Add LINE channel adapter with webhook ingress and gating

docs/plans/2026-02-16-line-channel-adapter-checklist.md

@@ -0,0 +1,58 @@
+# LINE Channel Adapter Checklist
+
+**Date:** 2026-02-16  
+**Scope:** Close the first item in the LINE/Feishu/Zalo channel gap set by implementing LINE.
+
+## Goal
+
+Add a production-safe LINE channel adapter with webhook ingress, signature verification, outbound send path, mention/allowlist gating, and daemon/gateway wiring.
+
+## Implemented
+
+- Added new LINE adapter:
+  - `src/channels/line/adapter.ts`
+  - `src/channels/line/index.ts`
+- Added webhook ingress on gateway:
+  - `POST /line/events` routed to adapter handler.
+- Added daemon registration:
+  - config-driven adapter creation in `registerChannels()`
+  - gateway webhook handler binding via `setLineHandler()`
+- Added config schema:
+  - `line.channel_access_token`
+  - `line.channel_secret`
+  - `line.allowed_source_ids`
+  - `line.require_mention`
+  - `line.mention_name`
+- Added service discovery listing:
+  - `line` channel now appears in `system.services`.
+- Added docs/config examples:
+  - `README.md`
+  - `config/default.yaml`
+
+## Security/Safety
+
+- Verifies `x-line-signature` using HMAC-SHA256 + `channel_secret`.
+- Applies source allowlist (`allowed_source_ids`) when configured.
+- Applies mention gating (`require_mention` + `mention_name`) for group/room contexts.
+
+## Tests
+
+- `src/channels/line/adapter.test.ts`
+  - inbound signature validation
+  - mention gating behavior
+  - outbound push API call
+  - invalid signature rejection
+- `src/daemon/channels.test.ts`
+  - LINE adapter registration + gateway handler binding.
+- `src/config/schema.test.ts`
+  - LINE config parsing/defaults.
+- `src/gateway/handlers/services.test.ts`
+  - LINE service presence in discovery output.
+
+## Validation Run
+
+```bash
+pnpm test:run src/channels/line/adapter.test.ts src/daemon/channels.test.ts src/config/schema.test.ts src/gateway/handlers/services.test.ts
+pnpm typecheck
+pnpm build
+```