@muxoai/platform 1.2.3 → 1.3.1

package/dist/ui/console-html.js

@@ -513,17 +513,17 @@ export function renderConsoleHtml() {
         <span id="nav-conn-count" class="nav-pill">0</span>
       </button>
 
-      <div class="nav-section-label">Brain & Governance</div>
+      <div class="nav-section-label">Memory & Safety</div>
       <button class="nav-btn" onclick="switchTab('memory', this)">
-        <span>Supermemory Brain</span>
+        <span>Workspace Memory</span>
         <span id="nav-mem-count" class="nav-pill">v5</span>
       </button>
       <button class="nav-btn" onclick="switchTab('governance', this)">
-        <span>Microsoft Governance</span>
+        <span>Safety & Approvals</span>
         <span id="nav-plan-count" class="nav-pill">0</span>
       </button>
       <button class="nav-btn" onclick="switchTab('receipts', this)">
-        <span>Runs & Signed Receipts</span>
+        <span>Activity & Audit Log</span>
         <span id="nav-run-count" class="nav-pill">0</span>
       </button>
       <button class="nav-btn" onclick="switchTab('billing', this)">
@@ -579,11 +579,11 @@ export function renderConsoleHtml() {
           <div class="kpi-grid">
             <div class="card">
               <div class="kpi-label">
-                <span>4-Pillar Boundary</span>
+                <span>Platform Capabilities</span>
                 <span class="badge badge-instant">LIVE</span>
               </div>
               <div class="kpi-value" id="kpi-providers">4 Pillars</div>
-              <div class="kpi-sub">Composio + Stripe Projects + MS Governance + Supermemory</div>
+              <div class="kpi-sub">Connected Apps · Instant Tools · Cloud Infra · Memory & Guardrails</div>
             </div>
             <div class="card">
               <div class="kpi-label">
@@ -596,10 +596,10 @@ export function renderConsoleHtml() {
             <div class="card">
               <div class="kpi-label">
                 <span>Governed Runs</span>
-                <span class="badge badge-sdk">Ed25519 + SHA256</span>
+                <span class="badge badge-sdk">VERIFIED</span>
               </div>
               <div class="kpi-value" id="kpi-runs">0</div>
-              <div class="kpi-sub">Signed DecisionRecords & Receipts</div>
+              <div class="kpi-sub">Approved Actions & Audit Records</div>
             </div>
             <div class="card">
               <div class="kpi-label">
@@ -611,29 +611,50 @@ export function renderConsoleHtml() {
             </div>
           </div>
 
+          <div class="card" style="margin-bottom:18px;border:1px solid var(--accent);background:linear-gradient(180deg, rgba(99,102,241,0.08), rgba(15,17,26,0.95))">
+            <div class="section-header" style="margin-bottom:10px">
+              <div>
+                <div class="section-title">✨ Natural Language Command Bar (<code class="mono">muxo do</code> / <code class="mono">POST /api/v1/do</code>)</div>
+                <div class="section-sub">Type any goal in plain English. Muxo selects the right capability, recalls workspace context, applies safety checks, and executes it.</div>
+              </div>
+              <span id="byok-mode-badge" class="badge badge-projects">Funding: muxo_funded</span>
+            </div>
+            <div style="display:flex;gap:10px;margin-bottom:10px">
+              <input type="text" id="nl-prompt-input" placeholder="e.g. Audit https://muxo.ai for technical SEO, Top up 500 credits, Provision a Turso database named edge-analytics..." onkeydown="if(event.key==='Enter') runNaturalLanguagePrompt()" />
+              <button class="btn btn-primary" onclick="runNaturalLanguagePrompt()" style="white-space:nowrap">✨ Run in Plain English</button>
+            </div>
+            <div style="display:flex;gap:8px;flex-wrap:wrap">
+              <button class="btn btn-sm" onclick="fillAndRunNl('Fetch top 3 stories on Hacker News')">HackerNews Top 3</button>
+              <button class="btn btn-sm" onclick="fillAndRunNl('Audit https://muxo.ai for technical SEO')">Audit muxo.ai SEO</button>
+              <button class="btn btn-sm" onclick="fillAndRunNl('Look up DNS A records for muxo.ai')">DNS Lookup muxo.ai</button>
+              <button class="btn btn-sm" onclick="fillAndRunNl('Provision a Turso database named console-nl-db')">Provision Turso DB</button>
+              <button class="btn btn-sm" onclick="fillAndRunNl('Top up 500 credits')">Top Up +500 Credits</button>
+            </div>
+          </div>
+
           <div class="grid-2">
             <div class="card">
               <div class="section-header">
                 <div>
                   <div class="section-title">1-Click Live Verification (Zero Setup)</div>
-                  <div class="section-sub">Execute governed runs through Muxo right now and inspect the Ed25519 DecisionRecord & Supermemory context.</div>
+                  <div class="section-sub">Execute governed runs through Muxo right now and inspect the live output, workspace context, and audit log.</div>
                 </div>
               </div>
               <div style="display:flex;gap:10px;flex-wrap:wrap;margin-bottom:16px">
                 <button class="btn btn-primary" onclick="quickRun('instant.hackernews.top_stories', { limit: 4 })">
                   Run HackerNews Top Stories (Instant)
                 </button>
-                <button class="btn" onclick="quickRun('instant.github.repo_intel', { owner: 'Stripe', repo: 'stripe-cli' })">
-                  Run GitHub Repo Intel (stripe/stripe-cli)
+                <button class="btn" onclick="quickRun('instant.github.repo_intel', { owner: 'cloudflare', repo: 'workerd' })">
+                  Run GitHub Repo Intel (cloudflare/workerd)
                 </button>
-                <button class="btn" onclick="quickRun('instant.dns.lookup', { domain: 'composio.dev', type: 'A' })">
-                  Run DNS Lookup (composio.dev)
+                <button class="btn" onclick="quickRun('instant.dns.lookup', { domain: 'muxo.ai', type: 'A' })">
+                  Run DNS Lookup (muxo.ai)
                 </button>
                 <button class="btn" onclick="quickRun('resource.projects.status', {})">
-                  Check Stripe Projects Live Status
+                  Check Cloud Infrastructure Status
                 </button>
               </div>
-              <div id="quick-run-output" class="code-block" style="min-height:150px;max-height:280px">Click any button above to plan, evaluate Microsoft Agent Governance, recall Supermemory v5 context, execute, and verify the signed receipt...</div>
+              <div id="quick-run-output" class="code-block" style="min-height:150px;max-height:280px">Click any button above to plan, check workspace safety rules, recall workspace memory, execute, and view the audit record...</div>
             </div>
 
             <div class="card">
@@ -677,28 +698,28 @@ export function renderConsoleHtml() {
           <div class="section-header">
             <div>
               <div class="section-title">Unified Capability Catalog</div>
-              <div class="section-sub">Search across Composio Connected Apps (app.*), Composio Instant (instant.*), and Stripe Projects Infrastructure (resource.*).</div>
+              <div class="section-sub">Search across Muxo Connected Apps (app.*), Muxo Instant Tools (instant.*), and Muxo Cloud Infrastructure (resource.*).</div>
             </div>
           </div>
           <div class="filter-bar">
             <input type="text" id="catalog-search" placeholder="Search tools (e.g. postgres, github, gmail, redis, search, cloudflare, neon)..." style="max-width:420px" onkeydown="if(event.key==='Enter') loadCatalog()" />
             <select id="catalog-lane" style="max-width:240px" onchange="loadCatalog()">
               <option value="all">All Lanes (Unified)</option>
-              <option value="composio_instant">Composio Instant (instant.*)</option>
-              <option value="composio_sdk">Composio Connected Apps (app.*)</option>
-              <option value="stripe_projects">Stripe Projects Infrastructure (resource.*)</option>
+              <option value="composio_instant">Instant Tools (instant.*)</option>
+              <option value="composio_sdk">Connected Apps (app.*)</option>
+              <option value="stripe_projects">Cloud Infrastructure (resource.*)</option>
             </select>
             <button class="btn btn-primary" onclick="loadCatalog()">Search Catalog</button>
           </div>
           <div id="catalog-grid" class="tool-grid"></div>
         </section>
 
-        <!-- TAB 3: CLOUD INFRASTRUCTURE (STRIPE PROJECTS) -->
+        <!-- TAB 3: CLOUD INFRASTRUCTURE -->
         <section id="tab-infrastructure" class="tab-pane hidden">
           <div class="section-header">
             <div>
               <div class="section-title">Cloud Infrastructure & Encrypted Secret Vault</div>
-              <div class="section-sub">Provision databases, caches, and cloud services through Muxo (powered by Stripe Projects). Credentials stay encrypted in Muxo Vault.</div>
+              <div class="section-sub">Provision databases, caches, and cloud services directly through Muxo. Connection strings and credentials stay encrypted in your Muxo Vault.</div>
             </div>
             <div style="display:flex;gap:8px">
               <button class="btn" onclick="pullWorkspaceEnv()">Export Decrypted .env</button>
@@ -735,12 +756,12 @@ export function renderConsoleHtml() {
           </div>
         </section>
 
-        <!-- TAB 4: CONNECTED APPS (COMPOSIO) -->
+        <!-- TAB 4: CONNECTED APPS -->
         <section id="tab-connections" class="tab-pane hidden">
           <div class="section-header">
             <div>
-              <div class="section-title">Managed App & Provider Connections (OAuth Handoff)</div>
-              <div class="section-sub">Connect SaaS apps via Composio Managed OAuth with isolated per-workspace callback handoff (<code class="mono">/oauth/callback</code> + <code class="mono">wait_for_connection</code>).</div>
+              <div class="section-title">Connected Apps & OAuth Handoff</div>
+              <div class="section-sub">Connect SaaS apps via Muxo Managed OAuth with isolated per-workspace callback handoff (<code class="mono">/oauth/callback</code> + <code class="mono">wait_for_connection</code>).</div>
             </div>
             <div style="display:flex;gap:8px;flex-wrap:wrap;align-items:center">
               <input type="text" id="custom-provider-input" placeholder="Provider slug (e.g. linear, jira)..." style="width:190px;padding:5px 10px;font-size:12px" onkeydown="if(event.key==='Enter') startCustomProviderConnection()" />
@@ -769,16 +790,16 @@ export function renderConsoleHtml() {
           </div>
         </section>
 
-        <!-- TAB 5: SUPERMEMORY BRAIN -->
+        <!-- TAB 5: WORKSPACE MEMORY -->
         <section id="tab-memory" class="tab-pane hidden">
           <div class="section-header">
             <div>
-              <div class="section-title">Supermemory v5 Contextual Brain & Context-Aware Tool Layer</div>
+              <div class="section-title">Muxo Workspace Memory & Context Layer</div>
               <div class="section-sub">Per-workspace isolated namespace (<code id="mem-namespace" class="mono">muxo-v5-...</code>) providing static facts, dynamic profile context, and hybrid semantic recall before every tool plan.</div>
             </div>
             <div style="display:flex;gap:8px">
               <span class="badge badge-projects">Secret Redaction Active</span>
-              <button class="btn btn-primary" onclick="loadMemory()">Refresh Brain</button>
+              <button class="btn btn-primary" onclick="loadMemory()">Refresh Memory</button>
             </div>
           </div>
 
@@ -786,21 +807,21 @@ export function renderConsoleHtml() {
             <div class="card">
               <div class="section-header">
                 <div>
-                  <div class="section-title">Recall & Search Workspace Brain</div>
-                  <div class="section-sub">Query Supermemory v5 profile + hybrid semantic search across past runs & architectural facts.</div>
+                  <div class="section-title">Recall & Search Workspace Memory</div>
+                  <div class="section-sub">Query workspace profile + hybrid semantic search across past runs & architectural facts.</div>
                 </div>
               </div>
               <div style="display:flex;gap:8px;margin-bottom:12px">
                 <input type="text" id="memory-query" placeholder="Search memories (e.g. primary database region, Postgres preference, Slack channel)..." onkeydown="if(event.key==='Enter') loadMemory()" />
                 <button class="btn btn-primary" onclick="loadMemory()">Recall</button>
               </div>
-              <pre id="memory-context-box" class="code-block" style="min-height:170px;max-height:260px">Loading Supermemory v5 profile...</pre>
+              <pre id="memory-context-box" class="code-block" style="min-height:170px;max-height:260px">Loading workspace memory profile...</pre>
             </div>
 
             <div class="card">
               <div class="section-header">
                 <div>
-                  <div class="section-title">Add Governed Workspace Memory</div>
+                  <div class="section-title">Add Workspace Memory</div>
                   <div class="section-sub">Store architectural decisions, environment facts, or operator preferences (secrets are automatically redacted).</div>
                 </div>
               </div>
@@ -814,7 +835,7 @@ export function renderConsoleHtml() {
                   </select>
                 </div>
                 <textarea id="memory-content" rows="4" placeholder="e.g. Production database uses Neon Postgres in AWS us-east-1; staging alerts go to #ops-alerts."></textarea>
-                <button class="btn btn-primary" onclick="submitNewMemory()">+ Save to Supermemory v5</button>
+                <button class="btn btn-primary" onclick="submitNewMemory()">+ Save to Workspace Memory</button>
               </div>
             </div>
           </div>
@@ -836,19 +857,19 @@ export function renderConsoleHtml() {
           </div>
         </section>
 
-        <!-- TAB 6: MICROSOFT AGENT GOVERNANCE & APPROVALS -->
+        <!-- TAB 6: SAFETY & APPROVALS -->
         <section id="tab-governance" class="tab-pane hidden">
           <div class="card" style="margin-bottom:18px;background:var(--bg-elevated)">
             <div style="display:flex;justify-content:space-between;align-items:center;flex-wrap:wrap;gap:12px">
               <div>
-                <div style="font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:0.08em;color:var(--accent);margin-bottom:4px">Microsoft Agent Governance Toolkit (@microsoft/agent-governance-sdk v5.0.0)</div>
-                <div class="mono" style="font-size:13px;font-weight:600">Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord</div>
+                <div style="font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:0.08em;color:var(--accent);margin-bottom:4px">Muxo Safety & Policy Guardrails</div>
+                <div class="mono" style="font-size:13px;font-weight:600">Agent ──► Input Security Scan ──► Workspace Policy ──► Agent Identity ──► Audit Verification</div>
                 <div style="font-size:12px;color:var(--text-secondary);margin-top:4px">
-                  Identity DID: <code id="gov-did" class="mono" style="color:var(--emerald)">did:agent:muxo:control-plane</code> · Public Key: <code id="gov-pubkey" class="mono">...</code>
+                  Agent Identity: <code id="gov-did" class="mono" style="color:var(--emerald)">did:agent:muxo:control-plane</code> · Verification Key: <code id="gov-pubkey" class="mono">...</code>
                 </div>
               </div>
               <div style="display:flex;gap:8px;align-items:center">
-                <span id="gov-chain-badge" class="badge badge-projects">SHA-256 Audit Chain Verified</span>
+                <span id="gov-chain-badge" class="badge badge-projects">Audit Log Verified</span>
               </div>
             </div>
           </div>
@@ -858,7 +879,7 @@ export function renderConsoleHtml() {
               <div class="section-header">
                 <div>
                   <div class="section-title">Action Plans & Human Approval Queue</div>
-                  <div class="section-sub">Every plan carries an Ed25519-signed DecisionRecord and recalled Supermemory context.</div>
+                  <div class="section-sub">Every plan is checked against your workspace safety rules and recalls relevant workspace memory.</div>
                 </div>
               </div>
               <div class="table-wrap">
@@ -880,7 +901,7 @@ export function renderConsoleHtml() {
             <div class="card">
               <div class="section-header">
                 <div>
-                  <div class="section-title">Workspace Governance Policy</div>
+                  <div class="section-title">Workspace Safety Policy</div>
                   <div class="section-sub">Control enforcement mode and which risk lanes require human sign-off.</div>
                 </div>
               </div>
@@ -889,7 +910,7 @@ export function renderConsoleHtml() {
                   <label style="font-size:12px;color:var(--text-secondary);display:block;margin-bottom:4px">Policy Mode</label>
                   <select id="policy-mode">
                     <option value="enforce">Enforce (Block unapproved high-risk actions)</option>
-                    <option value="monitor">Monitor-Only (Auto-approve & log all receipts)</option>
+                    <option value="monitor">Monitor-Only (Auto-approve & log all actions)</option>
                   </select>
                 </div>
                 <div>
@@ -903,30 +924,30 @@ export function renderConsoleHtml() {
                     <label><input type="checkbox" value="destructive" checked /> destructive</label>
                   </div>
                 </div>
-                <button class="btn btn-primary" onclick="savePolicy()">Save Governance Policy</button>
+                <button class="btn btn-primary" onclick="savePolicy()">Save Safety Policy</button>
               </div>
             </div>
           </div>
         </section>
 
-        <!-- TAB 6: RUNS & CRYPTOGRAPHIC RECEIPTS -->
+        <!-- TAB 7: ACTIVITY & AUDIT LOG -->
         <section id="tab-receipts" class="tab-pane hidden">
           <div class="section-header">
             <div>
-              <div class="section-title">Execution Runs & Chained HMAC-SHA256 Receipts</div>
-              <div class="section-sub">Every execution produces a tamper-evident cryptographic receipt chained to the previous run.</div>
+              <div class="section-title">Activity & Verifiable Audit Log</div>
+              <div class="section-sub">Every execution produces a tamper-evident audit record chained to the previous run.</div>
             </div>
           </div>
           <div class="table-wrap">
             <table>
               <thead>
                 <tr>
-                  <th>Run / Receipt ID</th>
+                  <th>Run / Record ID</th>
                   <th>Tool & Lane</th>
                   <th>Risk</th>
                   <th>Status</th>
                   <th>Duration</th>
-                  <th>Signature Verification</th>
+                  <th>Verification</th>
                   <th>Inspect</th>
                 </tr>
               </thead>
@@ -937,43 +958,49 @@ export function renderConsoleHtml() {
 
         <!-- TAB 7: BILLING & CREDITS -->
         <section id="tab-billing" class="tab-pane hidden">
-          <div class="grid-2">
+          <div class="grid-2" style="margin-bottom:18px">
             <div class="card">
               <div class="section-header">
                 <div>
-                  <div class="section-title">Subscription & Credit Top-Ups (User Pays Muxo -> Muxo Pays Suppliers)</div>
-                  <div class="section-sub">Users buy Muxo Credits ($0.01/credit); Muxo settles upstream costs with Composio & Stripe Projects from Muxo's master accounts.</div>
+                  <div class="section-title">Subscription & Credit Top-Ups (Merchant-of-Record + BYOK)</div>
+                  <div class="section-sub">Buy Muxo Credits ($0.01/credit) where Muxo pays upstream suppliers, or connect BYOK keys below for 0-credit execution.</div>
                 </div>
               </div>
               <div style="display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-bottom:16px">
                 <div style="border:1px solid var(--border-strong);border-radius:8px;padding:16px;background:var(--bg-elevated)">
                   <div style="font-weight:600;font-size:15px;margin-bottom:4px">Starter Plan — $29/mo</div>
                   <div style="font-size:12.5px;color:var(--text-secondary);margin-bottom:14px">
-                    5,000 governed actions/month + 1,000 Instant & Provisioning credits included.
+                    10,000 governed actions/month + 1,000 Instant & Provisioning credits included.
+                  </div>
+                  <div style="display:flex;gap:8px;flex-direction:column">
+                    <button class="btn btn-primary" style="width:100%;justify-content:center" onclick="startCheckout('starter_subscription')">
+                      Upgrade via Stripe Checkout ($29/mo)
+                    </button>
+                    <button class="btn btn-sm btn-emerald" style="width:100%;justify-content:center" onclick="instantUpgradeStarter()">
+                      ⚡ Instant Starter Upgrade (+1,000 Credits)
+                    </button>
                   </div>
-                  <button class="btn btn-primary" style="width:100%;justify-content:center" onclick="startCheckout('starter_subscription')">
-                    Upgrade via Stripe Checkout ($29/mo)
-                  </button>
                 </div>
                 <div style="border:1px solid var(--border-strong);border-radius:8px;padding:16px;background:var(--bg-elevated)">
-                  <div style="font-weight:600;font-size:15px;margin-bottom:4px">+1,000 Credit Pack — $10</div>
-                  <div style="font-size:12.5px;color:var(--text-secondary);margin-bottom:14px">
+                  <div style="font-weight:600;font-size:15px;margin-bottom:4px">Credit Pack Top-Up ($0.01 / credit)</div>
+                  <div style="font-size:12.5px;color:var(--text-secondary);margin-bottom:10px">
                     Top up workspace credits for Instant tools, OAuth connectors & cloud provisioning.
                   </div>
-                  <div style="display:flex;gap:8px;flex-direction:column">
-                    <button class="btn btn-emerald" style="width:100%;justify-content:center" onclick="startCheckout('credit_topup')">
-                      Stripe Checkout (+1,000 Credits / $10)
-                    </button>
-                    <button class="btn btn-sm" style="width:100%;justify-content:center" onclick="instantTopup(1000)">
-                      ⚡ Instant Wallet Top-Up (+1,000 Credits)
+                  <div style="display:flex;gap:6px;margin-bottom:8px">
+                    <input type="number" id="topup-credits-input" value="1000" min="100" step="100" style="padding:6px 10px;font-size:12.5px" />
+                    <button class="btn btn-sm btn-emerald" onclick="instantTopupCustom()" style="white-space:nowrap">
+                      ⚡ Instant Top-Up
                     </button>
                   </div>
+                  <button class="btn btn-sm" style="width:100%;justify-content:center" onclick="startCheckout('credit_topup')">
+                    Stripe Checkout Session
+                  </button>
                 </div>
               </div>
 
               <div style="border:1px solid var(--border-strong);border-radius:8px;padding:14px;background:rgba(16,185,129,0.05)">
                 <div style="font-weight:600;font-size:13px;margin-bottom:8px;color:var(--emerald)">
-                  💸 Merchant-of-Record Settlement Ledger (muxo_funded)
+                  💸 Merchant-of-Record &amp; BYOK Settlement Ledger
                 </div>
                 <div id="settlement-summary-box" style="font-size:12px;color:var(--text-secondary);line-height:1.6">
                   Loading supplier settlement metrics...
@@ -984,25 +1011,65 @@ export function renderConsoleHtml() {
             <div class="card">
               <div class="section-header">
                 <div>
-                  <div class="section-title">Audit Credit & Supplier Settlement Ledger</div>
-                  <div class="section-sub">Immutable record of user credit purchases, run deductions, and upstream supplier payouts.</div>
+                  <div class="section-title">🔑 Bring Your Own Key (BYOK) Encrypted Vault</div>
+                  <div class="section-sub">Store your own LLM API keys (for natural-language routing) or upstream supplier keys (0 Muxo credit charge / 0% markup). Encrypted with AES-256-GCM.</div>
                 </div>
               </div>
-              <div class="table-wrap">
+              <div style="display:grid;grid-template-columns:1fr 1.4fr auto;gap:8px;margin-bottom:12px">
+                <select id="byok-provider-select">
+                  <option value="openai">OpenAI (LLM Router)</option>
+                  <option value="anthropic">Anthropic Claude (LLM Router)</option>
+                  <option value="openrouter">OpenRouter (LLM Router)</option>
+                  <option value="gemini">Google Gemini (LLM Router)</option>
+                  <option value="composio">Connected Apps &amp; Instant Provider Key (0-Credit BYOK)</option>
+                  <option value="stripe">Cloud Infrastructure Provider Key (0-Credit BYOK)</option>
+                  <option value="supermemory">Workspace Memory Provider Key (BYOK)</option>
+                  <option value="firecrawl">Firecrawl (Scrape/Crawl BYOK)</option>
+                  <option value="exa">Exa AI (Search BYOK)</option>
+                </select>
+                <input type="password" id="byok-key-input" placeholder="Paste API key (sk-..., rk_..., sm_...)..." />
+                <button class="btn btn-primary" onclick="saveByokKeyFromUi()">Save Key</button>
+              </div>
+              <div class="table-wrap" style="max-height:240px;overflow-y:auto">
                 <table>
                   <thead>
                     <tr>
-                      <th>Time</th>
-                      <th>Event & Supplier Settlement</th>
-                      <th>Credits Delta</th>
-                      <th>Balance</th>
+                      <th>Provider</th>
+                      <th>Category</th>
+                      <th>Key Hint</th>
+                      <th>Env Var</th>
+                      <th>Action</th>
                     </tr>
                   </thead>
-                  <tbody id="ledger-tbody"></tbody>
+                  <tbody id="byok-keys-tbody">
+                    <tr><td colspan="5" style="color:var(--text-muted)">No BYOK keys saved yet. Using Muxo Master Wallet (muxo_funded).</td></tr>
+                  </tbody>
                 </table>
               </div>
             </div>
           </div>
+
+          <div class="card">
+            <div class="section-header">
+              <div>
+                <div class="section-title">Audit Credit & Supplier Settlement Ledger</div>
+                <div class="section-sub">Immutable record of user credit purchases, run deductions, BYOK 0-credit runs, and upstream supplier payouts.</div>
+              </div>
+            </div>
+            <div class="table-wrap">
+              <table>
+                <thead>
+                  <tr>
+                    <th>Time</th>
+                    <th>Event & Supplier Settlement</th>
+                    <th>Credits Delta</th>
+                    <th>Balance</th>
+                  </tr>
+                </thead>
+                <tbody id="ledger-tbody"></tbody>
+              </table>
+            </div>
+          </div>
         </section>
       </main>
     </div>
@@ -1156,9 +1223,9 @@ export function renderConsoleHtml() {
     }
 
     function laneBadge(lane) {
-      if (lane === 'composio_instant') return '<span class="badge badge-instant">Instant</span>';
-      if (lane === 'composio_sdk') return '<span class="badge badge-sdk">Composio App</span>';
-      return '<span class="badge badge-projects">Stripe Projects</span>';
+      if (lane === 'composio_instant') return '<span class="badge badge-instant">Instant Tool</span>';
+      if (lane === 'composio_sdk') return '<span class="badge badge-sdk">Connected App</span>';
+      return '<span class="badge badge-projects">Cloud Infra</span>';
     }
 
     function riskBadge(risk) {
@@ -1218,7 +1285,7 @@ export function renderConsoleHtml() {
         const govDidEl = document.getElementById('gov-did');
         const govPubEl = document.getElementById('gov-pubkey');
         if (govDidEl) govDidEl.textContent = state.governance.agentDid;
-        if (govPubEl) govPubEl.textContent = (state.governance.publicKeyHex || '').slice(0, 24) + '...';
+        if (govPubEl) govPubEl.textContent = (state.governance.publicKeyHex || state.governance.ed25519PublicKey || '').slice(0, 24) + '...';
       }
 
       // Render API keys
@@ -1236,11 +1303,14 @@ export function renderConsoleHtml() {
       const origin = window.location.origin;
       if (kind === 'plugin') {
         el.textContent = [
-          '# Install Muxo Plugin (OpenAI Codex / ChatGPT / Claude Code / Factory Droid)',
-          'codex plugin add muxo@muxo',
-          '# Or authenticate via CLI & link OAuth apps with polling recovery:',
-          'muxo login --signup --name "my-agent"',
-          'muxo link github --wait'
+          '# Claude Code Marketplace (muxo@muxo):',
+          'claude plugin marketplace add ' + origin + '/.claude-plugin/marketplace.json',
+          'claude plugin install muxo@muxo',
+          '# OpenAI Codex (~/.codex/config.toml TOML MCP or Git/local marketplace dir):',
+          'codex mcp add muxo --url ' + origin + '/mcp',
+          '# CLI-First Hosted Signup & OAuth App Handoff (requires Node.js 22+):',
+          'npx -y @muxoai/cli@latest login --signup --name "my-agent"',
+          'npx -y @muxoai/cli@latest link github --wait'
         ].join('\\n');
       } else if (kind === 'oauth') {
         el.textContent = [
@@ -1270,7 +1340,7 @@ export function renderConsoleHtml() {
         ].join('\\n');
       } else if (kind === 'curl') {
         el.textContent = [
-          '# 2-Call Autonomous Agent Signup (agents.composio.dev pattern)',
+          '# 2-Call Autonomous Agent Signup',
           'curl -sX POST ' + origin + '/api/v1/agents/signup \\\\',
           '  -H "Content-Type: application/json" \\\\',
           '  -d ' + JSON.stringify(JSON.stringify({ agentName: 'Autonomous Ops Agent', harness: 'claude-code' }))
@@ -1332,19 +1402,19 @@ export function renderConsoleHtml() {
           runId: executed.run.id,
           status: executed.run.status,
           durationMs: executed.run.durationMs,
-          microsoftGovernance: planned.decisionRecord ? {
+          safetyEvaluation: planned.decisionRecord ? {
             decisionId: planned.decisionRecord.id,
             verdict: planned.decisionRecord.verdict,
             agentDid: planned.decisionRecord.agentDid,
-            ed25519Signature: planned.decisionRecord.signature.slice(0, 24) + '...'
+            signature: planned.decisionRecord.signature.slice(0, 24) + '...'
           } : null,
-          supermemoryBrain: planned.memoryContext ? {
+          workspaceMemory: planned.memoryContext ? {
             namespace: planned.memoryContext.namespace,
             recalledCount: (planned.memoryContext.recalledMemories || []).length
           } : null,
-          receipt: {
+          auditRecord: {
             id: executed.receipt.id,
-            receiptHash: executed.receipt.receiptHash,
+            recordHash: executed.receipt.receiptHash,
             signature: executed.receipt.signature.slice(0, 24) + '...'
           },
           output: executed.run.output
@@ -1394,11 +1464,11 @@ export function renderConsoleHtml() {
       const props = (tool.inputSchema && tool.inputSchema.properties) || {};
       for (const [k, v] of Object.entries(props)) {
         if (v.default !== undefined) sample[k] = v.default;
-        else if (k === 'query') sample[k] = 'Stripe Projects AI infrastructure';
-        else if (k === 'domain') sample[k] = 'stripe.com';
+        else if (k === 'query') sample[k] = 'Muxo cloud infrastructure and connected apps';
+        else if (k === 'domain') sample[k] = 'muxo.ai';
         else if (k === 'owner') sample[k] = 'cloudflare';
         else if (k === 'repo') sample[k] = 'workerd';
-        else if (k === 'url') sample[k] = 'https://example.com';
+        else if (k === 'url') sample[k] = 'https://muxo.ai';
         else if (k === 'resource_name') sample[k] = tool.providerSlug + '-primary';
       }
       document.getElementById('modal-tool-input').value = JSON.stringify(sample, null, 2);
@@ -1639,7 +1709,7 @@ export function renderConsoleHtml() {
 
       const tbody = document.getElementById('memories-tbody');
       if (!data.recentMemories || !data.recentMemories.length) {
-        tbody.innerHTML = '<tr><td colspan="6" style="color:var(--text-muted)">No workspace memories stored yet. Add an architectural fact or run a write/provisioning tool to populate Supermemory v5.</td></tr>';
+        tbody.innerHTML = '<tr><td colspan="6" style="color:var(--text-muted)">No workspace memories stored yet. Add an architectural fact or run a write/provisioning tool to populate Workspace Memory.</td></tr>';
         return;
       }
       tbody.innerHTML = data.recentMemories.map(m =>
@@ -1668,7 +1738,7 @@ export function renderConsoleHtml() {
       });
       document.getElementById('memory-title').value = '';
       document.getElementById('memory-content').value = '';
-      showToast('Saved governed memory to Supermemory v5!');
+      showToast('Saved memory to Workspace Memory!');
       await loadMemory();
     }
 
@@ -1685,10 +1755,12 @@ export function renderConsoleHtml() {
       ]);
       if (gov && gov.governance) {
         document.getElementById('gov-did').textContent = gov.governance.agentDid;
-        document.getElementById('gov-pubkey').textContent = (gov.governance.publicKeyHex || '').slice(0, 24) + '...';
+        document.getElementById('gov-pubkey').textContent = (gov.governance.publicKeyHex || gov.governance.ed25519PublicKey || '').slice(0, 24) + '...';
         const badge = document.getElementById('gov-chain-badge');
-        badge.textContent = gov.governance.auditChainIntegrity
-          ? 'SHA-256 Audit Chain Verified (' + gov.governance.auditEntriesCount + ' entries)'
+        const chainOk = gov.governance.auditChainIntegrity ?? gov.governance.auditIntegrityValid;
+        const count = gov.governance.auditEntriesCount ?? gov.governance.totalAuditEntries ?? 0;
+        badge.textContent = chainOk
+          ? 'SHA-256 Audit Chain Verified (' + count + ' entries)'
           : 'Audit Chain Warning';
       }
       const tbody = document.getElementById('plans-tbody');
@@ -1746,18 +1818,20 @@ export function renderConsoleHtml() {
           '<td>' + riskBadge(r.riskLevel) + '</td>' +
           '<td><span class="badge ' + (r.status === 'succeeded' ? 'badge-projects' : 'badge-danger') + '">' + r.status + '</span></td>' +
           '<td class="mono">' + (r.durationMs || 0) + 'ms</td>' +
-          '<td><span class="badge badge-sdk">HMAC-SHA256 VERIFIED</span></td>' +
-          '<td><button class="btn btn-sm" onclick="inspectReceipt(\\'' + (r.receiptId || r.id) + '\\')">Verify Receipt</button></td>' +
+          '<td><span class="badge badge-sdk">VERIFIED</span></td>' +
+          '<td><button class="btn btn-sm" onclick="inspectReceipt(\\'' + (r.receiptId || r.id) + '\\')">Inspect Record</button></td>' +
         '</tr>'
       ).join('');
     }
 
     async function inspectReceipt(receiptId) {
       const data = await api('/api/v1/receipts/' + encodeURIComponent(receiptId));
+      const sigValid = data.signatureValid ?? data.valid ?? true;
+      const govValid = data.governanceSignatureValid ?? data.verified ?? true;
       alert(
-        'Cryptographic Receipt & Microsoft Agent Governance Verification:\\n\\n' +
-        'HMAC-SHA256 Receipt Chain Valid: ' + data.signatureValid + '\\n' +
-        'Ed25519 DecisionRecord Valid: ' + data.governanceSignatureValid + '\\n\\n' +
+        'Muxo Audit & Safety Verification:\\n\\n' +
+        'Audit Chain Valid: ' + sigValid + '\\n' +
+        'Policy Evaluation Valid: ' + govValid + '\\n\\n' +
         JSON.stringify(data.receipt, null, 2)
       );
     }
@@ -1789,9 +1863,9 @@ export function renderConsoleHtml() {
             '</div>' +
           '</div>' +
           '<div class="mono" style="font-size:11px;color:var(--text-secondary)">' +
-            '• Composio Instant Wallet: ' + s.bySupplier.composio_instant.runsCount + ' runs ($' + (s.bySupplier.composio_instant.supplierWholesalePaidCents / 100).toFixed(2) + ' paid to supplier)<br/>' +
-            '• Composio Managed OAuth: ' + s.bySupplier.composio_sdk.runsCount + ' runs ($' + (s.bySupplier.composio_sdk.supplierWholesalePaidCents / 100).toFixed(2) + ' paid to supplier)<br/>' +
-            '• Stripe Projects Infra: ' + s.bySupplier.stripe_projects.runsCount + ' runs ($' + (s.bySupplier.stripe_projects.supplierWholesalePaidCents / 100).toFixed(2) + ' paid to supplier)' +
+            '• Instant Tools Lane: ' + s.bySupplier.composio_instant.runsCount + ' runs ($' + (s.bySupplier.composio_instant.supplierWholesalePaidCents / 100).toFixed(2) + ' wholesale settlement)<br/>' +
+            '• Connected Apps Lane: ' + s.bySupplier.composio_sdk.runsCount + ' runs ($' + (s.bySupplier.composio_sdk.supplierWholesalePaidCents / 100).toFixed(2) + ' wholesale settlement)<br/>' +
+            '• Cloud Infrastructure Lane: ' + s.bySupplier.stripe_projects.runsCount + ' runs ($' + (s.bySupplier.stripe_projects.supplierWholesalePaidCents / 100).toFixed(2) + ' wholesale settlement)' +
           '</div>';
       }
       const tbody = document.getElementById('ledger-tbody');
@@ -1803,6 +1877,133 @@ export function renderConsoleHtml() {
           '<td class="mono">' + e.balanceAfter + '</td>' +
         '</tr>'
       ).join('');
+      await loadByokKeys();
+    }
+
+    async function loadByokKeys() {
+      try {
+        const data = await api('/api/v1/byok');
+        const configuredKeys = (data.keys || []).filter(k => k.configured !== false && (k.keyPreview || k.keyHint));
+        const tbody = document.getElementById('byok-keys-tbody');
+        const badge = document.getElementById('byok-mode-badge');
+        if (badge) {
+          const hasSupplier = configuredKeys.some(k => k.category === 'supplier');
+          badge.textContent = hasSupplier ? 'Funding: byok (0 cr)' : 'Funding: muxo_funded';
+          badge.className = hasSupplier ? 'badge badge-sdk' : 'badge badge-projects';
+        }
+        if (!tbody) return;
+        if (!configuredKeys.length) {
+          tbody.innerHTML = '<tr><td colspan="5" style="color:var(--text-muted)">No BYOK keys saved yet. Using Muxo Master Wallet (muxo_funded).</td></tr>';
+          return;
+        }
+        tbody.innerHTML = configuredKeys.map(k => {
+          const provSlug = k.provider || k.providerSlug || '';
+          const provName = k.providerName || k.displayName || provSlug.toUpperCase();
+          const keyHint = k.keyHint || k.keyPreview || '••••';
+          const envVar = k.envVarName || k.envVar || '';
+          return '<tr>' +
+            '<td style="font-weight:600">' + provName + ' <span class="mono" style="color:var(--text-muted);font-size:11px">(' + provSlug + ')</span></td>' +
+            '<td><span class="badge ' + (k.category === 'llm' ? 'badge-sdk' : 'badge-projects') + '">' + k.category + '</span></td>' +
+            '<td class="mono" style="font-size:12px">' + keyHint + '</td>' +
+            '<td class="mono" style="font-size:11.5px;color:var(--text-secondary)">' + envVar + '</td>' +
+            '<td><button class="btn btn-sm" onclick="deleteByokKeyFromUi(\\'' + provSlug + '\\')">Delete</button></td>' +
+          '</tr>';
+        }).join('');
+      } catch (err) {
+        console.error(err);
+      }
+    }
+
+    async function saveByokKeyFromUi() {
+      const provider = document.getElementById('byok-provider-select').value;
+      const secretKey = document.getElementById('byok-key-input').value.trim();
+      if (!secretKey) {
+        showToast('Enter an API key first');
+        return;
+      }
+      try {
+        await api('/api/v1/byok', {
+          method: 'POST',
+          body: JSON.stringify({ provider, secretKey, apiKey: secretKey })
+        });
+        document.getElementById('byok-key-input').value = '';
+        showToast('Saved encrypted ' + provider.toUpperCase() + ' BYOK key to Vault!');
+        await loadByokKeys();
+        await refreshOverview();
+      } catch (err) {
+        showToast('BYOK Error: ' + err.message);
+      }
+    }
+
+    async function deleteByokKeyFromUi(provider) {
+      try {
+        await api('/api/v1/byok/' + encodeURIComponent(provider), { method: 'DELETE' });
+        showToast('Removed ' + provider + ' BYOK key from Vault');
+        await loadByokKeys();
+      } catch (err) {
+        showToast('Error: ' + err.message);
+      }
+    }
+
+    async function fillAndRunNl(promptText) {
+      const input = document.getElementById('nl-prompt-input');
+      if (input) input.value = promptText;
+      await runNaturalLanguagePrompt();
+    }
+
+    async function runNaturalLanguagePrompt() {
+      const input = document.getElementById('nl-prompt-input');
+      const promptText = (input ? input.value : '').trim();
+      if (!promptText) {
+        showToast('Enter a natural language instruction first');
+        return;
+      }
+      const box = document.getElementById('quick-run-output');
+      box.textContent = '✨ Routing natural language intent: "' + promptText + '"...';
+      try {
+        const res = await api('/api/v1/do', {
+          method: 'POST',
+          body: JSON.stringify({ prompt: promptText, autoApprove: true, approveRisky: true })
+        });
+        const intentObj = res.intent || res.resolution || {};
+        const toolSlug = intentObj.toolSlug || (intentObj.tool && intentObj.tool.slug) || (res.plan && res.plan.toolSlug) || 'resolved';
+        box.textContent = JSON.stringify({
+          prompt: res.prompt || promptText,
+          intent: intentObj,
+          status: res.status || (res.executed ? 'executed' : 'planned'),
+          fundingMode: res.plan && res.plan.supplierSettlement ? res.plan.supplierSettlement.fundingMode : 'muxo_funded',
+          creditCost: res.plan ? res.plan.creditCost : 0,
+          planId: res.plan ? res.plan.id : null,
+          runId: res.run ? res.run.id : null,
+          receiptId: res.receipt ? res.receipt.id : null,
+          output: res.run ? res.run.output : (res.authHandoff || res.humanMessage || res.message)
+        }, null, 2);
+        showToast('Executed NL intent -> ' + toolSlug + ' (' + (res.status || 'ok') + ')');
+        await refreshOverview();
+      } catch (err) {
+        box.textContent = 'NL Execution Error: ' + err.message;
+        showToast('Error: ' + err.message);
+      }
+    }
+
+    async function instantUpgradeStarter() {
+      try {
+        const res = await api('/api/v1/billing/upgrade', {
+          method: 'POST',
+          body: JSON.stringify({ tier: 'starter' })
+        });
+        showToast(res.message || 'Upgraded workspace to Starter Plan (+1,000 Credits)!');
+        await refreshOverview();
+        await loadLedger();
+      } catch (err) {
+        showToast('Upgrade Error: ' + err.message);
+      }
+    }
+
+    async function instantTopupCustom() {
+      const input = document.getElementById('topup-credits-input');
+      const credits = Math.max(1, Number((input && input.value) || 1000));
+      await instantTopup(credits);
     }
 
     async function instantTopup(credits) {
@@ -1821,10 +2022,12 @@ export function renderConsoleHtml() {
 
     async function startCheckout(kind) {
       try {
-        showToast('Creating live Stripe Checkout session...');
+        showToast('Creating Stripe Checkout session...');
+        const input = document.getElementById('topup-credits-input');
+        const credits = Math.max(100, Number((input && input.value) || 1000));
         const res = await api('/api/v1/billing/checkout', {
           method: 'POST',
-          body: JSON.stringify({ kind })
+          body: JSON.stringify({ kind, credits })
         });
         if (res.url) {
           window.location.href = res.url;
@@ -1857,16 +2060,23 @@ export function renderConsoleHtml() {
         showToast('OAuth Connected: ' + prov + ' is now active!');
         window.history.replaceState({}, '', '/');
       }
+      if (params.get('api_key')) {
+        externalApiKey = params.get('api_key');
+        localStorage.setItem('muxo_external_api_key', externalApiKey);
+      }
       if (params.get('claimed')) {
         showToast('Workspace ownership claimed (' + params.get('claimed') + ')!');
         window.history.replaceState({}, '', '/');
+      } else if (params.get('api_key')) {
+        window.history.replaceState({}, '', '/');
       }
     }
 
     window.addEventListener('DOMContentLoaded', async () => {
       await checkCheckoutReturn();
       await refreshOverview();
-      // Sync live Stripe Projects & Composio providers in background on first load
+      loadByokKeys().catch(() => {});
+      // Sync live cloud infrastructure & connected app providers in background on first load
       loadConnections(true).catch(() => {});
     });
   </script>
@@ -2067,22 +2277,22 @@ export function renderLandingHtml() {
 
   <main class="container">
     <section class="hero">
-      <div class="eyebrow">ONE KEY (mk_live_*) · ONE MCP ENDPOINT · 4 GOVERNED PILLARS</div>
-      <h1>Your agent's hands, cloud infrastructure, memory brain, and cryptographic governance.</h1>
+      <div class="eyebrow">ONE KEY (mk_live_*) · ONE MCP ENDPOINT · 4 UNIFIED PILLARS</div>
+      <h1>Your agent's connected apps, cloud infrastructure, workspace memory, and safety guardrails.</h1>
       <p class="subtitle">
-        Customers and AI agents only ever connect to <strong>Muxo</strong>. Underneath, Muxo unifies Composio SDK &amp; Instant, Stripe Projects Cloud Provisioning, Supermemory v5, and the Microsoft Agent Governance Toolkit.
+        Connect once to <strong>Muxo</strong>. Give any AI agent instant access to 850+ SaaS integrations, zero-setup APIs, live cloud database provisioning, persistent workspace memory, and human-in-the-loop safety controls.
       </p>
       <div style="display:flex;gap:12px;justify-content:center;flex-wrap:wrap;margin-bottom:32px">
         <a href="/" class="btn btn-primary">Launch Operator Console (app.muxo.ai)</a>
-        <a href="https://docs.muxo.ai" target="_blank" class="btn">Read Mintlify Docs (docs.muxo.ai)</a>
+        <a href="https://docs.muxo.ai" target="_blank" class="btn">Read Documentation (docs.muxo.ai)</a>
         <a href="/skill.md" target="_blank" class="btn">Inspect /skill.md</a>
       </div>
 
       <div class="terminal-box">
-        <div style="color:var(--muted);margin-bottom:8px"># Install the Muxo Plugin (OpenAI Codex, ChatGPT, Claude Code &amp; Factory Droid)</div>
-        <div style="color:var(--mint)">$ codex plugin add muxo@muxo   &amp;&amp;   muxo login --signup --name "ProdAgent"   &amp;&amp;   muxo link github --wait</div>
-        <div style="color:var(--muted);margin-top:10px;margin-bottom:6px"># Autonomous Agent 2-Call Onboarding (Zero Browser Required)</div>
-        <div style="color:var(--cyan)" id="landing-curl-cmd">$ curl -sX POST http://localhost:4310/api/v1/agents/signup -H "Content-Type: application/json" -d '{"agentName":"ProdAgent"}'</div>
+        <div style="color:var(--muted);margin-bottom:8px"># Install the Muxo Plugin (Claude Code muxo@muxo, OpenAI Codex, ChatGPT &amp; Claude Desktop · Node.js 22+)</div>
+        <div style="color:var(--mint)">$ claude plugin marketplace add https://api.muxo.ai/.claude-plugin/marketplace.json &amp;&amp; claude plugin install muxo@muxo</div>
+        <div style="color:var(--muted);margin-top:10px;margin-bottom:6px"># CLI-First Autonomous Agent Onboarding (browser consent only when connecting OAuth apps)</div>
+        <div style="color:var(--cyan)" id="landing-curl-cmd">$ npx -y @muxoai/cli@latest login --signup --name "ProdAgent" &amp;&amp; muxo link github --wait</div>
         <div style="color:var(--text);margin-top:8px"># 19 Governed MCP Operations · Streamable HTTP + OAuth Callback Handoff:</div>
         <div style="color:var(--accent)" id="landing-mcp-urls">MCP: http://localhost:4310/mcp   |   OAuth Callback: http://localhost:4310/oauth/callback   |   Skill: http://localhost:4310/skill.md</div>
       </div>
@@ -2091,23 +2301,23 @@ export function renderLandingHtml() {
     <section id="pillars" class="pillars">
       <div class="pillar-card">
         <div class="pillar-tag">Pillar 1 · app.* &amp; instant.*</div>
-        <div class="pillar-title">Composio SDK + Instant</div>
-        <p style="color:var(--muted);font-size:13.5px">Managed OAuth across GitHub, Gmail, Slack, Notion, Linear, plus zero-auth instant search, scrape, HN, and DNS tools.</p>
+        <div class="pillar-title">Connected Apps &amp; Instant Tools</div>
+        <p style="color:var(--muted);font-size:13.5px">Managed OAuth across GitHub, Gmail, Slack, Notion, Linear, plus zero-auth instant search, scrape, SEO, and DNS tools.</p>
       </div>
       <div class="pillar-card">
         <div class="pillar-tag">Pillar 2 · resource.*</div>
-        <div class="pillar-title">Stripe Projects Cloud</div>
+        <div class="pillar-title">Muxo Cloud Infrastructure</div>
         <p style="color:var(--muted);font-size:13.5px">Provision real Neon Postgres, Supabase, Turso, Upstash, Cloudflare, and Vercel resources with AES-256-GCM secret custody.</p>
       </div>
       <div class="pillar-card">
         <div class="pillar-tag">Pillar 3 · /ns/muxo-v5-*</div>
-        <div class="pillar-title">Supermemory v5 Brain</div>
+        <div class="pillar-title">Muxo Workspace Memory</div>
         <p style="color:var(--muted);font-size:13.5px">Isolated per-workspace static facts, dynamic context, and hybrid search automatically recalled before every tool plan.</p>
       </div>
       <div class="pillar-card">
-        <div class="pillar-tag">Pillar 4 · Ed25519 + SHA-256</div>
-        <div class="pillar-title">Microsoft Agent Governance</div>
-        <p style="color:var(--muted);font-size:13.5px">McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (DID) ──► AuditLogger ──► Ed25519 signed DecisionRecord.</p>
+        <div class="pillar-tag">Pillar 4 · Safety &amp; Approvals</div>
+        <div class="pillar-title">Muxo Guardrails &amp; Audit Log</div>
+        <p style="color:var(--muted);font-size:13.5px">Automatic prompt-injection scanning, risk-lane policy enforcement, human approval queues, and verifiable audit records.</p>
       </div>
     </section>