feat: notify actions + LLM-backed rule suggestion (tracks θ + η)

[chenliuyun]

Summary

• Track θ — NotifyAction: New type: notify action in the rules engine lets rules POST to webhooks, append to files, or push to OpenClaw after firing. Adds discriminated union types, executor, audit rule-notify kind, JSON schema notifyAction definition, lintRules URL/field validation, rule_notifications MCP tool, and doctor notify-connectivity check.

• Track η — LLM-backed suggestion: rules suggest and rules_suggest MCP tool gain an optional --llm flag. Simple intents use the existing heuristic; complex intents (score ≥ 4) are routed to OpenAI or Anthropic. Auto mode falls back to heuristic with a warning on provider failure. All LLM calls are written to the audit log.

Follow-up fixes (556e2ac)

Four regressions caught in review, fixed before merge:

• [P1] notify dry-run bypass — executeNotifyAction now receives globalDryRun from the engine and skips all side effects (webhook POST / file write) when either --dry-run or dry_run: true is set; audit entry is still written with dryRun: true.
• [P1] CLI --llm not wired — rules suggest was calling suggestRule without forwarding the --llm option; the option is now declared and passed through.
• [P1] MCP rules_suggest missing llm — inputSchema and handler both lacked the llm field, making the LLM path unreachable from agents; both are updated and the tool description corrected.
• [P3] rule_notifications total off — total was reporting bounded.length (post-limit count) instead of entries.length (full filtered count), breaking pagination semantics.

Follow-up fixes (ef0474a)

Three correctness issues caught in second review pass:

• [P2] LLM silently drops explicit overrides — trigger, event, schedule, days, webhookPath are now appended as explicit constraints in the LLM user message so the model cannot produce a conflicting rule structure.
• [P2] LLM output not validated before lintRules — added a structural guard checking the parsed YAML is a non-null object with when and then fields before passing to lintRules; malformed model output now surfaces a clean UsageError instead of an internal crash.
• [P2] Non-HTTP/HTTPS notify URLs silently downgraded — sendWebhook now rejects any URL whose protocol is not http: or https: with an explicit error, rather than treating it as plain HTTP.

Follow-up fixes — third review round (MVP A/B/C/D)

Seven additional fixes after a third pass through the diff. Split into four
self-contained MVPs so each can be reviewed and reverted independently.

MVP A — Contract guarantees (6b5ae1f)

• [P1] LLM dry_run was advisory. suggestRuleWithLlm now coerces every
  generated rule to dry_run: true regardless of what the model returned,
  with a warning on the result if the model proposed false or omitted it.
  This closes the path where a creative model could ship a live-arming
  suggestion past the audit guards.
• [P2] LLM ignored explicit caller overrides at the structure level. Even
  though the user message was hinting --trigger/--event/--schedule/
  --days/--webhook-path, nothing actually checked the model's output.
  Now: a mismatched --trigger raises UsageError (caller is right, model
  is wrong); within the same trigger, mismatched event/schedule/days/path
  are rewritten to the caller's value with a warning.
• [P2] rules lint accepted non-http(s) notify URLs. A to: ftp://...
  passed lint and only failed at runtime (or worse — silently fell through
  on file:// targets in the file-channel path). Lint now emits
  notify-unsupported-protocol for any scheme other than http: / https:,
  matching the runtime guard.

MVP B — UX defenses (86ed243)

• [P2] --llm had no enum validation in the CLI. Any string fell through
  and produced confusing downstream errors. Now rules suggest --llm garbage
  exits with a clear UsageError (exit 2). MCP rules_suggest already
  enforced this via Zod.
• [P3] --llm auto silently used the heuristic for low-complexity
  intents. Callers couldn't tell whether the LLM was actually invoked. The
  result now carries an explicit warning (intent complexity below LLM threshold; used heuristic. Pass --llm openai|anthropic to force LLM.)
  when this happens.

MVP C — Observability & defense in depth (065e8da)

• [P3] LLM audit always recorded result: 'ok'. The audit row was
  written immediately after provider.generateYaml, before any
  parse/validate/lint step that could reject the suggestion. Audit is now
  deferred until the final outcome, with result: 'error' and the message
  captured when the pipeline rejects.
• [P3] No structural validation of LLM output. Defects that bypassed
  lintRules (wrong types, missing required fields, unknown enum values)
  could surface as crashes deeper in the pipeline. Generated rules are now
  wrapped into a synthetic v0.2 policy and run through validateLoadedPolicy
  (the same Ajv schema validator as policy validate) before lint.

MVP D — Documentation (10bc49a)

• README rules suggest section now spells out the four guardrails:
  forced dry_run, hard alignment with explicit overrides, CLI --llm
  enum validation, and the http(s)-only notify URL rule.
• Notify channel section explicitly calls out the protocol restriction.

Test plan

• npx tsc --noEmit — 0 errors
• npx vitest run — 2105 tests, 0 failures (baseline 2096 + 9 new)
• rules lint on notify actions validates URL, required to field, and rejects non-http(s) protocols
• Engine dispatches type: notify actions to executeNotifyAction
• notify actions are skipped (no webhook/file side effects) under --dry-run
• rule_notifications MCP tool returns only rule-notify audit entries
• rule_notifications total reflects filtered count, not page count
• doctor --section notify-connectivity skips when no webhook notify actions exist
• LLM mock tests cover: direct backend, auto→LLM, auto→heuristic, auto→LLM-failure-fallback
• rules suggest --llm auto reaches the LLM path via CLI
• rules_suggest MCP tool accepts and forwards the llm field
• rules suggest --llm auto --trigger cron --schedule "0 22 * * *" — constraint forwarded to model
• malformed LLM output (null / array / plain text) raises UsageError, not crash
• notify URL with ftp:// protocol rejected at lint and at send time
• LLM dry_run: false is coerced to true with a warning
• --trigger mismatch raises UsageError; --event/--schedule/--days/--webhook-path mismatches rewrite with warning
• --llm garbage exits 2 with a clear message
• --llm auto on a simple intent emits a heuristic-fallback warning
• LLM audit row records result: 'error' and the error string when the pipeline rejects
• LLM rule that fails Ajv schema raises UsageError (caught before lint)