kodelyth-ecc 2.9.0 → 2.11.0

package/CHANGELOG.md

@@ -2,6 +2,106 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.11.0 — Arena run #2: three containment bugs in the dashboard (August 2026)
+
+Pointed the arena at `scripts/dashboard` — the localhost HTTP server that serves
+static files and returns your private memory store. Round 1 found **3 findings,
+all 3 confirmed by executed repro**. Round 2 attacked the fixes across 7 vectors
+and found **nothing new**.
+
+All three are **low severity** and the reasoning matters: the server is
+localhost-only, read-only, GET-only, and each finding needs local write access
+that already grants the same data. None is a browser-reachable hole. They are
+containment bugs worth closing, not emergencies.
+
+### Fixed — three containment gaps
+
+- **`sessionDetail` followed symlinks out of the coordination root.** The check
+  compared the *joined* path, which for a symlink is the link's own location —
+  inside the root, so it passed — while the target was anywhere on disk. It
+  returned real `task.md` / `handoff.md` / `status.md` excerpts from outside.
+- **`resolveStatic` followed symlinks out of `STATIC_DIR`.** Same class:
+  `path.resolve` does not resolve symlinks, so a lexically-contained link passed
+  the guard and `readFile` followed it. `/etc/hosts` was readable through it.
+- **An empty or absent `Host` header bypassed the DNS-rebinding guard.** The
+  condition read `reqHost !== '' && ...`, so a missing Host short-circuited the
+  whole check to false. An HTTP/1.0 request reached the private-data APIs with
+  `200 OK`. Browsers always send Host, so this was never browser-reachable.
+
+All three now canonicalize with `realpathSync` and re-check against the real
+destination; the Host guard denies by default.
+
+### Fixed — `Host` comparison is now case-insensitive
+
+Hostnames are case-insensitive per RFC 3986, so `Host: LOCALHOST` was a
+legitimate spelling being rejected.
+
+### Fixed — arena recall ignored scope
+
+Every arena memory carries the tag `arena`, and recall is BM25 — so a query
+mentioning the arena matched **all** of them regardless of origin. The first
+dashboard run was handed all 10 `scripts/terse` findings and told they were
+*"confirmed here previously."* That is false, and it would have sent EVIL hunting
+for `compress.js` bugs in an HTTP server. Recall is now filtered to memories
+whose files actually live in the scope.
+
+### Added — `access-control` bug class
+
+The Host-header bypass classified as `uncategorized`. Its guard advice: *deny by
+default — an allowlist, with every absent or empty case treated as invalid rather
+than waved through.*
+
+### Compound learning is earning its keep
+
+`filesystem-symlink` is now confirmed **4 times across 3 files** — `compress.js`,
+`data.js`, and `server.js`. Every one is the same mistake: a lexical containment
+check that a symlink walks straight through. The guard proposal says what to do
+about it — a shared path-safety helper, rather than a fourth spot fix.
+
+**535 tests passing**, up from 525.
+
+## v2.10.0 — Arena dashboard tab + docs (phases 5 & 6) (August 2026)
+
+### Added — Arena tab in the dashboard
+
+The tab answers one question: **did the attacker give up?**
+
+- **Convergence trend** per run, drawn as a block-character sparkline — no chart
+  library, no CDN, legible at one round or twenty. Rounds that surface nothing
+  render green; a round worse than the last renders red.
+- **Still open** — confirmed findings GOD has *not* answered for, ranked by real
+  risk (`severity × confidence × exploitability`).
+- **Recurring bug classes** — the same class twice is flagged `recurring`, because
+  one is an incident and several is a process gap.
+- Runs that began with recalled memories are marked `recalled`.
+
+Read-only. The dashboard never writes to your memory store.
+
+`GET /api/arena[?limit=N]` → `{ available, runs, open, classes, totals }`. Raw
+findings are stripped from the wire payload — the page needs counts and the open
+list, not every finding on every run.
+
+### Fixed — a confirmed finding is not the same as an open one
+
+`closeRound` recorded *how many* findings were left outstanding but not *which
+ones*, so nothing downstream could tell a confirmed-and-fixed bug from a
+confirmed-and-ignored one. The dashboard's first draft reported all ten fixed
+findings as open risk — a healthy run reading as alarming, which is exactly
+backwards. Rounds now persist `addressedIds`.
+
+### Added — `docs/arena.md`
+
+A full feature doc: why a loop beats a review pass, what makes a finding count,
+how convergence is decided, the compound-learning return path, guard proposals,
+and cost control. Wired into the sitemap, the docs index, and `dashboard.md`.
+
+### Fixed — stale counts
+
+The README and `CLAUDE.md` advertised 194 skills and 97 commands; the real
+figures are 196 and 102. Both now match what is on disk.
+
+**525 tests passing**, up from 516.
+
 ## v2.9.0 — Compound learning: the arena now remembers (phase 4) (August 2026)
 
 A finished arena run used to be knowledge thrown away. Every new run started from

package/CLAUDE.md

@@ -7,8 +7,8 @@ Guidance for Claude Code when working with this repository.
 **Kodelyth ECC** — a production-grade AI coding toolkit:
 
 - **70 specialist agents** — debug-detective, incident-commander, load-tester, image-architect, kodelyth-memory, security-reviewer, plus 8 adversarial devil-mode agents
-- **194 skills** — domain knowledge, patterns, testing, security, intent routing, local memory, swarm orchestration, MCP integration
-- **97 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, ...)
+- **196 skills** — domain knowledge, patterns, testing, security, intent routing, local memory, swarm orchestration, MCP integration
+- **102 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, ...)
 - **22+ hooks** — quality gates, memory inject + capture, correction encoding, prompt-injection guard, token-budget enforcer
 - **14 rules** — always-on coding standards + semantic intent routing + memory protocol + self-improvement
 
@@ -18,15 +18,15 @@ Works with Claude Code, Windsurf, Cursor, Codex CLI, Antigravity, OpenCode, Clin
 
 ```
 agents/      → 70 specialist subagents (planner, code-reviewer, debug-detective, devil-mode crew, ...)
-commands/    → 97 slash commands (8 parallel multi-agent, rest single-agent)
-skills/      → 194 workflow + domain knowledge files (loadable via slash commands)
+commands/    → 102 slash commands (8 parallel multi-agent, 1 adversarial loop, rest single-agent)
+skills/      → 196 workflow + domain knowledge files (loadable via slash commands)
 hooks/       → 22+ automations (pre-commit, session memory, prompt-injection guard, token-budget)
 rules/       → 14 always-on guidelines (agent-intent-routing, self-improvement, memory-protocol, ...)
 scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router, memory, supply-chain
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
-docs/        → Feature docs (mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 516 passing tests across 27 test files
+docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
+tests/       → 535 passing tests across 29 test files
 ```
 
 ## Running Tests
@@ -80,6 +80,7 @@ These fire multiple specialist agents simultaneously:
 | `/pre-release` | release-captain + security-reviewer + code-reviewer | Go/no-go verdict before shipping |
 | `/onboard` | code-explorer + architect + doc-updater | Understand any codebase in 15 minutes |
 | `/devil-mode` | prompt-injection-hunter + supply-chain-auditor + secret-hunter + backdoor-hunter | Adversarial sweep (use `--all` for all 8) |
+| `/arena` | GOD crew vs EVIL crew, looped | Ship something that must not break — runs until the attacker gives up |
 
 ## Key Commands
 

package/README.md

@@ -33,7 +33,7 @@
 
 </div>
 
-**Kodelyth ECC** is a production-grade AI coding toolkit — **70 specialist agents (incl. an 8-agent devil-mode adversarial crew), 194 skills, 97 commands**, a god-tier **semantic intent-routing system**, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
+**Kodelyth ECC** is a production-grade AI coding toolkit — **70 specialist agents (incl. an 8-agent devil-mode adversarial crew), 196 skills, 102 commands**, a god-tier **semantic intent-routing system**, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
 
 Now bundled with:
 
@@ -73,7 +73,7 @@ You never typed `use debug-detective`. You didn't have to. The toolkit read the
 | **Intent routing** | Plain-language → right specialist via 10-tier priority rules | Mostly missing — you memorize names |
 | **70 agents** | Specialists with playbooks, severity calibration, real commands | Often persona-only ("you are a senior engineer...") |
 | **194 skills** | Domain knowledge files agents read on demand | Rarely separated from agents |
-| **97 commands** | Slash workflows (`/tdd`, `/devil-mode`, `/team-review`) | Limited or none |
+| **102 commands** | Slash workflows (`/tdd`, `/arena`, `/devil-mode`, `/team-review`) | Limited or none |
 | **8 parallel commands** | Fire 3-8 agents simultaneously, aggregate results | Rare |
 | **Compound memory** | BM25 local recall + auto-inject + project lessons | Cloud-only or absent |
 | **22+ hooks** | Quality gates, secret scan, project-DNA detection | Often missing |
@@ -92,6 +92,7 @@ You never typed `use debug-detective`. You didn't have to. The toolkit read the
 | **Local BM25 self-learning memory** | ✅ | ❌ | ❌ | ❌ |
 | **Compound learning from corrections** | ✅ `tasks/lessons.md` | ❌ | ❌ | ❌ |
 | **Adversarial / red-team agents** | ✅ 8 (devil-mode) | ❌ | ❌ | ❌ |
+| **Adversarial build/attack loop** | ✅ `/arena` — scored, verified, converges | ❌ | ❌ | ❌ |
 | Quality hooks | ✅ 22+ | Some | ❌ | ❌ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
 | Telemetry | ❌ none | Varies | ❌ | Varies |
@@ -372,6 +373,7 @@ Eight commands fire multiple specialist agents simultaneously and aggregate thei
 | `/pre-release` | release-captain + security-reviewer + code-reviewer | 30 min → 8 min |
 | `/onboard` | code-explorer + architect + doc-updater | 45 min → 12 min |
 | `/devil-mode` | 8 adversarial agents (see below) | Hours → 20 min |
+| `/arena` | GOD crew vs EVIL crew, looped until the attacker gives up | Days → 1 session |
 
 Each command waits for all agents to complete, then returns a single **Team Review Report** with findings bucketed by severity: CRITICAL → HIGH → MEDIUM → LOW.
 

package/VERSION

@@ -1 +1 @@
-2.9.0
+2.11.0

package/bin/kodelyth-ecc.js

@@ -501,8 +501,14 @@ if (args[0] === 'god' || args[0] === 'evil' || args[0] === 'arena') {
         try {
           const learn = require(path.join(ROOT, 'scripts', 'arena', 'learn.js'));
           const memStore = require(path.join(ROOT, 'scripts', 'memory', 'store.js'));
-          const hits = memStore.recall(`arena ${scopeArg} ${task}`, { limit: 20 })
-            .filter(m => (m.source || '') === 'arena');
+          // Filter to the scope. BM25 matches every arena memory on the word
+          // "arena" alone, so without this a dashboard run is handed terse findings
+          // and told they were confirmed in this very scope.
+          const hits = learn.filterToScope(
+            memStore.recall(`arena ${scopeArg} ${task}`, { limit: 60 })
+              .filter(m => (m.source || '') === 'arena'),
+            scopeArg,
+          ).slice(0, 20);
           recalledCount = hits.length;
           priorKnowledge = learn.priorKnowledgeBrief(hits);
         } catch { /* memory is optional — a missing store must never block a run */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.9.0",
+  "version": "2.11.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/arena/arena.js

@@ -176,6 +176,10 @@ function closeRound(run) {
   });
 
   // Attach whether GOD actually finished its side of the round.
+  // Persist WHICH findings GOD answered for, not just how many are left over.
+  // Without the ids, nothing downstream can tell a confirmed-and-fixed finding
+  // from confirmed-and-ignored — the dashboard would report every fix as open risk.
+  verdict.addressedIds = [...(run.pending.addressedIds || [])];
   verdict.godComplete = completion.complete;
   verdict.unverifiedArtifacts = completion.unverifiedArtifacts;
   verdict.outstandingFindings = completion.outstandingFindings;

package/scripts/arena/learn.js

@@ -43,6 +43,7 @@ const CLASSES = [
   ['semantic-corruption', /\bsemantic|meaning|threshold|negation|inverts?|widen/i],
   ['idempotency',         /\bidempoten|fixed point|second run|re-?run\b/i],
   ['input-validation',    /validat|wrong shape|silently accept|malformed|type ?error|unsanitiz/i],
+  ['access-control',      /\bbypass(?:es|ed)? the|rebinding|host header|allowlist|authoriz|access control\b/i],
   ['supply-chain',        /\btyposquat|lockfile|install script|dependency confusion\b/i],
 ];
 
@@ -169,6 +170,25 @@ function priorKnowledgeBrief(memories = [], { limit = 8 } = {}) {
   return lines.join('\n');
 }
 
+// Recall is BM25 over the whole memory store, and every arena memory carries the
+// tag "arena" — so a query mentioning the arena matches ALL of them regardless of
+// which scope they came from. Left unfiltered, a run against scripts/dashboard is
+// told that bugs in scripts/terse were "confirmed here previously", which is false
+// and sends EVIL hunting for the wrong thing in the wrong file.
+//
+// A memory belongs to this scope only if it actually points at a file inside it.
+function filterToScope(memories = [], scope) {
+  if (!scope || scope === '.' || scope === './') return memories;
+  const norm = String(scope).replace(/^\.\//, '').replace(/\/+$/, '');
+  if (!norm) return memories;
+  return memories.filter(m =>
+    (m.files || []).some(f => {
+      const file = String(f).replace(/^\.\//, '');
+      return file === norm || file.startsWith(norm + '/');
+    }),
+  );
+}
+
 // ── Recurring classes → evolve proposals ────────────────────────────────────
 //
 // One bug is an incident. The same class across several runs is a gap in the
@@ -210,6 +230,7 @@ const GUARD_ADVICE = {
   'semantic-corruption': 'Add golden tests asserting that meaning-bearing tokens survive transformation.',
   'idempotency':         'Assert f(f(x)) === f(x) in the test suite for every transform.',
   'input-validation':    'Validate argument shape at every public boundary and throw — never silently coerce to a plausible default.',
+  'access-control':      'Deny by default: an allowlist of permitted values, with every absent or empty case treated as invalid rather than waved through.',
   'supply-chain':        'Pin and verify dependencies; add a lockfile-drift check to CI.',
 };
 
@@ -265,6 +286,7 @@ module.exports = {
   refutedToMemory,
   runToMemories,
   priorKnowledgeBrief,
+  filterToScope,
   recurringClasses,
   buildGuardProposalMarkdown,
   guardProposalId,

package/scripts/dashboard/data.js

@@ -307,8 +307,28 @@ function sessionDetail({ session, coordRoot = defaultCoordRoot() } = {}) {
   if (!session || session === '..' || session === '.') return null;
   const dir = path.join(coordRoot, session);
   // Containment check — ensure the resolved path stays within coordRoot.
+  // path.join normalises "..", so a textual escape is caught here.
   if (!dir.startsWith(coordRoot + path.sep) && dir !== coordRoot) return null;
   if (!fs.existsSync(dir)) return null;
+
+  // ...but a SYMLINK is not a textual escape: the link itself sits inside
+  // coordRoot and passes the check above, while its target does not. Reading
+  // through it hands the API task/handoff/status excerpts from anywhere on
+  // disk. realpath resolves the link so containment is checked against the
+  // real destination, which is the only location that matters.
+  let realDir;
+  try {
+    realDir = fs.realpathSync(dir);
+  } catch {
+    return null;   // dangling or unreadable link
+  }
+  let realRoot;
+  try {
+    realRoot = fs.realpathSync(coordRoot);
+  } catch {
+    realRoot = coordRoot;   // root itself may legitimately not be a link
+  }
+  if (!realDir.startsWith(realRoot + path.sep) && realDir !== realRoot) return null;
   const workers = safeReadDir(dir).filter(e => e.isDirectory());
   return {
     session,
@@ -580,9 +600,120 @@ function tokenBudgetSnapshot({ budgetDir = defaultBudgetDir() } = {}) {
   return { sessions: sessions.slice(0, 50), total_tokens: total };
 }
 
+// ── Arena ────────────────────────────────────────────────────────────────────
+//
+// The dashboard's job here is to make ONE thing legible: did the attacker give
+// up? A run whose new-finding count falls to zero is converging. A flat or
+// rising line means the code has deeper problems, or the scope is too broad for
+// EVIL to ever exhaust — either way, look before shipping.
+
+function arenaSnapshot({ runLimit = 20 } = {}) {
+  let arenaState = null;
+  let learn = null;
+  try { arenaState = require('../arena/state.js'); } catch { /* arena is optional */ }
+  try { learn = require('../arena/learn.js'); } catch { /* */ }
+  if (!arenaState) return { available: false, runs: [], classes: [], open: [], totals: {} };
+
+  let list = [];
+  try { list = arenaState.listRuns() || []; } catch { /* no runs yet */ }
+
+  const runs = list.slice(0, Math.max(1, Math.min(100, runLimit))).map(meta => {
+    let run = null;
+    try { run = arenaState.load(meta.runId); } catch { /* skip unreadable */ }
+    if (!run) return null;
+
+    const rounds = run.rounds || [];
+    const settled = [];
+    const seen = new Set();
+    for (const r of rounds) {
+      for (const f of r.findings || []) {
+        if (seen.has(f.id)) continue;
+        seen.add(f.id);
+        settled.push(f);
+      }
+    }
+
+    return {
+      runId: run.runId,
+      task: run.task,
+      scope: run.scope || '.',
+      status: run.status,
+      stopReason: run.stopReason || null,
+      startedAt: run.startedAt,
+      rounds: rounds.length,
+      tokens: run.spent?.tokens || 0,
+      // The trend IS the story: new findings per round, which should fall to zero.
+      trend: rounds.map(r => r.counts?.new || 0),
+      confirmed: settled.filter(f => f.verdict === 'confirmed').length,
+      refuted: settled.filter(f => f.verdict === 'refuted').length,
+      unverified: settled.filter(f => f.verdict === 'unverified').length,
+      artifacts: rounds.reduce((n, r) => n + (r.artifacts?.length || 0), 0),
+      recalled: run.priorKnowledge ? true : false,
+      findings: settled,
+    };
+  }).filter(Boolean);
+
+  // Still-open risk across every run, worst first. A confirmed finding nobody
+  // fixed is the single most useful thing this page can surface.
+  const open = [];
+  // Findings GOD answered for are not open risk. Counting a confirmed-and-fixed
+  // bug as outstanding would make a healthy run look alarming.
+  const addressed = new Set();
+  for (const meta of list.slice(0, runLimit)) {
+    try {
+      const full = arenaState.load(meta.runId);
+      for (const rd of full?.rounds || []) for (const id of rd.addressedIds || []) addressed.add(id);
+    } catch { /* */ }
+  }
+  for (const r of runs) {
+    for (const f of r.findings) {
+      if (f.verdict !== 'confirmed') continue;
+      if (addressed.has(f.id)) continue;   // GOD answered for this one
+      open.push({
+        runId: r.runId, scope: r.scope, title: f.title,
+        file: f.file, line: f.line, severity: f.severity,
+        risk: f.risk || 0,
+        class: learn ? learn.classify(f) : null,
+      });
+    }
+  }
+  open.sort((a, b) => b.risk - a.risk);
+
+  // Which bug classes keep coming back — the signal that a guard belongs upstream.
+  const classCount = new Map();
+  if (learn) {
+    for (const r of runs) {
+      for (const f of r.findings) {
+        if (f.verdict !== 'confirmed') continue;
+        const c = learn.classify(f);
+        classCount.set(c, (classCount.get(c) || 0) + 1);
+      }
+    }
+  }
+  const classes = [...classCount.entries()]
+    .map(([name, count]) => ({ name, count }))
+    .sort((a, b) => b.count - a.count);
+
+  const totals = {
+    runs: runs.length,
+    converged: runs.filter(r => r.status === 'converged').length,
+    confirmed: runs.reduce((n, r) => n + r.confirmed, 0),
+    refuted: runs.reduce((n, r) => n + r.refuted, 0),
+    artifacts: runs.reduce((n, r) => n + r.artifacts, 0),
+    tokens: runs.reduce((n, r) => n + r.tokens, 0),
+  };
+
+  // Drop the raw findings from the wire payload — the page needs the counts and
+  // the open list, not every finding on every run.
+  const wireRuns = runs.map(({ findings, ...rest }) => rest);
+  return { available: true, runs: wireRuns, open: open.slice(0, 40), classes, totals };
+}
+
 module.exports = {
   // overview
   overview,
+  // arena
+  arenaSnapshot,
   // memory
   memoryStats,
   recentMemories,

package/scripts/dashboard/server.js

@@ -147,12 +147,32 @@ function serveStaticFile(res, filePath) {
 }
 
 // Defensive — block path traversal, only allow files under STATIC_DIR.
-function resolveStatic(reqPath) {
+// baseDir is injectable so the containment logic can be tested against a real
+// symlink without planting one in the shipped static/ directory.
+function resolveStatic(reqPath, baseDir = STATIC_DIR) {
   const decoded = decodeURIComponent(reqPath.replace(/^\/+/, ''));
   if (decoded.includes('..')) return null;
-  if (decoded === '' || decoded === '/') return path.join(STATIC_DIR, 'index.html');
-  const abs = path.resolve(STATIC_DIR, decoded);
-  if (!abs.startsWith(STATIC_DIR + path.sep) && abs !== path.join(STATIC_DIR, 'index.html')) return null;
+  if (decoded === '' || decoded === '/') return path.join(baseDir, 'index.html');
+  const abs = path.resolve(baseDir, decoded);
+  if (!abs.startsWith(baseDir + path.sep) && abs !== path.join(baseDir, 'index.html')) return null;
+
+  // The check above is purely lexical, and path.resolve does not resolve
+  // symlinks — so a link sitting lexically inside baseDir passes it while
+  // readFile follows it to a target anywhere on disk. Canonicalize and re-check
+  // against the real destination, which is the only one that matters.
+  let real;
+  try {
+    real = fs.realpathSync(abs);
+  } catch {
+    return null;   // missing file or dangling link — 404 either way
+  }
+  let realBase;
+  try {
+    realBase = fs.realpathSync(baseDir);
+  } catch {
+    realBase = baseDir;
+  }
+  if (!real.startsWith(realBase + path.sep) && real !== path.join(realBase, 'index.html')) return null;
   return abs;
 }
 
@@ -160,8 +180,15 @@ function resolveStatic(reqPath) {
 
 function handleRequest(req, res) {
   // DNS-rebinding defence: only respond to requests targeting localhost.
-  const reqHost = (req.headers.host || '').split(':')[0];
-  if (reqHost !== '' && reqHost !== '127.0.0.1' && reqHost !== 'localhost') {
+  // A missing or empty Host is treated as INVALID, not as valid. The original
+  // `reqHost !== ''` short-circuited the whole condition whenever the header was
+  // absent, so an HTTP/1.0 request — or any raw socket writing "Host:" with no
+  // value — sailed past the rebinding guard and got the private-data APIs.
+  // Deny by default: only an explicit localhost Host is allowed through.
+  // Hostnames are case-insensitive (RFC 3986), so LOCALHOST is a legitimate
+  // spelling. Node already strips OWS around the field value.
+  const reqHost = (req.headers.host || '').split(':')[0].toLowerCase();
+  if (reqHost !== '127.0.0.1' && reqHost !== 'localhost') {
     res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
     return res.end(JSON.stringify({ ok: false, error: 'bad request' }));
   }
@@ -304,6 +331,10 @@ function handleRequest(req, res) {
       return jsonResponse(res, 200, { ok: true, ...s });
     }
 
+    if (p === '/api/arena') {
+      return jsonResponse(res, 200, data.arenaSnapshot({ runLimit: Number(q.get('limit')) || 20 }));
+    }
+
     if (p === '/api/codebase') {
       const cb = require('../codebase/index.js');
       return jsonResponse(res, 200, cb.dashboardSnapshot());

package/scripts/dashboard/static/index.html

@@ -223,6 +223,7 @@
         <button data-tab="rtk">Token Savings</button>
         <button data-tab="memory">Memory</button>
         <button data-tab="codebase">Codebase</button>
+        <button data-tab="arena">Arena</button>
         <button data-tab="evolve">Evolve</button>
         <button data-tab="catalog">Catalog</button>
         <button data-tab="sessions">Sessions</button>
@@ -320,6 +321,50 @@ kodelyth-ecc codebase query detect_changes '{}'</pre>
     </section>
 
     <!-- ───────── EVOLVE ───────── -->
+    <!-- ───────── ARENA ───────── -->
+    <section data-panel="arena" hidden>
+      <div class="grid" id="arenaCards"></div>
+      <hr class="sep">
+      <div class="card">
+        <h2>Did the attacker give up?</h2>
+        <p class="muted" style="font-size:12.5px;margin:-4px 0 14px;">
+          New findings per round. Falling to zero means EVIL ran out of ideas.
+          A flat or rising line means stop and look — either the code has deeper
+          problems, or the scope is too broad to ever exhaust.
+        </p>
+        <div id="arenaRuns">loading…</div>
+      </div>
+      <hr class="sep">
+      <div class="row">
+        <div class="card">
+          <h2>Still open</h2>
+          <p class="muted" style="font-size:12.5px;margin:-4px 0 12px;">
+            Confirmed and not yet answered for, worst risk first.
+          </p>
+          <div id="arenaOpen">loading…</div>
+        </div>
+        <div class="card">
+          <h2>Recurring bug classes</h2>
+          <p class="muted" style="font-size:12.5px;margin:-4px 0 12px;">
+            One is an incident. Several is a process gap — the guard belongs upstream.
+          </p>
+          <div id="arenaClasses">loading…</div>
+        </div>
+      </div>
+      <hr class="sep">
+      <div class="card">
+        <h2>Compound learning</h2>
+        <p class="muted" style="font-size:12.5px;margin:-4px 0 10px;">
+          Store what a run proved so the next run on that scope starts informed:
+        </p>
+        <div><code>kodelyth-ecc arena learn &lt;run-id&gt; --commit</code></div>
+        <p class="muted" style="margin-top:12px;font-size:12.5px;">
+          Nothing is written without <code>--commit</code>. The dashboard NEVER
+          writes to your memory store.
+        </p>
+      </div>
+    </section>
+
     <section data-panel="evolve" hidden>
       <div class="grid" id="evolveCards"></div>
       <hr class="sep">
@@ -527,6 +572,86 @@ kodelyth-ecc codebase query detect_changes '{}'</pre>
   }
 
   // ───── evolve ─────
+  // A compact sparkline made of block characters — no chart library, no CDN,
+  // and it stays legible when the run has one round or twenty.
+  function trendBar(trend) {
+    if (!trend || !trend.length) return '<span class="dim">no rounds yet</span>';
+    const max = Math.max(...trend, 1);
+    const blocks = '▁▂▃▄▅▆▇█';
+    return trend.map((n, i) => {
+      const idx = n === 0 ? 0 : Math.min(blocks.length - 1, Math.ceil((n / max) * (blocks.length - 1)));
+      const colour = n === 0 ? '#22c55e' : (i > 0 && n < trend[i - 1] ? '#eab308' : '#ef4444');
+      return `<span title="round ${i + 1}: ${n} new" style="color:${colour};font-size:18px;line-height:1;">${blocks[idx]}</span>`;
+    }).join('');
+  }
+
+  function arenaStatusPill(status) {
+    const map = {
+      converged: ['ok', 'converged'],
+      running:   ['', 'running'],
+      exhausted: ['pending', 'max rounds'],
+      aborted:   ['pending', 'stopped'],
+    };
+    const [cls, label] = map[status] || ['', status || 'unknown'];
+    return `<span class="pill ${cls}">${escapeHtml(label)}</span>`;
+  }
+
+  async function loadArena() {
+    try {
+      const a = await api('/api/arena');
+      if (!a.available) {
+        $('#arenaCards').innerHTML = '';
+        $('#arenaRuns').innerHTML = '<div class="empty">Arena is not installed.</div>';
+        $('#arenaOpen').innerHTML = '';
+        $('#arenaClasses').innerHTML = '';
+        return;
+      }
+
+      $('#arenaCards').innerHTML = [
+        statCard(a.totals.runs,      'Runs'),
+        statCard(a.totals.confirmed, 'Bugs confirmed'),
+        statCard(a.totals.refuted,   'False positives caught'),
+        statCard(a.open.length,      'Still open'),
+        statCard(a.totals.artifacts, 'Verified fixes'),
+      ].join('');
+
+      $('#arenaRuns').innerHTML = a.runs.length
+        ? `<div class="table-wrap"><table>
+            <thead><tr><th>Run</th><th>Scope</th><th>Trend</th><th>Rounds</th><th>Confirmed</th><th>Refuted</th><th>Tokens</th><th>Status</th></tr></thead>
+            <tbody>${a.runs.map(r => `<tr>
+              <td><span class="strong">${escapeHtml(r.task || r.runId)}</span>${r.recalled ? ' <span class="pill" title="started with recalled memories from past runs">recalled</span>' : ''}</td>
+              <td><code>${escapeHtml(r.scope)}</code></td>
+              <td>${trendBar(r.trend)}</td>
+              <td>${r.rounds}</td>
+              <td>${r.confirmed}</td>
+              <td>${r.refuted}</td>
+              <td>${(r.tokens || 0).toLocaleString()}</td>
+              <td>${arenaStatusPill(r.status)}</td>
+            </tr>`).join('')}</tbody></table></div>`
+        : '<div class="empty">No arena runs yet. Start one with <code>kodelyth-ecc arena start --task "..."</code></div>';
+
+      $('#arenaOpen').innerHTML = a.open.length
+        ? a.open.map(f => `<div style="margin-bottom:12px;">
+            <div class="strong">${escapeHtml(f.title)}</div>
+            <div class="muted" style="font-size:12px;margin-top:3px;">
+              <span class="pill">${escapeHtml(f.severity)}</span>
+              risk ${f.risk}${f.class ? ` · ${escapeHtml(f.class)}` : ''}
+              ${f.file ? ` · <code>${escapeHtml(f.file)}${f.line ? ':' + f.line : ''}</code>` : ''}
+            </div>
+          </div>`).join('')
+        : '<div class="empty">Nothing open. Every confirmed finding was either fixed or refuted.</div>';
+
+      $('#arenaClasses').innerHTML = a.classes.length
+        ? a.classes.map(c => `<div style="display:flex;justify-content:space-between;margin-bottom:8px;">
+            <span>${escapeHtml(c.name)}${c.count > 1 ? ' <span class="pill pending">recurring</span>' : ''}</span>
+            <span class="strong">${c.count}</span>
+          </div>`).join('')
+        : '<div class="empty">No confirmed findings yet.</div>';
+    } catch (err) {
+      $('#arenaRuns').innerHTML = `<div class="empty">Could not load arena data: ${escapeHtml(String(err.message || err))}</div>`;
+    }
+  }
+
   async function loadEvolve() {
     try {
       const e = await api('/api/evolve');
@@ -838,6 +963,7 @@ kodelyth-ecc codebase query detect_changes '{}'</pre>
     if (tab === 'rtk')      loadRtk();
     if (tab === 'memory')   loadMemory();
     if (tab === 'codebase') loadCodebase();
+    if (tab === 'arena')    loadArena();
     if (tab === 'evolve')   loadEvolve();
     if (tab === 'catalog')  loadCatalog();
     if (tab === 'sessions') { loadIdeSessions(); loadSessions(); }