Add Zalo channel adapter with webhook and send path

docs/architecture/CONTRIBUTOR_MAP.md

@@ -20,7 +20,7 @@ src/
   hooks/         Confirm/log/silent policy + autonomy resolution
   sandbox/       Docker sandbox manager + sandboxed tool wrappers
   models/        Provider clients + model router + retry/cost/capabilities
-  channels/      Chat adapters + pairing gate (Telegram/Discord/Slack/WhatsApp/Matrix/Signal/Mattermost/LINE/Feishu/etc.)
+  channels/      Chat adapters + pairing gate (Telegram/Discord/Slack/WhatsApp/Matrix/Signal/Mattermost/LINE/Feishu/Zalo/etc.)
   gateway/       WebSocket JSON-RPC server + web UI + handlers
   memory/        Hybrid search + embeddings + persistence
   session/       SQLite store + session mgmt

docs/plans/2026-02-16-zalo-channel-adapter-checklist.md

@@ -0,0 +1,50 @@
+# Zalo Channel Adapter Checklist
+
+**Date:** 2026-02-16  
+**Scope:** Implement Zalo adapter to close the remaining channel gap in the LINE/Feishu/Zalo set.
+
+## Goal
+
+Add a Zalo OA channel adapter with webhook ingress, outbound send path, mention/allowlist gating, and runtime wiring through daemon + gateway.
+
+## Implemented
+
+- Added Zalo adapter:
+  - `src/channels/zalo/adapter.ts`
+  - `src/channels/zalo/index.ts`
+- Inbound webhook handling:
+  - endpoint: `POST /zalo/events`
+  - optional webhook token validation (`x-zalo-token` header or payload token)
+- Message normalization:
+  - sender/message extraction and normalized `InboundMessage` emission
+  - mention gating (`require_mention`, `mention_name`)
+  - optional user allowlist (`allowed_user_ids`)
+- Outbound send:
+  - OA CS text message API call with `oa_access_token`
+- Runtime integration:
+  - config schema for `zalo` block
+  - daemon registration + gateway handler binding
+  - service discovery listing
+
+## Tests
+
+- `src/channels/zalo/adapter.test.ts`
+  - name/status
+  - outbound send path
+  - inbound normalization
+  - webhook token enforcement
+  - mention gating behavior
+- `src/daemon/channels.test.ts`
+  - adapter registration + gateway `setZaloHandler` wiring
+- `src/config/schema.test.ts`
+  - zalo config parse/defaults
+- `src/gateway/handlers/services.test.ts`
+  - `zalo` service visibility
+
+## Validation Run
+
+```bash
+pnpm test:run src/channels/zalo/adapter.test.ts src/daemon/channels.test.ts src/config/schema.test.ts src/gateway/handlers/services.test.ts
+pnpm typecheck
+pnpm build
+```

docs/plans/state.json

@@ -647,6 +647,33 @@
       ],
       "test_status": "pnpm test:run src/channels/feishu/adapter.test.ts src/daemon/channels.test.ts src/config/schema.test.ts src/gateway/handlers/services.test.ts + pnpm typecheck + pnpm build passing"
     },
+    "zalo-channel-adapter": {
+      "file": "2026-02-16-zalo-channel-adapter-checklist.md",
+      "status": "completed",
+      "date": "2026-02-16",
+      "updated": "2026-02-16",
+      "summary": "Implemented Zalo OA channel adapter with webhook ingress (`/zalo/events`), optional webhook token validation, mention/allowlist gating, outbound OA message send path, daemon/gateway wiring, and service discovery visibility.",
+      "files_created": [
+        "docs/plans/2026-02-16-zalo-channel-adapter-checklist.md",
+        "src/channels/zalo/adapter.ts",
+        "src/channels/zalo/adapter.test.ts",
+        "src/channels/zalo/index.ts"
+      ],
+      "files_modified": [
+        "src/channels/index.ts",
+        "src/daemon/channels.ts",
+        "src/daemon/channels.test.ts",
+        "src/config/schema.ts",
+        "src/config/schema.test.ts",
+        "src/gateway/server.ts",
+        "src/gateway/handlers/services.ts",
+        "src/gateway/handlers/services.test.ts",
+        "README.md",
+        "config/default.yaml",
+        "docs/architecture/CONTRIBUTOR_MAP.md"
+      ],
+      "test_status": "pnpm test:run src/channels/zalo/adapter.test.ts src/daemon/channels.test.ts src/config/schema.test.ts src/gateway/handlers/services.test.ts + pnpm typecheck + pnpm build passing"
+    },
     "qmd-backend": {
       "file": "2026-02-16-qmd-backend-checklist.md",
       "status": "completed",
@@ -3208,7 +3235,7 @@
     }
   },
   "overall_progress": {
-    "total_test_count": 1808,
+    "total_test_count": 1814,
     "all_tests_passing": true,
     "p0_completion": "3/3 (100%)",
     "p1_completion": "4/4 (100%)",
@@ -3223,12 +3250,12 @@
     "tier2_completion": "4/4 (100%) — inbound webhooks, vector memory search, Dockerfile, heartbeat monitor",
     "tier3_completion": "5/5 (100%) — lane queue, credential redaction, web UI token dashboard, xAI (Grok) provider, Voyage AI embeddings",
     "tier4_completion": "4/4 (100%) — gateway lock, shell completion, Tailscale Serve/Funnel, DM pairing codes",
-    "feature_gap_scorecard": "125/128 match (98%), 0 partial (0%), 3 missing (2%)",
+    "feature_gap_scorecard": "126/128 match (98%), 0 partial (0%), 2 missing (2%)",
     "operator_dx_milestone": "Phase 3 (Live Ops Dashboard): 2/2 plans complete — milestone done",
     "gmail_auth_cli": "flynn gmail-auth command implemented with OAuth2 flow, doctor check, config routed to Telegram",
     "native_audio_support": "completed — smart routing for native audio (Gemini/OpenAI/GitHub) vs Whisper transcription fallback",
     "remaining_phases_completion": "Phase 1: 3/3 (100%) — context levels, command registry, memory structure. Phase 2: 3/3 (100%) — component registry, confidence routing, history index. Phase 3: 2/2 (100%) — adaptive memory/compaction, truthfulness/autonomy hardening",
-    "next_up": "OpenClaw gap: Zalo channel adapter (open next scoped implementation checklist)"
+    "next_up": "OpenClaw gap: companion app runtime clients (macOS/iOS/Android implementation) — open next scoped implementation checklist"
   },
   "soul_md_and_cron_create": {
     "date": "2026-02-11",