docs(#744): add Tess API and operations guides

docs/tess/ADMIN-GUIDE.md

@@ -0,0 +1,3 @@
+# Tess Administration
+
+Provision authenticated users, configured agent identities, providers, and approved channel bindings. Never expose service credentials in status or logs. Use health/readiness and provider status endpoints for recovery diagnostics; privileged termination remains approval-bound and auditable.

docs/tess/DEVELOPER-GUIDE.md

@@ -0,0 +1,3 @@
+# Tess Developer Guide
+
+Interaction adapters pass only server-derived actor/tenant scope, channel, and correlation to runtime providers. Durable session state owns inbox/outbox/checkpoint recovery. Use the OpenAPI contract rather than inventing routes; unsupported provider capabilities fail closed.

docs/tess/M5-003-DOCUMENTATION-CHECKLIST.md

@@ -0,0 +1,8 @@
+# TESS-M5-003 Documentation Checklist
+
+- [x] `openapi-tess.yaml`: authenticated interaction endpoints, Mos handoff/observe/result, memory search.
+- [x] User guide: authorized session and handoff workflows.
+- [x] Admin guide: provisioning, policy, health, and approval boundary.
+- [x] Developer guide: scope, durable state, and provider adapter contract.
+- [x] Plugin guide: replaceable-adapter, redaction, and identity-as-data rules.
+- [x] Operations guide: readiness, recovery, ambiguous-effect safety, and tracing.

docs/tess/OPERATIONS-GUIDE.md

@@ -0,0 +1,3 @@
+# Tess Operations and Recovery
+
+Check `/health/ready`, provider health, and effective policy before recovery. Recover durable sessions through the interaction recovery operation; it requeues only interrupted work and does not replay ambiguous external effects. Preserve correlation IDs for incident tracing and use Mos handoff observation/result endpoints for orchestration visibility.

docs/tess/PLUGIN-GUIDE.md

@@ -0,0 +1,3 @@
+# Tess Plugin Authoring
+
+Plugins are replaceable adapters. Declare capabilities, derive scope from trusted context, preserve correlation IDs, redact before persistence/egress, and return unsupported operations as fail-closed results. Names and identities are configuration data, not literals in keys or defaults.

docs/tess/USER-GUIDE.md

@@ -0,0 +1,3 @@
+# Tess User Guide
+
+Use authenticated interaction endpoints with an `X-Correlation-Id`. List sessions, attach, send, and recover only sessions visible to your server-derived tenant scope. Stop requires a durable exact-action approval. Mos handoffs are submitted through `/api/coord/mos/handoff` and can be observed or read by receipt ID.