Add text features: trusted triggers, context cache, response policy, MCP config tools

TODO.md

@@ -0,0 +1,49 @@
+# TODO
+
+Ordered backlog. `CURRENT.md` tracks the live session state.
+
+## Where the project finished (2026-09-11)
+
+- The validated core bridge is live: a fixed action list, input validation, structured errors, and a
+  hard outbound rate limit. See `docs/core-bridge.md`.
+- The daemon uses the core bridge. QR login, pacing, the trigger log, the trust list, the context
+  cache, and the response policy work.
+- Mock tests and a live test passed: state, DM send, and a synthetic trigger through the real event
+  path.
+- Repo note: use `zib/Veskslop-t` (remote `veskslop-t`) until the original repo's server hook is
+  fixed. Pushes to the original land, but its UI and fetch path are broken.
+
+## Deferred
+
+- Voice join and leave, invite-link joins, audio in and out, and video streaming. Text features come
+  first.
+- Client lightening. Low priority. The client must stay stable.
+- Web debug UI and remote client authentication.
+
+## Text features
+
+Done:
+
+- Trusted-only triggers: direct messages and direct mentions.
+- Context: the last 15 messages or 4000 characters, whichever is lower. File names only for videos
+  and images. Incremental fetch with an old-message cache.
+- Context cache in a tmp folder with a size limit.
+- Response policy: reply in the origin channel or by DM. Sensitive commands default to DM.
+- MCP tools for context and config.
+
+Next:
+
+- Notification parsing: edits, deletes, reactions, replies, and message references.
+- Persistent trigger log with rotation.
+- Per-user rate limit and command cooldowns.
+- More commands: `ask`, `summarize`, `context`, and `config`.
+- MCP event delivery for agents. Push or a stateful stream.
+- Multi-identity: a read-only collector account beside the puppet.
+
+## Open design questions
+
+- MCP event delivery: the current Streamable HTTP mode is stateless, so the server cannot push
+  events. Options are polling, SSE, or a stateful session.
+- Untrusted interactions: ignored for now. The daemon keeps the 30-entry untrusted buffer for later.
+- Context freshness: the daemon fetches on each mention. Add a TTL or a minimum gap if the query
+  cost is too high.