update ai docs

apps/ai-bot/README.md

@@ -36,6 +36,7 @@ apps/ai-bot/
 ├── xai.go          # chat/completions client + retry (F6)
 ├── store.go        # SQLite: spend ledger, txn dedup, encrypted-warned set
 ├── messages.go     # bot-authored RU notices
+├── markdown.go     # markdown → org.matrix.custom.html for the reply's formatted_body
 ├── util.go         # bounded dedup set
 ├── prompts/system_ru.txt
 ├── Dockerfile      # CGO-free static build → distroless, EXPOSE 8009
@@ -139,14 +140,16 @@ Compile-level + unit-tested locally:
   200/404); mention detection (m.mentions, empty-`{}` F29, no-body-fallback F30,
   pill, reply-to-bot); DM classification (invited+joined==2, F3: 2 joined + 1
   invited is **not** a 1:1); group-vs-DM context minimisation (groups never leak
-  third-party content); USD pricing.
+  third-party content); USD pricing; **markdown → HTML rendering** (escaping,
+  safe-URL allowlist, false-positive guards, oversize/adversarial fallbacks).
 - ✅ `check-config` reads env + loads the system prompt.
 
 Deferred to a live homeserver + xAI key + a loaded registration (runtime ✔):
 
 - Synapse pushes transactions → bot replies (`authenticated as @ai:vojo.chat` in logs);
 - invite from `:vojo.chat` → join, foreign-server invite → leave (F11);
-- `@`-mention / 1:1 message → `m.notice` reply with reply (and thread, F27) relation;
+- `@`-mention / 1:1 message → `m.notice` reply with reply (and thread, F27) relation,
+  carrying a `formatted_body` (org.matrix.custom.html) when the answer has markdown;
 - encrypted room → exactly one notice, **not** repeated after restart (F5);
 - per-user cap → silent drop; global USD ceiling → one notice/room/day;
 - a retried transaction (lost 200) is processed at most once (txn dedup).

docs/ai/server-side.md

@@ -130,7 +130,7 @@ in doubt.
 | `telegram-bridge` | `dock.mau.dev/mautrix/telegram:<v26.04 bridgev2 tag>` | `./bridges/telegram:/data` |
 | `discord-bridge` | `dock.mau.dev/mautrix/discord:v0.7.5` | `./bridges/discord:/data` (legacy bridge — runtime reports `0.7.6+dev`) |
 | `whatsapp-bridge` | `dock.mau.dev/mautrix/whatsapp:v0.12.4` | `./bridges/whatsapp:/data` |
-| `ai-bot` | `ai-bot:custom` (built locally from [`apps/ai-bot/`](../../apps/ai-bot/), shipped via `docker save \| ssh docker load` — VS Code task **Deploy AI bot**) | **Vojo AI** = `@ai:vojo.chat`, an xAI-Grok-backed **application service** (NOT a normal bot user). Answers `@`-mentions in groups + everything in 1:1s. Mounts `./ai-bot:/data` (owned **uid 65532**, distroless nonroot) holding `registration.yaml` (self-generated, `generate-registration`), `state/` (SQLite spend ledger + txn dedup) and `secrets/xai_api_key`. Push port `:8009` (registration `url: http://ai-bot:8009`). Secrets via env/`*_FILE`; `as_token`/`hs_token` read from `registration.yaml` (no rotation). See [`apps/ai-bot/README.md`](../../apps/ai-bot/README.md). |
+| `ai-bot` | `ai-bot:custom` (built locally from [`apps/ai-bot/`](../../apps/ai-bot/), shipped via `docker save \| ssh docker load` — VS Code task **Deploy AI bot**) | **Vojo AI** = `@ai:vojo.chat`, an xAI-Grok-backed **application service** (NOT a normal bot user). Answers `@`-mentions in groups + everything in 1:1s; the Grok reply (markdown) is rendered to `org.matrix.custom.html` and sent as `formatted_body` (in-bot `markdown.go`, zero deps; emits only tags Cinny's sanitizer keeps, escapes all model text), falling back to the plain `body` when there's no formatting. Mounts `./ai-bot:/data` (owned **uid 65532**, distroless nonroot) holding `registration.yaml` (self-generated, `generate-registration`), `state/` (SQLite spend ledger + txn dedup) and `secrets/xai_api_key`. Push port `:8009` (registration `url: http://ai-bot:8009`). Secrets via env/`*_FILE`; `as_token`/`hs_token` read from `registration.yaml` (no rotation). See [`apps/ai-bot/README.md`](../../apps/ai-bot/README.md). |
 
 ### Bridge service stanza (template)