saf: fence schedules from authority

The watcher path, tool path, trigger files, and declared config do not meet. Record the traversal and prompt-injection boundaries before schedules wake an agent.

saf/nervous/01-eventbus.md

@@ -39,4 +39,29 @@ One type, not an enum per event, so a listener filters on `event_type` and ignor
 
 A `SensorConfig` says how a sensor takes part: which domain (`Cron`, `Filesystem`, `FilesystemWatch`, `GitDiff`, `Memory`, `Process`, `Federation`), whether it pushes on its own or waits to be asked, when it fires (once, on change, or on an interval), and how eagerly.
 
-A sensor marked as a nerve ending fires onto the bus uncalled. Right now the schedule is the only one that does. The other domains are named and waiting; nothing drives them yet. Tracked in `docs/tasks/firehose-subconscious-subscription.md`.
+A sensor marked as a nerve ending fires onto the bus uncalled. The schedule is
+the first intended nerve ending, but it is not operational for agent-created
+schedules in the current source.
+
+## Schedule boundary — observed 2026-08-20
+
+- `LocalBackend` spawns `CronSensor` against
+  `agents/<id>/schedules/`, while the CLI and schedule tool write
+  `agents/<id>/memory/schedules/`. Those files are therefore not watched.
+- `schedule run` and the tool's `trigger` action create `.trigger-*` files;
+  `CronSensor` never consumes them.
+- `[schedules].enabled` and `schedules_dir` are declared in config but ignored
+  by the `LocalBackend` wiring.
+- Schedule names are interpolated into a path without validation. Do not treat
+  the tool as a safe authority boundary until traversal is rejected and file
+  ownership is explicit.
+- A due schedule injects its prompt as a background user turn. Schedule text is
+  therefore untrusted input, not an authorization token for shell, Git,
+  deployment, publication, or credential use.
+
+The intended repair is one canonical directory, validated names, working
+manual triggers, honoured configuration, and a capability-limited wake path.
+For the Gitea watcher, schedules may later wake Ani to inspect already
+reconciled read-only state; they must not replace signed webhooks, API
+reconciliation, or CI authority. The other sensor domains remain named and
+waiting. Tracked in `docs/tasks/firehose-subconscious-subscription.md`.

saf/state.md

@@ -7,7 +7,7 @@ Everything else belongs to its owning section and is reached from the index.
 Keep it honest: when component state moves, move it here. Dated history goes
 to `archive/` — it never returns as news.
 
-Last reconciled: 2026-08-18 (cadences + memory tool tree selector landed).
+Last reconciled: 2026-08-20 (schedule authority boundary audited).
 
 ## Deployed
 
@@ -41,6 +41,11 @@ Last reconciled: 2026-08-18 (cadences + memory tool tree selector landed).
   owning work record.
 - **Memory sync**: per-instance branches and `resolve_remote` are in; merge
   policy and auto-fetch are next (FEDERATION.md step 3).
+- **Schedules are wired across the bus but miss their own files.** The sensor
+  watches `agents/<id>/schedules`; the CLI/tool write under
+  `agents/<id>/memory/schedules`, manual triggers are not consumed, config is
+  ignored, and names need traversal rejection. Do not use schedules as CI or
+  deployment authority. `nervous/01-eventbus.md` owns the boundary.
 
 ## The substrate, one line