mindforge-cc 11.9.0 → 11.9.2

package/RELEASENOTES.md

@@ -1,5 +1,80 @@
 # Release Notes
 
+## v11.9.2 — 2026-08-16 — Correctness: config gate, audit chain, retrieval, cost ledger
+
+### What's New
+Nothing. This is a correctness release: four things that were reported as working were measured
+and found not to be, and a fifth — the plugin channel's hooks — is now documented as broken
+instead of advertised as the fastest path.
+
+### ⚠️ Breaking (under a patch bump)
+The dashboard's HTTP surface changed shape. `detail` is gone from 5 endpoints and raw errno
+strings from 10 more; `correlation_id` is added to 15; malformed bodies now return
+`application/json` instead of an HTML error page. Those fields were leaking absolute filesystem
+paths — and so the operator's username and home directory — into an unauthenticated response.
+The dashboard also now **exits** on an unhandled rejection or uncaught exception where 11.9.1
+logged and continued, so supervised deployments will see restarts instead of silent errors.
+The surface is loopback-only, so this affects you only if you script against it.
+
+### Fixes
+- **`security-scan` could not fail.** It reported `MINDFORGE.md valid — 0 settings configured`
+  and exited 0 on every input, because both config parsers used a plain `KEY=value` regex while
+  the registry declares bracketed `[KEY] = value`. All 43 parameters were invisible. One shared
+  parser now reads both forms, and the schema has real `required` keys. Three CI gates go from
+  unfailable to failable — on fresh installs and `--force` reinstalls; a plain upgrade keeps
+  your existing schema.
+- **The audit hash chain forked under concurrent writers.** No `.jsonl` append took a lock, and
+  the chain head was cached in-process and never invalidated — so a second process's append made
+  the first keep chaining from a superseded hash. Both halves are fixed: a fail-closed lock, and
+  a cached head that carries the file size witnessing it is still the tail. A lock alone was
+  measured insufficient. 8 concurrent appenders went from 199 broken links to 0.
+- **44.4% of trace content was unsearchable and every multi-word query returned nothing.** The
+  index was keyed on `trace_id` rather than the row's primary key, so each span evicted the
+  previous one; and whole queries were wrapped as a single FTS phrase, so one absent term zeroed
+  the result. 2,270 of 5,117 rows are recovered losslessly and queries are now tokenised and
+  ranked. The shipped retrieval eval had zero callers and now runs as `npm run eval:retrieval`.
+- **The cost ledger reported two different totals for one concept** ($13.73 vs $0.00) because
+  writer and reader used different field names — and the test wrote the reader's name, so the
+  mismatch passed. One record shape now, and the configured ledger path no longer points at a
+  file that never existed.
+- **The daily cost cap is declared but not enforced**, and is now labelled that way in
+  `MINDFORGE.md` and the schema rather than described as non-overridable. Wiring it is COST-02.
+
+### Honesty
+`README.md` now carries a per-channel capability table with an explicit **Hooks enforced: No**
+row for both install channels, because no hook configuration ships and nothing generates one.
+The plugin channel's dispatcher additionally fails with `Cannot find module './lib/hook-flags'`
+on every fire. Treat MindForge as governance-by-convention plus a verifiable audit log, not as a
+policy enforcement point. Making enforcement real per harness is the goal of v12.
+
+### Stats
+105 test files, 103 pass, 2 environment-dependent skips. Four suites that could not report
+failure now can. Audit chain verifies clean. Tarball 1,973 entries.
+
+---
+
+## v11.9.0 — 2026-07-27 — Bedrock Provider + Full Dry-Run Audit
+
+### What's New
+Added an AWS Bedrock provider and completed a full exhaustive dry-run audit of all 224 commands, 216 personas, and 355 skills.
+
+### Fixes
+- `bin/models/bedrock-provider.js`: AWS Bedrock provider with Anthropic/Bedrock config switch and base64 credential decoding
+- Resolved phantom-tool references ported unmodified from a different agent harness across 40 personas and ~40 skills (`Context7`/`search_web`/`read_url_content` → `WebFetch`/`WebSearch`; `CommandStatus`/`ReadTerminal`/`terminal`/`read_file`/`write_file`/`search_files`/`patch` → real Claude Code tool names; `delegate_task` → `Agent`; `kanban_create` → `TaskCreate`)
+- Repointed 21 broken `@.agent/references/` and `@.agent/templates/` path references to their real `docs/References/` and `docs/Templates/*/` locations
+- Copied in missing companion `scripts/`/`references/`/`templates/` assets for 17 skills that referenced files never carried over during porting
+- Fixed hardcoded broken paths (`~/.hermes/skills`, `/home/teknium/...`, `HERMES_HOME`)
+- Fixed a markdown fence-nesting bug in `code-tour` and 4 truncated heredoc strings in `github-code-review`
+- Removed banned single-word triggers (`test`, `tests`) from `testing-standards`
+- CI: build SDK before test suite; run Verification before Health Check in execution-plane
+- Security: patched hono and picomatch HIGH-severity vulnerabilities
+
+### Stats
+- Dry-run audit: 224 commands, 216 personas, 355 skills reviewed
+- Phantom-tool references resolved: 40 personas, ~40 skills
+
+---
+
 ## v11.8.3 — 2026-07-01 — Autopsy Fixes Stable Release
 
 ### What's New

package/SECURITY.md

@@ -1,6 +1,6 @@
 # Security Policy
 
-> **Current version:** 11.8.3 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
+> **Current version:** 11.9.0 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
 
 ## Supported Versions
 

package/bin/autonomous/audit-writer.js

@@ -20,6 +20,7 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { hashAuditEntry } = require('../governance/audit-hash');
+const { withFileLock } = require('../utils/file-lock');
 
 /**
  * Computes the SHA-256 hash of an entry chained to its predecessor (UC-04).
@@ -57,19 +58,20 @@ function readLastHash(auditPath) {
 // sync write gives in-process consumers (e.g. StuckMonitor, which is fed the event
 // object directly but may also re-read the file) immediate, durable data.
 //
-// Chain head caching: re-reading the file's tail on every append is O(file) — bad
-// on hot paths. Instead we keep a per-path in-memory lastHash (Map keyed by the
-// RESOLVED absolute path), seeded ONCE from the file's last entry on the first
-// append, then advanced in-process for O(1) appends. If the cache is cold (new
-// process, or a path never written in this process) we seed from disk — so a
-// second process correctly continues the on-disk chain from its tail.
+// Chain head caching: re-reading the file's tail on every append is O(file) — bad on
+// hot paths. We keep a per-path in-memory head (Map keyed by the RESOLVED absolute
+// path) as { hash, size }, where `size` is the file size immediately after our own
+// write. The size is the WITNESS that the cache is still the true tail: if the file is
+// still exactly that long, nobody else appended and the cached hash is the tail (O(1));
+// if it differs, another process appended and we MUST re-seed from disk.
 //
-// Concurrency: within a process this is fully synchronous, so calls cannot
-// interleave and the cached lastHash is always current. ACROSS processes, each
-// process seeds from the file tail on its first append; this is correct only under
-// the single-operator model (no two processes appending CONCURRENTLY to the same
-// audit file). MindForge runs one autonomous operator at a time, so this holds.
-const _lastHashCache = new Map(); // resolvedPath -> last `_hash` written/seen
+// Concurrency (LOCK-01): the seed-through-write sequence below runs inside
+// withFileLock, so no other process can read the head, or append, while we hold it.
+// The size check is what makes the cache safe across processes — a lock alone is NOT
+// enough, because a warm cache would still hand back a hash that a lock-respecting
+// second writer has since superseded, forking the chain. Verified: lock-only leaves
+// 4-6 link breaks per 8-process run; lock + size-validated reseed leaves 0.
+const _lastHashCache = new Map(); // resolvedPath -> { hash, size }
 
 /**
  * Synchronously appends ONE hash-chained, durable entry to an audit JSONL file.
@@ -96,30 +98,43 @@ function appendAuditEntrySync(auditPath, event) {
     timestamp: event.timestamp || new Date().toISOString(),
   };
 
-  // 2. Seed previous_hash: prefer the warm in-process cache; fall back to the
-  //    file's last entry when cold (first append in this process for this path).
-  let previous_hash = _lastHashCache.has(resolved)
-    ? _lastHashCache.get(resolved)
-    : readLastHash(resolved);
+  // 2-5. LOCK-01: seed-through-write is ONE critical section. The lock opens BEFORE
+  //      the head is read and closes AFTER the fsync, so no other process can read the
+  //      same head, or interleave an append, while we hold it. maxTries is raised above
+  //      the module default because failing closed here DROPS an audit entry: at 16
+  //      concurrent writers the default ~1s ceiling loses ~35% of entries, 150 tries
+  //      loses none.
+  return withFileLock(resolved, () => {
+    // 2. Seed previous_hash from the warm cache ONLY if the file is still exactly as
+    //    long as we left it (proof nobody else appended); otherwise re-seed from disk.
+    const cached = _lastHashCache.get(resolved);
+    let onDiskSize = -1;
+    try { onDiskSize = fs.statSync(resolved).size; } catch { onDiskSize = -1; }
+    const previous_hash = (cached && cached.size === onDiskSize)
+      ? cached.hash
+      : readLastHash(resolved);
 
-  // 3. Compute _hash over {...stamped, previous_hash} WITHOUT _hash in the material.
-  const _hash = hashEntry(stamped, previous_hash);
+    // 3. Compute _hash over {...stamped, previous_hash} WITHOUT _hash in the material.
+    const _hash = hashEntry(stamped, previous_hash);
 
-  // 4. Write {...stamped, previous_hash, _hash} as one JSON line, durably+synchronously
-  //    (openSync('a') + writeSync + fsyncSync + closeSync — mirrors appendDurableSync).
-  const chained = { ...stamped, previous_hash, _hash };
-  fs.mkdirSync(path.dirname(resolved), { recursive: true });
-  const fd = fs.openSync(resolved, 'a');
-  try {
-    fs.writeSync(fd, JSON.stringify(chained) + '\n');
-    fs.fsyncSync(fd);
-  } finally {
-    fs.closeSync(fd);
-  }
+    // 4. Write {...stamped, previous_hash, _hash} as one JSON line, durably+synchronously
+    //    (openSync('a') + writeSync + fsyncSync + closeSync — mirrors appendDurableSync).
+    const chained = { ...stamped, previous_hash, _hash };
+    fs.mkdirSync(path.dirname(resolved), { recursive: true });
+    const fd = fs.openSync(resolved, 'a');
+    let sizeAfter = -1;
+    try {
+      fs.writeSync(fd, JSON.stringify(chained) + '\n');
+      fs.fsyncSync(fd);
+      sizeAfter = fs.fstatSync(fd).size;   // exact new length, one syscall, fd already open
+    } finally {
+      fs.closeSync(fd);
+    }
 
-  // 5. Advance the in-process chain head and return the written entry.
-  _lastHashCache.set(resolved, _hash);
-  return chained;
+    // 5. Advance the in-process chain head (hash + its witness) and return the entry.
+    _lastHashCache.set(resolved, { hash: _hash, size: sizeAfter });
+    return chained;
+  }, { maxTries: 150, label: 'audit' });
 }
 
 module.exports = { appendAuditEntrySync };

package/bin/dashboard/api-router.js

@@ -9,6 +9,7 @@ const fs      = require('fs');
 const Metrics = require('./metrics-aggregator');
 const Approval = require('./approval-handler');
 const SSE     = require('./sse-bridge');
+const { sendServerError } = require('./error-response');
 
 // Steering queue path (from Day 8 auto-executor)
 const STEERING_QUEUE = path.join(process.cwd(), '.planning', 'steering-queue.jsonl');
@@ -38,7 +39,7 @@ function register(app) {
     try {
       res.json(Metrics.getStatus());
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/status', err, 'Failed to read project status');
     }
   });
 
@@ -50,7 +51,7 @@ function register(app) {
       const event  = typeof req.query.event === 'string' ? req.query.event : null;
       res.json(Metrics.getAuditEntries(limit, offset, event));
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/audit', err, 'Failed to read audit entries');
     }
   });
 
@@ -59,7 +60,7 @@ function register(app) {
     try {
       res.json(Metrics.getMetrics());
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/metrics', err, 'Failed to read quality metrics');
     }
   });
 
@@ -68,7 +69,7 @@ function register(app) {
     try {
       res.json(Metrics.getApprovals());
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/approvals', err, 'Failed to read approvals');
     }
   });
 
@@ -104,7 +105,7 @@ function register(app) {
 
       res.json(result);
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'POST /api/approve/:id', err, 'Failed to record approval decision');
     }
   });
 
@@ -113,7 +114,7 @@ function register(app) {
     try {
       res.json(Metrics.getTeamActivity());
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/team', err, 'Failed to read team activity');
     }
   });
 
@@ -124,7 +125,7 @@ function register(app) {
       const limit = Math.min(parseInt(req.query.limit || '20', 10), 100);
       res.json(Metrics.getMemory(q, limit));
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/memory', err, 'Failed to query knowledge base');
     }
   });
 
@@ -134,7 +135,7 @@ function register(app) {
       const window = Math.min(parseInt(req.query.window || '7', 10), 90);
       res.json(Metrics.getCosts(window));
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/costs', err, 'Failed to read cost metrics');
     }
   });
 
@@ -193,7 +194,7 @@ function register(app) {
 
       res.json({ success: true, queued: true, id: entry.id, action });
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'POST /api/steer', err, 'Failed to queue steering directive');
     }
   });
 
@@ -241,7 +242,7 @@ function register(app) {
         timestamp: new Date().toISOString()
       });
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/v1/system', err, 'Failed to read system observability data');
     }
   });
 }

package/bin/dashboard/error-response.js

@@ -0,0 +1,44 @@
+/**
+ * MindForge — Dashboard error responses (LEAK-01)
+ *
+ * Every dashboard route used to return `err.message` — and express's default
+ * handler returned `err.stack` — straight to the client. fs-sourced errors embed
+ * ABSOLUTE paths (EACCES/ENOENT/EISDIR), so a 500 disclosed the operator's home
+ * directory and username. This matters more than a normal 500 body leak because
+ * `requireAuth` (server.js) lets GET and OPTIONS through unguarded: every read
+ * route was an *unauthenticated* filesystem-layout oracle.
+ *
+ * Contract: the full error (stack included) is logged server-side against a
+ * correlation id; the client receives only a generic message plus that id.
+ */
+'use strict';
+
+const crypto = require('crypto');
+
+/** Short, non-guessable id used to tie a client response to a server log line. */
+function newCorrelationId() {
+  return crypto.randomBytes(8).toString('hex');
+}
+
+/**
+ * Log `err` server-side and answer with a generic 500 carrying a correlation id.
+ *
+ * @param {object} res            Express response.
+ * @param {string} context        Route identifier for the log, e.g. 'GET /api/metrics'.
+ * @param {unknown} err           The caught error (or any value).
+ * @param {string} clientMessage  Safe, static message for the client.
+ * @param {object} [extra]        Extra fields merged into the body (e.g. { success: false }).
+ * @returns {object} the Express response.
+ */
+function sendServerError(res, context, err, clientMessage, extra = {}) {
+  const correlationId = newCorrelationId();
+  const detail = err && err.stack ? err.stack : String(err);
+  console.error(`[dashboard] ${context} failed [cid=${correlationId}]: ${detail}`);
+  return res.status(500).json({
+    ...extra,
+    error: clientMessage,
+    correlation_id: correlationId
+  });
+}
+
+module.exports = { sendServerError, newCorrelationId };

package/bin/dashboard/frontend/index.html

@@ -198,7 +198,7 @@
         </div>
       </div>
       <div class="grid-4">
-        <div class="card"><div class="card-body"><div class="stat-label">Cumulative Cost</div><div id="stat-total-cost" class="stat-value">$0.00</div></div></div>
+        <div class="card"><div class="card-body"><div class="stat-label">Cost (7d)</div><div id="stat-total-cost" class="stat-value">$0.00</div></div></div>
         <div class="card"><div class="card-body"><div class="stat-label">Avg Quality</div><div id="stat-avg-quality" class="stat-value">0.0</div></div></div>
         <div class="card"><div class="card-body"><div class="stat-label">LSPs Registered</div><div id="stat-lsp-count" class="stat-value">0</div></div></div>
         <div class="card"><div class="card-body"><div class="stat-label">Token Velocity</div><div id="stat-velocity" class="stat-value">0 <span class="stat-unit">tx/m</span></div></div></div>
@@ -430,6 +430,7 @@
         const data = await res.json();
         state = data;
         updateMetricsUI(data);
+        refreshCosts();
         refreshApprovals();
         refreshMemory();
         refreshTeam();
@@ -538,8 +539,24 @@
     }
 
     function updateMetricsUI(data) {
-      document.getElementById('stat-total-cost').textContent = `$${(data.costs?.reduce((a,b) => a + b.cost, 0) || 0).toFixed(4)}`;
-      document.getElementById('stat-avg-quality').textContent = (data.quality?.reduce((a,b) => a + b.score, 0) / (data.quality?.length || 1)).toFixed(1);
+      // /api/metrics returns { sessions, avg_quality, avg_cost_usd, ... } — see
+      // bin/dashboard/metrics-aggregator.js getMetrics(). It has never returned
+      // `costs` or `quality`, so these tiles used to render "$0.0000" and "NaN".
+      document.getElementById('stat-avg-quality').textContent = (data.avg_quality ?? 0).toFixed(1);
+    }
+
+    // Cumulative spend comes from the usage ledger via /api/costs (already wired
+    // in bin/dashboard/api-router.js but never fetched until now).
+    async function refreshCosts() {
+      try {
+        const res = await fetch('/api/costs?window=7');
+        // sendServerError returns a well-formed JSON body, so res.json() would
+        // SUCCEED on a 500 and `total_usd ?? 0` would render "$0.00" — an outage
+        // and genuine zero spend look identical under the "Cost (7d)" label.
+        if (!res.ok) throw new Error(`/api/costs ${res.status}`);
+        const data = await res.json();
+        document.getElementById('stat-total-cost').textContent = `${(data.total_usd ?? 0).toFixed(2)}`;
+      } catch (e) { console.error('Cost refresh failed', e); }
     }
 
     function appendAuditEvent(data) {

package/bin/dashboard/metrics-aggregator.js

@@ -7,6 +7,7 @@
 
 const fs   = require('fs');
 const path = require('path');
+const { ledgerPath, entryCost, entryDay } = require('../models/usage-record');
 
 // ── TTL Cache (5-second window) ──────────────────────────────────────────────
 const _cache = new Map();
@@ -29,7 +30,7 @@ function cacheSet(key, data) {
 // Paths are resolved lazily to support testing in temp directories
 const getPaths = () => ({
   quality:   path.join(process.cwd(), '.mindforge', 'metrics', 'session-quality.jsonl'),
-  usage:     path.join(process.cwd(), '.mindforge', 'metrics', 'token-usage.jsonl'),
+  usage:     ledgerPath(),
   audit:     path.join(process.cwd(), '.planning', 'AUDIT.jsonl'),
   handoff:   path.join(process.cwd(), '.planning', 'HANDOFF.json'),
   auto:      path.join(process.cwd(), '.planning', 'auto-state.json'),
@@ -122,12 +123,29 @@ function getMetrics() {
   const auditEntries   = readJSONL(paths.audit, 500);
 
   // Quality scores (last 20 sessions)
+  // session-quality.jsonl has NO writer anywhere in this repo — every one of its
+  // four references (here, sdk/src/client.ts, mcp-server/src/vendor/client.ts,
+  // plugins/mindforge/mcp/dist/index.js) is a READ, and no command instructs an
+  // agent to append it either. The read is kept because those three other
+  // consumers depend on the file and a schema-compliant one may exist in a user
+  // project; supplying a writer is OUT OF SCOPE for this patch. Read the
+  // SCHEMA-DECLARED names first (.mindforge/metrics/METRICS-SCHEMA.md), keeping
+  // the historical names as fallbacks.
+  // Per-session cost is NOT a session-quality field: it is joined from the
+  // usage ledger by session_id (every provider result carries one — see
+  // bin/models/model-client.js:69).
+  const costBySession = usageEntries.reduce((acc, u) => {
+    if (!u || typeof u.session_id !== 'string') return acc;
+    acc[u.session_id] = (acc[u.session_id] || 0) + entryCost(u);
+    return acc;
+  }, {});
+
   const sessions = qualityEntries.map(e => ({
     id:               e.session_id,
     timestamp:        e.timestamp,
-    quality_score:    e.quality_score ?? 0,
+    quality_score:    e.session_quality_score ?? e.quality_score ?? 0,
     verify_pass_rate: e.verify_pass_rate ?? 0,
-    cost_usd:         e.total_cost_usd ?? 0,
+    cost_usd:         costBySession[e.session_id] ?? 0,
     node_repairs:     e.node_repairs ?? 0,
   }));
 
@@ -302,12 +320,15 @@ function getCosts(windowDays = 7) {
   };
 
   for (const e of entries) {
-    if (e.timestamp < cutoff) continue;
-    
-    const cost = e.total_cost_usd || 0;
+    // Ledger rows carry both `date` and `timestamp` (see bin/models/usage-record.js).
+    // Bucket on the canonical day so date-only and full-ISO rows behave alike.
+    const day = entryDay(e);
+    if (!day || day < cutoff) continue;
+
+    const cost = entryCost(e);
     stats.total_usd += cost;
-    
-    if (e.timestamp && e.timestamp.startsWith(today)) {
+
+    if (day === today) {
       stats.today_usd += cost;
     }
 

package/bin/dashboard/revops-api.js

@@ -10,6 +10,7 @@ const roiEngine = require('../revops/roi-engine');
 const velocityForecaster = require('../revops/velocity-forecaster');
 const debtMonitor = require('../revops/debt-monitor');
 const metricsAggregator = require('./metrics-aggregator');
+const { sendServerError } = require('./error-response');
 
 /**
  * GET /api/revops/overview
@@ -25,7 +26,11 @@ router.get('/overview', (req, res) => {
         ...metrics, 
         tasks_total: status.tasks_total || 0,
         tasks_completed: status.tasks_completed || 0,
-        auditEntries: metricsAggregator.getAuditEntries(500) // need enough history for velocity
+        // .entries — getAuditEntries() returns { entries, total, limit, offset }, not an
+        // array. roi-engine, velocity-forecaster and debt-monitor all call .filter() on
+        // this value, so handing them the wrapper object throws a TypeError that the
+        // route's catch turns into an opaque 500.
+        auditEntries: metricsAggregator.getAuditEntries(500).entries // need enough history for velocity
     };
 
     const roi      = roiEngine.calculate(fullMetrics);
@@ -40,7 +45,12 @@ router.get('/overview', (req, res) => {
         timestamp: new Date().toISOString()
     });
   } catch (err) {
-    res.status(500).json({ success: false, error: 'AgRevOps metrics retrieval failed', detail: err.message });
+    // LEAK-01: echoing err.message as a `detail` field put absolute filesystem paths
+    // — and therefore the operator's username and home directory — into an
+    // unauthenticated HTTP response body (requireAuth exempts GET). Log the full
+    // error server-side; return a generic message plus a correlation id.
+    sendServerError(res, 'GET /api/revops/overview', err,
+      'AgRevOps metrics retrieval failed', { success: false });
   }
 });
 

package/bin/dashboard/server.js

@@ -37,6 +37,7 @@ const SSE    = require('./sse-bridge');
 const API    = require('./api-router');
 const TemporalAPI = require('./temporal-api');
 const RevOpsAPI   = require('./revops-api');
+const { newCorrelationId } = require('./error-response');
 
 // ── Express app ───────────────────────────────────────────────────────────────
 const app = express();
@@ -190,6 +191,73 @@ app.post('/api/v1/token/refresh', requireAuth, (req, res) => {
 // ── Register API routes ───────────────────────────────────────────────────────
 API.register(app);
 app.use('/api/temporal', TemporalAPI);
+// RevOpsAPI was required at the top of this file but never mounted, so /api/revops
+// returned 404 while the AgRevOps dashboard panels and docs described it as live.
+app.use('/api/revops', RevOpsAPI);
+
+// ── Terminal error handler (LEAK-01) ─────────────────────────────────────────
+// MUST stay last, after every route, and MUST keep its 4-arg signature or express
+// will treat it as ordinary middleware. Without it, express's default handler
+// renders err.stack into the response body whenever NODE_ENV !== 'production':
+// a single unauthenticated malformed-JSON POST (express.json() is mounted BEFORE
+// requireAuth, and requireAuth exempts GET anyway) returned the absolute paths of
+// node_modules and the repo — the operator's username and home directory — to any
+// local caller. Log server-side; return a generic body plus a correlation id.
+app.use((err, req, res, next) => {
+  if (res.headersSent) return next(err); // e.g. an SSE stream already flushed headers
+  const status = Number.isInteger(err && err.status) && err.status >= 400 && err.status < 600
+    ? err.status
+    : 500;
+  const correlationId = newCorrelationId();
+  console.error(
+    `[dashboard] unhandled ${req.method} ${req.originalUrl} -> ${status} [cid=${correlationId}]:`,
+    err && err.stack ? err.stack : err
+  );
+  res.status(status).json({
+    error: status >= 500 ? 'Internal server error' : 'Invalid request',
+    correlation_id: correlationId
+  });
+});
+
+// ── Crash guards ──────────────────────────────────────────────────────────────
+// Both guards log and exit. That is deliberate and symmetric.
+//
+// unhandledRejection: an escaped rejection is the ONLY reliable signal that an
+// async call was left un-awaited — the ASYNC-01 class this release fixes. Measured
+// on v11.9.1: an un-awaited rollbackTo() rejected, and by the time the rejection
+// surfaced a hash-chained `hindsight_injected` entry had already been fsync'd and
+// auto-state.json flipped to awaiting_regeneration for a rollback that never
+// happened; the client got ECONNRESET at ~16ms and the process exited 1. The
+// durable damage is committed before any handler can run, so a 500-and-continue
+// response would answer the request while leaving the audit chain asserting an
+// event that did not occur.
+// Keeping it survivable is also not free: express 4.22.1 does not route async
+// handler rejections to its error middleware (measured: a 4-arity app.use never
+// fires), so log-and-continue leaves the client socket open until the CLIENT gives
+// up — 2.5s, 4s and 8s clients all timed out with no response — versus a ~15ms
+// connection reset when the process exits. A silent hang is worse than a restart.
+// Cost accepted: one faulting request takes the observability surface down. The
+// dashboard is a 127.0.0.1-only single-operator tool, and an audit chain that
+// verifies as valid while recording events that did not happen is not a survivable
+// state to keep serving from.
+process.on('unhandledRejection', (reason) => {
+  console.error('[Dashboard] Unhandled rejection — exiting:',
+    reason instanceof Error ? reason.stack : reason);
+  process.exit(1);
+});
+
+// uncaughtException MUST exit. After an uncaught throw the process state is
+// undefined, and log-and-continue actively broke shutdown: a throw anywhere in the
+// first half of shutdown() (SSE.stop(), or unlinking the token file) was swallowed,
+// so server.close() was never reached and the forced-exit timer was never armed.
+// The result was a dashboard that IGNORED SIGTERM while still serving the
+// token-authenticated mutation endpoints, with the bearer token left on disk and
+// still valid in memory — i.e. the operator's documented stop command silently
+// failed while reporting success. Only SIGKILL stopped it.
+process.on('uncaughtException', (err) => {
+  console.error('[Dashboard] Uncaught exception — exiting:', err && err.stack ? err.stack : err);
+  process.exit(1);
+});
 
 // ── Start SSE bridge ──────────────────────────────────────────────────────────
 SSE.start();
@@ -231,14 +299,26 @@ server.on('error', err => {
 // ── Graceful shutdown ─────────────────────────────────────────────────────────
 function shutdown(signal) {
   console.log(`\n[dashboard] ${signal} received — shutting down`);
-  SSE.stop();
-  // Remove sensitive token file on shutdown
-  if (fs.existsSync(TOKEN_FILE)) fs.unlinkSync(TOKEN_FILE);
+
+  // Arm the forced exit FIRST. Every step below can throw (permission drift on the
+  // token path, a read-only .mindforge, an SSE listener error), and if any of them
+  // does before this timer is set, the process would keep serving the authenticated
+  // mutation API after the operator asked it to stop.
+  const forced = setTimeout(() => process.exit(0), 3000);
+  forced.unref();
+
+  try { SSE.stop(); } catch (err) { console.error('[dashboard] SSE.stop failed:', err.message); }
+
+  // Destroying the bearer token is a security step, not housekeeping — never let it
+  // throw. rmSync with force tolerates a missing path and most permission cases.
+  try { fs.rmSync(TOKEN_FILE, { force: true }); } catch (err) {
+    console.error('[dashboard] could not remove token file:', err.message);
+  }
+
   server.close(() => {
-    if (fs.existsSync(PID_FILE)) fs.unlinkSync(PID_FILE);
+    try { fs.rmSync(PID_FILE, { force: true }); } catch { /* best effort */ }
     process.exit(0);
   });
-  setTimeout(() => process.exit(0), 3000);
 }
 
 process.on('SIGTERM', () => shutdown('SIGTERM'));