mindforge-cc 11.9.1 → 11.9.2

package/MINDFORGE.md

@@ -1,9 +1,9 @@
-# MINDFORGE.md — Parameter Registry (v11.9.1)
+# MINDFORGE.md — Parameter Registry (v11.9.2)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.9.1
+[VERSION] = 11.9.2
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
 [REQUIRED_CORE_VERSION] = 11.9.1
@@ -99,7 +99,7 @@ The following parameters cannot be overridden by plugins, agents, or session-lev
 
 - [MIN_SOUL_SCORE] — Minimum SOUL score required for architectural changes
 - [BLOCK_ON_SECURITY] — Security gate enforcement cannot be disabled
-- [COST_HARD_LIMIT_USD] — Hard cost limit cannot be raised without human approval
+- [COST_HARD_LIMIT_USD] — declared here, but **NOT enforced as of 11.9.2**; do not rely on it as a spend control. `bin/models/cost-tracker.js` reads `MODEL_COST_HARD_LIMIT_USD`, a key this registry does not declare, so `preflight()` returns early and no cap is ever applied. Wiring it is tracked as COST-02 for 11.9.3
 - [BLOCK_ON_SECURITY] is non-overridable; PQAS itself is simulated/experimental (inactive by default) and is NOT a non-overridable guarantee — do not rely on it as an enforced control
 - [SOVEREIGN_IDENTITY] — Identity verification is always required
 - [ENABLE_ZTAI] — Zero-trust identity cannot be bypassed

package/README.md

@@ -6,13 +6,55 @@
 
 ## Latest release
 
-**v11.9.0** (2026-07-27) — Bedrock provider + full dry-run audit. See [CHANGELOG.md](./CHANGELOG.md) for full history, or [RELEASENOTES.md](./RELEASENOTES.md) for human-readable notes.
+**v11.9.2** (2026-08-16) — Correctness: the config gate can now fail, the audit chain no longer
+forks under concurrent writers, trace retrieval works, and the cost ledger has one record shape.
+**Contains a breaking change to the dashboard HTTP surface** (loopback-only) — see the BREAKING
+section in [CHANGELOG.md](./CHANGELOG.md), or [RELEASENOTES.md](./RELEASENOTES.md) for
+human-readable notes.
+
+---
+
+## What is actually enforced
+
+Read this before the install instructions. MindForge ships a large corpus of agent
+instructions — commands, skills, personas, protocols — and those are advisory: they work by
+being in the model's context, and a model can decline them. The parts that would *block* an
+action are hooks, and **no install channel currently registers them.**
+
+| Capability | Plugin channel | `npx` channel |
+|---|---|---|
+| Slash commands | Yes | Yes |
+| Skills / personas / protocol docs | Yes | Yes |
+| Subagents | Yes | Yes |
+| Audit hash-chain (`bin/verify-audit.js`) | Yes | Yes |
+| **Hooks enforced (can block a tool call)** | **No** | **No** |
+
+Why, specifically:
+
+- **No hook configuration ships, and nothing generates one.** `package.json` `files[]` has 47
+  entries and none contains `settings`, so neither `.claude/settings.json` nor
+  `.agent/settings.json` is published. All references to those paths in `bin/` are reads or
+  metadata strings — there is no code that writes or merges one. `bin/harness-audit.js:335`
+  even offers "wire trust-gate + block-no-verify into both …" as a *fix suggestion*, auditing a
+  wiring nothing creates.
+- **The plugin channel's hooks additionally crash when fired.**
+  `plugins/mindforge/scripts/run-with-flags.js:24` requires `./lib/hook-flags`, and
+  `plugins/mindforge/scripts/lib/` does not exist in the published plugin. Running the
+  dispatcher gives `Error: Cannot find module './lib/hook-flags'` and exit 1. The module it
+  needs does exist at `.agent/hooks/lib/hook-flags.js`; it was never copied in.
+
+So treat MindForge as **governance-by-convention plus a tamper-evident audit log**, not as a
+policy enforcement point. Installing it also expands your repository's trust boundary by a large
+volume of agent instructions — review what you install. Making hook registration real per
+harness is the headline goal of v12; the audit chain is genuinely verifiable today
+(`node bin/verify-audit.js`).
 
 ---
 
 ## Install
 
-Fastest path — Claude Code plugin marketplace (no project files written):
+Claude Code plugin marketplace (no project files written). **Note:** the plugin's hooks do not
+fire — see *What is actually enforced* above. Slash commands, skills and subagents do work.
 
 ```bash
 /plugin marketplace add sairam0424/MindForge
@@ -27,6 +69,12 @@ npx mindforge-cc@latest --claude --local
 
 All install channels (global, local, Antigravity, Cursor, Copilot, Gemini CLI, MCP server, combined runtimes, `--minimal`): see [docs/getting-started.md](docs/getting-started.md).
 
+**Upgrading from 11.9.x?** The installer does not overwrite an existing
+`.mindforge/MINDFORGE-SCHEMA.json`, so 11.9.2's armed config validator keeps the older
+permissive schema on a plain upgrade. Run with `--force` if you want the stricter gate. The
+daily cost cap declared as `[COST_HARD_LIMIT_USD]` in `MINDFORGE.md` is **not enforced** in
+11.9.2 — see the CHANGELOG.
+
 ---
 
 ## Verify

package/RELEASENOTES.md

@@ -1,5 +1,58 @@
 # Release Notes
 
+## v11.9.2 — 2026-08-16 — Correctness: config gate, audit chain, retrieval, cost ledger
+
+### What's New
+Nothing. This is a correctness release: four things that were reported as working were measured
+and found not to be, and a fifth — the plugin channel's hooks — is now documented as broken
+instead of advertised as the fastest path.
+
+### ⚠️ Breaking (under a patch bump)
+The dashboard's HTTP surface changed shape. `detail` is gone from 5 endpoints and raw errno
+strings from 10 more; `correlation_id` is added to 15; malformed bodies now return
+`application/json` instead of an HTML error page. Those fields were leaking absolute filesystem
+paths — and so the operator's username and home directory — into an unauthenticated response.
+The dashboard also now **exits** on an unhandled rejection or uncaught exception where 11.9.1
+logged and continued, so supervised deployments will see restarts instead of silent errors.
+The surface is loopback-only, so this affects you only if you script against it.
+
+### Fixes
+- **`security-scan` could not fail.** It reported `MINDFORGE.md valid — 0 settings configured`
+  and exited 0 on every input, because both config parsers used a plain `KEY=value` regex while
+  the registry declares bracketed `[KEY] = value`. All 43 parameters were invisible. One shared
+  parser now reads both forms, and the schema has real `required` keys. Three CI gates go from
+  unfailable to failable — on fresh installs and `--force` reinstalls; a plain upgrade keeps
+  your existing schema.
+- **The audit hash chain forked under concurrent writers.** No `.jsonl` append took a lock, and
+  the chain head was cached in-process and never invalidated — so a second process's append made
+  the first keep chaining from a superseded hash. Both halves are fixed: a fail-closed lock, and
+  a cached head that carries the file size witnessing it is still the tail. A lock alone was
+  measured insufficient. 8 concurrent appenders went from 199 broken links to 0.
+- **44.4% of trace content was unsearchable and every multi-word query returned nothing.** The
+  index was keyed on `trace_id` rather than the row's primary key, so each span evicted the
+  previous one; and whole queries were wrapped as a single FTS phrase, so one absent term zeroed
+  the result. 2,270 of 5,117 rows are recovered losslessly and queries are now tokenised and
+  ranked. The shipped retrieval eval had zero callers and now runs as `npm run eval:retrieval`.
+- **The cost ledger reported two different totals for one concept** ($13.73 vs $0.00) because
+  writer and reader used different field names — and the test wrote the reader's name, so the
+  mismatch passed. One record shape now, and the configured ledger path no longer points at a
+  file that never existed.
+- **The daily cost cap is declared but not enforced**, and is now labelled that way in
+  `MINDFORGE.md` and the schema rather than described as non-overridable. Wiring it is COST-02.
+
+### Honesty
+`README.md` now carries a per-channel capability table with an explicit **Hooks enforced: No**
+row for both install channels, because no hook configuration ships and nothing generates one.
+The plugin channel's dispatcher additionally fails with `Cannot find module './lib/hook-flags'`
+on every fire. Treat MindForge as governance-by-convention plus a verifiable audit log, not as a
+policy enforcement point. Making enforcement real per harness is the goal of v12.
+
+### Stats
+105 test files, 103 pass, 2 environment-dependent skips. Four suites that could not report
+failure now can. Audit chain verifies clean. Tarball 1,973 entries.
+
+---
+
 ## v11.9.0 — 2026-07-27 — Bedrock Provider + Full Dry-Run Audit
 
 ### What's New

package/bin/autonomous/audit-writer.js

@@ -20,6 +20,7 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { hashAuditEntry } = require('../governance/audit-hash');
+const { withFileLock } = require('../utils/file-lock');
 
 /**
  * Computes the SHA-256 hash of an entry chained to its predecessor (UC-04).
@@ -57,19 +58,20 @@ function readLastHash(auditPath) {
 // sync write gives in-process consumers (e.g. StuckMonitor, which is fed the event
 // object directly but may also re-read the file) immediate, durable data.
 //
-// Chain head caching: re-reading the file's tail on every append is O(file) — bad
-// on hot paths. Instead we keep a per-path in-memory lastHash (Map keyed by the
-// RESOLVED absolute path), seeded ONCE from the file's last entry on the first
-// append, then advanced in-process for O(1) appends. If the cache is cold (new
-// process, or a path never written in this process) we seed from disk — so a
-// second process correctly continues the on-disk chain from its tail.
+// Chain head caching: re-reading the file's tail on every append is O(file) — bad on
+// hot paths. We keep a per-path in-memory head (Map keyed by the RESOLVED absolute
+// path) as { hash, size }, where `size` is the file size immediately after our own
+// write. The size is the WITNESS that the cache is still the true tail: if the file is
+// still exactly that long, nobody else appended and the cached hash is the tail (O(1));
+// if it differs, another process appended and we MUST re-seed from disk.
 //
-// Concurrency: within a process this is fully synchronous, so calls cannot
-// interleave and the cached lastHash is always current. ACROSS processes, each
-// process seeds from the file tail on its first append; this is correct only under
-// the single-operator model (no two processes appending CONCURRENTLY to the same
-// audit file). MindForge runs one autonomous operator at a time, so this holds.
-const _lastHashCache = new Map(); // resolvedPath -> last `_hash` written/seen
+// Concurrency (LOCK-01): the seed-through-write sequence below runs inside
+// withFileLock, so no other process can read the head, or append, while we hold it.
+// The size check is what makes the cache safe across processes — a lock alone is NOT
+// enough, because a warm cache would still hand back a hash that a lock-respecting
+// second writer has since superseded, forking the chain. Verified: lock-only leaves
+// 4-6 link breaks per 8-process run; lock + size-validated reseed leaves 0.
+const _lastHashCache = new Map(); // resolvedPath -> { hash, size }
 
 /**
  * Synchronously appends ONE hash-chained, durable entry to an audit JSONL file.
@@ -96,30 +98,43 @@ function appendAuditEntrySync(auditPath, event) {
     timestamp: event.timestamp || new Date().toISOString(),
   };
 
-  // 2. Seed previous_hash: prefer the warm in-process cache; fall back to the
-  //    file's last entry when cold (first append in this process for this path).
-  let previous_hash = _lastHashCache.has(resolved)
-    ? _lastHashCache.get(resolved)
-    : readLastHash(resolved);
+  // 2-5. LOCK-01: seed-through-write is ONE critical section. The lock opens BEFORE
+  //      the head is read and closes AFTER the fsync, so no other process can read the
+  //      same head, or interleave an append, while we hold it. maxTries is raised above
+  //      the module default because failing closed here DROPS an audit entry: at 16
+  //      concurrent writers the default ~1s ceiling loses ~35% of entries, 150 tries
+  //      loses none.
+  return withFileLock(resolved, () => {
+    // 2. Seed previous_hash from the warm cache ONLY if the file is still exactly as
+    //    long as we left it (proof nobody else appended); otherwise re-seed from disk.
+    const cached = _lastHashCache.get(resolved);
+    let onDiskSize = -1;
+    try { onDiskSize = fs.statSync(resolved).size; } catch { onDiskSize = -1; }
+    const previous_hash = (cached && cached.size === onDiskSize)
+      ? cached.hash
+      : readLastHash(resolved);
 
-  // 3. Compute _hash over {...stamped, previous_hash} WITHOUT _hash in the material.
-  const _hash = hashEntry(stamped, previous_hash);
+    // 3. Compute _hash over {...stamped, previous_hash} WITHOUT _hash in the material.
+    const _hash = hashEntry(stamped, previous_hash);
 
-  // 4. Write {...stamped, previous_hash, _hash} as one JSON line, durably+synchronously
-  //    (openSync('a') + writeSync + fsyncSync + closeSync — mirrors appendDurableSync).
-  const chained = { ...stamped, previous_hash, _hash };
-  fs.mkdirSync(path.dirname(resolved), { recursive: true });
-  const fd = fs.openSync(resolved, 'a');
-  try {
-    fs.writeSync(fd, JSON.stringify(chained) + '\n');
-    fs.fsyncSync(fd);
-  } finally {
-    fs.closeSync(fd);
-  }
+    // 4. Write {...stamped, previous_hash, _hash} as one JSON line, durably+synchronously
+    //    (openSync('a') + writeSync + fsyncSync + closeSync — mirrors appendDurableSync).
+    const chained = { ...stamped, previous_hash, _hash };
+    fs.mkdirSync(path.dirname(resolved), { recursive: true });
+    const fd = fs.openSync(resolved, 'a');
+    let sizeAfter = -1;
+    try {
+      fs.writeSync(fd, JSON.stringify(chained) + '\n');
+      fs.fsyncSync(fd);
+      sizeAfter = fs.fstatSync(fd).size;   // exact new length, one syscall, fd already open
+    } finally {
+      fs.closeSync(fd);
+    }
 
-  // 5. Advance the in-process chain head and return the written entry.
-  _lastHashCache.set(resolved, _hash);
-  return chained;
+    // 5. Advance the in-process chain head (hash + its witness) and return the entry.
+    _lastHashCache.set(resolved, { hash: _hash, size: sizeAfter });
+    return chained;
+  }, { maxTries: 150, label: 'audit' });
 }
 
 module.exports = { appendAuditEntrySync };

package/bin/dashboard/api-router.js

@@ -9,6 +9,7 @@ const fs      = require('fs');
 const Metrics = require('./metrics-aggregator');
 const Approval = require('./approval-handler');
 const SSE     = require('./sse-bridge');
+const { sendServerError } = require('./error-response');
 
 // Steering queue path (from Day 8 auto-executor)
 const STEERING_QUEUE = path.join(process.cwd(), '.planning', 'steering-queue.jsonl');
@@ -38,7 +39,7 @@ function register(app) {
     try {
       res.json(Metrics.getStatus());
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/status', err, 'Failed to read project status');
     }
   });
 
@@ -50,7 +51,7 @@ function register(app) {
       const event  = typeof req.query.event === 'string' ? req.query.event : null;
       res.json(Metrics.getAuditEntries(limit, offset, event));
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/audit', err, 'Failed to read audit entries');
     }
   });
 
@@ -59,7 +60,7 @@ function register(app) {
     try {
       res.json(Metrics.getMetrics());
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/metrics', err, 'Failed to read quality metrics');
     }
   });
 
@@ -68,7 +69,7 @@ function register(app) {
     try {
       res.json(Metrics.getApprovals());
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/approvals', err, 'Failed to read approvals');
     }
   });
 
@@ -104,7 +105,7 @@ function register(app) {
 
       res.json(result);
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'POST /api/approve/:id', err, 'Failed to record approval decision');
     }
   });
 
@@ -113,7 +114,7 @@ function register(app) {
     try {
       res.json(Metrics.getTeamActivity());
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/team', err, 'Failed to read team activity');
     }
   });
 
@@ -124,7 +125,7 @@ function register(app) {
       const limit = Math.min(parseInt(req.query.limit || '20', 10), 100);
       res.json(Metrics.getMemory(q, limit));
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/memory', err, 'Failed to query knowledge base');
     }
   });
 
@@ -134,7 +135,7 @@ function register(app) {
       const window = Math.min(parseInt(req.query.window || '7', 10), 90);
       res.json(Metrics.getCosts(window));
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/costs', err, 'Failed to read cost metrics');
     }
   });
 
@@ -193,7 +194,7 @@ function register(app) {
 
       res.json({ success: true, queued: true, id: entry.id, action });
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'POST /api/steer', err, 'Failed to queue steering directive');
     }
   });
 
@@ -241,7 +242,7 @@ function register(app) {
         timestamp: new Date().toISOString()
       });
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendServerError(res, 'GET /api/v1/system', err, 'Failed to read system observability data');
     }
   });
 }

package/bin/dashboard/error-response.js

@@ -0,0 +1,44 @@
+/**
+ * MindForge — Dashboard error responses (LEAK-01)
+ *
+ * Every dashboard route used to return `err.message` — and express's default
+ * handler returned `err.stack` — straight to the client. fs-sourced errors embed
+ * ABSOLUTE paths (EACCES/ENOENT/EISDIR), so a 500 disclosed the operator's home
+ * directory and username. This matters more than a normal 500 body leak because
+ * `requireAuth` (server.js) lets GET and OPTIONS through unguarded: every read
+ * route was an *unauthenticated* filesystem-layout oracle.
+ *
+ * Contract: the full error (stack included) is logged server-side against a
+ * correlation id; the client receives only a generic message plus that id.
+ */
+'use strict';
+
+const crypto = require('crypto');
+
+/** Short, non-guessable id used to tie a client response to a server log line. */
+function newCorrelationId() {
+  return crypto.randomBytes(8).toString('hex');
+}
+
+/**
+ * Log `err` server-side and answer with a generic 500 carrying a correlation id.
+ *
+ * @param {object} res            Express response.
+ * @param {string} context        Route identifier for the log, e.g. 'GET /api/metrics'.
+ * @param {unknown} err           The caught error (or any value).
+ * @param {string} clientMessage  Safe, static message for the client.
+ * @param {object} [extra]        Extra fields merged into the body (e.g. { success: false }).
+ * @returns {object} the Express response.
+ */
+function sendServerError(res, context, err, clientMessage, extra = {}) {
+  const correlationId = newCorrelationId();
+  const detail = err && err.stack ? err.stack : String(err);
+  console.error(`[dashboard] ${context} failed [cid=${correlationId}]: ${detail}`);
+  return res.status(500).json({
+    ...extra,
+    error: clientMessage,
+    correlation_id: correlationId
+  });
+}
+
+module.exports = { sendServerError, newCorrelationId };

package/bin/dashboard/frontend/index.html

@@ -198,7 +198,7 @@
         </div>
       </div>
       <div class="grid-4">
-        <div class="card"><div class="card-body"><div class="stat-label">Cumulative Cost</div><div id="stat-total-cost" class="stat-value">$0.00</div></div></div>
+        <div class="card"><div class="card-body"><div class="stat-label">Cost (7d)</div><div id="stat-total-cost" class="stat-value">$0.00</div></div></div>
         <div class="card"><div class="card-body"><div class="stat-label">Avg Quality</div><div id="stat-avg-quality" class="stat-value">0.0</div></div></div>
         <div class="card"><div class="card-body"><div class="stat-label">LSPs Registered</div><div id="stat-lsp-count" class="stat-value">0</div></div></div>
         <div class="card"><div class="card-body"><div class="stat-label">Token Velocity</div><div id="stat-velocity" class="stat-value">0 <span class="stat-unit">tx/m</span></div></div></div>
@@ -430,6 +430,7 @@
         const data = await res.json();
         state = data;
         updateMetricsUI(data);
+        refreshCosts();
         refreshApprovals();
         refreshMemory();
         refreshTeam();
@@ -538,8 +539,24 @@
     }
 
     function updateMetricsUI(data) {
-      document.getElementById('stat-total-cost').textContent = `$${(data.costs?.reduce((a,b) => a + b.cost, 0) || 0).toFixed(4)}`;
-      document.getElementById('stat-avg-quality').textContent = (data.quality?.reduce((a,b) => a + b.score, 0) / (data.quality?.length || 1)).toFixed(1);
+      // /api/metrics returns { sessions, avg_quality, avg_cost_usd, ... } — see
+      // bin/dashboard/metrics-aggregator.js getMetrics(). It has never returned
+      // `costs` or `quality`, so these tiles used to render "$0.0000" and "NaN".
+      document.getElementById('stat-avg-quality').textContent = (data.avg_quality ?? 0).toFixed(1);
+    }
+
+    // Cumulative spend comes from the usage ledger via /api/costs (already wired
+    // in bin/dashboard/api-router.js but never fetched until now).
+    async function refreshCosts() {
+      try {
+        const res = await fetch('/api/costs?window=7');
+        // sendServerError returns a well-formed JSON body, so res.json() would
+        // SUCCEED on a 500 and `total_usd ?? 0` would render "$0.00" — an outage
+        // and genuine zero spend look identical under the "Cost (7d)" label.
+        if (!res.ok) throw new Error(`/api/costs ${res.status}`);
+        const data = await res.json();
+        document.getElementById('stat-total-cost').textContent = `${(data.total_usd ?? 0).toFixed(2)}`;
+      } catch (e) { console.error('Cost refresh failed', e); }
     }
 
     function appendAuditEvent(data) {

package/bin/dashboard/metrics-aggregator.js

@@ -7,6 +7,7 @@
 
 const fs   = require('fs');
 const path = require('path');
+const { ledgerPath, entryCost, entryDay } = require('../models/usage-record');
 
 // ── TTL Cache (5-second window) ──────────────────────────────────────────────
 const _cache = new Map();
@@ -29,7 +30,7 @@ function cacheSet(key, data) {
 // Paths are resolved lazily to support testing in temp directories
 const getPaths = () => ({
   quality:   path.join(process.cwd(), '.mindforge', 'metrics', 'session-quality.jsonl'),
-  usage:     path.join(process.cwd(), '.mindforge', 'metrics', 'token-usage.jsonl'),
+  usage:     ledgerPath(),
   audit:     path.join(process.cwd(), '.planning', 'AUDIT.jsonl'),
   handoff:   path.join(process.cwd(), '.planning', 'HANDOFF.json'),
   auto:      path.join(process.cwd(), '.planning', 'auto-state.json'),
@@ -122,12 +123,29 @@ function getMetrics() {
   const auditEntries   = readJSONL(paths.audit, 500);
 
   // Quality scores (last 20 sessions)
+  // session-quality.jsonl has NO writer anywhere in this repo — every one of its
+  // four references (here, sdk/src/client.ts, mcp-server/src/vendor/client.ts,
+  // plugins/mindforge/mcp/dist/index.js) is a READ, and no command instructs an
+  // agent to append it either. The read is kept because those three other
+  // consumers depend on the file and a schema-compliant one may exist in a user
+  // project; supplying a writer is OUT OF SCOPE for this patch. Read the
+  // SCHEMA-DECLARED names first (.mindforge/metrics/METRICS-SCHEMA.md), keeping
+  // the historical names as fallbacks.
+  // Per-session cost is NOT a session-quality field: it is joined from the
+  // usage ledger by session_id (every provider result carries one — see
+  // bin/models/model-client.js:69).
+  const costBySession = usageEntries.reduce((acc, u) => {
+    if (!u || typeof u.session_id !== 'string') return acc;
+    acc[u.session_id] = (acc[u.session_id] || 0) + entryCost(u);
+    return acc;
+  }, {});
+
   const sessions = qualityEntries.map(e => ({
     id:               e.session_id,
     timestamp:        e.timestamp,
-    quality_score:    e.quality_score ?? 0,
+    quality_score:    e.session_quality_score ?? e.quality_score ?? 0,
     verify_pass_rate: e.verify_pass_rate ?? 0,
-    cost_usd:         e.total_cost_usd ?? 0,
+    cost_usd:         costBySession[e.session_id] ?? 0,
     node_repairs:     e.node_repairs ?? 0,
   }));
 
@@ -302,12 +320,15 @@ function getCosts(windowDays = 7) {
   };
 
   for (const e of entries) {
-    if (e.timestamp < cutoff) continue;
-    
-    const cost = e.total_cost_usd || 0;
+    // Ledger rows carry both `date` and `timestamp` (see bin/models/usage-record.js).
+    // Bucket on the canonical day so date-only and full-ISO rows behave alike.
+    const day = entryDay(e);
+    if (!day || day < cutoff) continue;
+
+    const cost = entryCost(e);
     stats.total_usd += cost;
-    
-    if (e.timestamp && e.timestamp.startsWith(today)) {
+
+    if (day === today) {
       stats.today_usd += cost;
     }
 

package/bin/dashboard/revops-api.js

@@ -10,6 +10,7 @@ const roiEngine = require('../revops/roi-engine');
 const velocityForecaster = require('../revops/velocity-forecaster');
 const debtMonitor = require('../revops/debt-monitor');
 const metricsAggregator = require('./metrics-aggregator');
+const { sendServerError } = require('./error-response');
 
 /**
  * GET /api/revops/overview
@@ -25,7 +26,11 @@ router.get('/overview', (req, res) => {
         ...metrics, 
         tasks_total: status.tasks_total || 0,
         tasks_completed: status.tasks_completed || 0,
-        auditEntries: metricsAggregator.getAuditEntries(500) // need enough history for velocity
+        // .entries — getAuditEntries() returns { entries, total, limit, offset }, not an
+        // array. roi-engine, velocity-forecaster and debt-monitor all call .filter() on
+        // this value, so handing them the wrapper object throws a TypeError that the
+        // route's catch turns into an opaque 500.
+        auditEntries: metricsAggregator.getAuditEntries(500).entries // need enough history for velocity
     };
 
     const roi      = roiEngine.calculate(fullMetrics);
@@ -40,7 +45,12 @@ router.get('/overview', (req, res) => {
         timestamp: new Date().toISOString()
     });
   } catch (err) {
-    res.status(500).json({ success: false, error: 'AgRevOps metrics retrieval failed', detail: err.message });
+    // LEAK-01: echoing err.message as a `detail` field put absolute filesystem paths
+    // — and therefore the operator's username and home directory — into an
+    // unauthenticated HTTP response body (requireAuth exempts GET). Log the full
+    // error server-side; return a generic message plus a correlation id.
+    sendServerError(res, 'GET /api/revops/overview', err,
+      'AgRevOps metrics retrieval failed', { success: false });
   }
 });