Some(22);
-        settings.heartbeat.quiet_hours_end = Some(6);
-
-        let config = HeartbeatConfig::resolve(&settings).expect("resolve");
-        assert_eq!(config.quiet_hours_start, Some(22));
-        assert_eq!(config.quiet_hours_end, Some(6));
-    }
-
-    #[test]
-    fn test_quiet_hours_rejects_invalid_hour() {
-        let mut settings = Settings::default();
-        settings.heartbeat.quiet_hours_start = Some(24);
-
-        let result = HeartbeatConfig::resolve(&settings);
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn test_quiet_hours_accepts_boundary_values() {
-        let mut settings = Settings::default();
-        settings.heartbeat.quiet_hours_start = Some(0);
-        settings.heartbeat.quiet_hours_end = Some(23);
-
-        let config = HeartbeatConfig::resolve(&settings).expect("resolve");
-        assert_eq!(config.quiet_hours_start, Some(0));
-        assert_eq!(config.quiet_hours_end, Some(23));
-    }
-
-    #[test]
-    fn test_heartbeat_timezone_rejects_invalid() {
-        let mut settings = Settings::default();
-        settings.heartbeat.timezone = Some("Fake/Zone".to_string());
-
-        let result = HeartbeatConfig::resolve(&settings);
-        assert!(result.is_err(), "invalid IANA timezone should be rejected");
-    }
-
-    #[test]
-    fn test_heartbeat_timezone_accepts_valid() {
-        let mut settings = Settings::default();
-        settings.heartbeat.timezone = Some("America/New_York".to_string());
-
-        let config = HeartbeatConfig::resolve(&settings).expect("resolve");
-        assert_eq!(config.timezone.as_deref(), Some("America/New_York"));
-    }
-}

src/config/helpers.rs

@@ -25,13 +25,8 @@ pub(crate) fn optional_env(key: &str) -> Result<Option<String>, ConfigError> {
     }
 
     // Fall back to thread-safe overlay (secrets injected from DB)
-    if let Some(val) = INJECTED_VARS
-        .lock()
-        .unwrap_or_else(|p| p.into_inner())
-        .get(key)
-        .cloned()
-    {
-        return Ok(Some(val));
+    if let Some(val) = INJECTED_VARS.get().and_then(|map| map.get(key)) {
+        return Ok(Some(val.clone()));
     }
 
     Ok(None)

src/config/hygiene.rs

@@ -10,10 +10,8 @@ use crate::error::ConfigError;
 pub struct HygieneConfig {
     /// Whether hygiene is enabled. Env: `MEMORY_HYGIENE_ENABLED` (default: true).
     pub enabled: bool,
-    /// Days before `daily/` documents are deleted. Env: `MEMORY_HYGIENE_DAILY_RETENTION_DAYS` (default: 30).
-    pub daily_retention_days: u32,
-    /// Days before `conversations/` documents are deleted. Env: `MEMORY_HYGIENE_CONVERSATION_RETENTION_DAYS` (default: 7).
-    pub conversation_retention_days: u32,
+    /// Days before `daily/` documents are deleted. Env: `MEMORY_HYGIENE_RETENTION_DAYS` (default: 30).
+    pub retention_days: u32,
     /// Minimum hours between hygiene passes. Env: `MEMORY_HYGIENE_CADENCE_HOURS` (default: 12).
     pub cadence_hours: u32,
 }
@@ -22,8 +20,7 @@ impl Default for HygieneConfig {
     fn default() -> Self {
         Self {
             enabled: true,
-            daily_retention_days: 30,
-            conversation_retention_days: 7,
+            retention_days: 30,
             cadence_hours: 12,
         }
     }
@@ -33,11 +30,7 @@ impl HygieneConfig {
     pub(crate) fn resolve() -> Result<Self, ConfigError> {
         Ok(Self {
             enabled: parse_bool_env("MEMORY_HYGIENE_ENABLED", true)?,
-            daily_retention_days: parse_optional_env("MEMORY_HYGIENE_DAILY_RETENTION_DAYS", 30)?,
-            conversation_retention_days: parse_optional_env(
-                "MEMORY_HYGIENE_CONVERSATION_RETENTION_DAYS",
-                7,
-            )?,
+            retention_days: parse_optional_env("MEMORY_HYGIENE_RETENTION_DAYS", 30)?,
             cadence_hours: parse_optional_env("MEMORY_HYGIENE_CADENCE_HOURS", 12)?,
         })
     }
@@ -47,8 +40,7 @@ impl HygieneConfig {
     pub fn to_workspace_config(&self) -> crate::workspace::hygiene::HygieneConfig {
         crate::workspace::hygiene::HygieneConfig {
             enabled: self.enabled,
-            daily_retention_days: self.daily_retention_days,
-            conversation_retention_days: self.conversation_retention_days,
+            retention_days: self.retention_days,
             cadence_hours: self.cadence_hours,
             state_dir: ironclaw_base_dir(),
         }

src/config/mod.rs

@@ -13,18 +13,17 @@ mod embeddings;
 mod heartbeat;
 pub(crate) mod helpers;
 mod hygiene;
-pub(crate) mod llm;
+mod llm;
 mod routines;
 mod safety;
 mod sandbox;
 mod secrets;
 mod skills;
-mod transcription;
 mod tunnel;
 mod wasm;
 
 use std::collections::HashMap;
-use std::sync::{LazyLock, Mutex};
+use std::sync::OnceLock;
 
 use crate::error::ConfigError;
 use crate::settings::Settings;
@@ -33,35 +32,28 @@ use crate::settings::Settings;
 pub use self::agent::AgentConfig;
 pub use self::builder::BuilderModeConfig;
 pub use self::channels::{ChannelsConfig, CliConfig, GatewayConfig, HttpConfig, SignalConfig};
-pub use self::database::{
-    DatabaseBackend, DatabaseConfig, SslMode, VectorBackend, default_lancedb_path,
-    default_libsql_path,
-};
+pub use self::database::{DatabaseBackend, DatabaseConfig, SslMode, default_libsql_path};
 pub use self::embeddings::EmbeddingsConfig;
 pub use self::heartbeat::HeartbeatConfig;
 pub use self::hygiene::HygieneConfig;
-pub use self::llm::{CacheRetention, LlmConfig, NearAiConfig, RegistryProviderConfig};
+pub use self::llm::{
+    AnthropicDirectConfig, LlmBackend, LlmConfig, NearAiConfig, OllamaConfig,
+    OpenAiCompatibleConfig, OpenAiDirectConfig, TinfoilConfig,
+};
 pub use self::routines::RoutineConfig;
 pub use self::safety::SafetyConfig;
 pub use self::sandbox::{ClaudeCodeConfig, SandboxModeConfig};
 pub use self::secrets::SecretsConfig;
 pub use self::skills::SkillsConfig;
-pub use self::transcription::TranscriptionConfig;
 pub use self::tunnel::TunnelConfig;
 pub use self::wasm::WasmConfig;
-pub use crate::llm::session::SessionConfig;
 
 /// Thread-safe overlay for injected env vars (secrets loaded from DB).
 ///
 /// Used by `inject_llm_keys_from_secrets()` to make API keys available to
 /// `optional_env()` without unsafe `set_var` calls. `optional_env()` checks
 /// real env vars first, then falls back to this overlay.
-///
-/// Uses `Mutex<HashMap>` instead of `OnceLock` so that both
-/// `inject_os_credentials()` and `inject_llm_keys_from_secrets()` can merge
-/// their data. Whichever runs first initialises the map; the second merges in.
-static INJECTED_VARS: LazyLock<Mutex<HashMap<String, String>>> =
-    LazyLock::new(|| Mutex::new(HashMap::new()));
+static INJECTED_VARS: OnceLock<HashMap<String, String>> = OnceLock::new();
 
 /// Main configuration for the agent.
 #[derive(Debug, Clone)]
@@ -82,7 +74,6 @@ pub struct Config {
     pub sandbox: SandboxModeConfig,
     pub claude_code: ClaudeCodeConfig,
     pub skills: SkillsConfig,
-    pub transcription: TranscriptionConfig,
     pub observability: crate::observability::ObservabilityConfig,
 }
 
@@ -110,8 +101,6 @@ impl Config {
                 libsql_path: Some(libsql_path),
                 libsql_url: None,
                 libsql_auth_token: None,
-                vector_backend: VectorBackend::default(),
-                lancedb_path: None,
             },
             llm: LlmConfig::for_testing(),
             embeddings: EmbeddingsConfig::default(),
@@ -121,7 +110,7 @@ impl Config {
                 http: None,
                 gateway: None,
                 signal: None,
-                wasm_channels_dir: std::env::temp_dir().join("ironclaw-test-channels"),
+                wasm_channels_dir: std::path::PathBuf::from("/tmp/ironclaw-test-channels"),
                 wasm_channels_enabled: false,
                 wasm_channel_owner_ids: HashMap::new(),
             },
@@ -156,7 +145,6 @@ impl Config {
                 installed_dir: installed_skills_dir,
                 ..SkillsConfig::default()
             },
-            transcription: TranscriptionConfig::default(),
             observability: crate::observability::ObservabilityConfig::default(),
         }
     }
@@ -262,32 +250,6 @@ impl Config {
         Ok(())
     }
 
-    /// Re-resolve only the LLM config after credential injection.
-    ///
-    /// Called by `AppBuilder::init_secrets()` after injecting API keys into
-    /// the env overlay. Only rebuilds `self.llm` — all other config fields
-    /// are unaffected, preserving values from the initial config load (or
-    /// from `Config::for_testing()` in test mode).
-    pub async fn re_resolve_llm(
-        &mut self,
-        store: Option<&(dyn crate::db::SettingsStore + Sync)>,
-        user_id: &str,
-        toml_path: Option<&std::path::Path>,
-    ) -> Result<(), ConfigError> {
-        let settings = if let Some(store) = store {
-            let mut s = match store.get_all_settings(user_id).await {
-                Ok(map) => Settings::from_db_map(&map),
-                Err(_) => Settings::default(),
-            };
-            Self::apply_toml_overlay(&mut s, toml_path)?;
-            s
-        } else {
-            Settings::default()
-        };
-        self.llm = LlmConfig::resolve(&settings)?;
-        Ok(())
-    }
-
     /// Build config from settings (shared by from_env and from_db).
     async fn build(settings: &Settings) -> Result<Self, ConfigError> {
         Ok(Self {
@@ -307,7 +269,6 @@ impl Config {
             sandbox: SandboxModeConfig::resolve()?,
             claude_code: ClaudeCodeConfig::resolve()?,
             skills: SkillsConfig::resolve()?,
-            transcription: TranscriptionConfig::resolve(settings)?,
             observability: crate::observability::ObservabilityConfig {
                 backend: std::env::var("OBSERVABILITY_BACKEND").unwrap_or_else(|_| "none".into()),
             },
@@ -321,40 +282,17 @@ impl Config {
 /// env-var-first resolution in `LlmConfig::resolve()`. Keys in the overlay
 /// are read by `optional_env()` before falling back to `std::env::var()`,
 /// so explicit env vars always win.
-///
-/// Also loads tokens from OS credential stores (macOS Keychain, Linux
-/// credentials files) which don't require the secrets DB.
 pub async fn inject_llm_keys_from_secrets(
     secrets: &dyn crate::secrets::SecretsStore,
     user_id: &str,
 ) {
-    // Static mappings for well-known providers.
-    // The registry's setup hints define secret_name -> env_var mappings,
-    // so new providers added to providers.json get injection automatically.
-    let mut mappings: Vec<(&str, &str)> = vec![
+    let mappings = [
+        ("llm_openai_api_key", "OPENAI_API_KEY"),
+        ("llm_anthropic_api_key", "ANTHROPIC_API_KEY"),
+        ("llm_compatible_api_key", "LLM_API_KEY"),
         ("llm_nearai_api_key", "NEARAI_API_KEY"),
-        ("llm_anthropic_oauth_token", "ANTHROPIC_OAUTH_TOKEN"),
     ];
 
-    // Dynamically discover secret->env mappings from the provider registry.
-    // Uses selectable() which deduplicates user overrides correctly.
-    let registry = crate::llm::ProviderRegistry::load();
-    let dynamic_mappings: Vec<(String, String)> = registry
-        .selectable()
-        .iter()
-        .filter_map(|def| {
-            def.api_key_env.as_ref().and_then(|env_var| {
-                def.setup
-                    .as_ref()
-                    .and_then(|s| s.secret_name())
-                    .map(|secret_name| (secret_name.to_string(), env_var.clone()))
-            })
-        })
-        .collect();
-    for (secret, env_var) in &dynamic_mappings {
-        mappings.push((secret, env_var));
-    }
-
     let mut injected = HashMap::new();
 
     for (secret_name, env_var) in mappings {
@@ -373,62 +311,5 @@ pub async fn inject_llm_keys_from_secrets(
         }
     }
 
-    inject_os_credential_store_tokens(&mut injected);
-
-    merge_injected_vars(injected);
-}
-
-/// Load tokens from OS credential stores (no DB required).
-///
-/// Called unconditionally during startup — even when the encrypted secrets DB
-/// is unavailable (no master key, no DB connection). This ensures OAuth tokens
-/// from `claude login` (macOS Keychain / Linux credentials.json)
-/// are available for config resolution.
-pub fn inject_os_credentials() {
-    let mut injected = HashMap::new();
-    inject_os_credential_store_tokens(&mut injected);
-    merge_injected_vars(injected);
-}
-
-/// Merge new entries into the global injected-vars overlay.
-///
-/// New keys are inserted; existing keys are overwritten (later callers win,
-/// e.g. fresh OS credential store tokens override stale DB copies).
-fn merge_injected_vars(new_entries: HashMap<String, String>) {
-    if new_entries.is_empty() {
-        return;
-    }
-    match INJECTED_VARS.lock() {
-        Ok(mut map) => map.extend(new_entries),
-        Err(poisoned) => poisoned.into_inner().extend(new_entries),
-    }
-}
-
-/// Inject a single key-value pair into the overlay.
-///
-/// Used by the setup wizard to make credentials available to `optional_env()`
-/// without calling `unsafe { std::env::set_var }`.
-pub fn inject_single_var(key: &str, value: &str) {
-    match INJECTED_VARS.lock() {
-        Ok(mut map) => {
-            map.insert(key.to_string(), value.to_string());
-        }
-        Err(poisoned) => {
-            poisoned
-                .into_inner()
-                .insert(key.to_string(), value.to_string());
-        }
-    }
-}
-
-/// Shared helper: extract tokens from OS credential stores into the overlay map.
-fn inject_os_credential_store_tokens(injected: &mut HashMap<String, String>) {
-    // Try the OS credential store for a fresh Anthropic OAuth token.
-    // Tokens from `claude login` expire in 8-12h, so the DB copy may be stale.
-    // A fresh extraction from macOS Keychain / Linux credentials.json wins
-    // over the (possibly expired) copy stored in the encrypted secrets DB.
-    if let Some(fresh) = crate::config::ClaudeCodeConfig::extract_oauth_token() {
-        injected.insert("ANTHROPIC_OAUTH_TOKEN".to_string(), fresh);
-        tracing::debug!("Refreshed ANTHROPIC_OAUTH_TOKEN from OS credential store");
-    }
+    let _ = INJECTED_VARS.set(injected);
 }

src/config/sandbox.rs

@@ -233,219 +233,7 @@ impl ClaudeCodeConfig {
 /// Expected shape: `{"claudeAiOauth": {"accessToken": "sk-ant-oat01-..."}}`
 fn parse_oauth_access_token(json: &str) -> Option<String> {
     let creds: serde_json::Value = serde_json::from_str(json).ok()?;
-    let token = creds["claudeAiOauth"]["accessToken"].as_str()?;
-    // Validate that the token looks like a real OAuth token before using it.
-    // Claude CLI tokens start with "sk-ant-oat".
-    if !token.starts_with("sk-ant-oat") {
-        tracing::debug!("Ignoring credential store token with unexpected prefix");
-        return None;
-    }
-    Some(token.to_string())
-}
-
-#[cfg(test)]
-mod tests {
-    use crate::config::sandbox::*;
-
-    // ── SandboxModeConfig defaults ──────────────────────────────────
-
-    #[test]
-    fn sandbox_mode_config_default_values() {
-        let cfg = SandboxModeConfig::default();
-        assert!(cfg.enabled);
-        assert_eq!(cfg.policy, "readonly");
-        assert_eq!(cfg.timeout_secs, 120);
-        assert_eq!(cfg.memory_limit_mb, 2048);
-        assert_eq!(cfg.cpu_shares, 1024);
-        assert_eq!(cfg.image, "ironclaw-worker:latest");
-        assert!(cfg.auto_pull_image);
-        assert!(cfg.extra_allowed_domains.is_empty());
-    }
-
-    #[test]
-    fn sandbox_mode_config_custom_values() {
-        let cfg = SandboxModeConfig {
-            enabled: false,
-            policy: "full_access".to_string(),
-            timeout_secs: 600,
-            memory_limit_mb: 4096,
-            cpu_shares: 512,
-            image: "custom-worker:v2".to_string(),
-            auto_pull_image: false,
-            extra_allowed_domains: vec!["example.com".to_string()],
-        };
-        assert!(!cfg.enabled);
-        assert_eq!(cfg.policy, "full_access");
-        assert_eq!(cfg.timeout_secs, 600);
-        assert_eq!(cfg.memory_limit_mb, 4096);
-        assert_eq!(cfg.cpu_shares, 512);
-        assert_eq!(cfg.image, "custom-worker:v2");
-        assert!(!cfg.auto_pull_image);
-        assert_eq!(cfg.extra_allowed_domains, vec!["example.com"]);
-    }
-
-    #[test]
-    fn sandbox_mode_to_sandbox_config_propagates_fields() {
-        let mode = SandboxModeConfig {
-            enabled: true,
-            policy: "workspace_write".to_string(),
-            timeout_secs: 300,
-            memory_limit_mb: 1024,
-            cpu_shares: 2048,
-            image: "test:latest".to_string(),
-            auto_pull_image: false,
-            extra_allowed_domains: vec!["custom.example.com".to_string()],
-        };
-        let sc = mode.to_sandbox_config();
-        assert!(sc.enabled);
-        assert_eq!(sc.policy, crate::sandbox::SandboxPolicy::WorkspaceWrite);
-        assert_eq!(sc.timeout, std::time::Duration::from_secs(300));
-        assert_eq!(sc.memory_limit_mb, 1024);
-        assert_eq!(sc.cpu_shares, 2048);
-        assert_eq!(sc.image, "test:latest");
-        assert!(!sc.auto_pull_image);
-        // extra domain should be in the allowlist
-        assert!(
-            sc.network_allowlist
-                .contains(&"custom.example.com".to_string()),
-            "expected custom domain in allowlist"
-        );
-    }
-
-    #[test]
-    fn sandbox_mode_to_sandbox_config_invalid_policy_falls_back_to_readonly() {
-        let mode = SandboxModeConfig {
-            policy: "garbage_value".to_string(),
-            ..SandboxModeConfig::default()
-        };
-        let sc = mode.to_sandbox_config();
-        assert_eq!(sc.policy, crate::sandbox::SandboxPolicy::ReadOnly);
-    }
-
-    #[test]
-    fn sandbox_mode_to_sandbox_config_includes_default_allowlist() {
-        let mode = SandboxModeConfig::default();
-        let sc = mode.to_sandbox_config();
-        // The default allowlist from sandbox module should be non-empty
-        assert!(
-            !sc.network_allowlist.is_empty(),
-            "default allowlist should not be empty"
-        );
-    }
-
-    // ── ClaudeCodeConfig defaults ───────────────────────────────────
-
-    #[test]
-    fn claude_code_config_default_values() {
-        let cfg = ClaudeCodeConfig::default();
-        assert!(!cfg.enabled);
-        assert_eq!(cfg.model, "sonnet");
-        assert_eq!(cfg.max_turns, 50);
-        assert_eq!(cfg.memory_limit_mb, 4096);
-        assert!(cfg.config_dir.ends_with(".claude"));
-        // Should have all the standard tools
-        assert!(!cfg.allowed_tools.is_empty());
-        assert!(cfg.allowed_tools.contains(&"Bash(*)".to_string()));
-        assert!(cfg.allowed_tools.contains(&"Read(*)".to_string()));
-        assert!(cfg.allowed_tools.contains(&"Edit(*)".to_string()));
-        assert!(cfg.allowed_tools.contains(&"Write(*)".to_string()));
-        assert!(cfg.allowed_tools.contains(&"Grep(*)".to_string()));
-        assert!(cfg.allowed_tools.contains(&"WebFetch(*)".to_string()));
-    }
-
-    #[test]
-    fn claude_code_config_custom_values() {
-        let cfg = ClaudeCodeConfig {
-            enabled: true,
-            config_dir: std::path::PathBuf::from("/opt/claude"),
-            model: "opus".to_string(),
-            max_turns: 100,
-            memory_limit_mb: 8192,
-            allowed_tools: vec!["Read(*)".to_string(), "Bash(*)".to_string()],
-        };
-        assert!(cfg.enabled);
-        assert_eq!(cfg.config_dir, std::path::PathBuf::from("/opt/claude"));
-        assert_eq!(cfg.model, "opus");
-        assert_eq!(cfg.max_turns, 100);
-        assert_eq!(cfg.memory_limit_mb, 8192);
-        assert_eq!(cfg.allowed_tools.len(), 2);
-    }
-
-    // ── parse_oauth_access_token ────────────────────────────────────
-
-    #[test]
-    fn parse_oauth_token_valid() {
-        let json = r#"{"claudeAiOauth": {"accessToken": "sk-ant-oat01-fake"}}"#;
-        let token = parse_oauth_access_token(json);
-        assert_eq!(token, Some("sk-ant-oat01-fake".to_string()));
-    }
-
-    #[test]
-    fn parse_oauth_token_missing_access_token() {
-        let json = r#"{"claudeAiOauth": {}}"#;
-        assert_eq!(parse_oauth_access_token(json), None);
-    }
-
-    #[test]
-    fn parse_oauth_token_missing_oauth_key() {
-        let json = r#"{"someOtherKey": {"accessToken": "tok"}}"#;
-        assert_eq!(parse_oauth_access_token(json), None);
-    }
-
-    #[test]
-    fn parse_oauth_token_invalid_json() {
-        assert_eq!(parse_oauth_access_token("not json at all"), None);
-    }
-
-    #[test]
-    fn parse_oauth_token_empty_string() {
-        assert_eq!(parse_oauth_access_token(""), None);
-    }
-
-    #[test]
-    fn parse_oauth_token_nested_extra_fields() {
-        let json = r#"{
-            "claudeAiOauth": {
-                "accessToken": "sk-ant-oat01-real-token",
-                "refreshToken": "rt-abc",
-                "expiresAt": 1700000000
-            }
-        }"#;
-        assert_eq!(
-            parse_oauth_access_token(json),
-            Some("sk-ant-oat01-real-token".to_string())
-        );
-    }
-
-    #[test]
-    fn parse_oauth_token_access_token_is_not_string() {
-        let json = r#"{"claudeAiOauth": {"accessToken": 12345}}"#;
-        assert_eq!(parse_oauth_access_token(json), None);
-    }
-
-    #[test]
-    fn parse_oauth_token_rejects_invalid_prefix() {
-        let json = r#"{"claudeAiOauth": {"accessToken": "not-an-oauth-token"}}"#;
-        assert_eq!(parse_oauth_access_token(json), None);
-    }
-
-    // ── default_claude_code_allowed_tools ───────────────────────────
-
-    #[test]
-    fn default_allowed_tools_has_expected_count() {
-        let tools = default_claude_code_allowed_tools();
-        // 10 tools: Read, Write, Edit, Glob, Grep, NotebookEdit, Bash, Task, WebFetch, WebSearch
-        assert_eq!(tools.len(), 10);
-    }
-
-    #[test]
-    fn default_allowed_tools_all_have_glob_pattern() {
-        let tools = default_claude_code_allowed_tools();
-        for tool in &tools {
-            assert!(
-                tool.ends_with("(*)"),
-                "tool '{tool}' should end with '(*)' glob pattern"
-            );
-        }
-    }
+    creds["claudeAiOauth"]["accessToken"]
+        .as_str()
+        .map(String::from)
 }

src/config/transcription.rs

@@ -1,79 +0,0 @@
-use secrecy::SecretString;
-
-use crate::config::helpers::{optional_env, parse_bool_env};
-use crate::error::ConfigError;
-use crate::settings::Settings;
-
-/// Transcription pipeline configuration.
-#[derive(Debug, Clone)]
-pub struct TranscriptionConfig {
-    /// Whether audio transcription is enabled.
-    pub enabled: bool,
-    /// Provider: "openai" (default).
-    pub provider: String,
-    /// OpenAI API key (reuses OPENAI_API_KEY).
-    pub openai_api_key: Option<SecretString>,
-    /// Model to use (default: "whisper-1").
-    pub model: String,
-    /// Base URL override for the transcription API.
-    pub base_url: Option<String>,
-}
-
-impl Default for TranscriptionConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            provider: "openai".to_string(),
-            openai_api_key: None,
-            model: "whisper-1".to_string(),
-            base_url: None,
-        }
-    }
-}
-
-impl TranscriptionConfig {
-    pub(crate) fn resolve(settings: &Settings) -> Result<Self, ConfigError> {
-        let enabled = parse_bool_env(
-            "TRANSCRIPTION_ENABLED",
-            settings.transcription.as_ref().is_some_and(|t| t.enabled),
-        )?;
-
-        let provider =
-            optional_env("TRANSCRIPTION_PROVIDER")?.unwrap_or_else(|| "openai".to_string());
-
-        let openai_api_key = optional_env("OPENAI_API_KEY")?.map(SecretString::from);
-
-        let model = optional_env("TRANSCRIPTION_MODEL")?.unwrap_or_else(|| "whisper-1".to_string());
-
-        let base_url = optional_env("TRANSCRIPTION_BASE_URL")?;
-
-        Ok(Self {
-            enabled,
-            provider,
-            openai_api_key,
-            model,
-            base_url,
-        })
-    }
-
-    /// Create the transcription provider if enabled and configured.
-    pub fn create_provider(&self) -> Option<Box<dyn crate::transcription::TranscriptionProvider>> {
-        if !self.enabled {
-            return None;
-        }
-
-        // Currently only OpenAI Whisper is supported; more providers can be
-        // added here with a match on self.provider.
-        let api_key = self.openai_api_key.as_ref()?;
-        tracing::info!(model = %self.model, "Audio transcription enabled via OpenAI Whisper");
-
-        let mut provider = crate::transcription::OpenAiWhisperProvider::new(api_key.clone())
-            .with_model(&self.model);
-
-        if let Some(ref base_url) = self.base_url {
-            provider = provider.with_base_url(base_url);
-        }
-
-        Some(Box::new(provider))
-    }
-}

src/config/tunnel.rs

@@ -104,215 +104,3 @@ impl TunnelConfig {
         })
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use crate::config::tunnel::TunnelConfig;
-    use crate::tunnel::{
-        CloudflareTunnelConfig, CustomTunnelConfig, NgrokTunnelConfig, TailscaleTunnelConfig,
-        TunnelProviderConfig,
-    };
-
-    // ── Default ─────────────────────────────────────────────────────
-
-    #[test]
-    fn default_is_disabled() {
-        let cfg = TunnelConfig::default();
-        assert!(cfg.public_url.is_none());
-        assert!(cfg.provider.is_none());
-        assert!(!cfg.is_enabled());
-    }
-
-    // ── is_enabled ──────────────────────────────────────────────────
-
-    #[test]
-    fn is_enabled_with_static_url() {
-        let cfg = TunnelConfig {
-            public_url: Some("https://tunnel.example.com".to_string()),
-            provider: None,
-        };
-        assert!(cfg.is_enabled());
-    }
-
-    #[test]
-    fn is_enabled_with_provider() {
-        let cfg = TunnelConfig {
-            public_url: None,
-            provider: Some(TunnelProviderConfig {
-                provider: "cloudflare".to_string(),
-                cloudflare: Some(CloudflareTunnelConfig {
-                    token: "cf-tok".to_string(),
-                }),
-                tailscale: None,
-                ngrok: None,
-                custom: None,
-            }),
-        };
-        assert!(cfg.is_enabled());
-    }
-
-    #[test]
-    fn is_enabled_with_both() {
-        let cfg = TunnelConfig {
-            public_url: Some("https://example.com".to_string()),
-            provider: Some(TunnelProviderConfig {
-                provider: "ngrok".to_string(),
-                cloudflare: None,
-                tailscale: None,
-                ngrok: Some(NgrokTunnelConfig {
-                    auth_token: "ngrok-tok".to_string(),
-                    domain: None,
-                }),
-                custom: None,
-            }),
-        };
-        assert!(cfg.is_enabled());
-    }
-
-    // ── webhook_url ─────────────────────────────────────────────────
-
-    #[test]
-    fn webhook_url_none_when_no_public_url() {
-        let cfg = TunnelConfig::default();
-        assert!(cfg.webhook_url("/hook").is_none());
-    }
-
-    #[test]
-    fn webhook_url_basic() {
-        let cfg = TunnelConfig {
-            public_url: Some("https://abc.ngrok.io".to_string()),
-            provider: None,
-        };
-        assert_eq!(
-            cfg.webhook_url("/webhook/telegram"),
-            Some("https://abc.ngrok.io/webhook/telegram".to_string())
-        );
-    }
-
-    #[test]
-    fn webhook_url_trims_trailing_slash_on_base() {
-        let cfg = TunnelConfig {
-            public_url: Some("https://abc.ngrok.io/".to_string()),
-            provider: None,
-        };
-        assert_eq!(
-            cfg.webhook_url("/hook"),
-            Some("https://abc.ngrok.io/hook".to_string())
-        );
-    }
-
-    #[test]
-    fn webhook_url_trims_leading_slash_on_path() {
-        let cfg = TunnelConfig {
-            public_url: Some("https://abc.ngrok.io".to_string()),
-            provider: None,
-        };
-        // Path without leading slash should also work
-        assert_eq!(
-            cfg.webhook_url("hook"),
-            Some("https://abc.ngrok.io/hook".to_string())
-        );
-    }
-
-    #[test]
-    fn webhook_url_double_slash_normalization() {
-        let cfg = TunnelConfig {
-            public_url: Some("https://abc.ngrok.io/".to_string()),
-            provider: None,
-        };
-        // Both base trailing and path leading slashes trimmed
-        assert_eq!(
-            cfg.webhook_url("/api/webhook"),
-            Some("https://abc.ngrok.io/api/webhook".to_string())
-        );
-    }
-
-    #[test]
-    fn webhook_url_empty_path() {
-        let cfg = TunnelConfig {
-            public_url: Some("https://abc.ngrok.io".to_string()),
-            provider: None,
-        };
-        assert_eq!(
-            cfg.webhook_url(""),
-            Some("https://abc.ngrok.io/".to_string())
-        );
-    }
-
-    // ── TunnelProviderConfig field coverage ─────────────────────────
-
-    #[test]
-    fn provider_config_cloudflare() {
-        let p = TunnelProviderConfig {
-            provider: "cloudflare".to_string(),
-            cloudflare: Some(CloudflareTunnelConfig {
-                token: "cf-secret".to_string(),
-            }),
-            tailscale: None,
-            ngrok: None,
-            custom: None,
-        };
-        assert_eq!(p.provider, "cloudflare");
-        assert_eq!(p.cloudflare.as_ref().unwrap().token, "cf-secret");
-    }
-
-    #[test]
-    fn provider_config_tailscale() {
-        let ts = TailscaleTunnelConfig {
-            funnel: true,
-            hostname: Some("my-host".to_string()),
-        };
-        assert!(ts.funnel);
-        assert_eq!(ts.hostname.as_deref(), Some("my-host"));
-    }
-
-    #[test]
-    fn provider_config_tailscale_defaults() {
-        let ts = TailscaleTunnelConfig::default();
-        assert!(!ts.funnel);
-        assert!(ts.hostname.is_none());
-    }
-
-    #[test]
-    fn provider_config_ngrok() {
-        let ng = NgrokTunnelConfig {
-            auth_token: "ng-tok".to_string(),
-            domain: Some("custom.ngrok.dev".to_string()),
-        };
-        assert_eq!(ng.auth_token, "ng-tok");
-        assert_eq!(ng.domain.as_deref(), Some("custom.ngrok.dev"));
-    }
-
-    #[test]
-    fn provider_config_ngrok_defaults() {
-        let ng = NgrokTunnelConfig::default();
-        assert!(ng.auth_token.is_empty());
-        assert!(ng.domain.is_none());
-    }
-
-    #[test]
-    fn provider_config_custom() {
-        let c = CustomTunnelConfig {
-            start_command: "bore local {port}".to_string(),
-            health_url: Some("http://localhost:8080/health".to_string()),
-            url_pattern: Some("https://bore.pub".to_string()),
-        };
-        assert_eq!(c.start_command, "bore local {port}");
-        assert!(c.health_url.is_some());
-        assert!(c.url_pattern.is_some());
-    }
-
-    #[test]
-    fn provider_config_custom_defaults() {
-        let c = CustomTunnelConfig::default();
-        assert!(c.start_command.is_empty());
-        assert!(c.health_url.is_none());
-        assert!(c.url_pattern.is_none());
-    }
-
-    #[test]
-    fn cloudflare_config_defaults() {
-        let cf = CloudflareTunnelConfig::default();
-        assert!(cf.token.is_empty());
-    }
-}