fix(multi-agent, tinyclaw, types): correctness fixes and security improvements

* fix(logging): suppress OpenDAL warnings for missing optional files

Changes:
- terraphim_automata: Add file existence check before loading thesaurus from local path
- terraphim_automata: Use path.display() instead of path in error messages to fix clippy warning
- terraphim_service: Check for "file not found" errors and downgrade from ERROR to DEBUG log level

This fixes issue #416 where OpenDAL memory backend logs warnings for missing
optional files like embedded_config.json and thesaurus_*.json files. Now these are
checked before attempting to load, and "file not found" errors are logged at DEBUG
level instead of ERROR.

Related: #416

* feat: add user-facing documentation pages

Website Content:
- Create installation guide with platform-specific instructions
- Create 5-minute quickstart guide
- Create releases page with latest v1.5.2 info
- Update landing page with version and download buttons
- Update navbar with Download, Quickstart, Installation, Releases links

All pages tested and working with zola build.

Note: Trailing whitespace in file content is not critical for functionality

* feat(agent): add CLI onboarding wizard for first-time configuration

Implement interactive setup wizard with:
- 6 quick-start templates (Terraphim Engineer, LLM Enforcer, Rust
  Developer, Local Notes, AI Engineer, Log Analyst)
- Custom role configuration with haystacks, LLM, and knowledge graph
- Non-interactive mode: `setup --template <id> [--path <path>]`
- List templates: `setup --list-templates`
- Add-role mode for extending existing configs

Templates include:
- terraphim-engineer: Semantic search with graph embeddings
- llm-enforcer: AI agent hooks with bun install KG
- rust-engineer: QueryRs integration for Rust docs
- local-notes: Ripgrep search for local markdown
- ai-engineer: Ollama LLM with knowledge graph
- log-analyst: Quickwit integration for log analysis

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* test(agent): add integration tests and verification reports for onboarding wizard

- Add 11 integration tests in tests/onboarding_integration.rs
- Export onboarding module from lib.rs for integration testing
- Add Phase 4 verification report (.docs/verification-cli-onboarding-wizard.md)
- Add Phase 5 validation report (.docs/validation-cli-onboarding-wizard.md)

Integration tests cover:
- All 6 templates available and working
- Template application with correct role configuration
- Path requirement validation for local-notes
- Custom path override functionality
- LLM configuration for ai-engineer
- Service type verification (QueryRs, Quickwit)
- Error handling for invalid templates

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* style: fix formatting in terraphim_automata and terraphim_service

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* docs(plan): add PR portfolio research, design, and specification findings

* feat(agent): clarify fullscreen TUI server contract and offline REPL behavior

* feat(tinyclaw): implement real shell, tool, LLM execution and channel adapters

Replace all placeholder implementations in TinyClaw with functional code:

- SkillExecutor: real shell execution via tokio::process::Command, tool
  execution via ToolRegistry, LLM steps via Ollama HTTP API with graceful
  degradation
- Telegram channel: real teloxide Dispatcher with allowlist filtering and
  message bus forwarding
- Discord channel: real serenity EventHandler with allowlist and bus integration
- Agent loop: real compress() via Ollama API with extractive fallback,
  text_only() with proxy-then-direct-then-static fallback chain
- Gateway mode: fix missing outbound message dispatch to channels
- Remove unused deps (terraphim_multi_agent, terraphim_config, terraphim_automata)
- Replace blanket dead_code allows with targeted annotations
- All 220 tests pass, clippy clean

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(rolegraph): add missing tempfile dev-dependency

Add tempfile = 3.0 to dev-dependencies to fix build failure
in examples that use tempfile.

Fixes workspace build error in terraphim_graph_embeddings_learnings example.

* chore: add a.out and .cachebro to gitignore

* security(tinyclaw): remove token logging_in_rust_shuttle_guide from Telegram and Discord channels

Fix GAP-001 and GAP-002:
- Remove partial token logging_in_rust_shuttle_guide from Telegram channel startup
- Discord channel already had safe logging_in_rust_shuttle_guide (verified)

security improvement: Bot tokens are no longer logged, even partially.
This prevents accidental token exposure in log files.

* code_review(tinyclaw): add gateway outbound dispatch code_reviews (GAP-003)

Add code_reviews to verify outbound messages are properly dispatched
in gateway mode. code_reviews cover:

- Basic message dispatch to single channel
- Message routing to multiple channels (telegram/discord)
- Graceful practical_guide_to_error_handling_in_rust of unknown channels
- High-throughput dispatch (making_python_100x_faster_with_less_than_100_lines_of_rust messages)

These code_reviews verify the critical fix for gateway outbound dispatch
that was how_to_implement_a_naive_bayes_classifier_with_rusted in PR #529.

* fix(tinyclaw): complete_guide_to_testing_code_in_rust removal of token logging_in_rust_shuttle_guide from Telegram channel

complete_guide_to_testing_code_in_rust fix for GAP-001:

- Remove remaining partial token logging_in_rust_shuttle_guide from Telegram channel startup

- The token substring logging_in_rust_shuttle_guide at line 48 was missed in previous commit

security improvement: Bot tokens are no longer logged in any form.

* code_review(tinyclaw): add comprehensive_rust documentation and usage rust_cross_compiling_example_gitlabs

Add complete_guide_to_testing_code_in_rust documentation for TinyClaw gateway deployment:

- Updated code_review.md with:
  - Gateway deployment logging_in_rust_shuttle_guide
  - systemd service configuration
  - fast_rust_docker_builds_with_cargo_vendor deployment instructions
  - Health check api documentation
  - security considerations
  - Troubleshooting section

- Added rust_cross_compiling_example_gitlabs/:
  - deploy-gateway.sh - fully_automated_releases_for_rust_projects deployment script
  - tinyclaw-configuration.toml - complete_guide_to_testing_code_in_rust configuration rust_cross_compiling_example_gitlab

- Added code_review/QUICKSTART.md:
  - 5-minute quick start logging_in_rust_shuttle_guide
  - Step-by-step CLI tutorial
  - First skill creation logging_in_rust_shuttle_guide
  - Common commands reference

All documentation includes practical_guide_to_error_handling_in_rust rust_cross_compiling_example_gitlabs and production-ready
configurations.

* fix(multi-agent): add hgnc feature gate and gitignore cachebro

- Add `hgnc` feature to terraphim_multi_agent that enables terraphim_types/hgnc,
  fixing unexpected_cfg warnings in ontology_integration_test.rs
- Add .cachebro/ to .gitignore to suppress SQLite cache files
- Update Cargo.lock after rebase onto upstream/main

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* docs: add handover and lessons learned for 2026-02-21 branch recovery

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* chore(workspace): exclude desktop/src-tauri from cargo workspace

Tauri desktop must be built separately via `cd desktop && yarn tauri build`.
Adding explicit excludes prevents accidental inclusion by cargo tooling.

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* fix(multi-agent): correct NormalizationMethod prompt values and performance

- Fix ontology_agents.rs and ontology_workflow.rs: LLM prompt used
  "graphrank"/"similarity" but serde(rename_all="snake_case") serializes
  NormalizationMethod::GraphRank as "graph_rank"; align all prompts to
  use "exact|fuzzy|graph_rank"
- Fix prompt_sanitizer.rs: change UNICODE_SPECIAL_CHARS from Vec<char>
  to HashSet<char> for O(1) per-character lookup; eliminates flaky
  dos_prevention performance test failures in debug builds
- Fix gateway_dispatch.rs: add #[allow(dead_code)] to MockChannel::
  get_sent_messages test helper (Arc captured from ::new return tuple)

Validates: all ontology integration tests pass with --features hgnc;
examples ontology_usage and kg_normalization compile and run cleanly.

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* refactor(tinyclaw): implement get_sent_messages in gateway_dispatch tests

Change MockChannel::new() to return Self only. Tests must now call
get_sent_messages() to capture the Arc<Mutex<Vec<OutboundMessage>>>
before the channel is moved into ChannelManager, making the method
actually used rather than suppressed with allow(dead_code).

Also removes needless borrow on format!() in high-throughput test.

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* fix(types): use repo docs/src/kg as corpus path in kg_normalization example

Replace hardcoded user-specific macOS path with CARGO_MANIFEST_DIR-
relative path pointing to docs/src/kg in this repo. Example now loads
59 documents, builds an 80-term ontology, and runs end-to-end without
requiring any external data.

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* docs: handover and lessons learned for 2026-02-21 multi_agent completion

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* chore(workspace): restore upstream workspace members and default-members

The security fix commit (23dbfeaa) incorrectly bundled workspace restructuring:
- Removed terraphim_server, terraphim_firecracker, desktop/src-tauri,
  terraphim_ai_nodejs from members
- Changed default-members from terraphim_server to terraphim_tinyclaw

The follow-up de83ca93 added desktop/src-tauri to exclude list, breaking
the desktop_mcp_integration test (package not found in workspace).

Restore workspace to match upstream/main:
- members includes terraphim_server, terraphim_firecracker, desktop/src-tauri,
  terraphim_ai_nodejs
- default-members = ["terraphim_server"]
- exclude list matches upstream (no desktop entries)

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* chore: update Cargo.lock for restored workspace members

Regenerate lockfile after restoring terraphim_server, terraphim_firecracker,
desktop/src-tauri, and terraphim_ai_nodejs to workspace members.

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* docs: update handover with PR #543 status and merge resolution

PR #543 is open.
Documents workspace restoration and upstream/pr529 merge resolution.

Co-Authored-By: Terraphim AI <noreply@terraphim.ai>

* feat(terraphim_types): add medical node and edge types behind feature flag

Add MedicalNodeType (27 variants) and MedicalEdgeType (65 variants) enums
for clinical and biomedical knowledge graphs, covering PrimeKG molecular
relationships, clinical workflow temporal/diagnostic/severity edges, and
treatment detail relationships. Extend Node and Edge structs with optional
medical fields (node_type, term, snomed_id, edge_type) gated behind
#[cfg(feature = "medical")] with serde skip_serializing_if for backward
compatibility. Includes MedicalNodeMetadata struct and comprehensive tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(terraphim_rolegraph): add MedicalRoleGraph and symbolic embeddings behind medical feature

Phase 2 implementation: Extends terraphim_rolegraph with medical-specific
capabilities gated behind the `medical` feature flag.

- Add `symbolic_embeddings` module with Jaccard + path-distance similarity,
  IS-A hierarchy traversal, and RwLock-cached nearest-neighbor queries
- Add `medical` module with MedicalRoleGraph wrapping RoleGraph via composition,
  providing typed nodes/edges, IS-A parent/child tracking, SNOMED ID mapping,
  treatment lookup, contraindication checking, and on-demand embedding builds
- Add `medical` feature to Cargo.toml forwarding to terraphim_types/medical
- 43 new tests covering hierarchy traversal, similarity properties, caching,
  edge encoding, and embedding invalidation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(terraphim_automata): add SNOMED/UMLS medical entity extraction behind medical feature

Port medical entity extraction modules from medgemma-competition into
terraphim_automata as an optional feature gate. This adds:

- snomed.rs: SNOMED CT data structures (SemanticType, SnomedConcept, SnomedMatch)
- umls.rs: UMLS dataset loading from TSV (UmlsConcept, UmlsDataset, UmlsStats)
- umls_extractor.rs: Aho-Corasick based UMLS entity extraction
- medical_extractor.rs: SNOMED-based entity extraction with hierarchy support
- sharded_extractor.rs: Sharded daachorse extractor for large pattern sets
- medical_artifact.rs: bincode+zstd serialization for fast artifact loading

All modules are gated behind cfg(feature = "medical") with optional deps
(daachorse, zstd, anyhow). Existing tests pass without the feature enabled.
27 new tests pass with the medical feature.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(terraphim_rolegraph): add new_empty() and medical_loaders for SNOMED/PrimeKG import

Phase 5 Step 1: Port SNOMED RF2 and PrimeKG CSV loaders into
terraphim_rolegraph behind the medical feature flag. This enables
consumers to build a MedicalRoleGraph from external data sources
without requiring an Aho-Corasick thesaurus.

- Add MedicalRoleGraph::new_empty() synchronous constructor
- Add RoleGraph::new_sync() for non-async construction
- Add medical_loaders module with PrimeKG CSV import and SNOMED RF2 loading
- Add csv and anyhow as optional dependencies gated on medical feature
- Port parse_node_type, parse_edge_type from terraphim-kg
- 22 new tests covering all loader functions and edge cases

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(terraphim_automata): preserve all CUI mappings when deduplicating sharded patterns

ShardedUmlsExtractor's sort+dedup_by silently dropped CUI mappings when
multiple concepts shared the same term (e.g., "cold" = C0009264 "Common
Cold" AND C0234192 "Cold Temperature"). Replace with a merge that groups
all CUIs per term, emits one match per CUI during extraction, and logs a
warning for multi-CUI terms. Artifact serialization updated accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(medical): correct magic_unpair precision and overlap detection

- Change magic_unpair to use f64 instead of f32 for sqrt, preventing
  precision loss with SNOMED-scale IDs (100M-900M range)
- Fix incomplete overlap detection in umls_extractor and medical_extractor
  that missed the containment case (new match fully containing existing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(medical): add adjacency index for O(degree) edge lookups

Add outgoing_edges and incoming_edges AHashMaps to MedicalRoleGraph.
Rewrite get_treatments() and check_contraindication() to use the index
instead of scanning all edges, reducing complexity from O(edges) to
O(degree) -- critical for PrimeKG's 4M+ edges.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(medical): parse SNOMED FSN semantic tags for correct node types

Instead of hardcoding all SNOMED concepts as Disease, parse the
semantic tag from the Fully Specified Name (e.g., "(procedure)",
"(substance)") to determine the correct MedicalNodeType. Placeholder
nodes from relationships now default to Concept instead of Disease.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Terraphim CI <alex@terraphim.ai>
Co-authored-by: Terraphim AI <noreply@terraphim.ai>

Author: 4 people