@cgh567/agent 2.4.3 → 2.4.5

package/daemon/routes/dept.js

@@ -149,7 +149,16 @@ module.exports = function createDeptRoute({ mgQuery, broadcast, semanticUpdater
            pcp.rationale    = $rationale,
            pcp.status       = 'pending',
            pcp.updatedAt    = datetime()`,
-        { proposalId, cid, pillarId, dept, section, proposedChange: String(proposedChange), rationale: rationale ? String(rationale) : '', authorId }
+         { proposalId, cid, pillarId, dept, section, proposedChange: String(proposedChange), rationale: rationale ? String(rationale) : '', authorId }
+      );
+
+      // P1-C: Create Approval node for plan_change_review so it surfaces in GET /api/hbo/approvals
+      await mgQuery(
+        `MERGE (a:Approval {id: $approvalId})
+         ON CREATE SET a.type = 'plan_change_review', a.companyId = $cid, a.status = 'pending',
+                       a.proposalId = $proposalId, a.createdAt = datetime()
+         ON MATCH SET  a.status = 'pending', a.proposalId = $proposalId`,
+        { approvalId: `approval:pcp:${proposalId}`, proposalId, cid }
       );
 
       // Respond immediately — LLM analysis is async

package/daemon/routes/email-triage.js

@@ -16,14 +16,16 @@ const { spawn } = require('child_process');
 const path = require('path');
 
 const HOME = homedir();
-const TRIAGE_DATA = join(HOME, 'helios-agent', 'data', 'email-triage');
+const HELIOS_ROOT = process.env.HELIOS_ROOT
+  || join(HOME, 'Desktop', 'Helios', 'helios-agent-main');
+const TRIAGE_DATA = join(HELIOS_ROOT, 'data', 'email-triage');
 const BRIEFING_PATH = join(TRIAGE_DATA, 'latest-briefing.json');
 const INBOX_PATH = join(TRIAGE_DATA, 'latest-inbox.json');
 const DRAFTS_PATH = join(TRIAGE_DATA, 'drafted-responses.json');
-const DASHBOARD_PATH = join(HOME, 'helios-agent', 'daemon', 'triage', 'dashboard.html');
+const DASHBOARD_PATH = join(HELIOS_ROOT, 'daemon', 'triage', 'dashboard.html');
 
 // ─── Backfill Process Mutex (PID file) ──────────────────────────────────────
-const BACKFILL_PID_FILE = path.join(HOME, 'helios-agent', 'data', 'backfill.pid');
+const BACKFILL_PID_FILE = path.join(HELIOS_ROOT, 'data', 'backfill.pid');
 
 function isBackfillRunning() {
   try {
@@ -64,14 +66,14 @@ function jsonResponse(res, status, data) {
  */
 async function regenerateDashboard() {
   return new Promise((resolve) => {
-    const updaterPath = join(HOME, 'helios-agent', 'scripts', 'update-dashboard.js');
+    const updaterPath = join(HELIOS_ROOT, 'scripts', 'update-dashboard.js');
     if (!existsSync(updaterPath)) {
       console.warn('[email-triage] update-dashboard.js not found — skipping regen');
       resolve();
       return;
     }
     const child = spawn(process.execPath, [updaterPath], {
-      cwd: join(HOME, 'helios-agent'),
+      cwd: HELIOS_ROOT,
       env: { ...process.env },
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: true,
@@ -237,6 +239,7 @@ module.exports = function emailTriageRoute({ broadcast } = {}) {
       // Parse optional body for config
       let since = '30d';
       let limit = 100;
+      let account = null;
       try {
         const chunks = [];
         await new Promise((resolve, reject) => {
@@ -247,6 +250,7 @@ module.exports = function emailTriageRoute({ broadcast } = {}) {
         const body = chunks.length > 0 ? JSON.parse(Buffer.concat(chunks).toString()) : {};
         if (body.since) since = body.since;
         if (body.limit) limit = parseInt(body.limit, 10) || 100;
+        if (body.account) account = body.account;
       } catch (_) { /* use defaults */ }
 
       // Set up SSE headers
@@ -268,10 +272,12 @@ module.exports = function emailTriageRoute({ broadcast } = {}) {
 
       // Resolve the backfill script — prefer run-backfill-30d.ts (full triage + drafts)
       const scriptCandidates = [
-        join(HOME, 'helios-agent', 'run-backfill-30d.ts'),        // W1-3: correct script (full 5-phase email triage + drafts)
-        join(HOME, 'helios-agent', 'run-triage-backfill.ts'),     // legacy name (does not exist, kept as fallback)
-        join(HOME, 'helios-agent', 'extensions', 'email', 'backfill.ts'), // graph ingestion only
-        join(HOME, 'helios-agent', 'scripts', 'run-backfill.ts'), // full graph backfill (wrong for email triage)
+        process.env.HELIOS_ROOT
+          ? join(process.env.HELIOS_ROOT, 'run-backfill-30d.ts')
+          : join(HOME, 'Desktop', 'Helios', 'helios-agent-main', 'run-backfill-30d.ts'),  // W1-3: correct script (full 5-phase email triage + drafts)
+        join(HELIOS_ROOT, 'run-triage-backfill.ts'),     // legacy name (does not exist, kept as fallback)
+        join(HELIOS_ROOT, 'extensions', 'email', 'backfill.ts'), // graph ingestion only
+        join(HELIOS_ROOT, 'scripts', 'run-backfill.ts'), // full graph backfill (wrong for email triage)
       ];
 
       const scriptPath = scriptCandidates.find(p => existsSync(p));
@@ -293,17 +299,20 @@ module.exports = function emailTriageRoute({ broadcast } = {}) {
       }
 
       const args = [scriptPath, '--since', sinceDate, '--limit', limit];
+      if (account) args.push('--account', account);
       sendSSE({ phase: 1, message: `Running: npx tsx ${path.basename(scriptPath)} --since ${sinceDate} --limit ${limit}` });
 
       let child;
       try {
         // C6: use npx.cmd on Windows so spawn finds the correct executable
+        // shell:true required on Windows for .cmd files (EINVAL without it)
         const npxBin = process.platform === 'win32' ? 'npx.cmd' : 'npx';
         child = spawn(npxBin, ['tsx', ...args], {
-          cwd: join(HOME, 'helios-agent'),
+          cwd: HELIOS_ROOT,
           env: { ...process.env, HELIOS_SKIP_INTERNAL_DASHBOARD_REGEN: '1' },
           stdio: ['ignore', 'pipe', 'pipe'],
           windowsHide: true,
+          shell: process.platform === 'win32',
         });
       } catch (spawnErr) {
         sendSSE({ phase: -1, message: `Spawn error: ${spawnErr.message}`, error: true, done: true });

package/daemon/routes/hbo.js

@@ -580,7 +580,14 @@ async function handleCreateBusinessGoal(req, res, ctx) {
     } catch (storeErr) {
       process.stderr.write(`[hbo] goal mirror failed: ${storeErr.message}\n`);
     }
-    try { ctx._bc?.({ type: 'goal.created', companyId: cid, goalId }); } catch (_) {}
+    try { ctx._bc?.({ type: 'goal.created', companyId: cid, goalId }); } catch (_) {}
+    // Fire-and-forget: trigger tickGoalDecompose so the Harada cascade begins immediately
+    // (normally runs every 5th tick = up to 150s; injected hook shortens this to ~0ms).
+    if (_triggerGoalDecompose) {
+      setImmediate(() => {
+        try { _triggerGoalDecompose(cid); } catch (_tgdErr) {}
+      });
+    }
     jsonOk(res, { goal: { id: goalId, companyId: cid, title, description, level, status: 'active', parentId } }, 201);
   } catch (e) {
     jsonErr(res, 500, `Create BusinessGoal failed: ${safeErrMsg(e)}`);
@@ -629,7 +636,7 @@ async function handleUpdateBusinessGoal(req, res, ctx, goalId) {
     // H-3 fix: only pass fields that were explicitly provided in the PATCH body to updateGoal.
     // rowToObj fills missing Memgraph fields with null — passing null for e.g. title would
     // overwrite the existing SQLite title with null on a status-only update.
-    const storeUpdate: Record<string, any> = { id: goalId };
+    const storeUpdate = { id: goalId };
     if (title !== null) storeUpdate.title = goal.title;
     if (description !== null) storeUpdate.description = goal.description;
     if (level !== null) storeUpdate.level = goal.level;
@@ -2355,9 +2362,11 @@ async function handleGetHboApprovals(req, res, ctx) {
     const type   = url.searchParams.get('type')   || null;
 
     // GP3-B2: expanded to include strategy_proposal and harada_strategy_review types
-    let cypher = `MATCH (a:Approval {companyId: $cid}) WHERE a.type IN ['question','send_approval','strategy_proposal','harada_strategy_review','approval','domain_purchase','sender_identity_config','dns_records_review','email_domain_setup','harada_l2_review','harada_l3_review','harada_question']`;
+    let cypher = `MATCH (a:Approval {companyId: $cid}) WHERE a.type IN ['question','send_approval','strategy_proposal','harada_strategy_review','approval','domain_purchase','sender_identity_config','dns_records_review','email_domain_setup','harada_l2_review','harada_l3_review','harada_question','plan_change_review']`;
     const params = { cid: ctx.cid };
-    if (status) { cypher += ' AND a.status = $status'; params.status = status; }
+    // F-03: 'pending' filter also includes 'revision_requested' so operators see revision_requested items in the Pending tab
+    if (status === 'pending') { cypher += " AND a.status IN ['pending', 'revision_requested']"; }
+    else if (status) { cypher += ' AND a.status = $status'; params.status = status; }
     if (type)   { cypher += ' AND a.type = $type';     params.type = type; }
     cypher += ' RETURN a ORDER BY a.createdAt DESC LIMIT toInteger(50)';
 
@@ -2384,6 +2393,8 @@ async function handleGetHboApprovals(req, res, ctx) {
         department: p?.department ?? null,
         templateKey: p?.templateKey ?? null,
         inferredAnswer: p?.inferredAnswer ?? null,
+        decisionNote: p?.decisionNote ?? null,
+        followUpTaskId: p?.followUpTaskId ?? null,
       };
     });
     jsonOk(res, { approvals, count: approvals.length });
@@ -2392,6 +2403,28 @@ async function handleGetHboApprovals(req, res, ctx) {
   }
 }
 
+// P9A: GET /api/hbo/blocked-work — tasks stopped due to a blocker
+async function handleGetBlockedWork(req, res, ctx) {
+  try {
+    if (!ctx.mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+    const url = new URL(req.url, 'http://localhost');
+    const cid = ctx.cid || url.searchParams.get('companyId') || url.searchParams.get('cid') || '';
+    const r = await ctx.mgQuery(
+      `MATCH (t:Task) WHERE t.blockedReason IS NOT NULL AND t.status = 'blocked' AND t.companyId = $cid
+       RETURN t.id AS id, t.title AS title, t.blockedReason AS blockedReason, t.blockedAt AS blockedAt
+       ORDER BY t.blockedAt DESC`,
+      { cid }
+    ).catch(() => null);
+    const blockedWork = (r?.rows ?? []).map(row => {
+      if (Array.isArray(row)) return { id: row[0], title: row[1], blockedReason: row[2], blockedAt: row[3] };
+      return { id: row['id'], title: row['title'], blockedReason: row['blockedReason'], blockedAt: row['blockedAt'] };
+    });
+    jsonOk(res, { blockedWork, count: blockedWork.length });
+  } catch (e) {
+    jsonErr(res, 500, `Get blocked-work failed: ${safeErrMsg(e)}`);
+  }
+}
+
 async function handleHboLaunch(req, res, ctx) {
   const { mgQuery } = ctx;
   if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
@@ -2900,9 +2933,90 @@ async function handleGetCommandCenter(req, res, ctx) {
   }
 }
 
+// ── G-01: Budget Policy CRUD Handlers ────────────────────────────────────────
+
+async function handleCreateBudgetPolicy(req, res, ctx) {
+  try {
+    if (!ctx.mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+    const body = await readBody(req);
+    if (!assertValidBody(body, res)) return;
+    const { agentId, limitUSD, period, companyId: bodyCompanyId, id: clientId } = body || {};
+    if (!agentId || limitUSD === undefined || !period) {
+      jsonErr(res, 400, 'agentId, limitUSD, and period are required'); return;
+    }
+    // Use client-supplied id (from SQLite saved record) so delete path matches; fall back to generated key.
+    const cid = bodyCompanyId || ctx.cid;
+    const id = clientId || `bp:${cid}:${agentId}:${Date.now()}`;
+    await ctx.mgQuery(
+      `MERGE (bp:BudgetPolicy {id: $id})
+       ON CREATE SET bp.companyId = $cid, bp.agentId = $agentId,
+                     bp.limitUSD = $limitUSD, bp.period = $period,
+                     bp.limitCents = toInteger($limitUSD * 100),
+                     bp.spentCents = 0, bp.createdAt = datetime()
+       ON MATCH  SET bp.limitUSD = $limitUSD, bp.period = $period,
+                     bp.limitCents = toInteger($limitUSD * 100)`,
+      { id, cid, agentId: String(agentId), limitUSD: Number(limitUSD), period: String(period) }
+    );
+    jsonOk(res, { policy: { id, agentId, limitUSD: Number(limitUSD), period } });
+  } catch (e) { jsonErr(res, 500, `Create budget policy failed: ${safeErrMsg(e)}`); }
+}
+
+async function handleUpdateBudgetPolicy(req, res, ctx, policyId) {
+  try {
+    if (!ctx.mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+    if (!policyId) { jsonErr(res, 400, 'Missing policy ID'); return; }
+    const body = await readBody(req);
+    if (!assertValidBody(body, res)) return;
+    const setClauses = [];
+    const params = { id: policyId, cid: ctx.cid };
+    if (body.limitUSD !== undefined) { setClauses.push('bp.limitUSD = $limitUSD, bp.limitCents = toInteger($limitUSD * 100)'); params.limitUSD = Number(body.limitUSD); }
+    if (body.period !== undefined)   { setClauses.push('bp.period = $period'); params.period = String(body.period); }
+    if (body.agentId !== undefined)  { setClauses.push('bp.agentId = $agentId'); params.agentId = String(body.agentId); }
+    if (setClauses.length === 0) { jsonErr(res, 400, 'No fields to update'); return; }
+    const r = await ctx.mgQuery(
+      `MATCH (bp:BudgetPolicy {id: $id, companyId: $cid}) SET ${setClauses.join(', ')}, bp.updatedAt = datetime() RETURN bp.id`,
+      params
+    );
+    if (!(r?.rows?.length)) { jsonErr(res, 404, `Budget policy not found: ${policyId}`); return; }
+    jsonOk(res, { updated: true, policyId });
+  } catch (e) { jsonErr(res, 500, `Update budget policy failed: ${safeErrMsg(e)}`); }
+}
+
+async function handleDeleteBudgetPolicy(req, res, ctx, policyId) {
+  try {
+    if (!ctx.mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+    if (!policyId) { jsonErr(res, 400, 'Missing policy ID'); return; }
+    await ctx.mgQuery(
+      `MATCH (bp:BudgetPolicy {id: $id, companyId: $cid}) DETACH DELETE bp`,
+      { id: policyId, cid: ctx.cid }
+    );
+    jsonOk(res, { deleted: true, policyId });
+  } catch (e) { jsonErr(res, 500, `Delete budget policy failed: ${safeErrMsg(e)}`); }
+}
+
+async function handleGetBudgetIncidents(req, res, ctx) {
+  try {
+    if (!ctx.mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+    const r = await ctx.mgQuery(
+      `MATCH (bi:BudgetIncident {companyId: $cid}) RETURN bi ORDER BY bi.createdAt DESC LIMIT 50`,
+      { cid: ctx.cid }
+    ).catch(() => null);
+    const incidents = (r?.rows ?? []).map(row => {
+      const node = Array.isArray(row) ? row[0] : (row['bi'] || row);
+      const p = node?.properties || node;
+      return { id: p?.id, agentId: p?.agentId, limitUSD: p?.limitUSD, spentUSD: p?.spentUSD,
+               period: p?.period, resolvedAt: p?.resolvedAt ?? null, createdAt: p?.createdAt ?? null };
+    });
+    jsonOk(res, { incidents, count: incidents.length });
+  } catch (e) { jsonErr(res, 500, `Get budget incidents failed: ${safeErrMsg(e)}`); }
+}
+
 module.exports = function createHBORouter(handlers) {
-  const { broadcast, mgQuery: _mgQueryInit } = handlers || {};
+  const { broadcast, mgQuery: _mgQueryInit, triggerGoalDecompose } = handlers || {};
   const _bc = typeof broadcast === 'function' ? broadcast : () => {};
+  // Optional hook: after a BusinessGoal is created, caller can fire-and-forget tickGoalDecompose
+  // so the Harada cascade starts on the next event-loop tick rather than waiting up to 150s.
+  const _triggerGoalDecompose = typeof triggerGoalDecompose === 'function' ? triggerGoalDecompose : null;
   return async function hboRoute(req, res, ctx, pathname, method) {
     // R3-C10: Set module-level request reference so jsonOk/jsonErr can include CORS headers
     // at all 155 call sites without requiring changes to each handler.
@@ -2997,12 +3111,110 @@ module.exports = function createHBORouter(handlers) {
       return true;
     }
 
+    // P8A-03: GET /api/hbo/tasks/:id — full task detail including originKind, approvalId, etc.
+    // Must be matched BEFORE the PATCH /:id pattern below.
+    const taskGetMatch = pathname.match(/^\/api\/hbo\/tasks\/([^/]+)$/);
+    if (method === 'GET' && taskGetMatch) {
+      const taskId = decodeURIComponent(taskGetMatch[1]);
+      const { mgQuery, cid } = ctx;
+      // E2 fix: prefer ?companyId query param so multi-company operator's active company
+      // is used. Fall back to ctx.cid (session default) for single-company deployments.
+      // Note: raw Node.js http.IncomingMessage has no .query property — must use URL.searchParams.
+      const queryCid = new URL(req.url, 'http://localhost').searchParams.get('companyId') || cid;
+      if (!mgQuery) {
+        // SQL parity: fall back to SQLite when Memgraph unavailable
+        try {
+          const hboStore = require('../../lib/hbo-core-store');
+          const t = hboStore.getTask ? hboStore.getTask(taskId, queryCid) : null;
+          if (!t) { jsonErr(res, 404, 'Task not found'); return true; }
+          jsonOk(res, { task: t, _source: 'sqlite' });
+        } catch (storeErr) {
+          jsonErr(res, 503, `Task unavailable: Memgraph not connected`);
+        }
+        return true;
+      }
+      try {
+        // Return full node — includes all properties: originKind, approvalId, pillarId,
+        // executionStateJson, executionPolicyJson, workspacePath, etc.
+        const result = await mgQuery('MATCH (t:Task {id: $id, companyId: $cid}) RETURN t', { id: taskId, cid: queryCid });
+        if (result.rows && result.rows.length > 0) {
+          const t = result.rows[0][0].properties || result.rows[0][0];
+          jsonOk(res, { task: t });
+        } else {
+          jsonErr(res, 404, 'Task not found');
+        }
+      } catch (e) {
+        jsonErr(res, 500, `Task query failed: ${safeErrMsg(e)}`);
+      }
+      return true;
+    }
+
     // POST /api/hbo/tasks
     if (method === 'POST' && pathname === '/api/hbo/tasks') {
       await handleCreateBusinessTask(req, res, ctx);
       return true;
     }
 
+    // POST /api/hbo/tasks/:id/interpretation/refresh — P_EXPLAIN-04
+    const taskInterpRefreshMatch = pathname.match(/^\/api\/hbo\/tasks\/([^/]+)\/interpretation\/refresh$/);
+    if (method === 'POST' && taskInterpRefreshMatch) {
+      const taskId = decodeURIComponent(taskInterpRefreshMatch[1]);
+      const { mgQuery } = ctx;
+      if (!mgQuery) { jsonResponse(res, 503, { error: 'Memgraph not connected' }); return true; }
+      const cid = ctx.cid;
+      try {
+        const { createInterpretationExplanation } = require('../lib/interpretation-engine.js');
+        const { rawWrite: _interpRw } = require('../lib/safe-memgraph.js');
+        await createInterpretationExplanation(taskId, cid, _interpRw);
+        jsonResponse(res, 200, { ok: true, taskId });
+      } catch (err) {
+        jsonResponse(res, 500, { error: `Interpretation refresh failed: ${err.message}` });
+      }
+      return true;
+    }
+
+    // E-02: GET /api/hbo/tasks/:taskId/enrichment — hill chart position + recent PDSA cycles
+    // Returns hillChart: { id, position, phase, updatedAt } | null
+    //         pdsaCycles: [...] (up to 5 most recent, ordered by createdAt DESC)
+    const taskEnrichmentMatch = pathname.match(/^\/api\/hbo\/tasks\/([^/]+)\/enrichment$/);
+    if (method === 'GET' && taskEnrichmentMatch) {
+      const taskId = decodeURIComponent(taskEnrichmentMatch[1]);
+      const { mgQuery, cid } = ctx;
+      const queryCid = new URL(req.url, 'http://localhost').searchParams.get('companyId') || cid;
+      if (!mgQuery) {
+        jsonResponse(res, 503, { error: 'Memgraph not connected' });
+        return true;
+      }
+      try {
+        const [hillResult, pdsaResult] = await Promise.all([
+          mgQuery(
+            `MATCH (t:Task {id: $taskId, companyId: $cid})
+             OPTIONAL MATCH (t)-[:HAS_HILL_CHART]->(h:HillChart)
+             RETURN h`,
+            { taskId, cid: queryCid }
+          ),
+          mgQuery(
+            `MATCH (t:Task {id: $taskId, companyId: $cid})
+             OPTIONAL MATCH (t)-[:HAS_PDSA]->(p:PDSACycle)
+             RETURN p ORDER BY p.createdAt DESC LIMIT 5`,
+            { taskId, cid: queryCid }
+          ),
+        ]);
+        const hRow = hillResult.rows && hillResult.rows[0] ? hillResult.rows[0][0] : null;
+        const hillChart = hRow
+          ? (hRow.properties ?? hRow)
+          : null;
+        const pdsaCycles = (pdsaResult.rows || [])
+          .map((r) => r[0])
+          .filter(Boolean)
+          .map((p) => p.properties ?? p);
+        jsonOk(res, { hillChart, pdsaCycles });
+      } catch (e) {
+        jsonErr(res, 500, `Enrichment query failed: ${safeErrMsg(e)}`);
+      }
+      return true;
+    }
+
     // PATCH /api/hbo/tasks/:id
     const taskPatchMatch = pathname.match(/^\/api\/hbo\/tasks\/(.+)$/);
     if (method === 'PATCH' && taskPatchMatch) {
@@ -3102,6 +3314,127 @@ module.exports = function createHBORouter(handlers) {
       return true;
     }
 
+    // ── T3-01: POST /api/hbo/pillar/:id/l2content — L2 research agent submits strategy ──────
+    const pillarL2ContentMatch = pathname.match(/^\/api\/hbo\/pillar\/([^/]+)\/l2content$/);
+    if (method === 'POST' && pillarL2ContentMatch) {
+      const pillarId = decodeURIComponent(pillarL2ContentMatch[1]);
+      const cid = ctx.cid;
+      const mgQuery = ctx.mgQuery;
+      if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return true; }
+      try {
+        const body = await readBody(req);
+        if (!assertValidBody(body, res)) return true;
+        const { l2Strategy, l2Content } = body || {};
+        if (!l2Strategy && !l2Content) { jsonErr(res, 400, 'l2Strategy or l2Content required'); return true; }
+        const r = await mgQuery(
+          `MATCH (gp:GoalPillar {id: $pillarId, companyId: $cid})
+           SET gp.l2Strategy = COALESCE($l2Strategy, gp.l2Strategy),
+               gp.l2Content = COALESCE($l2Content, gp.l2Content),
+               gp.l2ReviewStatus = 'pending_review',
+               gp.updatedAt = datetime()
+           RETURN gp.id AS id`,
+          { pillarId, cid, l2Strategy: l2Strategy ? String(l2Strategy) : null, l2Content: l2Content ? String(l2Content) : null }
+        );
+        if (!parseRows(r).length) { jsonErr(res, 404, `GoalPillar ${pillarId} not found`); return true; }
+        jsonOk(res, { ok: true, pillarId, l2ReviewStatus: 'pending_review' });
+      } catch (e) { jsonErr(res, 500, `l2content submit failed: ${safeErrMsg(e)}`); }
+      return true;
+    }
+
+    // ── T3-02: POST /api/hbo/pillar/:id/l2review — CEO agent reviews L2 content ────────────
+    const pillarL2ReviewMatch = pathname.match(/^\/api\/hbo\/pillar\/([^/]+)\/l2review$/);
+    if (method === 'POST' && pillarL2ReviewMatch) {
+      const pillarId = decodeURIComponent(pillarL2ReviewMatch[1]);
+      const cid = ctx.cid;
+      const mgQuery = ctx.mgQuery;
+      if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return true; }
+      try {
+        const body = await readBody(req);
+        if (!assertValidBody(body, res)) return true;
+        const { verdict, reviewCritique, goalId, agentId } = body || {};
+        if (!verdict || !['pass', 'fail'].includes(verdict)) { jsonErr(res, 400, 'verdict must be "pass" or "fail"'); return true; }
+        if (verdict === 'pass') {
+          await mgQuery(
+            `MATCH (gp:GoalPillar {id: $pillarId, companyId: $cid})
+             SET gp.l2ReviewStatus = 'approved', gp.l2ReviewedAt = datetime()
+             RETURN gp.id`,
+            { pillarId, cid }
+          );
+          jsonOk(res, { ok: true, pillarId, verdict: 'pass' });
+        } else {
+          // FAIL: increment cycle count, re-dispatch L2 research with critique
+          const cycleResult = await mgQuery(
+            `MATCH (gp:GoalPillar {id: $pillarId, companyId: $cid})
+             SET gp.l2ReviewStatus = 'revision_needed',
+                 gp.l2ReviewCycles = COALESCE(toInteger(gp.l2ReviewCycles), 0) + 1
+             RETURN gp.l2ReviewCycles AS cycles, gp.goalId AS goalId`,
+            { pillarId, cid }
+          );
+          const cycleRow = parseRows(cycleResult)[0];
+          const resolvedGoalId = goalId || (cycleRow && (cycleRow['cycles'] !== undefined ? null : cycleRow['goalId'])) || null;
+          const cycles = cycleRow ? Number(cycleRow['cycles'] ?? 1) : 1;
+          if (cycles < 3 && resolvedGoalId && agentId) {
+            try {
+              const { CascadeResearchDispatcher } = require('../lib/harada/cascade-research-dispatcher');
+              const crd = new CascadeResearchDispatcher(mgQuery, cid);
+              await crd.dispatchL2Research(pillarId, resolvedGoalId, cid, agentId, reviewCritique || '');
+            } catch (dispErr) {
+              process.stderr.write(`[hbo] l2review: re-dispatch failed: ${safeErrMsg(dispErr)}\n`);
+            }
+          }
+          jsonOk(res, { ok: true, pillarId, verdict: 'fail', cycles });
+        }
+      } catch (e) { jsonErr(res, 500, `l2review failed: ${safeErrMsg(e)}`); }
+      return true;
+    }
+
+    // ── T3-03: POST /api/hbo/action-cell/:id/l3content — L3 research agent submits ──────────
+    const cellL3ContentMatch = pathname.match(/^\/api\/hbo\/action-cell\/([^/]+)\/l3content$/);
+    if (method === 'POST' && cellL3ContentMatch) {
+      const cellId = decodeURIComponent(cellL3ContentMatch[1]);
+      const cid = ctx.cid;
+      const mgQuery = ctx.mgQuery;
+      if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return true; }
+      try {
+        const body = await readBody(req);
+        if (!assertValidBody(body, res)) return true;
+        const { l3Plan, l3Content } = body || {};
+        if (!l3Plan && !l3Content) { jsonErr(res, 400, 'l3Plan or l3Content required'); return true; }
+        const r = await mgQuery(
+          `MATCH (ac:ActionCell {id: $cellId, companyId: $cid})
+           SET ac.l3Plan = COALESCE($l3Plan, ac.l3Plan),
+               ac.l3Content = COALESCE($l3Content, ac.l3Content),
+               ac.l3ReviewStatus = 'pending_review',
+               ac.updatedAt = datetime()
+           RETURN ac.id AS id`,
+          { cellId, cid, l3Plan: l3Plan ? String(l3Plan) : null, l3Content: l3Content ? String(l3Content) : null }
+        );
+        if (!parseRows(r).length) { jsonErr(res, 404, `ActionCell ${cellId} not found`); return true; }
+        jsonOk(res, { ok: true, cellId, l3ReviewStatus: 'pending_review' });
+      } catch (e) { jsonErr(res, 500, `l3content submit failed: ${safeErrMsg(e)}`); }
+      return true;
+    }
+
+    // ── T3-03b: POST /api/hbo/action-cell/:id/l3review — dept head reviews L3 content ───────
+    const cellL3ReviewMatch = pathname.match(/^\/api\/hbo\/action-cell\/([^/]+)\/l3review$/);
+    if (method === 'POST' && cellL3ReviewMatch) {
+      const cellId = decodeURIComponent(cellL3ReviewMatch[1]);
+      const cid = ctx.cid;
+      const mgQuery = ctx.mgQuery;
+      if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return true; }
+      try {
+        const body = await readBody(req);
+        if (!assertValidBody(body, res)) return true;
+        const { verdict, reviewCritique } = body || {};
+        if (!verdict || !['pass', 'fail'].includes(verdict)) { jsonErr(res, 400, 'verdict must be "pass" or "fail"'); return true; }
+        const { CascadeJudge } = require('../lib/harada/cascade-judge');
+        const judge = new CascadeJudge(mgQuery, cid);
+        const result = await judge.judgeL3(cellId);
+        jsonOk(res, { ok: true, cellId, verdict: result.verdict, critique: result.critique });
+      } catch (e) { jsonErr(res, 500, `l3review failed: ${safeErrMsg(e)}`); }
+      return true;
+    }
+
     // GET /api/hbo/metrics — ProcessMetrics and ControlChartSignals
     if (method === 'GET' && pathname === '/api/hbo/metrics') {
       await handleGetMetrics(req, res, ctx);
@@ -3259,11 +3592,17 @@ module.exports = function createHBORouter(handlers) {
       return true;
     }
 
-    // GET /api/hbo/command-center — aggregated snapshot for dashboard
-    if (method === 'GET' && pathname === '/api/hbo/command-center') {
-      await handleGetCommandCenter(req, res, ctx);
-      return true;
-    }
+     // GET /api/hbo/blocked-work — P9A: tasks stopped due to a blocker
+     if (method === 'GET' && pathname === '/api/hbo/blocked-work') {
+       await handleGetBlockedWork(req, res, ctx);
+       return true;
+     }
+
+     // GET /api/hbo/command-center — aggregated snapshot for dashboard
+     if (method === 'GET' && pathname === '/api/hbo/command-center') {
+       await handleGetCommandCenter(req, res, ctx);
+       return true;
+     }
 
     // GET /api/hbo/decisions/timeline — unified historical decisions timeline
     if (method === 'GET' && pathname === '/api/hbo/decisions/timeline') {
@@ -3271,6 +3610,21 @@ module.exports = function createHBORouter(handlers) {
       return true;
     }
 
-    return false;
-  };
-};
+    // G-01: Budget Policy CRUD
+    if (method === 'POST' && pathname === '/api/budget-policies') {
+      await handleCreateBudgetPolicy(req, res, ctx);
+      return true;
+    }
+    const budgetPolicyMatch = pathname.match(/^\/api\/budget-policies\/([^/]+)$/);
+    if (budgetPolicyMatch) {
+      if (method === 'PATCH') { await handleUpdateBudgetPolicy(req, res, ctx, budgetPolicyMatch[1]); return true; }
+      if (method === 'DELETE') { await handleDeleteBudgetPolicy(req, res, ctx, budgetPolicyMatch[1]); return true; }
+    }
+    if (method === 'GET' && pathname === '/api/budget-incidents') {
+      await handleGetBudgetIncidents(req, res, ctx);
+      return true;
+    }
+
+     return false;
+   };
+};