…slash-commands-settings

feat: Sprint 17 -- Workspace breadcrumbs, slash commands, send key setting

Adds a Knowledge tab alongside the existing Memory tab under /memory.
The knowledge browser renders markdown wiki pages from ~/.hermes/knowledge/
with support for:

- YAML frontmatter parsing (title, type, domain, status, tags)
- Directory-based navigation with folder tree sidebar
- [[wikilink]] resolution as clickable in-app navigation
- Backlinks ('Pages that link here')
- Full-text search across all wiki pages
- Tag filtering
- Metadata display (type, domain, status, created/updated)
- Graph view dialog showing page connections
- 'Ask agent about this' button linking to chat
- Graceful empty state when no knowledge directory exists

Server side:
- src/server/knowledge-browser.ts — wiki scanner, frontmatter parser,
  wikilink extractor, graph builder
- 4 API routes: /api/knowledge/list, /read, /search, /graph

Frontend:
- src/routes/memory.tsx — tabbed layout (Memory | Knowledge)
- src/screens/memory/knowledge-browser-screen.tsx — full browser UI

Knowledge tab works independently of gateway capabilities (reads local
filesystem directly). No new dependencies added.

Closes NousResearch#30

)

When the WebUI's model picker sets the active provider to
"venice" (or "crof", "bankr", "cometapi"), the agent's
resolve_provider_client() looked up the slug in
PROVIDER_REGISTRY, failed to find it, and raised:

  "Provider 'venice' is set in config.yaml but no API key
   was found. Set the VENICE_API_KEY environment variable..."

VENICE_API_KEY WAS set in env — the failure was because
the agent had no idea which env var or base URL to use for
"venice" as a slug. PROVIDER_REGISTRY entries for the other
OpenAI-compatible aggregators (Z.AI, MiniMax, Mistral, etc.)
already existed; Venice/CrofAI/Bankr/CometAPI just hadn't
been added in the upstream code.

Adds four api_key-auth entries mirroring the existing
OpenAI-compat ones:
- venice → https://api.venice.ai/api/v1 + VENICE_API_KEY
- crof → https://crof.ai/v1 + CROF_API_KEY
- bankr → https://gateway.bankr.bot/v1 + BANKR_API_KEY
- cometapi → https://api.cometapi.com/v1 + COMETAPI_API_KEY

Companion to the WebUI side (PRs #26/#27/#29/#30/#32/#33)
which made these providers discoverable in the model picker
with their live /v1/models catalogs.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…(was lost in chain shift)

…on + dispatcher-only lookup

Second self-review found one BROKEN issue and one WEAK adversarial
concern. Both addressed.

## BROKEN #7 — same-tenant cross-umbrella collision

Two goal_mode umbrellas sharing a tenant (the common marvel-swarm-*
case) would both look up integrative reviews by the same title prefix +
tenant. Umbrella B's archive could find umbrella A's review and either
falsely unblock (if A was approved) or falsely block (if A was in
flight).

Fix: embed `umbrella_id` in the review title:
``Integrative architectural review (v6.7 NousResearch#30) for <umbrella_id>``
Lookup uses a per-umbrella LIKE pattern via two new helpers:
`_v6_7_integrative_title_for(umbrella_id, round)` and
`_v6_7_integrative_title_pattern(umbrella_id)`. Tenant is no longer
load-bearing for isolation — the title is unique per umbrella.

## WEAK #8a — manual fake-review bypass mitigated

A worker with kanban write access could create a task with the right
title, mark it done with `result = "verdict: approve"`, and unblock
the umbrella. Now the lookup query also filters
`created_by = 'dispatcher'`, so hand-crafted fake reviews are
ignored. This isn't a complete defense (a worker who can write
arbitrary `created_by` values could still spoof) but defense in depth
that catches the common case.

## Tests

3 new tests added (30 total, up from 27):
- TestCrossUmbrellaIsolation.test_two_umbrellas_same_tenant_have_separate_reviews
- TestCrossUmbrellaIsolation.test_approving_one_umbrella_does_not_unblock_another
- TestFakeReviewMitigation.test_lookup_requires_created_by_dispatcher

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ousResearch#30)

archive_task gates JARVIS goal-mode umbrella archives behind a final
T'Challa integrative architectural review. When all per-block reviews
are terminal and ≥1 build child + ≥1 review child exist, the
dispatcher spawns a PEER task (not child — that caused a deadlock in
the first attempt) assigned to tchalla with the 4-item review scope:
end-to-end request trace, page render trace, adversarial enumeration,
error-path audit.

Strict line-anchored verdict parser (^verdict: approve|reject). Reject
verdict triggers re-spawn with :rN suffix the next archive call.
Per-umbrella title isolation prevents same-tenant cross-umbrella
collision. created_by='dispatcher' filter mitigates fake-review
bypass.

Closes hermes-jarvis#30. Context: hermes-jarvis#61. 30 tests after
three self-review passes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…h#79) (#19)

* feat(kanban): v6.8 Part 4 — umbrella keep_running until reviewers spawn (NousResearch#79)

The 2026-06-10 v6.7 validation chain caught this orchestration bug:
JARVIS umbrella spawned Pepper + Friday from the umbrella, then
called kanban_complete on itself before any reviewer was queued. The
umbrella showed as done with build-only descendants; Kaipo had to
manually spawn Tony / Tchalla / Vision to continue the chain.

Closes hermes-jarvis#79.

## What this PR adds

New gate ``verify_umbrella_review_coverage`` that fires when a
goal_mode umbrella calls kanban_complete. The gate walks the
umbrella's transitive descendants (reusing _v6_7_walk_descendants
from NousResearch#73 so chained shapes count). If no review-role descendant
exists anywhere in the subtree, the gate rejects.

Two violation messages:

1. ``no descendants at all`` — pathological goal-mode umbrella that
   never decomposed. The orchestrator misfired.
2. ``build-role descendants but NO review-role descendants`` — the
   exact 2026-06-10 case. Message points the operator to spawn
   tony/tchalla/vision now via kanban_create --parent <build-id>.

Opt-out: ``metadata={"x_no_review_needed": "<≥20-char reason>"}``
for legitimate cases (e.g. pure status-ack umbrellas). Standard
v6.7/v6.8 opt-out conventions — emits completion_opt_out_used
audit event with verbatim reason; bool/short strings rejected.

## Relationship to v6.7 NousResearch#30

- NousResearch#30 (integrative review at archive): fires at ARCHIVE time, spawns
  Tchalla after a chain settles.
- NousResearch#79 (this PR): fires at COMPLETE time, forces JARVIS to spawn
  reviewers BEFORE marking itself done.

Together they catch the empty-chain failure mode at both ends of the
lifecycle.

## Tests

12 new tests:

TestUmbrellaReviewCoverage (7) — non_goal skips, review descendant
passes, only-build rejects with helpful message, no-descendants
rejects with different message, tchalla/vision also satisfy, opt-out
bypasses.

TestUmbrellaReviewCoverageIntegration (5) — end-to-end via
complete_task: build-only blocks, adding chained tony unblocks
(closes NousResearch#73 + NousResearch#79 together), x_no_review_needed passes, short opt-out
rejected, non-goal_mode tasks unaffected.

135 in test_kanban_completion_gates.py pass. 231/231 across full
v6.7+v6.8 + adjacent regression set, zero failures.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(kanban): self-review fixes for v6.8 Part 4 umbrella gate (NousResearch#79)

Three findings from the independent code review on PR #19:

1. Scope tightening: verify_umbrella_review_coverage now requires
   umbrella_assignee in ORCHESTRATION_ROLES (jarvis/pepper/banner).
   A goal-mode worker like Friday is out of scope — only orchestrators
   own umbrella-decomposition discipline. Was over-applying.

2. Empty-assignee message correctness: has_non_review_descendant is
   now bool(descendants), not the unset has_non_review flag. Prevents
   the "no descendants at all" message lying when descendants exist
   but all have empty assignees. Also added break after first review
   match for early termination.

3. Opt-out rename: x_no_review_needed → x_umbrella_no_review across
   gate messages, kanban_db opt-out validation, accepted_opt_outs
   audit entry, and tests. Avoids future collision with
   x_no_reviewer_fields (reviewer-field opt-out).

Plus 8 new unit tests covering the scope tightening (friday/tony
skipped, empty-assignee skipped, pepper/banner in scope, case-
insensitive matching) and edge cases the reviewer flagged
(blocked-status review counts, deep transitive review, multi-children
multi-reviews).

Module docstring updated: was "Three gates ship today (Tranche 1
of v6.7)" — now reflects the v6.7+v6.8 gate roster (5 gates,
closing 7 issues).

All 144 gate tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Jarvis <jarvis@Kaipos-Mac-mini.local>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>