codehere 0.7.1 → 1.0.1

package/dist/infrastructure/protocols/mcp-server-impl.js

@@ -19,101 +19,84 @@
  *   codehere serve --port 8080  # custom port
  */
 import http from 'http';
-import { readFileSync, existsSync, statSync, watchFile, unwatchFile } from 'fs';
-import { join, relative, dirname } from 'path';
+import { readFileSync, existsSync, statSync, watchFile, unwatchFile, rmSync, mkdirSync } from 'fs';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { join, dirname, resolve as resolvePath } from 'path';
+import { shipScan } from '../security/ship-scan.js';
+import { fixExposedSecret } from '../security/fix-secret.js';
+import { fixCodeVuln } from '../security/fix-code.js';
 import { fileURLToPath } from 'url';
-import { collectFilesForMCP, scoreFileForMCP } from './mcp-helpers.js';
-import { scanPayload, calculateRiskScore, AUDIT_FILE, verifyAuditChain } from '../hooks/claude-sdk-hook.js';
+import { AUDIT_FILE, MOCK_AUDIT_FILE, verifyAuditChain } from '../hooks/claude-sdk-hook.js';
+import { signAuditTip, pruneSignState } from '../hooks/audit-tip-signature.js';
 import { analyzeSessions, isRealHostSession, previewFromToolInput } from '../hooks/session-analyzer.js';
 import { CodexControlSurface } from '../orchestration/control/codex-control-surface.js';
 import { getVersion } from '../../utils/version.js';
-import { HISTORY_HTML, THREAD_HTML } from './ui-page.js';
+import { TOOLS, dispatch } from './mcp-tools.js';
 import { TASK_HTML_V2 } from './ui-page-v2.js';
 import { VERIFY_HTML } from './verify-page.js';
-import { verifyClaim } from '../../application/use-cases/verify-claim.js';
-import { signBundle, verifyBundle, shortFingerprint, } from '../../application/use-cases/thread-export.js';
+import { composeVerdict } from '../../application/services/verdict-service.js';
+import { signBundle, verifyBundle, shortFingerprint, collectAuditEntriesForSession, verifyEmbeddedAuditChain, } from '../../application/use-cases/thread-export.js';
 import { loadOrCreateKeypair, trustedKeySet, trustKey } from '../orchestration/thread-key-store.js';
-import { loadSessionById } from '../orchestration/session-persistence.js';
+import { loadSessionById, appendResolved, appendCompleted } from '../orchestration/session-persistence.js';
+import { buildCrossVendorVerdictById, buildCrossVendorVerdictForWriter, } from '../../application/use-cases/build-cross-vendor-verdict.js';
 import { validateIntent as validateWritePassIntent, validateDecision as validateWritePassDecision, applyDecision as applyWritePassDecision, applyResponse as applyWritePassResponse, statusToAuditLine as writePassStatusToAuditLine, newPassId, WritePassError, } from '../../application/use-cases/write-pass.js';
 import { putPending as wpPutPending, getById as wpGetById, setStatus as wpSetStatus, listForSession as wpListForSession, listPending as wpListPending, } from '../orchestration/write-pass-store.js';
 import { resolveWriteRequest, WritePassResolveError } from '../context/write-pass-resolver.js';
 import { trustDomain as trustDomainStore } from '../../application/use-cases/domain-trust.js';
-import { appendAuditLog, appendOverrideAudit } from '../hooks/claude-sdk-hook.js';
+import { appendAuditLog, appendAuditLogDirect, appendOverrideAudit } from '../hooks/claude-sdk-hook.js';
 import { readFileSync as fsReadFileSync, existsSync as fsExistsSync } from 'fs';
 import { resolveContextSourceUrls } from '../context/context-resolver.js';
 import { getDefaultRegistry, createDefaultFetchContextWithPost } from '../context/registry-bootstrap.js';
 import { begin as oauthBegin, complete as oauthComplete, getProvider as getOAuthProvider, listProviders as listOAuthProviders, } from '../context/oauth-flow.js';
-import { saveToken, clearToken, connectionStatus } from '../context/oauth-store.js';
+import { saveToken, clearToken, connectionStatus, loadToken } from '../context/oauth-store.js';
+import { requestDeviceCode, pollForToken, githubClientId } from '../context/github-device-flow.js';
+import { fetchIssue, listIssues, parseRepoRef, issueToTaskPrompt, commentOnIssue, issueRefFromText, } from '../context/github-api.js';
 import { SessionManager, availableAgents, readinessForAllAgents, getAdapter, allAdapters, } from '../orchestration/session-manager.js';
 import { isAbsolute } from 'path';
+import { findProjectRoot } from '../orchestration/memory-injector.js';
+import { scaffoldProjectAt } from '../../presentation/cli/commands/init-command.js';
 import { readCrossToolAgents } from '../storage/cross-tool-agents.js';
-import { listProjects, readProjectThread } from '../storage/project-thread-reader.js';
-import { mirrorReplyToThread, renameProject } from '../storage/project-thread-mirror.js';
+import { listProjects, readMergedProjectThread, parseGitHubCloneTarget } from '../storage/project-thread-reader.js';
+import { mirrorReplyToThread, renameProject, setTaskArchived } from '../storage/project-thread-mirror.js';
 import { randomUUID, timingSafeEqual } from 'crypto';
 import { installAgent } from '../orchestration/agent-installer.js';
 import { detectReadiness } from '../orchestration/readiness.js';
 import { getHookMode } from '../hooks/hook-mode.js';
 import { addPermissionEntry, loadPermissions, removePermissionEntry } from '../security/permissions-config.js';
 import { computeSpendToday, estimateCostUsd } from '../cost/spend-aggregator.js';
-import { loadBudget, isOverBudget, budgetUsedPct } from '../cost/budget-config.js';
-// ── Tool definitions ─────────────────────────────────────────────────────────
-const TOOLS = [
-    {
-        name: 'codehere_trust',
-        description: 'Scan a file or code snippet for security vulnerabilities. Returns a trust score 0-100, grade, and plain-English findings. Zero API calls — runs entirely locally.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                filepath: { type: 'string', description: 'Path to file (relative to cwd)' },
-                code: { type: 'string', description: 'Code content to scan (alternative to filepath)' },
-                verbose: { type: 'boolean', description: 'Include all findings with line numbers' },
-            },
-        },
-    },
-    {
-        name: 'codehere_scan',
-        description: 'Scan an instruction, prompt, or command text for injection attacks, credential theft attempts, destructive operations, and other threats. Returns block/allow decision with findings.',
-        inputSchema: {
-            type: 'object',
-            required: ['text'],
-            properties: {
-                text: { type: 'string', description: 'Text to scan (instruction, prompt, command)' },
-            },
-        },
-    },
-    {
-        name: 'codehere_review',
-        description: 'Review all files in a directory and return trust scores. Identifies the riskiest files to focus review effort.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                path: { type: 'string', description: 'Directory path (default: current directory)' },
-                topN: { type: 'number', description: 'Return top N riskiest files (default: 10)' },
-            },
-        },
-    },
-    {
-        name: 'codehere_audit',
-        description: 'Read recent hook audit log entries — shows which tool calls codehere blocked, allowed, or overrode (fail-open paths) in Claude Code sessions. Pass verify:true to instead validate the SHA-256 hash chain and return any tampering detected.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                limit: { type: 'number', description: 'Number of recent entries to return (default: 20)' },
-                blockedOnly: { type: 'boolean', description: 'Only return blocked events' },
-                overrideOnly: {
-                    type: 'boolean',
-                    description: 'Only return trust-override events — cases where the scanner was bypassed (stdin failure, parse failure, --log-only, scan exception). Per CC frontier Q1 (auditable permission trails) — surface every bypass for review.',
-                },
-                verify: {
-                    type: 'boolean',
-                    description: 'Verify the SHA-256 hash chain instead of returning entries. Returns { valid, totalEntries, chainedEntries, legacyEntries, errors[] } where errors lists every detected tampering point (modification / deletion / insertion / parse failure). Per CC frontier Q1 (cryptographic commitment + tamper evidence).',
-                },
-            },
-        },
-    },
-];
+import { loadBudget, saveBudget, isOverBudget, budgetUsedPct } from '../cost/budget-config.js';
+import { loadTeamConfig, saveTeamConfig, initTeamDir, codehereHome, writeMyShare, buildTeamView, } from '../cost/team-ledger.js';
+import { recordOpenOncePerDay, discoverySummary, recruitUrl } from '../discovery/discovery-log.js';
+// ── Brand favicon ────────────────────────────────────────────────────────────
+// Byte-for-byte copy of the landing's app/icon.svg (codehere-landing repo —
+// the brand source of truth, per Ega's standing rule). The gradient-C:
+// orange #ff9a76 → blue #4a90e2, 135° (x1 0%/y1 0% → x2 100%/y2 100%).
+// Embedded so the local-first daemon never hotlinks codehere.uk.
+const BRAND_ICON_SVG = `<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <linearGradient id="gradient" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" style="stop-color:#ff9a76;stop-opacity:1" />
+      <stop offset="100%" style="stop-color:#4a90e2;stop-opacity:1" />
+    </linearGradient>
+  </defs>
+  <text
+    x="16"
+    y="24"
+    font-family="Inter, system-ui, sans-serif"
+    font-size="24"
+    font-weight="900"
+    text-anchor="middle"
+    fill="url(#gradient)"
+  >
+    C
+  </text>
+</svg>
+
+`;
+// ── MCP message types ────────────────────────────────────────────────────────
 // ── Tool handlers ────────────────────────────────────────────────────────────
-import { homedir } from 'os';
+import { homedir, tmpdir } from 'os';
 const controlSessions = new Map();
 let controlSeq = 0;
 /**
@@ -123,7 +106,7 @@ let controlSeq = 0;
  * public key is meant for client-side embedding (analytics tracking key, not
  * a secret) so committing the URL is safe.
  *
- * Why runtime injection instead of editing TASK_HTML/HISTORY_HTML directly:
+ * Why runtime injection instead of editing the page templates directly:
  * the templates stay identical between dev and release builds. The only
  * delta is the env var. This keeps the release surface clean (zero-telemetry
  * value per PRD §1.5 #2 stays intact) while letting elu observe founder
@@ -138,203 +121,6 @@ function withDevElu(html) {
         return html;
     return html.replace('</head>', `${ELU_DEV_SCRIPT}\n</head>`);
 }
-function handleTrust(params) {
-    const { filepath, code, verbose } = params;
-    let content;
-    let label;
-    if (code) {
-        content = code;
-        label = 'provided code';
-    }
-    else if (filepath) {
-        const resolved = join(process.cwd(), filepath);
-        if (!existsSync(resolved)) {
-            return JSON.stringify({ error: `File not found: ${filepath}` });
-        }
-        content = readFileSync(resolved, 'utf-8');
-        label = filepath;
-    }
-    else {
-        return JSON.stringify({ error: 'Provide either filepath or code' });
-    }
-    const result = scoreFileForMCP(label, content);
-    if (!verbose) {
-        // Compact response
-        return JSON.stringify({
-            score: result.score,
-            grade: result.grade,
-            summary: result.summary,
-            criticalCount: result.findings.filter((f) => f.severity === 'critical').length,
-            highCount: result.findings.filter((f) => f.severity === 'high').length,
-            recommendation: result.score >= 75
-                ? 'Safe — minor issues can be addressed in follow-up'
-                : result.score >= 60
-                    ? 'Review recommended before merge'
-                    : 'Block — resolve critical/high findings first',
-        });
-    }
-    return JSON.stringify(result, null, 2);
-}
-function handleScan(params) {
-    const text = String(params.text ?? '');
-    const findings = scanPayload(text);
-    const riskScore = calculateRiskScore(findings);
-    const criticalFindings = findings.filter((f) => f.severity === 'critical');
-    const blocked = criticalFindings.length > 0 || riskScore >= 60;
-    return JSON.stringify({
-        blocked,
-        riskScore,
-        decision: blocked ? 'block' : 'allow',
-        reason: blocked
-            ? criticalFindings.length > 0
-                ? `${criticalFindings[0].category}: ${criticalFindings[0].description}`
-                : `Risk score ${riskScore}/100 exceeds threshold`
-            : 'No threats detected',
-        findings: findings.slice(0, 10), // cap at 10 to keep response small
-    });
-}
-/**
- * Coerce a client-supplied numeric param to a bounded integer. Daemon
- * endpoints take topN/limit straight from request bodies; a negative or NaN
- * value silently corrupts slice() math (limit=-1 → slice keeps all-but-last,
- * NaN → slice returns everything). Clamp to a sane range instead of trusting
- * the wire.
- */
-export function clampInt(v, def, min, max) {
-    // null/undefined = absent → default. Number(null) is 0 (finite), so without
-    // this guard a literal null would coerce to the min instead of the default.
-    if (v === null || v === undefined)
-        return def;
-    const n = Math.floor(Number(v));
-    if (!Number.isFinite(n))
-        return def;
-    return Math.max(min, Math.min(n, max));
-}
-function handleReview(params) {
-    const targetPath = String(params.path ?? process.cwd());
-    const topN = clampInt(params.topN, 10, 1, 100);
-    try {
-        const files = collectFilesForMCP(targetPath);
-        if (files.length === 0) {
-            return JSON.stringify({ message: 'No code files found', path: targetPath });
-        }
-        const results = files.map((f) => scoreFileForMCP(relative(targetPath, f.filepath), f.code));
-        results.sort((a, b) => a.score - b.score); // worst first
-        const top = results.slice(0, topN);
-        const overallScore = Math.round(results.reduce((s, r) => s + r.score, 0) / results.length);
-        return JSON.stringify({
-            overallScore,
-            grade: overallScore >= 90 ? 'A' : overallScore >= 75 ? 'B' : overallScore >= 60 ? 'C' : overallScore >= 40 ? 'D' : 'F',
-            totalFiles: results.length,
-            riskiestFiles: top.map((r) => ({
-                filepath: r.filepath,
-                score: r.score,
-                grade: r.grade,
-                summary: r.summary,
-                criticalCount: r.findings.filter((f) => f.severity === 'critical').length,
-                highCount: r.findings.filter((f) => f.severity === 'high').length,
-            })),
-        });
-    }
-    catch (e) {
-        return JSON.stringify({ error: String(e) });
-    }
-}
-function handleAudit(params) {
-    const limit = clampInt(params.limit, 20, 1, 500);
-    const blockedOnly = Boolean(params.blockedOnly);
-    const overrideOnly = Boolean(params.overrideOnly);
-    const verify = Boolean(params.verify);
-    if (verify) {
-        // Tamper-evidence verification — walks the file, recomputes every hash,
-        // checks the chain. Returns full report including ALL break points.
-        const result = verifyAuditChain(AUDIT_FILE);
-        return JSON.stringify(result, null, 2);
-    }
-    if (!existsSync(AUDIT_FILE)) {
-        return JSON.stringify({
-            message: 'No audit log yet — install hooks first with: codehere hook install',
-            entries: [],
-        });
-    }
-    const lines = readFileSync(AUDIT_FILE, 'utf-8')
-        .split('\n')
-        .filter(Boolean)
-        .slice(-Math.min(limit * 3, 500)); // read more than needed to account for filter
-    const entries = lines
-        .map((l) => {
-        try {
-            return JSON.parse(l);
-        }
-        catch {
-            return null;
-        }
-    })
-        .filter(Boolean)
-        .filter((e) => {
-        if (overrideOnly)
-            return Boolean(e.overrideReason);
-        if (blockedOnly)
-            return Boolean(e.blocked);
-        return true;
-    })
-        .slice(-limit);
-    return JSON.stringify({ entries, total: entries.length });
-}
-// ── JSON-RPC dispatcher ──────────────────────────────────────────────────────
-function dispatch(req) {
-    const id = req.id;
-    const params = (req.params ?? {});
-    try {
-        switch (req.method) {
-            case 'initialize':
-                return {
-                    jsonrpc: '2.0',
-                    id,
-                    result: {
-                        protocolVersion: '2024-11-05',
-                        capabilities: { tools: {} },
-                        serverInfo: { name: 'codehere', version: getVersion() },
-                    },
-                };
-            case 'tools/list':
-                return { jsonrpc: '2.0', id, result: { tools: TOOLS } };
-            case 'tools/call': {
-                const toolName = String(params.name ?? '');
-                const toolParams = (params.arguments ?? {});
-                let content;
-                switch (toolName) {
-                    case 'codehere_trust':
-                        content = handleTrust(toolParams);
-                        break;
-                    case 'codehere_scan':
-                        content = handleScan(toolParams);
-                        break;
-                    case 'codehere_review':
-                        content = handleReview(toolParams);
-                        break;
-                    case 'codehere_audit':
-                        content = handleAudit(toolParams);
-                        break;
-                    default:
-                        return { jsonrpc: '2.0', id, error: { code: -32601, message: `Unknown tool: ${toolName}` } };
-                }
-                return {
-                    jsonrpc: '2.0',
-                    id,
-                    result: { content: [{ type: 'text', text: content }] },
-                };
-            }
-            case 'ping':
-                return { jsonrpc: '2.0', id, result: {} };
-            default:
-                return { jsonrpc: '2.0', id, error: { code: -32601, message: `Method not found: ${req.method}` } };
-        }
-    }
-    catch (e) {
-        return { jsonrpc: '2.0', id, error: { code: -32603, message: String(e) } };
-    }
-}
 const MAX_BODY_SIZE = 2_097_152; // 2 MiB — covers 1MB code-scan payloads + framing
 // v0.8 S2.5 · in-memory map of pending OAuth flows keyed by `state` value.
 // Lifecycle: begin() inserts; callback resolves and removes; entries also
@@ -375,6 +161,20 @@ export function startMCPServer(options = {}) {
     const port = options.port ?? 3773;
     const host = options.host ?? '127.0.0.1'; // localhost only by default
     const token = options.token;
+    // S9 · practice mode starts clean and leaves no residue: when the mock
+    // chain (stable tmp path) is in use, wipe last session's practice chain
+    // and forget its sign-state key — otherwise the stale key reads the fresh
+    // chain as an rm-bypass (a false tamper alarm), and dead keys pile up in
+    // the real keystore. Explicit CODEHERE_AUDIT_FILE (tests) is untouched.
+    if (process.env.CODEHERE_MOCK === '1' && AUDIT_FILE === MOCK_AUDIT_FILE) {
+        try {
+            rmSync(dirname(MOCK_AUDIT_FILE), { recursive: true, force: true });
+            pruneSignState(MOCK_AUDIT_FILE);
+        }
+        catch {
+            /* best-effort — a leftover practice chain never blocks boot */
+        }
+    }
     const server = http.createServer((req, res) => {
         // v0.7 Week-2.2 · CORS for read-only public endpoints.
         // The landing-page daemon-status pill (codehere.uk → 127.0.0.1:3773)
@@ -386,13 +186,22 @@ export function startMCPServer(options = {}) {
         // /api/writepass/:id/:decision, etc.) are NOT covered by this · they
         // remain same-origin-only.
         const url = req.url ?? '';
+        // Query-stripped path for static brand assets — a cache-busted
+        // /icon.svg?v=N must still hit the icon route, not fall to 404.
+        const urlPath = url.split('?')[0];
         const isReadOnlyPublic = url === '/health' ||
             url === '/api/version' ||
             url === '/api/tasks' ||
             url === '/api/host-sessions' ||
             url.startsWith('/api/host-sessions/') ||
-            url.startsWith('/api/audit/stats') ||
-            url.startsWith('/api/readiness/agents');
+            // MED #32 (atomic audit) · this allowlisted '/api/audit/stats', a route
+            // that never existed (CORS headers on a 404). The real read-only route
+            // the footer polls is /api/audit/summary.
+            url.startsWith('/api/audit/summary') ||
+            url.startsWith('/api/readiness/agents') ||
+            // Brand favicon — static public bytes, no state.
+            urlPath === '/icon.svg' ||
+            urlPath === '/favicon.ico';
         if (isReadOnlyPublic) {
             res.setHeader('Access-Control-Allow-Origin', '*');
             res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
@@ -446,7 +255,24 @@ export function startMCPServer(options = {}) {
             res.writeHead(200, { 'Content-Type': 'application/json' });
             // `mock` lets a no-spend tool (verify-all) confirm a daemon is mock BEFORE
             // attaching — so it can refuse to drive a LIVE daemon while claiming "no spend".
-            res.end(JSON.stringify({ status: 'ok', server: 'codehere-mcp', version: getVersion(), tools: TOOLS.length, mock: process.env.CODEHERE_MOCK === '1' }));
+            res.end(JSON.stringify({
+                status: 'ok',
+                server: 'codehere-mcp',
+                version: getVersion(),
+                tools: TOOLS.length,
+                mock: process.env.CODEHERE_MOCK === '1',
+            }));
+            return;
+        }
+        // Brand favicon · S16 one-brand-everywhere. Byte-for-byte copy of the
+        // landing's app/icon.svg (codehere.uk = brand source of truth) — embedded,
+        // never hotlinked, because the product is local-first/offline.
+        // /favicon.ico answers with the same SVG bytes: browsers request it by
+        // default on any tab whose HTML they haven't parsed yet, so the brand
+        // holds even on surfaces a <link rel=icon> hasn't reached.
+        if (req.method === 'GET' && (urlPath === '/icon.svg' || urlPath === '/favicon.ico')) {
+            res.writeHead(200, { 'Content-Type': 'image/svg+xml', 'Cache-Control': 'public, max-age=86400' });
+            res.end(BRAND_ICON_SVG);
             return;
         }
         // v2 Task-Centric PM UI (primary — served at /)
@@ -472,22 +298,24 @@ export function startMCPServer(options = {}) {
             res.end(VERIFY_HTML);
             return;
         }
-        // History / audit feed (what we built Day 0; now secondary)
-        if (req.method === 'GET' && (req.url === '/history' || req.url === '/history/')) {
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(withDevElu(HISTORY_HTML));
-            return;
-        }
-        // v0.6.0 M1 — project thread view; consumes /api/projects + /api/projects/:slug
+        // Legacy v1-era pages DELETED 2026-06-10 (Ega hit /history and called it
+        // what it was). The v1-MVP surface is exactly: / (the v2 dashboard),
+        // /verify, the JSON API, and /mcp. /history's audit feed lives on in the
+        // v2 AUDIT footer + `codehere audit`; /threads' project view IS the v2
+        // goal-first home. Old bookmarks land on the real product, never a relic.
         if (req.method === 'GET' &&
-            (req.url === '/threads' || req.url === '/threads/' || req.url?.startsWith('/threads?'))) {
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(withDevElu(THREAD_HTML));
+            (req.url === '/history' ||
+                req.url === '/history/' ||
+                req.url === '/threads' ||
+                req.url === '/threads/' ||
+                req.url?.startsWith('/threads?'))) {
+            res.writeHead(301, { Location: '/' });
+            res.end();
             return;
         }
-        // Backwards-compat: /ui used to be the Mission Control audit view — now at /history
+        // Backwards-compat: /ui used to be the Mission Control audit view
         if (req.method === 'GET' && (req.url === '/ui' || req.url === '/ui/')) {
-            res.writeHead(302, { Location: '/history' });
+            res.writeHead(302, { Location: '/' });
             res.end();
             return;
         }
@@ -545,7 +373,7 @@ export function startMCPServer(options = {}) {
         // Tails sessions.jsonl and pushes "change" events so the /v2 UI can
         // re-fetch task state instantly instead of waiting 8s for the next poll.
         // Same pattern as /events (audit log tail) but for sessions.
-        const SESSIONS_FILE = join(homedir(), '.codehere', 'sessions.jsonl');
+        const SESSIONS_FILE = join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'sessions.jsonl');
         if (req.method === 'GET' && req.url === '/api/events/sessions') {
             res.writeHead(200, {
                 'Content-Type': 'text/event-stream',
@@ -590,9 +418,46 @@ export function startMCPServer(options = {}) {
                 }
             };
             watchFile(SESSIONS_FILE, { interval: 500 }, onChange);
+            // Live-progress push: sessions.jsonl is only written on spawn + completion,
+            // so disk-watching alone left the room at "0 steps" for the whole run and
+            // then jumped to the outcome (user-#1, 2026-06-07). Steps update in memory;
+            // SessionManager emits a tick when they do. Push it (throttled to ~400ms so
+            // a chatty agent can't flood the stream) so the room watches work live.
+            // Leading-edge throttle: push the FIRST step the instant it lands (no
+            // 400ms wait), then at most every 250ms with a trailing flush for any
+            // steps that arrived during the window. The old trailing-only throttle
+            // delayed the first step and collapsed bursts into one "jump" — the
+            // running view felt batched, not streamed. (Ega dogfood, watch-it-work)
+            let liveTimer = null;
+            let livePending = false;
+            const pushLive = () => {
+                try {
+                    res.write(`data: ${JSON.stringify({ type: 'change' })}\n\n`);
+                }
+                catch {
+                    /* transient */
+                }
+            };
+            const offLive = SessionManager.getInstance().onLiveChange(() => {
+                if (liveTimer) {
+                    livePending = true;
+                    return;
+                }
+                pushLive();
+                liveTimer = setTimeout(() => {
+                    liveTimer = null;
+                    if (livePending) {
+                        livePending = false;
+                        pushLive();
+                    }
+                }, 250);
+            });
             const ping = setInterval(() => res.write(': ping\n\n'), 15000);
             req.on('close', () => {
                 clearInterval(ping);
+                if (liveTimer)
+                    clearTimeout(liveTimer);
+                offLive();
                 unwatchFile(SESSIONS_FILE, onChange);
             });
             return;
@@ -609,9 +474,14 @@ export function startMCPServer(options = {}) {
         if (req.method === 'GET' && req.url === '/api/audit/verify') {
             try {
                 const r = verifyAuditChain();
+                // A walk over zero entries trivially succeeds, so valid:true here would tell the
+                // dashboard "hash chain verified" about a log that does not exist — the same claim
+                // the CLI's --json path was making. Nothing to verify is not the same as verified.
+                const verifiable = r.totalEntries > 0;
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({
-                    valid: r.valid,
+                    valid: verifiable && r.valid,
+                    verifiable,
                     totalEntries: r.totalEntries,
                     chainedEntries: r.chainedEntries,
                     legacyEntries: r.legacyEntries,
@@ -620,7 +490,13 @@ export function startMCPServer(options = {}) {
             }
             catch {
                 res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ valid: true, totalEntries: 0, chainedEntries: 0, legacyEntries: 0, errors: [] }));
+                res.end(JSON.stringify({
+                    valid: false,
+                    totalEntries: 0,
+                    chainedEntries: 0,
+                    legacyEntries: 0,
+                    errors: [{ lineNumber: 0, reason: 'unreadable', detail: 'audit verification failed to run' }],
+                }));
             }
             return;
         }
@@ -689,6 +565,118 @@ export function startMCPServer(options = {}) {
             })();
             return;
         }
+        // Ship-readiness scan — run gitleaks + semgrep on a folder, return the prioritized findings.
+        // Deterministic, no model tokens. Powers the home's "is your app safe to ship?" hook.
+        if (req.method === 'POST' && req.url === '/api/scan') {
+            (async () => {
+                try {
+                    const body = await readBody(req, res);
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(body || '{}');
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON body' }));
+                        return;
+                    }
+                    const dir = resolvePath(String(parsed.dir || '.'));
+                    if (!existsSync(dir) || !statSync(dir).isDirectory()) {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: `Not a folder on this machine: ${dir}` }));
+                        return;
+                    }
+                    const result = shipScan(dir);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(result));
+                }
+                catch (e) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'scan_failed', detail: String(e?.message || e) }));
+                }
+            })();
+            return;
+        }
+        // Fix + prove closed — for now the deterministic exposed-secret fix (move out of code, re-verify).
+        if (req.method === 'POST' && req.url === '/api/fix') {
+            (async () => {
+                try {
+                    const body = await readBody(req, res);
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(body || '{}');
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, message: 'Invalid JSON body' }));
+                        return;
+                    }
+                    const dir = resolvePath(String(parsed.dir || '.'));
+                    if (!existsSync(dir) || !statSync(dir).isDirectory()) {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, message: `Not a folder on this machine: ${dir}` }));
+                        return;
+                    }
+                    // Stream progress: the AI code-fix can take a few minutes, so we send live steps over SSE
+                    // instead of leaving the browser frozen on "Fixing…". The final 'done' event carries the result.
+                    res.writeHead(200, {
+                        'Content-Type': 'text/event-stream',
+                        'Cache-Control': 'no-cache',
+                        Connection: 'keep-alive',
+                        'X-Accel-Buffering': 'no',
+                    });
+                    res.flushHeaders?.();
+                    res.socket?.setNoDelay?.(true);
+                    const send = (obj) => {
+                        try {
+                            res.write(`data: ${JSON.stringify(obj)}\n\n`);
+                        }
+                        catch {
+                            /* client gone — the fix still runs to completion */
+                        }
+                    };
+                    // Yield a tick after each send so the chunk actually leaves the socket before the next
+                    // synchronous scanner (spawnSync) blocks the event loop — otherwise it all flushes at the end.
+                    const flush = () => new Promise((r) => setImmediate(r));
+                    send({ type: 'step', label: 'Looking at your code' });
+                    await flush();
+                    // Route by the top finding: a leaked secret → deterministic move-out (instant, no spend);
+                    // a code danger → AI fix + re-scan proof (uses the Claude Code subscription).
+                    const scan = shipScan(dir);
+                    const top = scan.top;
+                    let result;
+                    if (!top) {
+                        result = { ok: false, provenClosed: false, message: 'No ship-blockers found — nothing to fix.' };
+                    }
+                    else if (top.tool === 'gitleaks') {
+                        send({ type: 'step', label: 'Moving the secret out of your code' });
+                        result = fixExposedSecret(dir);
+                    }
+                    else {
+                        result = await fixCodeVuln(dir, top, (label) => send({ type: 'step', label }));
+                    }
+                    send({ type: 'done', result });
+                    res.end();
+                }
+                catch (e) {
+                    // If the SSE stream already started, headers are sent — emit a done event instead of a new header.
+                    if (res.headersSent) {
+                        try {
+                            res.write(`data: ${JSON.stringify({ type: 'done', result: { ok: false, provenClosed: false, message: 'fix_failed', detail: String(e?.message || e) } })}\n\n`);
+                        }
+                        catch {
+                            /* best effort */
+                        }
+                        res.end();
+                    }
+                    else {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, message: 'fix_failed', detail: String(e?.message || e) }));
+                    }
+                }
+            })();
+            return;
+        }
         if (req.method === 'DELETE' && req.url?.startsWith('/api/permissions?')) {
             const params = new URLSearchParams(req.url.split('?')[1] || '');
             const cwd = params.get('cwd') || '';
@@ -918,7 +906,11 @@ export function startMCPServer(options = {}) {
                 totalCalls: calls.length,
                 blockedCalls: calls.filter((c) => c.blocked).length,
                 criticalCalls: calls.filter((c) => c.criticalFindings > 0).length,
-                chainValid: chain.valid,
+                // Same rule as /api/audit/verify: an empty chain walks clean, so validity is only
+                // meaningful once there is something to walk. The panel needs the third state to
+                // say "nothing recorded yet" instead of picking between verified and broken.
+                chainValid: chain.totalEntries > 0 && chain.valid,
+                chainVerifiable: chain.totalEntries > 0,
                 chainEntries: chain.chainedEntries,
             }));
             return;
@@ -1010,6 +1002,156 @@ export function startMCPServer(options = {}) {
         // returns the new entry's seq + short hash, so the UI can show "logged ·
         // chain continues <hash>" with the REAL hash, not a mockup. Same-origin
         // only (mutating · not in the CORS read-only list).
+        // (helper for the append route) last-10-lines tail scan by identity tuple.
+        function findRecentAuditSeq(sessionId, toolName, timestamp) {
+            try {
+                if (!existsSync(AUDIT_FILE))
+                    return null;
+                const lines = readFileSync(AUDIT_FILE, 'utf-8').trim().split('\n');
+                for (let i = lines.length - 1; i >= 0 && i >= lines.length - 10; i--) {
+                    try {
+                        const e = JSON.parse(lines[i]);
+                        if (e.sessionId === sessionId && e.toolName === toolName && e.timestamp === timestamp) {
+                            return typeof e.seq === 'number' ? e.seq : null;
+                        }
+                    }
+                    catch {
+                        /* skip malformed */
+                    }
+                }
+            }
+            catch {
+                /* unreadable → no match */
+            }
+            return null;
+        }
+        // R1.1 · the daemon as sole audit writer — append endpoint. Loopback-bound
+        // (the server binds 127.0.0.1 by default). Accepts ONLY the pre-chain entry
+        // shape; chain position (seq/prevHash/entryHash) is the DAEMON'S to compute —
+        // a caller supplying any chain field is rejected outright, so an entry
+        // cannot be forge-positioned VIA THIS ENDPOINT (direct file access by the
+        // same uid is R1.2/R1.3's territory). Marks writer:'daemon'. Mirrors
+        // the override route's no-screen-lies rule: success is claimed only after
+        // the entry is CONFIRMED on disk (appendAuditLog is fail-open by design).
+        if (req.method === 'POST' && req.url === '/api/audit/append') {
+            (async () => {
+                try {
+                    const text = await readBody(req, res);
+                    let raw;
+                    try {
+                        raw = JSON.parse(text || '{}');
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'invalid JSON' }));
+                        return;
+                    }
+                    if (typeof raw.auditFile === 'string' && raw.auditFile !== AUDIT_FILE) {
+                        // The caller records into a different audit file than this daemon —
+                        // we are not its recorder. 409 so the hook falls back to a direct
+                        // write into its own chain (R1.2 honest-routing invariant).
+                        res.writeHead(409, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'this daemon records a different audit file' }));
+                        return;
+                    }
+                    delete raw.auditFile; // accepted — not part of the entry shape
+                    if ('seq' in raw || 'prevHash' in raw || 'entryHash' in raw || 'writer' in raw) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            error: 'chain position and writer provenance are computed by the daemon — do not supply seq/prevHash/entryHash/writer',
+                        }));
+                        return;
+                    }
+                    if (typeof raw.sessionId !== 'string' ||
+                        !raw.sessionId ||
+                        typeof raw.toolName !== 'string' ||
+                        !raw.toolName) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'sessionId and toolName are required strings' }));
+                        return;
+                    }
+                    const entry = {
+                        timestamp: typeof raw.timestamp === 'string' && raw.timestamp ? raw.timestamp : new Date().toISOString(),
+                        sessionId: raw.sessionId,
+                        toolName: raw.toolName,
+                        toolInput: typeof raw.toolInput === 'string'
+                            ? raw.toolInput.slice(0, 2000)
+                            : JSON.stringify(raw.toolInput ?? {}).slice(0, 2000),
+                        riskScore: typeof raw.riskScore === 'number' && Number.isFinite(raw.riskScore) ? raw.riskScore : 0,
+                        blocked: raw.blocked === true,
+                        findings: typeof raw.findings === 'number' && Number.isFinite(raw.findings) ? raw.findings : 0,
+                        criticalFindings: typeof raw.criticalFindings === 'number' && Number.isFinite(raw.criticalFindings)
+                            ? raw.criticalFindings
+                            : 0,
+                        // Override provenance is legitimate hook data (R1.2 routes the
+                        // hook's bypass-path entries here) — enum-validated, never free-form.
+                        ...(typeof raw.overrideReason === 'string' &&
+                            [
+                                'stdin_read_failure',
+                                'event_parse_failure',
+                                'scan_exception',
+                                'log_only_mode',
+                                'user_override',
+                                'audit_write_failure',
+                            ].includes(raw.overrideReason)
+                            ? { overrideReason: raw.overrideReason }
+                            : {}),
+                        ...(typeof raw.overrideNote === 'string' && raw.overrideNote.trim()
+                            ? { overrideNote: raw.overrideNote.trim().slice(0, 500) }
+                            : {}),
+                        writer: 'daemon',
+                    };
+                    // Idempotency: a hook may retry after a client-side abort even though
+                    // this daemon already wrote the entry — same (timestamp, sessionId,
+                    // toolName) in the tail means it's already recorded; return its seq
+                    // instead of minting a duplicate row (refuter-demonstrated risk).
+                    const dupSeq = findRecentAuditSeq(entry.sessionId, entry.toolName, entry.timestamp);
+                    if (dupSeq !== null) {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true, seq: dupSeq, idempotent: true }));
+                        return;
+                    }
+                    appendAuditLogDirect(entry);
+                    // Confirm on disk before claiming success (append is fail-open).
+                    let seq = null;
+                    try {
+                        const lines = readFileSync(AUDIT_FILE, 'utf-8').trim().split('\n');
+                        for (let i = lines.length - 1; i >= 0 && i >= lines.length - 10; i--) {
+                            const e = JSON.parse(lines[i]);
+                            if (e.sessionId === entry.sessionId && e.toolName === entry.toolName && e.timestamp === entry.timestamp) {
+                                seq = typeof e.seq === 'number' ? e.seq : null;
+                                break;
+                            }
+                        }
+                    }
+                    catch {
+                        /* unreadable → unconfirmed */
+                    }
+                    if (seq === null) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'append could not be confirmed on disk' }));
+                        return;
+                    }
+                    // R1.3 · sign-at-write: every daemon append advances the signed tip,
+                    // so the protected prefix grows per WRITE, not per session-completion.
+                    // ed25519 sign is sub-ms; fail-open (signing never breaks the append).
+                    signAuditTip(AUDIT_FILE);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true, seq }));
+                }
+                catch (err) {
+                    // readBody may have already 413'd the response before rejecting —
+                    // re-writing headers then would crash embedded callers with
+                    // ERR_HTTP_HEADERS_SENT (refuter caveat c; the /api/permissions
+                    // route's pattern).
+                    if (!res.headersSent) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
+                    }
+                }
+            })();
+            return;
+        }
         if (req.method === 'POST' && req.url === '/api/audit/override') {
             (async () => {
                 try {
@@ -1029,7 +1171,11 @@ export function startMCPServer(options = {}) {
                         res.end(JSON.stringify({ error: 'a reason is required to log an override' }));
                         return;
                     }
-                    appendOverrideAudit('user_override', {
+                    // A failed-task recovery acknowledgement is NOT a security override —
+                    // record it as its own reason so an audit reader can't conflate the
+                    // two (refuter caveat). Default stays user_override.
+                    const reasonType = raw.reasonType === 'recovery_ack' ? 'recovery_ack' : 'user_override';
+                    appendOverrideAudit(reasonType, {
                         sessionId: typeof raw.sessionId === 'string' ? raw.sessionId : 'unknown',
                         toolName: typeof raw.toolName === 'string' ? raw.toolName : 'unknown',
                         note: reason,
@@ -1056,7 +1202,11 @@ export function startMCPServer(options = {}) {
                             catch {
                                 continue;
                             }
-                            if (e.overrideReason === 'user_override' && e.sessionId === wantSid && e.overrideNote === wantNote) {
+                            // S6 · match the reasonType we just wrote — a recovery ack is
+                            // recorded as 'recovery_ack', and matching only 'user_override'
+                            // made the readback miss it: the entry landed but the user was
+                            // told "could not be confirmed".
+                            if (e.overrideReason === reasonType && e.sessionId === wantSid && e.overrideNote === wantNote) {
                                 seq = typeof e.seq === 'number' ? e.seq : null;
                                 entryHash = typeof e.entryHash === 'string' ? e.entryHash : '';
                                 confirmed = true;
@@ -1072,6 +1222,14 @@ export function startMCPServer(options = {}) {
                         res.end(JSON.stringify({ ok: false, error: 'override could not be confirmed in the audit log' }));
                         return;
                     }
+                    // S3 · mirror a confirmed recovery ack into task state so the
+                    // resolved badge survives reload (the chain entry alone is not
+                    // what the recovery card re-renders from).
+                    if (reasonType === 'recovery_ack' && typeof raw.sessionId === 'string') {
+                        const resolvedAt = Date.now();
+                        appendResolved({ id: raw.sessionId, resolvedAt });
+                        SessionManager.getInstance().markPersistedResolved(raw.sessionId, resolvedAt);
+                    }
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({
                         ok: true,
@@ -1198,6 +1356,355 @@ export function startMCPServer(options = {}) {
             }
             return;
         }
+        // GET /api/team — merged team cost+audit ledger for the dashboard hero.
+        // Refreshes THIS machine's snapshot in the team dir (no git push; the CLI
+        // `codehere team` is the active pull/push), then merges every machine's
+        // snapshot. Read-only of the network: nothing leaves the box, the merge is
+        // from the team's own dir. { configured:false } when no team dir is set.
+        if (req.method === 'GET' && req.url === '/api/team') {
+            try {
+                const cfg = loadTeamConfig();
+                if (!cfg.dir) {
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ configured: false }));
+                    return;
+                }
+                try {
+                    writeMyShare(cfg.dir); // refresh this machine's live numbers; best-effort
+                }
+                catch {
+                    /* dir not writable (e.g. missing) — still try to read what's there */
+                }
+                const view = buildTeamView(cfg.dir, cfg.dailyUsd);
+                recordOpenOncePerDay(); // discovery outcome: the lead opened the shared record (deduped per day, best-effort)
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ configured: true, dir: cfg.dir, recruitUrl: recruitUrl(), ...view }));
+            }
+            catch (e) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'team_view_failed', detail: String(e) }));
+            }
+            return;
+        }
+        // GET /api/discovery/summary — the continuous-discovery outcome (record-open
+        // behaviour) read back for the weekly cadence. Read-only, local.
+        if (req.method === 'GET' && req.url === '/api/discovery/summary') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(discoverySummary()));
+            return;
+        }
+        // POST /api/team/init { dir? } — create a team from the dashboard: make +
+        // git-init a shared dir, point at it, write the first snapshot. Same core as
+        // `codehere team init`. Local-first: nothing leaves the box.
+        if (req.method === 'POST' && req.url === '/api/team/init') {
+            (async () => {
+                try {
+                    const raw = await readBody(req, res);
+                    let parsed = {};
+                    try {
+                        parsed = JSON.parse(raw || '{}');
+                    }
+                    catch {
+                        /* empty/invalid body → default dir */
+                    }
+                    const rawDir = parsed.dir && String(parsed.dir).trim();
+                    // "undefined"/"null" are client-bug tripwires, not paths — a Jul-1
+                    // client sent one and six days of shares landed in a cwd-relative
+                    // agent/undefined/. Relative inputs resolve to absolute here.
+                    if (rawDir === 'undefined' || rawDir === 'null') {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            error: 'dir_invalid',
+                            dir: rawDir,
+                            message: 'That dir looks unset (the literal string "' +
+                                rawDir +
+                                '"). Send a real path or omit dir for the default.',
+                        }));
+                        return;
+                    }
+                    const dir = rawDir ? resolvePath(rawDir) : join(codehereHome(), 'team-shared');
+                    initTeamDir(dir);
+                    const cfg = loadTeamConfig();
+                    cfg.dir = dir;
+                    saveTeamConfig(cfg);
+                    try {
+                        writeMyShare(dir);
+                    }
+                    catch {
+                        /* best-effort first snapshot */
+                    }
+                    const view = buildTeamView(dir, cfg.dailyUsd);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ configured: true, dir, ...view }));
+                }
+                catch (e) {
+                    // readBody may have already sent 413 + ended on an oversized body —
+                    // guard so we don't double-write headers (otherwise process-fatal).
+                    if (!res.headersSent) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'team_init_failed', detail: String(e?.message || e) }));
+                    }
+                }
+            })();
+            return;
+        }
+        // POST /api/team/set-dir { dir } — point at an EXISTING shared team dir (a
+        // member who cloned the team repo, or a lead pointing at a shared drive).
+        if (req.method === 'POST' && req.url === '/api/team/set-dir') {
+            (async () => {
+                try {
+                    const raw = await readBody(req, res);
+                    let parsed = {};
+                    try {
+                        parsed = JSON.parse(raw || '{}');
+                    }
+                    catch {
+                        /* fall through to validation */
+                    }
+                    const rawDir = parsed.dir ? String(parsed.dir).trim() : '';
+                    if (!rawDir || rawDir === 'undefined' || rawDir === 'null') {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            error: 'dir_required',
+                            message: 'Provide { dir } — the shared team folder.' +
+                                (rawDir ? ' (got the literal string "' + rawDir + '" — a client-side unset variable)' : ''),
+                        }));
+                        return;
+                    }
+                    const dir = resolvePath(rawDir); // relative input would pin the record to a cwd
+                    if (!existsSync(dir)) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            error: 'dir_not_found',
+                            dir,
+                            message: 'That folder does not exist. Clone the team repo first, or use /api/team/init.',
+                        }));
+                        return;
+                    }
+                    const cfg = loadTeamConfig();
+                    cfg.dir = dir;
+                    saveTeamConfig(cfg);
+                    try {
+                        writeMyShare(dir);
+                    }
+                    catch {
+                        /* best-effort */
+                    }
+                    const view = buildTeamView(dir, cfg.dailyUsd);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ configured: true, dir, ...view }));
+                }
+                catch (e) {
+                    if (!res.headersSent) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'team_setdir_failed', detail: String(e?.message || e) }));
+                    }
+                }
+            })();
+            return;
+        }
+        // POST /api/github/connect/start — begin the OAuth device flow. Returns the
+        // user code + verification URL to show the user; the deviceCode round-trips
+        // back on /poll (server stays stateless). Needs codehere's GitHub OAuth App
+        // client_id (CODEHERE_GITHUB_CLIENT_ID); no secret, local-first.
+        if (req.method === 'POST' && req.url === '/api/github/connect/start') {
+            (async () => {
+                const clientId = githubClientId();
+                if (!clientId) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        error: 'github_not_configured',
+                        message: "GitHub isn't set up yet: set CODEHERE_GITHUB_CLIENT_ID to codehere's OAuth App client id.",
+                    }));
+                    return;
+                }
+                try {
+                    const dc = await requestDeviceCode(clientId);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        userCode: dc.userCode,
+                        verificationUri: dc.verificationUri,
+                        deviceCode: dc.deviceCode,
+                        intervalSec: dc.intervalSec,
+                        expiresInSec: dc.expiresInSec,
+                    }));
+                }
+                catch (e) {
+                    res.writeHead(502, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'github_device_code_failed', detail: String(e?.message || e) }));
+                }
+            })();
+            return;
+        }
+        // POST /api/github/connect/poll {deviceCode} — poll once for the token. On
+        // success the token is persisted under 'github' via oauth-store. The client
+        // repeats at intervalSec until status is connected or error.
+        if (req.method === 'POST' && req.url === '/api/github/connect/poll') {
+            (async () => {
+                const clientId = githubClientId();
+                if (!clientId) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'github_not_configured' }));
+                    return;
+                }
+                try {
+                    const body = await readBody(req, res);
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(body || '{}');
+                    }
+                    catch (e) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON body', detail: String(e) }));
+                        return;
+                    }
+                    const deviceCode = parsed.deviceCode;
+                    if (!deviceCode || typeof deviceCode !== 'string') {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'deviceCode (string) required' }));
+                        return;
+                    }
+                    const outcome = await pollForToken(clientId, deviceCode);
+                    if (outcome.status === 'connected') {
+                        saveToken(outcome.token);
+                    }
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify(outcome.status === 'connected' ? { status: 'connected', scope: outcome.token.scope } : outcome));
+                }
+                catch {
+                    if (process.env.CODEHERE_DEBUG === '1')
+                        console.error('[codehere] github poll readBody rejected');
+                }
+            })();
+            return;
+        }
+        // POST /api/github/issue-to-task {ref} | {repo, issueNumber} — fetch the
+        // issue via the stored token and return a ready task prompt + issue metadata.
+        // The client spawns it through the existing POST /api/task (one proven path).
+        if (req.method === 'POST' && req.url === '/api/github/issue-to-task') {
+            (async () => {
+                const tok = loadToken('github');
+                if (!tok?.accessToken) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'github_not_connected', message: 'Connect GitHub first.' }));
+                    return;
+                }
+                try {
+                    const body = await readBody(req, res);
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(body || '{}');
+                    }
+                    catch (e) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON body', detail: String(e) }));
+                        return;
+                    }
+                    const refStr = parsed.ref || (parsed.repo && parsed.issueNumber ? `${parsed.repo}#${parsed.issueNumber}` : '');
+                    const ref = parseRepoRef(refStr);
+                    if (!ref || ref.number === undefined) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            error: 'bad_ref',
+                            message: 'Provide ref ("owner/repo#123" or an issue URL) or repo + issueNumber.',
+                        }));
+                        return;
+                    }
+                    const issue = await fetchIssue(tok.accessToken, ref.owner, ref.repo, ref.number);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ prompt: issueToTaskPrompt(issue), issue }));
+                }
+                catch (e) {
+                    res.writeHead(502, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'github_issue_fetch_failed', detail: String(e?.message || e) }));
+                }
+            })();
+            return;
+        }
+        // POST /api/github/post-result {text|ref, body} — comment the agent's result
+        // back on the source GitHub issue. ref ("owner/repo#123") OR text (the task
+        // prompt, from which the issue link is parsed). Non-destructive (no branches).
+        if (req.method === 'POST' && req.url === '/api/github/post-result') {
+            (async () => {
+                const tok = loadToken('github');
+                if (!tok?.accessToken) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'github_not_connected', message: 'Connect GitHub first.' }));
+                    return;
+                }
+                try {
+                    const raw = await readBody(req, res);
+                    let parsed;
+                    try {
+                        parsed = JSON.parse(raw || '{}');
+                    }
+                    catch (e) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON body', detail: String(e) }));
+                        return;
+                    }
+                    const ref = parsed.ref ? parseRepoRef(parsed.ref) : issueRefFromText(parsed.text || '');
+                    if (!ref || ref.number === undefined) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'no_issue_ref', message: 'No GitHub issue found in ref/text.' }));
+                        return;
+                    }
+                    const comment = (parsed.body || '').trim();
+                    if (!comment) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'empty_body', message: 'body (the result comment) is required.' }));
+                        return;
+                    }
+                    const r = await commentOnIssue(tok.accessToken, ref.owner, ref.repo, ref.number, comment);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ htmlUrl: r.htmlUrl, issue: `${ref.owner}/${ref.repo}#${ref.number}` }));
+                }
+                catch (e) {
+                    res.writeHead(502, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'github_comment_failed', detail: String(e?.message || e) }));
+                }
+            })();
+            return;
+        }
+        // GET /api/github/status — does the composer/import panel have a connected
+        // GitHub to work with? Cheap, no network: reads the stored token + whether a
+        // client_id is even configured (so the UI can show "connect" vs "set it up").
+        if (req.method === 'GET' && req.url === '/api/github/status') {
+            const tok = loadToken('github');
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ connected: !!tok?.accessToken, clientIdConfigured: !!githubClientId() }));
+            return;
+        }
+        // GET /api/github/issues?repo=owner/repo — list open issues so the user can
+        // PICK one instead of typing "owner/repo#123" from memory. Uses the stored
+        // device-flow token (loadToken). PRs are filtered out in listIssues.
+        if (req.method === 'GET' && req.url?.startsWith('/api/github/issues')) {
+            (async () => {
+                const tok = loadToken('github');
+                if (!tok?.accessToken) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'github_not_connected', message: 'Connect GitHub first.' }));
+                    return;
+                }
+                const repoParam = new URL(req.url || '', 'http://localhost').searchParams.get('repo') || '';
+                const ref = parseRepoRef(repoParam);
+                if (!ref) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'bad_repo', message: 'Provide repo as owner/repo.' }));
+                    return;
+                }
+                try {
+                    const issues = await listIssues(tok.accessToken, ref.owner, ref.repo);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ repo: `${ref.owner}/${ref.repo}`, issues }));
+                }
+                catch (e) {
+                    res.writeHead(502, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'github_issues_failed', detail: String(e?.message || e) }));
+                }
+            })();
+            return;
+        }
         // ── F1a readiness check ───────────────────────────────────────────────────
         if (req.method === 'GET' && req.url === '/api/readiness') {
             try {
@@ -1211,6 +1718,71 @@ export function startMCPServer(options = {}) {
             }
             return;
         }
+        // ── v1 project-memory routes (the room's init nudge) ─────────────────────
+        // Found by the stranger walk: web-only users never run `codehere init`, so
+        // the spec's "agent remembers the project" half of nothing-lost silently
+        // doesn't apply. Status reports the SAME readiness the injector acts on
+        // (shared findProjectRoot); init runs the SAME hardened scaffold the CLI
+        // does (shared scaffoldProjectAt — symlink defenses included).
+        if (req.method === 'GET' && req.url?.startsWith('/api/memory/status')) {
+            try {
+                const u = new URL(req.url, `http://${req.headers.host || '127.0.0.1'}`);
+                const cwd = u.searchParams.get('cwd') || '';
+                if (!cwd || !isAbsolute(cwd) || cwd.includes('\0')) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'cwd (absolute path) required' }));
+                    return;
+                }
+                const root = findProjectRoot(cwd);
+                const ready = !!root && existsSync(join(root, '.codehere', 'memory', 'working'));
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ready, projectRoot: root }));
+            }
+            catch (e) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'memory_status_failed', detail: String(e) }));
+            }
+            return;
+        }
+        if (req.method === 'POST' && req.url === '/api/memory/init') {
+            (async () => {
+                try {
+                    const body = await readBody(req, res);
+                    let cwd = '';
+                    try {
+                        cwd = String(JSON.parse(body || '{}').cwd || '');
+                    }
+                    catch {
+                        /* falls through to the validation below */
+                    }
+                    if (!cwd || !isAbsolute(cwd) || cwd.includes('\0') || !existsSync(cwd) || !statSync(cwd).isDirectory()) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'cwd (absolute path to an existing directory) required' }));
+                        return;
+                    }
+                    const r = scaffoldProjectAt(cwd);
+                    if (!r.ok) {
+                        res.writeHead(409, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: false, reason: r.reason }));
+                        return;
+                    }
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        ok: true,
+                        created: r.created.length,
+                        skipped: r.skipped.length,
+                        refused: r.refused.length + r.refusedDirs.length,
+                    }));
+                }
+                catch (e) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'memory_init_failed', detail: String(e) }));
+                }
+            })().catch(() => {
+                /* handled above — keep the route from rejecting unhandled */
+            });
+            return;
+        }
         // ── v0.6.0 M1 project thread routes ──────────────────────────────────────
         // GET /api/projects           — list all known projects (slug, cwd, title, taskCount, lastActivityAt)
         // GET /api/projects/:slug     — single project thread (meta + tasks merged by sessionId)
@@ -1218,7 +1790,19 @@ export function startMCPServer(options = {}) {
         // populated by migration + forward-mirror). Drives the new thread-view UI.
         if (req.method === 'GET' && req.url === '/api/projects') {
             try {
-                const projects = listProjects();
+                // Drop ephemeral/dead projects from the board: a "project" rooted in a throwaway temp dir
+                // (eval/test harnesses), with no local path at all, or whose dirs are all gone, isn't real
+                // work the user can open. Same temp-dir rule as the /api/tasks filter, plus an existence check.
+                const tmpRoot = tmpdir().replace(/^\/private/, '');
+                const isEphemeralPath = (cwd) => {
+                    if (!cwd)
+                        return true;
+                    const norm = cwd.replace(/^\/private/, '');
+                    if (norm === tmpRoot || norm.startsWith(tmpRoot + '/') || norm === '/tmp' || norm.startsWith('/tmp/'))
+                        return true;
+                    return !existsSync(cwd); // a project whose directory is gone isn't workable
+                };
+                const projects = listProjects().filter((p) => (p.localPaths || []).some((c) => !isEphemeralPath(c)));
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ projects }));
             }
@@ -1239,14 +1823,33 @@ export function startMCPServer(options = {}) {
                     res.end(JSON.stringify({ error: 'invalid_slug' }));
                     return;
                 }
-                const thread = readProjectThread(slug);
+                // Merge clones so the room shows the repo's FULL history, and attach per-task
+                // cost (same estimator as /api/tasks) so the conversation rows carry their bill.
+                const thread = readMergedProjectThread(slug);
                 if (!thread) {
                     res.writeHead(404, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ error: 'project_not_found', slug }));
                     return;
                 }
+                const tasksWithCost = thread.tasks.map((t) => {
+                    // F-07 / R11 · the same single verdict object /api/tasks serves — the
+                    // room UI reads THIS route, and without it no persisted task could
+                    // ever show its trust verdict (found live: 465 tasks, 0 verdicts).
+                    const verdict = composeVerdict({ finalReport: t.finalReport ?? undefined, artifacts: t.artifacts, steps: t.steps }, t.auditRecon);
+                    const u = t.artifacts?.usage;
+                    if (!u || (!u.inputTokens && !u.outputTokens))
+                        return { ...t, verdict };
+                    const usd = estimateCostUsd(String(t.agent || ''), {
+                        inputTokens: u.inputTokens || 0,
+                        outputTokens: u.outputTokens || 0,
+                        cacheReadTokens: u.cacheReadTokens,
+                        cacheCreationTokens: u.cacheCreationTokens,
+                        model: u.model,
+                    });
+                    return { ...t, verdict, cost: { spent: usd * 100, paid: usd > 0 } };
+                });
                 res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ thread }));
+                res.end(JSON.stringify({ thread: { ...thread, tasks: tasksWithCost } }));
             }
             catch (e) {
                 res.writeHead(500, { 'Content-Type': 'application/json' });
@@ -1304,6 +1907,171 @@ export function startMCPServer(options = {}) {
             })();
             return;
         }
+        // POST /api/projects/:slug/archive — body { sessionId, archived } — soft-delete /
+        // restore a task. Append-only + audit-safe (the task record is never deleted).
+        if (req.method === 'POST' && req.url?.match(/^\/api\/projects\/[^/]+\/archive$/)) {
+            const slug = req.url.split('/')[3];
+            (async () => {
+                try {
+                    const body = await readBody(req, res);
+                    let parsed;
+                    try {
+                        const raw = JSON.parse(body);
+                        if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'invalid_body' }));
+                            return;
+                        }
+                        parsed = raw;
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'invalid_json' }));
+                        return;
+                    }
+                    if (typeof parsed.sessionId !== 'string') {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'sessionId_required' }));
+                        return;
+                    }
+                    const result = setTaskArchived(slug, parsed.sessionId, parsed.archived === true);
+                    if (!result.ok) {
+                        let status = 400;
+                        if (result.error === 'Project not found')
+                            status = 404;
+                        else if (result.error === 'Write failed')
+                            status = 500;
+                        res.writeHead(status, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: result.error }));
+                        return;
+                    }
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true, sessionId: parsed.sessionId, archived: parsed.archived === true }));
+                }
+                catch {
+                    if (process.env.CODEHERE_DEBUG === '1')
+                        console.error('[codehere] readBody rejected (oversized or aborted)');
+                }
+            })();
+            return;
+        }
+        // POST /api/budget — body { dailyUsd: number | null } — set the daily spend cap
+        // (null/0 disables). Used by first-time setup so the cost-bounded promise is real
+        // from minute one; same store the `codehere budget set` CLI writes.
+        if (req.method === 'POST' && req.url === '/api/budget') {
+            (async () => {
+                try {
+                    const body = await readBody(req, res);
+                    let parsed;
+                    try {
+                        const raw = JSON.parse(body);
+                        if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'invalid_body' }));
+                            return;
+                        }
+                        parsed = raw;
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'invalid_json' }));
+                        return;
+                    }
+                    let dailyUsd;
+                    if (parsed.dailyUsd === null || parsed.dailyUsd === 0) {
+                        dailyUsd = null; // disable enforcement
+                    }
+                    else if (typeof parsed.dailyUsd === 'number' && Number.isFinite(parsed.dailyUsd) && parsed.dailyUsd > 0) {
+                        dailyUsd = parsed.dailyUsd;
+                    }
+                    else {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'dailyUsd must be a positive number, 0, or null' }));
+                        return;
+                    }
+                    const cfg = loadBudget();
+                    cfg.dailyUsd = dailyUsd;
+                    saveBudget(cfg);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true, dailyUsd }));
+                }
+                catch {
+                    if (process.env.CODEHERE_DEBUG === '1')
+                        console.error('[codehere] readBody rejected (oversized or aborted)');
+                }
+            })();
+            return;
+        }
+        // POST /api/projects/clone  — { url } → clone a GitHub repo locally, return its cwd.
+        // The room opens from a cwd; the project record auto-creates on the first task
+        // spawned there. Clone target is ~/codehere-projects/<repo> (visible, predictable).
+        // Idempotent: if that dir already holds the same repo, we open it instead of
+        // re-cloning. Async (execFile, not execFileSync) so a slow clone never freezes
+        // the daemon. Uses the user's existing git auth — fails open with a plain reason.
+        if (req.method === 'POST' && req.url === '/api/projects/clone') {
+            (async () => {
+                try {
+                    const body = await readBody(req, res);
+                    let parsed;
+                    try {
+                        const raw = JSON.parse(body);
+                        if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'invalid_body' }));
+                            return;
+                        }
+                        parsed = raw;
+                    }
+                    catch {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'invalid_json' }));
+                        return;
+                    }
+                    const baseDir = join(process.env.CODEHERE_CLONE_DIR || join(homedir(), 'codehere-projects'));
+                    const target = parseGitHubCloneTarget(typeof parsed.url === 'string' ? parsed.url : '', baseDir);
+                    if (!target.ok) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: target.error }));
+                        return;
+                    }
+                    // Already cloned here? Open it (idempotent), don't re-clone.
+                    if (existsSync(join(target.dir, '.git'))) {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true, cwd: target.dir, repo: target.repo, alreadyHere: true }));
+                        return;
+                    }
+                    if (existsSync(target.dir)) {
+                        res.writeHead(409, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'dir_exists', detail: target.dir }));
+                        return;
+                    }
+                    mkdirSync(baseDir, { recursive: true });
+                    try {
+                        // `--` ends option parsing: a cloneUrl beginning with '-' is then a
+                        // positional, never read by git as a flag (defense even though execFile
+                        // already avoids a shell). --config protocol.ext.allow=never blocks the
+                        // ext:: transport (git's RCE vector) belt-and-suspenders to the parser.
+                        await promisify(execFile)('git', ['-c', 'protocol.ext.allow=never', 'clone', '--depth', '1', '--', target.cloneUrl, target.dir], {
+                            timeout: 120000,
+                            maxBuffer: 8 * 1024 * 1024,
+                        });
+                    }
+                    catch (cloneErr) {
+                        const msg = String(cloneErr?.stderr || cloneErr?.message || cloneErr).slice(0, 400);
+                        res.writeHead(502, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'clone_failed', detail: msg }));
+                        return;
+                    }
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true, cwd: target.dir, repo: target.repo }));
+                }
+                catch {
+                    if (process.env.CODEHERE_DEBUG === '1')
+                        console.error('[codehere] clone readBody rejected');
+                }
+            })();
+            return;
+        }
         // ── F1 task orchestration routes ─────────────────────────────────────────
         // POST /api/task               — { prompt, cwd? } → { sessionId }
         // GET  /api/tasks              — list all sessions
@@ -1352,6 +2120,10 @@ export function startMCPServer(options = {}) {
                         const batchBudget = loadBudget();
                         const batchSpendNow = batchBudget.dailyUsd !== null ? computeSpendToday().totalUsd : 0;
                         const results = [];
+                        const seenCwds = new Set();
+                        // It-4 V1-MULTITASK — one batch call = one parent; children share
+                        // the batchId so the room can render a live-derived rollup row.
+                        const batchId = randomUUID();
                         for (const t of tasks) {
                             const prompt = t.prompt;
                             if (!prompt || typeof prompt !== 'string') {
@@ -1372,6 +2144,42 @@ export function startMCPServer(options = {}) {
                                     results.push({ error: 'cwd must be absolute, no NUL bytes', agent: agentId });
                                     continue;
                                 }
+                                let tCwdIsDir = false;
+                                try {
+                                    tCwdIsDir = statSync(t.cwd).isDirectory();
+                                }
+                                catch {
+                                    /* missing path */
+                                }
+                                if (!tCwdIsDir) {
+                                    results.push({
+                                        error: `That folder doesn't exist on this machine: ${t.cwd.slice(0, 200)}`,
+                                        agent: agentId,
+                                    });
+                                    continue;
+                                }
+                            }
+                            // The batch contract is "independent files only — non-overlapping
+                            // cwds" (W2). It was a comment, not a guard (AUD audit 2026-06-07):
+                            // two tasks on the same cwd both spawned, racing writes on one
+                            // repo path. Enforce it per task; undefined cwds share one key.
+                            // Literal-string guard, not canonicalized — '/tmp' vs '/private/tmp'
+                            // aren't deduped; this catches the paste-same-path-twice footgun.
+                            // readOnly tasks (the @all fanout: same QUESTION to every ready
+                            // adapter) are exempt — read concurrency was never the race this
+                            // guard stops. Caller-asserted, like the rest of the batch
+                            // contract; write fanout stays blocked until worktree isolation.
+                            const readOnly = t.readOnly === true;
+                            const cwdKey = t.cwd ?? '<daemon-cwd>';
+                            if (!readOnly) {
+                                if (seenCwds.has(cwdKey)) {
+                                    results.push({
+                                        error: `cwd already used by another task in this batch (${cwdKey.slice(0, 200)}) — batch tasks must target independent folders`,
+                                        agent: agentId,
+                                    });
+                                    continue;
+                                }
+                                seenCwds.add(cwdKey);
                             }
                             // Per-task budget check (paid agents only).
                             if (batchBudget.dailyUsd !== null) {
@@ -1387,7 +2195,7 @@ export function startMCPServer(options = {}) {
                                 }
                             }
                             try {
-                                const session = manager.spawn(prompt, agentId, { cwd: t.cwd });
+                                const session = manager.spawn(prompt, agentId, { cwd: t.cwd, batchId });
                                 results.push({
                                     sessionId: session.sessionId,
                                     agent: session.agent,
@@ -1470,6 +2278,27 @@ export function startMCPServer(options = {}) {
                                 }));
                                 return;
                             }
+                            // R7 onboarding fix (2026-06-07): an explicitly-picked vendor that
+                            // readiness already KNOWS isn't usable (aider without a billed key,
+                            // gemini without auth) used to accept the spawn and fail generically
+                            // afterwards. Refuse upfront with the same plain-English hint the
+                            // squad bar shows. Mock mode skips (mock spawns run regardless);
+                            // conductor routes around readiness itself; states readiness can't
+                            // detect (claude subscription auth) still rely on post-spawn
+                            // error fingerprints by design.
+                            if (process.env.CODEHERE_MOCK !== '1' && agentId !== 'conductor') {
+                                const ready = readinessForAllAgents().find((a) => a.id === agentId);
+                                if (ready && ready.state !== 'ready') {
+                                    const hint = ready.authHint?.detail;
+                                    res.writeHead(409, { 'Content-Type': 'application/json' });
+                                    res.end(JSON.stringify({
+                                        error: 'agent_not_ready',
+                                        state: ready.state,
+                                        message: `${ready.label} isn't ready on this machine (${String(ready.state).replace(/_/g, ' ')}).${hint ? ' ' + hint : ''} Pick another agent, or fix the setup and retry.`,
+                                    }));
+                                    return;
+                                }
+                            }
                             // Path-traversal + null-byte defense · cwd must be absolute and
                             // free of NUL bytes (some filesystems treat \0 as terminator).
                             if (cwd !== undefined) {
@@ -1478,11 +2307,33 @@ export function startMCPServer(options = {}) {
                                     res.end(JSON.stringify({ error: 'cwd must be an absolute path with no NUL bytes' }));
                                     return;
                                 }
+                                // Lane J S3 (2026-06-07 audit): a nonexistent cwd returned 200
+                                // and the task hung "running" forever — empty steps, no error,
+                                // nothing on the stream. Fail at intake with a human answer.
+                                let cwdIsDir = false;
+                                try {
+                                    cwdIsDir = statSync(cwd).isDirectory();
+                                }
+                                catch {
+                                    /* missing path */
+                                }
+                                if (!cwdIsDir) {
+                                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                                    res.end(JSON.stringify({
+                                        error: `That folder doesn't exist on this machine: ${cwd.slice(0, 200)} — check the path and try again.`,
+                                    }));
+                                    return;
+                                }
                             }
                             const budgetForSpawn = loadBudget();
                             if (budgetForSpawn.dailyUsd !== null) {
                                 const probe = estimateCostUsd(agentId, { inputTokens: 1, outputTokens: 1 });
-                                const isPaidSpawn = probe > 0;
+                                // Conductor (the auto router) is NOT refused here — it self-manages
+                                // by failing over to a free agent when over budget (Ega-approved
+                                // 2026-06-08), refusing only if no free agent is ready. Explicit
+                                // paid-agent picks ARE refused (respect the choice + never spend
+                                // over budget). See spawnConductor's budgetBounded routing.
+                                const isPaidSpawn = probe > 0 && agentId !== 'conductor';
                                 if (isPaidSpawn) {
                                     const todaySpend = computeSpendToday();
                                     if (isOverBudget(todaySpend.totalUsd, budgetForSpawn)) {
@@ -1526,7 +2377,13 @@ export function startMCPServer(options = {}) {
                                 // enrichment instead of failing outright.
                                 console.error('[context-source] resolver failed:', e instanceof Error ? e.message : String(e));
                             }
-                            const session = manager.spawn(promptForSpawn, agentId, { cwd });
+                            const parentSessionId = typeof parsed.parentSessionId === 'string' && parsed.parentSessionId
+                                ? parsed.parentSessionId
+                                : undefined;
+                            const session = manager.spawn(promptForSpawn, agentId, {
+                                cwd,
+                                ...(parentSessionId ? { parentSessionId } : {}),
+                            });
                             res.writeHead(200, { 'Content-Type': 'application/json' });
                             res.end(JSON.stringify({
                                 sessionId: session.sessionId,
@@ -1555,52 +2412,144 @@ export function startMCPServer(options = {}) {
                 return;
             }
             if (req.method === 'GET' && req.url === '/api/tasks') {
+                // Tier 0.1 · a MOCK run fabricates its own artifacts, so verify-claim
+                // compares the synthetic report to the synthetic artifacts and the green
+                // "verified" is tautological — it proves wiring, not a real result. Flag
+                // real mock RUNS so the surface says "wiring only". Seeded demo-* sessions
+                // are deliberate showcases (and the /verify coverage fixture) — left green.
+                // S18 · classification holds on the RECORD: appendSpawned stamps mockRun
+                // at run time, so a daemon restart / mode flip never reclassifies
+                // history. Legacy persisted records written before the stamp are
+                // recovered on read from the mock adapter's own resume token
+                // (recordedMockRun in session-persistence). The env stamp below applies
+                // only to (a) in-memory sessions of THIS daemon (env == record by
+                // definition) and (b) legacy records with neither stamp nor token —
+                // genuinely no other signal exists for those.
+                const mockDaemon = process.env.CODEHERE_MOCK === '1' || process.env.CODEHERE_MOCK === 'true';
+                const isMockRun = (id) => mockDaemon && !id.startsWith('demo-');
+                // Per-task bill · the card already shows steps/files/verdict but never the
+                // cost (it read t.cost, which nothing populated). Derive it from the task's
+                // own token usage so "what each agent did" includes "what it cost" inline.
+                // cents (sub-cent precision kept; costPill formats). undefined when there's
+                // no usage data — never fabricate a $0.
+                const costFor = (agent, artifacts) => {
+                    const u = artifacts?.usage;
+                    if (!u || (!u.inputTokens && !u.outputTokens))
+                        return undefined;
+                    const usd = estimateCostUsd(String(agent || ''), {
+                        inputTokens: u.inputTokens || 0,
+                        outputTokens: u.outputTokens || 0,
+                        cacheReadTokens: u.cacheReadTokens,
+                        cacheCreationTokens: u.cacheCreationTokens,
+                        model: u.model,
+                    });
+                    return { spent: usd * 100, paid: usd > 0 };
+                };
                 const spawned = manager.list().map((s) => {
                     const completedAt = manager.getCompletedAt(s.sessionId);
                     const finalReport = manager.getFinalReport(s.sessionId);
+                    const acceptanceCriteria = manager.getAcceptanceCriteria(s.sessionId);
                     const cwd = manager.getCwd(s.sessionId);
                     const continuedFrom = manager.getContinuedFrom(s.sessionId);
                     const continuedAs = manager.getContinuedAs(s.sessionId);
+                    const recoveredFrom = manager.getRecoveredFrom(s.sessionId);
+                    const auditRecon = manager.getAuditRecon(s.sessionId);
+                    const batchId = manager.getBatchId(s.sessionId);
+                    const delegatedTo = manager.getDelegatedTo(s.sessionId);
                     const failedReport = manager.hasFailedReport(s.sessionId);
                     const stalledReason = manager.getStallReason(s.sessionId);
-                    // F-07 · verifier-agent block · run claim vs reality on every task.
-                    // Pure function, no I/O, runs sync · cheap to do per request.
-                    // The UI renders the verdict + findings inline below the Summary.
-                    const verifyResult = verifyClaim({
-                        summary: finalReport?.summary,
-                        artifacts: s.artifacts,
-                        steps: s.steps,
-                    });
+                    // F-07 / R11 · the session's honesty verdict, ONE object owned by the
+                    // VerdictService: claim-vs-reality + audit-vs-disk reconciliation.
+                    // Pure, no I/O, runs sync · cheap to do per request. The UI renders
+                    // verdict.claim + verdict.audit without re-joining anything.
+                    const verdict = composeVerdict({ finalReport, artifacts: s.artifacts, steps: s.steps }, auditRecon);
+                    const cost = costFor(s.agent, s.artifacts);
                     return {
                         sessionId: s.sessionId,
-                        prompt: s.prompt,
+                        prompt: manager.getDisplayPrompt(s.sessionId) ?? s.prompt,
                         startedAt: s.startedAt,
                         status: s.status,
                         agent: s.agent,
                         steps: s.steps ?? [],
                         artifacts: s.artifacts,
+                        ...(cost ? { cost } : {}),
                         ...(completedAt !== undefined ? { completedAt, durationMs: completedAt - s.startedAt } : {}),
                         ...(finalReport !== undefined ? { finalReport } : {}),
+                        ...(acceptanceCriteria && acceptanceCriteria.length ? { acceptanceCriteria } : {}),
                         ...(failedReport ? { failedReport: true } : {}),
                         ...(stalledReason ? { stalledReason } : {}),
-                        verifyResult,
+                        verdict,
                         canAppendMessage: s.canAppendMessage === true,
+                        // S1 · the server is the single source of truth on whether a
+                        // follow-up can actually be DELIVERED — the UI renders from this,
+                        // never guesses.
+                        canFollowUp: s.canAppendMessage === true,
                         ...(cwd !== undefined ? { cwd } : {}),
                         ...(continuedFrom !== undefined ? { continuedFrom } : {}),
                         ...(continuedAs !== undefined ? { continuedAs } : {}),
+                        // Recovery lineage → activates the dashboard "recovered from <vendor>"
+                        // badge + the failover kicker (gemini → claude · QUOTA · COMPLETED).
+                        ...(recoveredFrom !== undefined
+                            ? { failoverFrom: recoveredFrom.agent, failoverTo: s.agent, failoverReason: recoveredFrom.reason }
+                            : {}),
+                        ...(batchId !== undefined ? { batchId } : {}),
+                        ...(delegatedTo !== undefined ? { delegatedTo } : {}),
+                        ...(isMockRun(s.sessionId) ? { mockRun: true } : {}),
                         provenance: 'spawned',
                     };
                 });
                 const activeAgents = manager.listActiveAgents();
-                // F-07 · attach verifyResult to persisted records too · same logic.
+                // F-07 / R11 · persisted records get the same single verdict object.
+                // 2.2 · the audit reconciliation now PERSISTS (appendAuditRecon), so a
+                // reloaded session carries its OBSERVED signal and the composite grade
+                // can still earn green after a restart — not just live in-memory tasks.
                 const persisted = manager.listPersisted().map((p) => ({
                     ...p,
-                    verifyResult: verifyClaim({
-                        summary: p.finalReport?.summary,
-                        artifacts: p.artifacts,
-                        steps: p.steps,
-                    }),
+                    verdict: composeVerdict(p, p.auditRecon),
+                    ...(costFor(p.agent, p.artifacts) ? { cost: costFor(p.agent, p.artifacts) } : {}),
+                    // S18 · the durable record (carried by ...p) wins; the env stamp is
+                    // only the fallback for legacy records that predate the run-time stamp.
+                    ...(p.mockRun === undefined && isMockRun(p.sessionId) ? { mockRun: true } : {}),
+                    // S1 · a dropped-from-memory session can only continue when
+                    // reconstructAppendable can rebuild it: claude-code + its native
+                    // resume token + cwd. Every other vendor keeps no resume token
+                    // codehere can use once the session is gone — say so.
+                    canFollowUp: p.agent === 'claude-code' && !!p.nativeSessionId && !!p.cwd,
                 }));
+                // A REAL (non-mock) dashboard must never show mock/demo sessions. They
+                // are dev fixtures — seeded `demo-*` showcases (the /verify coverage set)
+                // and `mockRun` wiring tests — that can leak into a persisted store
+                // (e.g. a mock run launched without an isolated CODEHERE_HOME). In mock
+                // mode the board needs them, so they stay; in real mode they are dev
+                // pollution and are filtered out so a genuine user only sees real work.
+                // A task run inside a throwaway temp dir (eval/test harnesses use mkdtemp —
+                // e.g. proven-fix's /…/T/pf-XXXX) is NOT the user's real work; it's harness
+                // pollution leaking into ~/.codehere/sessions.jsonl. Strip it from a real
+                // dashboard alongside mock/demo, so "your day so far" shows genuine work.
+                const tmpRoot = tmpdir().replace(/^\/private/, '');
+                const isEphemeralCwd = (cwd) => {
+                    if (!cwd)
+                        return false;
+                    const norm = cwd.replace(/^\/private/, '');
+                    return norm === tmpRoot || norm.startsWith(tmpRoot + '/') || norm.startsWith('/tmp/');
+                };
+                // Hide STALE throwaway-dir pollution only — NOT recent/live work. The old
+                // filter dropped any /tmp-cwd task outright, which silently hid a task the
+                // user just spawned AND broke verify-real-run (it sandboxes in mkdtemp under
+                // /tmp). A real run there proved the loop works but was invisible. So: an
+                // ephemeral-cwd task is filtered only once it's older than the window — a
+                // running/just-finished one always shows; only yesterday's eval junk fades.
+                const EPHEMERAL_STALE_MS = 2 * 60 * 60 * 1000; // 2h
+                const nowMs = Date.now();
+                const isStaleEphemeral = (cwd, ts) => isEphemeralCwd(cwd) && (!ts || nowMs - ts > EPHEMERAL_STALE_MS);
+                const realSpawned = mockDaemon
+                    ? spawned
+                    : spawned.filter((s) => !s.mockRun && !String(s.sessionId || '').startsWith('demo-') && !isStaleEphemeral(s.cwd, s.startedAt));
+                const realPersisted = mockDaemon
+                    ? persisted
+                    : persisted.filter((p) => p.mockRun !== true &&
+                        !String(p.sessionId || '').startsWith('demo-') &&
+                        !isStaleEphemeral(p.cwd, p.completedAt || p.startedAt));
                 // Layer 7: timestamp of most recent hook-audit line (= "last edit on this machine")
                 let lastEditAt = null;
                 try {
@@ -1612,11 +2561,11 @@ export function startMCPServer(options = {}) {
                 }
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({
-                    spawned,
-                    persisted,
+                    spawned: realSpawned,
+                    persisted: realPersisted,
                     activeAgents,
                     lastEditAt,
-                    sessions: spawned, // back-compat for earlier UI code
+                    sessions: realSpawned, // back-compat for earlier UI code
                     observed: manager.listObserved(), // legacy, kept for /history or future use
                 }));
                 return;
@@ -1658,6 +2607,27 @@ export function startMCPServer(options = {}) {
                 res.end(JSON.stringify({ blocks }));
                 return;
             }
+            // Cross-vendor verdict — GET /api/task/:id/cross-vendor → the receipt when
+            // this session reviewed an earlier DIFFERENT-vendor writer in the same room
+            // (who wrote, who reviewed, audit attribution, chain integrity, cost). null
+            // when the session isn't a cross-vendor review (the common case). Read-only.
+            const cvMatch = req.url.match(/^\/api\/task\/([^/]+)\/cross-vendor$/);
+            if (cvMatch && req.method === 'GET') {
+                const sessId = decodeURIComponent(cvMatch[1]);
+                let verdict = null;
+                try {
+                    // Reviewer-keyed first (the session IS a review); else writer-keyed
+                    // (the session was REVIEWED by a different vendor) so opening the
+                    // writer's run also shows "a different vendor reviewed this."
+                    verdict = buildCrossVendorVerdictById(sessId) ?? buildCrossVendorVerdictForWriter(sessId) ?? null;
+                }
+                catch {
+                    /* fail open — null (no verdict shown) */
+                }
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ crossVendor: verdict }));
+                return;
+            }
             // v0.6 M3 — GET /api/task/:id/narration → latest mid-task summary.
             // Read-only; SessionManager generates the narration in a background
             // timer and caches the latest. Frontend polls (~30s) while the
@@ -1674,8 +2644,65 @@ export function startMCPServer(options = {}) {
             const m = req.url.match(/^\/api\/task\/([^/]+)\/(events|kill|message)$/);
             if (m) {
                 const [, sessionId, verb] = m;
-                const session = manager.get(sessionId);
+                let session = manager.get(sessionId);
+                // BUG-2 (E2E 2.5) · verify accepts git-style 7+-char short ids; kill/
+                // events/message 404'd on the same prefix with a false "no running task
+                // found" while the task WAS running. Resolve a UNIQUE prefix against
+                // live sessions; ambiguous prefixes still fall through to the honest 404.
+                if (!session && sessionId.length >= 7) {
+                    const matches = manager.list().filter((s) => s.sessionId.startsWith(sessionId));
+                    if (matches.length === 1)
+                        session = matches[0];
+                }
+                // resume-after-restart: a completed session dropped from memory (a daemon
+                // restart, or eviction past MAX_COMPLETED) can still be CONTINUED — rebuild
+                // an appendable handle from its persisted native resume token + cwd. Only
+                // for the message verb (events/kill need a live process).
+                if (!session && verb === 'message') {
+                    session = manager.reconstructAppendable(sessionId);
+                }
                 if (!session) {
+                    // S13 refuter · a ZOMBIE running record (daemon restarted, process
+                    // long gone, status still 'running' on disk) was unstoppable: kill
+                    // 404'd forever while the row inflated the RUNNING count. There is
+                    // no live process to signal — record the honest bookkeeping kill so
+                    // the record stops claiming a life it doesn't have.
+                    if (verb === 'kill') {
+                        const zrec = loadSessionById(sessionId);
+                        const zLive = zrec && ['running', 'queued', 'paused', 'blocked'].includes(zrec.status);
+                        if (zrec && zLive) {
+                            appendCompleted({
+                                id: zrec.sessionId,
+                                status: 'killed',
+                                completedAt: Date.now(),
+                                durationMs: zrec.durationMs || 0,
+                                steps: zrec.steps ?? [],
+                                artifacts: zrec.artifacts ?? {},
+                            });
+                            SessionManager.getInstance().markPersistedKilled(zrec.sessionId);
+                            res.writeHead(200, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({
+                                sessionId,
+                                status: 'killed',
+                                note: 'no live process · the stale record was marked killed',
+                            }));
+                            return;
+                        }
+                    }
+                    // S1 · honest reason over a generic 404: if the task EXISTS but its
+                    // agent can't continue a finished session, say exactly that — the
+                    // composer should already be disabled, but the server is the gate.
+                    if (verb === 'message') {
+                        const rec = loadSessionById(sessionId);
+                        if (rec) {
+                            res.writeHead(409, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({
+                                error: `${rec.agent} can't continue a finished task — its session can't be resumed by codehere. Start a new task; the project thread carries the context.`,
+                                canFollowUp: false,
+                            }));
+                            return;
+                        }
+                    }
                     res.writeHead(404, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ error: `No session: ${sessionId}` }));
                     return;
@@ -1726,7 +2753,12 @@ export function startMCPServer(options = {}) {
                                 const out = await session.appendMessage(text);
                                 const replyCompletedAt = Date.now();
                                 try {
-                                    const replyCwd = manager.getCwd(sessionId);
+                                    // Live sessions: cwd from the in-memory map. Reconstructed
+                                    // (resume-after-restart) sessions: the map is empty — fall
+                                    // back to the cwd the handle carried from the persisted
+                                    // record, so the resumed turn still lands in thread.jsonl
+                                    // (no invisible agent activity).
+                                    const replyCwd = manager.getCwd(sessionId) ?? session.cwd;
                                     if (replyCwd) {
                                         mirrorReplyToThread({
                                             parentSessionId: sessionId,
@@ -1833,26 +2865,71 @@ export function startMCPServer(options = {}) {
         // MCP endpoint — POST jsonrpc; reject other verbs with 405 + Allow header
         // (rc.17: was 404, which is wrong HTTP semantic — UX_OBSERVATIONS P3).
         if (req.url === '/mcp') {
+            // MCP Streamable HTTP transport. Plain-JSON POST (Claude Desktop, Claude
+            // Code) AND SSE-framed POST + a GET stream + Mcp-Session-Id, so strict
+            // clients (Codex, Cursor) connect too. One server, every agent.
+            const mcpSessionId = 'codehere-mcp-' + process.pid;
+            // GET opens the server->client SSE channel some clients require.
+            if (req.method === 'GET') {
+                res.writeHead(200, {
+                    'Content-Type': 'text/event-stream',
+                    'Cache-Control': 'no-cache',
+                    Connection: 'keep-alive',
+                    'Mcp-Session-Id': mcpSessionId,
+                });
+                res.write(': codehere mcp stream open\n\n');
+                const ka = setInterval(() => {
+                    try {
+                        res.write(': keep-alive\n\n');
+                    }
+                    catch {
+                        /* socket closed */
+                    }
+                }, 25000);
+                req.on('close', () => clearInterval(ka));
+                return;
+            }
             if (req.method !== 'POST') {
-                res.writeHead(405, { 'Content-Type': 'application/json', Allow: 'POST' });
-                res.end(JSON.stringify({ error: 'MCP endpoint accepts POST only', method: req.method }));
+                res.writeHead(405, { 'Content-Type': 'application/json', Allow: 'GET, POST' });
+                res.end(JSON.stringify({ error: 'MCP endpoint accepts GET (stream) or POST', method: req.method }));
                 return;
             }
             (async () => {
                 try {
                     const body = await readBody(req, res);
+                    let mcpReq;
                     try {
-                        const mcpReq = JSON.parse(body);
-                        const mcpRes = dispatch(mcpReq);
-                        res.writeHead(200, {
-                            'Content-Type': 'application/json',
-                            'Access-Control-Allow-Origin': 'http://localhost',
-                        });
-                        res.end(JSON.stringify(mcpRes));
+                        mcpReq = JSON.parse(body);
                     }
                     catch {
                         res.writeHead(400, { 'Content-Type': 'application/json' });
                         res.end(JSON.stringify({ error: 'Invalid JSON' }));
+                        return;
+                    }
+                    // Notifications (no id, e.g. notifications/initialized) get a 202 with
+                    // no body, per the JSON-RPC / MCP Streamable HTTP spec.
+                    if (mcpReq.id === undefined || mcpReq.id === null) {
+                        res.writeHead(202, { 'Mcp-Session-Id': mcpSessionId });
+                        res.end();
+                        return;
+                    }
+                    const mcpRes = dispatch(mcpReq);
+                    // Strict Streamable-HTTP clients send Accept: text/event-stream and
+                    // want the response as a single SSE message; lenient ones take JSON.
+                    const accept = String(req.headers['accept'] || '');
+                    if (accept.includes('text/event-stream')) {
+                        res.writeHead(200, {
+                            'Content-Type': 'text/event-stream',
+                            'Cache-Control': 'no-cache',
+                            Connection: 'keep-alive',
+                            'Mcp-Session-Id': mcpSessionId,
+                        });
+                        res.write('event: message\ndata: ' + JSON.stringify(mcpRes) + '\n\n');
+                        res.end();
+                    }
+                    else {
+                        res.writeHead(200, { 'Content-Type': 'application/json', 'Mcp-Session-Id': mcpSessionId });
+                        res.end(JSON.stringify(mcpRes));
                     }
                 }
                 catch {
@@ -1885,12 +2962,31 @@ export function startMCPServer(options = {}) {
                         clientIdConfigured: !!process.env[p.clientIdEnv],
                     };
                 });
+                // GitHub is special: it authenticates via the device flow (/api/github/connect/*),
+                // not the generic auth-code OAuth above. Surface it as ONE connectable entry
+                // with its real device-flow status, so the panel stops showing the
+                // contradictory "public · no auth needed" chip alongside a Connect button
+                // elsewhere. authType 'github-device' tells the UI to drive the device flow.
+                const ghStatus = connectionStatus('github');
+                const githubItem = {
+                    id: 'github',
+                    label: 'GitHub',
+                    scheme: 'github',
+                    authType: 'github-device',
+                    status: ghStatus.status,
+                    userLabel: ghStatus.userLabel ?? null,
+                    connectedAt: ghStatus.connectedAt ?? null,
+                    expiresAt: ghStatus.expiresAt ?? null,
+                    clientIdConfigured: !!githubClientId(),
+                    description: 'Import issues and post results back. Connect once.',
+                };
                 // v0.8 S5 · public-by-URL adapters appear with status='available'
-                // (no Connect button needed · they work out of the box).
+                // (no Connect button needed · they work out of the box). GitHub is
+                // excluded here — it's rendered as the connectable githubItem above.
                 const oauthIds = new Set(oauthItems.map((i) => i.id));
                 const reg = getDefaultRegistry();
                 const noAuthItems = [...reg.bySchemeOnly.values()]
-                    .filter((s) => !oauthIds.has(s.id))
+                    .filter((s) => !oauthIds.has(s.id) && s.id !== 'github')
                     .map((s) => ({
                     id: s.id,
                     label: s.label,
@@ -1904,7 +3000,7 @@ export function startMCPServer(options = {}) {
                     description: s.description,
                 }));
                 res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ providers: [...oauthItems, ...noAuthItems] }));
+                res.end(JSON.stringify({ providers: [...oauthItems, githubItem, ...noAuthItems] }));
             }
             catch (e) {
                 console.error('[/api/context-sources] failed:', e);
@@ -2093,26 +3189,9 @@ export function startMCPServer(options = {}) {
             })();
             return;
         }
-        if (req.url === '/api/audit/verify' && req.method === 'GET') {
-            try {
-                const r = verifyAuditChain(AUDIT_FILE);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    path: AUDIT_FILE,
-                    valid: r.valid,
-                    totalEntries: r.totalEntries,
-                    chainedEntries: r.chainedEntries,
-                    legacyEntries: r.legacyEntries,
-                    errors: r.errors,
-                }));
-            }
-            catch (e) {
-                console.error('[/api/audit/verify] failed:', e);
-                res.writeHead(500, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Failed to verify audit chain' }));
-            }
-            return;
-        }
+        // (MED #34, atomic audit) · a second GET /api/audit/verify handler lived
+        // here — unreachable dead code (the earlier handler wins the dispatch)
+        // with a DIFFERENT response shape. Deleted; one route, one truth.
         // v0.8 S4 · share-thread · POST /api/thread/:id/export returns a signed
         // bundle of one session that the recipient can replay locally. No relay
         // through codehere's infrastructure · the response stays on-machine.
@@ -2132,7 +3211,12 @@ export function startMCPServer(options = {}) {
                     kind: 'thread',
                     sessionId: session.sessionId,
                     session,
-                    exporter: { codehereVersion: '0.7.0' },
+                    // Embed the tool-call audit so a teammate can inspect what the agent
+                    // did (signer-attested; see ThreadBundleBody.auditChain trust model).
+                    auditChain: collectAuditEntriesForSession(session.sessionId),
+                    // LOW #36 (atomic audit) · was hardcoded '0.7.0' while the build is 0.9.x —
+                    // a stale version stamped into every exported bundle's metadata.
+                    exporter: { codehereVersion: getVersion() },
                     exportedAt: new Date().toISOString(),
                 };
                 const bundle = signBundle(body, keys);
@@ -2185,10 +3269,33 @@ export function startMCPServer(options = {}) {
                     }
                     const finalBundle = verdict.bundle;
                     const ses = finalBundle.body.session;
+                    const importFp = shortFingerprint(finalBundle.publicKey);
+                    // No-clobber / idempotent import (Phase 2.5 multi-human): a re-import
+                    // must not duplicate the session in a shared room.
+                    if (loadSessionById(ses.sessionId)) {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ status: 'already_imported', sessionId: ses.sessionId, fingerprint: importFp }));
+                        return;
+                    }
                     const home = process.env.CODEHERE_HOME || homedir();
                     const sessionsPath = join(home, '.codehere', 'sessions.jsonl');
                     const fs = await import('fs');
                     fs.mkdirSync(dirname(sessionsPath), { recursive: true });
+                    // Re-verify the embedded tool-call audit so the importer SEES what the
+                    // agent did. attested gated on verified>0 + no tamper (never bare .valid,
+                    // true for an empty chain). Computed BEFORE persistence so it can be
+                    // stored on the session — the bundle isn't kept, so the room needs this.
+                    const auditCheck = finalBundle.body.auditChain
+                        ? verifyEmbeddedAuditChain(finalBundle.body.auditChain)
+                        : undefined;
+                    const importAudit = auditCheck
+                        ? {
+                            total: auditCheck.total,
+                            verified: auditCheck.verified,
+                            tampered: auditCheck.tampered.length,
+                            attested: auditCheck.verified > 0 && auditCheck.tampered.length === 0,
+                        }
+                        : undefined;
                     const lines = [];
                     lines.push(JSON.stringify({
                         t: 'spawned',
@@ -2197,6 +3304,16 @@ export function startMCPServer(options = {}) {
                         prompt: ses.prompt,
                         cwd: ses.cwd,
                         startedAt: ses.startedAt,
+                        // S18 · practice classification is a property of the RUN on the
+                        // exporter's machine, carried by the bundle — never the importing
+                        // daemon's env. Absent in a legacy bundle = the work was real and
+                        // audit-attested; an import performed on a mock daemon must never
+                        // demote a teammate's real work to practice. Stamped explicitly so
+                        // no spawned-record writer leaves the field env-classified.
+                        mockRun: ses.mockRun === true,
+                        // Provenance: attribute the imported session to its signer.
+                        importedFrom: importFp,
+                        ...(importAudit ? { importAudit } : {}),
                     }));
                     lines.push(JSON.stringify({
                         t: 'completed',
@@ -2217,11 +3334,14 @@ export function startMCPServer(options = {}) {
                         }));
                     }
                     fs.appendFileSync(sessionsPath, lines.join('\n') + '\n', 'utf-8');
+                    // auditCheck was computed above (before persistence); reuse it for the
+                    // response so the importer sees the same attestation that got stored.
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({
                         status: 'imported',
                         sessionId: ses.sessionId,
                         fingerprint: shortFingerprint(finalBundle.publicKey),
+                        audit: auditCheck ? { ...importAudit, legacy: auditCheck.legacy } : null,
                     }));
                 }
                 catch (e) {
@@ -2313,7 +3433,11 @@ export function startMCPServer(options = {}) {
                         return;
                     }
                     // Server assigns the id · agents shouldn't pick collisions.
-                    raw.id = typeof raw.id === 'string' && raw.id ? raw.id : newPassId();
+                    // S11 refuter caveat · the pass id is the DAEMON's to mint, always.
+                    // A caller-supplied id could collide, or match the demo-wp- prefix
+                    // the modal renders as not-sendable (a real pass made permanently
+                    // un-approvable by its own name).
+                    raw.id = newPassId();
                     raw.emittedAt =
                         typeof raw.emittedAt === 'number' && Number.isFinite(raw.emittedAt) ? raw.emittedAt : Date.now();
                     let intent;
@@ -2650,12 +3774,20 @@ export function startMCPServer(options = {}) {
         // Per claim_user_persona HIGH non-technical-first: a non-technical user
         // who typos a URL gets a useful page back, not a void.
         const requestedPath = (req.url ?? '/').split('?')[0];
+        // API clients are machines: an unknown /api/* path gets JSON, never an
+        // HTML page a fetch().json() chokes on (2026-06-07 audit, Lane API).
+        if (requestedPath.startsWith('/api/')) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: `Unknown API route: ${requestedPath.slice(0, 200)}` }));
+            return;
+        }
         res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' });
         res.end(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8"/>
 <meta name="viewport" content="width=device-width,initial-scale=1"/>
+<link rel="icon" type="image/svg+xml" href="/icon.svg"/>
 <title>codehere · page not found</title>
 <style>
   :root {
@@ -2715,8 +3847,7 @@ export function startMCPServer(options = {}) {
   <div class="routes">
     <div class="routes-label">VALID ROUTES</div>
     <a class="route" href="/"><span class="route-name">Dashboard</span><span class="route-path">/</span></a>
-    <a class="route" href="/threads"><span class="route-name">Project threads</span><span class="route-path">/threads</span></a>
-    <a class="route" href="/history"><span class="route-name">Audit history</span><span class="route-path">/history</span></a>
+    <a class="route" href="/verify"><span class="route-name">Verify at the surface</span><span class="route-path">/verify</span></a>
   </div>
 </main>
 </body>
@@ -2739,6 +3870,19 @@ export function startMCPServer(options = {}) {
             catch {
                 /* best-effort */
             }
+            // Project identity backfill — detect + cache each project's git remote in
+            // _meta once, so the project list can collapse clones of one repo without
+            // shelling git on every poll. Idempotent (skips already-checked projects).
+            try {
+                const { backfillProjectRemotes } = await import('../storage/project-thread-mirror.js');
+                const r = await backfillProjectRemotes();
+                if (process.env.CODEHERE_DEBUG === '1' && r.detected > 0) {
+                    console.error(`[daemon-start] detected ${r.detected}/${r.scanned} project remotes`);
+                }
+            }
+            catch {
+                /* best-effort */
+            }
             // Stale-session reconciliation. Walks per-project thread.jsonl files
             // and marks any sessions stuck in 'running' for >60 min as crashed.
             // Closes the dogfood-found gap where 3-day-old tasks displayed as
@@ -2767,10 +3911,10 @@ export function startMCPServer(options = {}) {
 function callbackHtml(status, message, providerLabel) {
     const safe = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
     const tone = status === 'ok' ? '#28c840' : '#ff5f57';
-    const icon = status === 'ok' ? '✓' : '✗';
+    const icon = status === 'ok' ? '✓' : '✕';
     const title = status === 'ok' ? `${providerLabel ?? 'Provider'} connected` : 'Connection failed';
     return `<!doctype html><html lang="en"><head>
-<meta charset="utf-8"><title>${safe(title)}</title>
+<meta charset="utf-8"><link rel="icon" type="image/svg+xml" href="/icon.svg"><title>${safe(title)}</title>
 <style>
   body { margin:0; background:#0a0a0a; color:#fff; font-family:ui-sans-serif,system-ui,-apple-system,sans-serif; display:flex; align-items:center; justify-content:center; min-height:100vh; }
   .card { max-width:480px; padding:32px 36px; border:1px solid rgba(255,255,255,0.08); border-radius:12px; background:#111; }