a surface can ask Nexus for the id behind a name (V-511)

blocked_on stores a canonical entity id, so the form that fills it needs a way
to turn "Kate" into one. ipc.ResolveEntity is that seam: the store adapter
refuses it, because identity is not the store's to answer, and the daemon
overrides it with the Nexus client the voice path already holds.

Three outcomes are kept apart, because a caller deciding whether to store an
id has to tell them apart. No nexus block is ErrNotImplemented. A miss is
ErrNoEntity. Several matches come back Ambiguous with the names, and the
caller asks — picking one is how a task ends up blocked on the wrong person
with nobody able to see it happened.

An outage stays the transport error. "There is no such person" and "Nexus is
down" must not read the same.

cmd/mavend/main.go

@@ -341,6 +341,7 @@ func run(args []string) error {
 			getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
 			getEvents:        intakeEventsFn(evBus),
 			seedStore:        seedStoreIfAllowed(st),
+			nexus:            nexusOf(voiceW),
 		}
 		if voiceW != nil && voiceW.handler != nil {
 			api := coreAPI.(*daemonAPI)

cmd/mavend/tick_api.go

@@ -23,6 +23,11 @@ type daemonAPI struct {
 	chatFn           func(ctx context.Context, conversation, text string) string
 	getMCPServers    func() []ipc.MCPServerStatus
 	getEvents        func(n int) []ipc.IntakeEvent
+	// nexus — the identity client, nil when no nexus block is configured. It
+	// is what makes ResolveEntity answerable at all; without it the store
+	// adapter's refusal stands, and a surface that wanted an entity id says so
+	// instead of storing a name.
+	nexus *nexusClient
 	// seedStore — non-nil ONLY when mavend was started with -allow-seed. It is
 	// the whole off-switch for the backdated write path (Vikunja #518), and it
 	// is a store rather than a bool so that leaving the flag off means the
@@ -41,6 +46,48 @@ func (d *daemonAPI) RecentEvents(ctx context.Context, n int) ([]ipc.IntakeEvent,
 	return d.getEvents(n), nil
 }
 
+// nexusOf — the identity client the voice wiring built, or nil. Same shape as
+// embedderOf: a wiring that is absent and a wiring with no nexus block are one
+// answer here.
+func nexusOf(w *voiceWiring) *nexusClient {
+	if w == nil || w.handler == nil || w.handler.ecosystem == nil {
+		return nil
+	}
+	return w.handler.ecosystem.nexus
+}
+
+// ResolveEntity asks Nexus for the canonical id behind a name (Vikunja #511).
+//
+// Three outcomes, kept apart on purpose. No nexus block is ErrNotImplemented,
+// so a surface can say "identity is not configured here" rather than invent an
+// id. A miss is ipc.ErrNoEntity. A match against several entities comes back
+// Ambiguous with the names, because picking one is how a task ends up blocked
+// on the wrong person and nobody can see it happened.
+func (d *daemonAPI) ResolveEntity(ctx context.Context, query string, types []string) (ipc.EntityRef, error) {
+	if d.nexus == nil {
+		return ipc.EntityRef{}, ipc.ErrNotImplemented
+	}
+	res, err := d.nexus.Resolve(ctx, query, types)
+	if err != nil {
+		return ipc.EntityRef{}, err
+	}
+	if len(res.Candidates) > 1 {
+		names := make([]string, 0, len(res.Candidates))
+		for _, c := range res.Candidates {
+			names = append(names, c.DisplayName)
+		}
+		return ipc.EntityRef{Ambiguous: true, Candidates: names}, nil
+	}
+	if res.Entity == nil || res.Entity.ID == "" {
+		return ipc.EntityRef{}, ipc.ErrNoEntity
+	}
+	return ipc.EntityRef{
+		ID:          res.Entity.ID,
+		Type:        res.Entity.Type,
+		DisplayName: res.Entity.DisplayName,
+	}, nil
+}
+
 // Chat runs one text turn and reports which query source claimed it. The sink
 // rides the context so handleText keeps the one string signature the mic,
 // telegram and the web all call it through (V-539).