docs: repository-wide accuracy corrections (doc-vs-code audit, v1.35.0)

[jkyberneees]

Summary

Full doc-vs-code accuracy audit: all 24 docs/ files + README.md + AGENTS.md, executed as 9 sub-agent waves (read-only code-reviewer profile, max 2 concurrent) plus a dedicated docs/SECURITY.md deep audit. Every concrete claim — identifiers, flags, env vars, defaults, numeric caps, test names, handler signatures — was checked against source. Docs-only; no code changes.

Notable corrections

File	Fix
SECURITY.md / PLANNING.md	stale TestIsPlanMessage citations (test does not exist; mechanism lives in refreshPlanMessage); ToolCallTaints is not "shared with skills"; undocumented untoggleable mcp_schema guard scope; plan-files bounds row (actual: maxTelegramPlanChars = 3800); MCP server-mode non_interactive default is read_only, not deny; utf16Len claim removed (counting is byte-based); <system> token requires an override verb
CONFIG.md / CLI.md	phantom ODEK_TOOL_PROGRESS env removed; --model default is deepseek-v4-flash; repl rejects unknown flags (not silently ignored); serve has no --no-compaction; "every knob has an env counterpart" softened
MCP.md	exposed-tools table +4 (skill_load/skill_list/artifact_read/list_subagent_profiles), plan conditional; approval keys also hash schema+description (sentence was garbled); per-tool approval applies to every server; discovery errors fail fast (not "skip and continue")
TELEGRAM.md	/plan_resume takes no args; all 4 handler signatures carry trailing userID int64
SANDBOXING.md / README / AGENTS.md	sandbox is default-on for run/repl/serve (--no-sandbox/ODEK_NO_SANDBOX opt-out, ODEK_REQUIRE_SANDBOX fatal); stale render.Start() symbol; per-tool-approval bullet; event-type lists completed (subagent_spawned/subagent_completed)
CHEATSHEET / TOOL_SELECTION	memory tool has 16 actions (was 6); phantom skill_save/skill_patch/skill_delete agent tools removed; list_subagent_profiles/artifact_read added
SUBAGENTS / EXTENSIONS / MAINTENANCE / PROVIDERS / DEVELOPMENT / WEBUI / etc.	per-line Unmarshal, max_concurrency fallback documented, artifacts_max_age_hours in config reference, 11 danger classes, docs/ index completed (+14 entries), version example freshened
DOCKER_COMPOSE_USER_GUIDE.md	sections rewritten to match the docker/ rework: real layout (context: .., dockerfile: docker/Dockerfile), 4-stage Dockerfile incl. whisper.cpp/MiniCPM-V stages, 4 odek services + 3 sidecars, read_only policy snippets

Verified clean (no changes needed)

PLANNING.md (post-fix), MEMORY.md, EXTENDED_MEMORY.md, SESSIONS.md, STREAMING.md, CACHING.md, API.md (Go SDK surface), WEBUI.md (auth + all numeric limits), SCHEDULES.md, DAILY-WORKER.md, REDACTION_HARDENING.md.

Verification

• Final stale-identifier grep gate passed (0 hits) before commit; the gate itself caught 3 residual hits (incl. two TestIsPlanMessage citations in PLANNING.md missed by a sub-agent pass) which were fixed pre-commit.
• Docs-only diff — no Go code touched; CI expected green.
• Every correction carries file:line evidence from the auditing pass; two auditor false-positives were caught and rejected during triage (sandbox default semantics, max_concurrency default 3).

Maintainer note (code, not docs)

odek init --global writes an explicit "sandbox": false into the template while the CLI treats unset as sandbox-wanted-by-default — worth a follow-up look so fresh configs don't silently opt users out of the default-on posture.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	odek	7e3fa8e	Commit Preview URL Branch Preview URL	Aug 31 2026, 10:51 AM