Omnibus: resolve 29 triaged issues (27 closed, 4 partially)

[retog]

Resolves the 29 dispatchable tasks from the full triage of all 46 open issues (every issue was re-verified against main @ e2f4e22 before implementation; the remaining 17 issues need maintainer decisions or owner-side settings and are untouched). 32 commits, one per issue (a small series for the CalDAV feature); each commit message names its issue.

Bug fixes

• Thread attachments are stored without a file extension, so a session reads a PDF as mojibake #65 — thread attachments are stored with a safe, allowlisted file extension (mirroring _store_message_files), so a session can actually open a forwarded PDF; old extensionless files still serve.
• ingest-sensors.py: the only documented invocation reads a directory no chamber has, writes nothing, and exits 0 #40 — ingest-sensors.py now requires an explicit chamber root and fails loudly instead of silently ingesting nothing; adds the missing Garmin "Pushes" column; fixes the Ultrahuman count divisor (10 → 5).
• expand_env's ${VAR:-default} doesn't fall back on set-and-empty, only on unset (scheduler.py) #75 — scheduler ${VAR:-default} falls back on set-but-empty values, matching shell semantics.
• git-serialize.sh does not serialize git -C <repo> …, the form the web gateway's own auto-commit uses #37 — git-serialize.sh parses git's global options (-C, -c, --git-dir, …) before dispatching, so the web gateway's git -C … auto-commits are serialized too, with the lock keyed to the right repository.
• /tmp lifetime: signal-gateway loses its send-approval queue on the documented update path, qlever-static reindexes from stale data on the documented refresh path #39 — Signal's pending-sends queue moves off /tmp onto the persisted signal-data volume; qlever-static no longer reindexes from a stale decompression cache on the documented refresh path (docs updated to match).
• Dashboard push: an agent-opened thread reports success with zero subscribed devices, and nothing anywhere reports the count #61 — the internal conversation endpoints report the real Web-Push subscriber count, and conversation-push.py warns when a thread was opened with zero subscribed devices.
• Boot emitter (PR #22): docs state the _generated indexing as unconditional, and the model slug is not injective #28 (partial) — the conversation-model slug is now injective (percent-encoding), so two distinct model ids can no longer merge into one store node; adds the _generated indexing caveat to docs/triple-stores.md. The entrypoint-ordering question stays open in the issue.
• RETINUE_CLAUDE_MODEL is documented as reaching every Claude Code process; the dashboard transcript cleanup hard-codes haiku #29 — dashboard transcript cleanup falls back to RETINUE_CLAUDE_MODEL before the built-in default; TRANSCRIPT_CLEANUP* documented in .env.example; README's "reaches every Claude Code process" claim qualified.
• Dashboard: wire up the agent sender-name override (PR #86 follow-up) #92 / PR #86 follow-up: the new "agent" sender-override is documented and read by the frontend, but no call site ever sets it #87 — the documented agent sender-name override is finally settable: conversation-push.py --agent NAME flows through both internal endpoints to the already-rendering frontend. (PR #86 follow-up: the new "agent" sender-override is documented and read by the frontend, but no call site ever sets it #87 is the duplicate of Dashboard: wire up the agent sender-name override (PR #86 follow-up) #92.)
• Signal group news items show opaque group_id as feed source (follow-up to #114) #124 — Signal group news items show the group's display name (resolved from the gateway's own roster) instead of the opaque group_id, with the id as fallback.
• PR #73 follow-up: custom "slug" field in MESSENGER_GATEWAYS is now silently ignored #74 — a legacy slug key in a MESSENGER_GATEWAYS entry now logs a diagnostic instead of being silently ignored.
• PR #60 follow-up: five small defects deferred at merge (header report path, stale doc, override/extend mismatch, wrong exception string, missing .env.example entry) #67 (partial: items 1, 2, 4, 5) — the send-approval path logs the stripped-header report instead of discarding it; the SEND_STRIP_HEADERS comment no longer claims "extend"; the wrong exchangelib exception name is corrected in comment and test; SEND_STRIP_HEADERS documented in .env.example. Item 3 (replace-vs-extend semantics) is deferred to the issue.
• Outcomes recorded into fields nothing reads: the updater's result is unreachable from both callers, and the scheduler's job status is written and never consulted #46 (partial) — a timed-out scheduler job's whole process group is killed (SIGTERM → grace → SIGKILL) instead of leaving descendants running. Retry policy and /status reporting stay open in the issue.
• agent-self-review: the documented resolved: true escape hatch emits no triple, so a project can never leave the sweep #23 (partial) — the agent-self-review sweep also skips paused: true projects. The canonical resolved-predicate question stays open in the issue.
• spawn-session calls the settings allowlist a security boundary, and hard-codes a permission mode the deployment cannot configure #31 — spawn-session honors CLAUDE_PERMISSION_MODE (hardcoded mode becomes the fallback) and no longer calls the settings allowlist a security boundary.

Feature

• CalDAV gateway: write calendar events with optional /sends verification #13 — CalDAV gateway: a new caldav-gateway compose service creates calendar events on any RFC 4791 server via the generic caldav library (no provider-specific code), gated by CALDAV_SEND_POLICY with the same allow/trust/verify semantics and fail-safe default as the messenger gateways; pending events are approved through the existing /sends flow (enrolled via MESSENGER_GATEWAYS, which needed no changes); caldav-push.py mirrors signal-push.py; standalone send-policy test included.

Documentation accuracy

• "An agent can never approve its own send" is stated as fact in four public places; #19 says it is not #26 — the false absolute "an agent can never approve its own send" softened to the calibrated phrasing at all nine sites; stale "untested" claim in comparison.md fixed.
• "The model never holds credentials" is unscoped in three public places, and #15 shows the scrub reaches only the main session #27 — "the model never holds credentials" re-scoped to messaging in comparison.md/SECURITY.md; stale review.md anchor fixed.
• review.md is stale on tests and CI: recommendation #2 is done, and CONTRIBUTING points contributors at the table as the roadmap #3 — review.md refreshed: test/CI claims match reality, recommendation docs: reindex latency is stated as ~15 s (measured 15-20 s) and the README omits converter extensions #2 marked done, dead citations re-pinned as permalinks.
• deploy/traefik security note: spoofed-cert-header stripping is credited to passTLSClientCert, which never strips — the real protection is entrypoint forwardedHeaders #112 / deploy/traefik/README.md says the retinue service's labels already add the mTLS middlewares; the base compose has no labels at all #54 — the traefik security note (and gateway_auth.py's comment) credits entrypoint forwardedHeaders, not passTLSClientCert, for spoofed-header stripping; the false "labels already wired" claim replaced.
• The two shipped example chamber agents tell themselves they can only read their own chamber; SECURITY.md says chambers are not compartmentalized #38 — example chamber agents no longer claim a chamber isolation that SECURITY.md says doesn't exist.
• PR #68 follow-up: SKILL.md doesn't document forward's new send-control/HTML behaviour (doc-only, blocked by sensitive-file permission in headless sessions) #69 — use-email-client skill documents forward's send-control gate and HTML-body handling.
• The three push CLIs' --help describes the send policy as a property of the recipient; the gateways, the tests and four docs key it to the sending identity #36 — the three push CLIs describe the send policy as keyed to the sending account, not the recipient.
• README calls the Telegram account "a Telegram bot"; it is a full MTProto user client, and the section's security argument depends on which it is #9 — Telegram wording corrected: an MTProto user client, not a bot (README, CLI, test comments).
• docs: reindex latency is stated as ~15 s (measured 15-20 s) and the README omits converter extensions #2 — remaining "~15 s" reindex claims updated to the agreed "tens of seconds" wording (4 sites).
• Plugin cache is keyed by the source repo's install-time commit, not by plugin.json's version — and no shipped manifest declares one #33 — plugin-cache staleness correctly attributed to install-time-commit keying, not plugin.json versions.
• The dashboard's four data cards ship commented out; CLAUDE.md and comparison.md describe them as running, and webapp/README.md is the only file that says otherwise #35 — CLAUDE.md/comparison.md now say the four dashboard data cards ship commented out.
• .env.example: two silently-ignored settings, one undocumented credential pair, three duplicate keys #5 — .env.example: Garmin credentials documented, CONVERSATION_BASE_URL defined, duplicate keys reconciled.
• CLAUDE.md's framework-checkout detection fails silently on a checkout whose gitdir is not mounted, and the recipe then commits to whatever repo the agent is standing in #32 — CLAUDE.md's framework-checkout detection replaced with a fail-loud, content-based check that can no longer silently commit to the wrong repository.

Testing

• Full standalone suite passes: 29/29 scripts (24 pre-existing + 5 new: attachments, agent sender, stripped-headers surfacing, transcript-cleanup model, CalDAV send policy; test_notification_settings.py and test_email_strip_headers.py extended in place). test_push_notify.py was not runnable in the build sandbox (pywebpush wheel build fails there); it is unmodified and covered by CI.
• py_compile on every changed Python file, bash -n on both changed shell scripts, YAML validation of docker-compose.yml.
• Behavioral fixes were exercised directly: process-group kill verified against a detached grandchild, ingest-sensors against a fixture chamber, git-serialize global-option parsing against the issue's own case table.

Notes for review

• Signal group news items show opaque group_id as feed source (follow-up to #114) #124 touches signal-gateway.py, which open PR feat(gateways): store inbound media as HTTP reference, not inline RDF #127 also modifies — whichever merges second needs a trivial rebase.
• The four partial issues (agent-self-review: the documented resolved: true escape hatch emits no triple, so a project can never leave the sweep #23, Boot emitter (PR #22): docs state the _generated indexing as unconditional, and the model slug is not injective #28, Outcomes recorded into fields nothing reads: the updater's result is unreachable from both callers, and the scheduler's job status is written and never consulted #46, PR #60 follow-up: five small defects deferred at merge (header report path, stale doc, override/extend mismatch, wrong exception string, missing .env.example entry) #67) intentionally stay open: each has a deferred half awaiting a maintainer decision, as does the rest of the triage's decision queue (Agent can self-approve a verify-policy send, bypassing human approval #19, Secrets leak into agent subsessions via inherited env; unset can't fix it — pass via stdin, not env_file #15, The updater cannot survive updating itself, and re-derives a compose invocation only the deployment knows — a submodule-layout override is invisible to it #90, LiteLLM is documented as optional but is an unconditional startup dependency of the retinue container, and its database needs a variable .env.example ships commented out #11, Chambers declared with path are invisible to the life store, and four docs say the opposite #30, Projects card returns no rows: web-gateway query and md2ttl.py converter disagree on namespace, predicate and actor URI shape #1, Personalized news agent: broadcast ingestion + time-decaying relevance feed #25, Dashboard: agent-offered choice buttons in conversation threads #18, .github/copilot-instructions.md is scoped to VS Code sessions, and the only Copilot mode that has written to this repo is the coding agent — which it tells not to push, and never points at CONTRIBUTING.md #34, README's service list names 4 of 12 compose services, and the Layout tree predates six directories #10, tell_ara should close the loop: reconcile a reported outcome with project state #79, Declarative chamber inboxes: Archivist as ingestion orchestrator #135, Epic: messenger reactions & message-scoped replies (Signal / WhatsApp / Telegram) #130, feat: integrate SMS Gateway private server into Retinue #16, and owner-action check-signal-cli pushes a bump branch but cannot open the PR: Actions is blocked from creating pull requests #4).

Fixes #2, fixes #3, fixes #5, fixes #9, fixes #13, fixes #26, fixes #27, fixes #29, fixes #31, fixes #32, fixes #33, fixes #35, fixes #36, fixes #37, fixes #38, fixes #39, fixes #40, fixes #54, fixes #61, fixes #65, fixes #69, fixes #74, fixes #75, fixes #87, fixes #92, fixes #112, fixes #124.
Addresses parts of #23, #28, #46, #67 (kept open).

🤖 Generated with Claude Code

https://claude.ai/code/session_014oMZgYcHBqdbRPV8J9oWuZ

---

Generated by Claude Code