https://github.com/huskyauto/visionclaw-agent-public-release
Open-source multi-tenant AI agent workspace · 16 personas · 399 tools · 216 tables · 129 active capabilities · 627 production indexes · self-hosted, BYO-keys
https://github.com/huskyauto/visionclaw-agent-public-release
agent-orchestration ai-agents ai-platform ai-workforce anthropic autonomous-agents express llm multi-agent open-source openai rag react self-hosted typescript
Last synced: 3 days ago
JSON representation
Open-source multi-tenant AI agent workspace · 16 personas · 399 tools · 216 tables · 129 active capabilities · 627 production indexes · self-hosted, BYO-keys
- Host: GitHub
- URL: https://github.com/huskyauto/visionclaw-agent-public-release
- Owner: Huskyauto
- License: mit
- Created: 2026-04-15T11:42:23.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2026-07-22T11:02:54.000Z (5 days ago)
- Last Synced: 2026-07-22T12:27:38.430Z (5 days ago)
- Topics: agent-orchestration, ai-agents, ai-platform, ai-workforce, anthropic, autonomous-agents, express, llm, multi-agent, open-source, openai, rag, react, self-hosted, typescript
- Language: TypeScript
- Homepage: https://agenticcorporation.net
- Size: 10.6 MB
- Stars: 21
- Watchers: 0
- Forks: 8
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- Funding: .github/FUNDING.yml
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Threat model: threat_model.md
- Security: SECURITY.md
- Roadmap: ROADMAP.md
- Agents: AGENTS.md
Awesome Lists containing this project
README
# VisionClaw Agent
[](https://github.com/Huskyauto/VisionClaw-Agent-Public-Release/actions/workflows/ci.yml)
[](https://github.com/Huskyauto/VisionClaw-Agent-Public-Release/stargazers)
[](https://agenticcorporation.net)
[](FORK-SETUP.md)
[](ROADMAP.md)
### ▶ Watch the 84-second demo
A narrated walkthrough of the **live** platform — every frame is a real page from the running app (counts match [`docs/CURRENT_PLATFORM_TOTALS.md`](docs/CURRENT_PLATFORM_TOTALS.md)).
[](https://github.com/Huskyauto/VisionClaw-Agent-Public-Release/releases/download/demo-v1/visionclaw-demo.mp4)
> Click the image to play/download the MP4 (1080p, ~12 MB, hosted as a release asset).
### The Self-Hosted AI Operating System for Agencies & Operators
**An open-source, multi-tenant AI agent workspace — documents, research & workflows. Built for agencies, operators, and founders who want an always-on AI operations team they own and host themselves: your keys, your database, your infrastructure. No per-seat SaaS, no vendor lock-in.**
**Created by Robert Washburn** | huskyauto@gmail.com | [Live demo: agenticcorporation.net](https://agenticcorporation.net)
> Not affiliated with the unrelated AR/wearable "VisionClaw" project. This is the AI agent platform.
> **Reviewing this repo (human or AI)?** Start with [`docs/FOR-EXTERNAL-REVIEWERS.md`](docs/FOR-EXTERNAL-REVIEWERS.md) — auto-regenerated at every mirror build with the current code-shape facts, deliberate architecture decisions (e.g. app-level tenant isolation, **not** RLS), and the single source of truth for all platform counts ([`docs/CURRENT_PLATFORM_TOTALS.md`](docs/CURRENT_PLATFORM_TOTALS.md)). Reviews graded against stale snapshots or third-party summaries will contain invalid findings.
---
## ⚠️ Autonomous Pipelines Disclaimer (please read before forking)
VisionClaw ships several **autonomous decision pipelines** — the multi-model jury (`jury_triage`), the Agentic CI Self-Healer, and downstream implementer hooks. In this public release these pipelines are **safe-by-default**:
- **Auto-apply is OFF.** The jury votes and writes a human-readable decision log for your review, but it does **not** automatically queue fixes for code-mutation or apply verdicts to your codebase.
- **To opt in**, set `JURY_AUTOAPPLY=1` in your environment. This enables the implementer-pickup seam (`data/jury-decisions/queue.json`). Only enable this if you have read the code, understand the risk model, and have your own test/rollback discipline in place — autonomous code-mutation can corrupt data, break auth, leak secrets, or commit broken code if your guardrails aren't set up.
- **No warranty.** This project is provided AS-IS under its open-source license. The maintainers, contributors, and any platform hosting the source (including Replit) are not responsible for outcomes when you enable autonomous pipelines in your own deployment. The defaults are deliberately conservative; if you change them, you own the consequences.
- **Reporting:** if you find a safety bug in the gated-off default path (i.e. something autonomous happens without `JURY_AUTOAPPLY=1`), please open a GitHub issue or email huskyauto@gmail.com.
---
## What Is This?
VisionClaw Agent is an open-source, multi-tenant AI platform where 16 specialized agents work together to produce real deliverables — research reports, legal documents, financial models, marketing campaigns, slide decks, spreadsheets, and PDFs.
Instead of a single chatbot, you get a full agent workforce. Give it a task. The right agent picks it up, selects the right tools, coordinates with other agents when needed, and delivers a finished result. Every decision is traceable, every action is governed, and every integration degrades gracefully when not configured.
**Fork it. Configure your API keys. Deploy. You have an AI operations team.**
**The app runs with just one LLM key and a Postgres database.** Everything else — email, payments, voice, Drive — is optional and appears automatically when you add the key.
Roughly 320k lines of TypeScript across 1,100+ files. 40+ pages. **407 tools · 129 active capabilities · 16 personas · 223 tables · 41 governance rules · 642 production indexes · 6 AI providers · 6 deployment targets.** Live, always-current counts: [`docs/CURRENT_PLATFORM_TOTALS.md`](docs/CURRENT_PLATFORM_TOTALS.md). Browsable indexes: [`docs/tools.md`](docs/tools.md) · [`docs/personas.md`](docs/personas.md).
---
## Who is this for?
- **Agencies** — give every client a multi-agent operations team without burning headcount.
- **Operators & founders** — replace 5-10 SaaS subscriptions with one agent workforce you own.
- **Solo entrepreneurs** — run a research / content / sales / finance team of one.
- **Research teams** — a real testbed for multi-agent orchestration, AHB safety layers, and tool governance.
## What can it actually do?
Out of the box, ask it to:
- Research a market, build the comparison spreadsheet, ship the PDF
- Draft a proposal, contract, or pitch deck (with vision-graded slide art)
- Analyze a contract for risk across 9 regulatory frameworks
- Run a deep research sweep across arXiv / HN / Reddit / press releases
- Build a financial forecast with charts and exec summary
- Plan a content calendar, generate the posts, schedule them
- Send invoices, track CRM, run an outreach sequence
- Produce a YouTube long-form or Short, end to end (script → render → upload)
Every deliverable lands as a real file (PDF, XLSX, PPTX, MP4, MP3) in Google Drive or local storage — not a chat transcript.
## 60-second quickstart
```bash
git clone https://github.com/Huskyauto/VisionClaw-Agent-Public-Release.git
cd VisionClaw-Agent-Public-Release && npm install
export DATABASE_URL="postgresql://localhost/visionclaw"
export SESSION_SECRET="$(openssl rand -hex 32)"
export OPENAI_API_KEY="sk-..." # or ANTHROPIC_API_KEY
npm run dev # http://localhost:5000
```
That's it. The platform auto-creates the schema, seeds 16 personas + 41 governance rules, and redirects you to `/setup`. First account becomes admin.
Don't want to run it locally? Look at the **live deployment**: [agenticcorporation.net](https://agenticcorporation.net).
## Architecture at a glance
Every request — human chat or autonomous loop — passes through the same safety layer before it can touch a tool, and every tool call lands in a tenant-isolated Postgres. One pipeline, no side doors:
```mermaid
flowchart TB
U["User / Autonomous loops
(heartbeat · scheduled tasks · self-repair)"] --> CE["Chat Engine (SSE)"]
CE --> SAFETY
subgraph SAFETY["AHB Safety Layer — every call passes through"]
direction TB
IG["Intent gate
(fail-OPEN, logged)"] --- DP["Destructive-tool policy
(fail-CLOSED)"]
RG["Outbound redaction gate"] --- TC["Tenant context
(AsyncLocalStorage)"]
end
SAFETY --> CEO["CEO orchestrator (Felix)"]
CEO --> ROUTER["Agent Router"]
ROUTER --> P1["Specialist personas
(Engineer · Writer · Research · Finance · Legal · …)"]
ROUTER --> P2["Imported Claude Code agents
(runtime adapter)"]
P1 --> TOOLS
P2 --> TOOLS
subgraph TOOLS["Tool layer — 407 governed tools"]
direction TB
T1["File I/O · web · email · LLM · payments · drive"]
T2["TNR snapshots — irreversible calls are undoable"]
T3["Tracing spans — parent-linked causality tree"]
T4["Admission control — priority pool + rate limits"]
end
TOOLS --> DB[("PostgreSQL + pgvector
tenant-isolated: every WHERE filters tenant_id")]
```
Plain-text version of the same diagram
```
┌────────────────────────────────────────┐
│ AHB safety layer (intent + policy) │
│ • intent gate (fail-OPEN, logged) │
│ • destructive-tool policy (fail-CLOSE)│
│ • outbound redaction gate │
│ • tenant-context (AsyncLocalStorage) │
└─────────────┬──────────────────────────┘
│ every call passes through
▼
User ──▶ Chat Engine (SSE) ──▶ CEO (Felix) ──▶ Agent Router ──┐
│
┌────────────────────────────────────────────────────────┤
▼ ▼ ▼ ▼ ▼
Specialist Specialist Specialist ... Imported
persona persona persona Claude Code
(Forge, (Scribe, (Neptune, agents (with
Engineer) Writer) Research) runtime adapter)
│ │ │ │
└──────┬─────────┴────────────────┴───────────────────────┘
│ tool dispatch (407 tools)
▼
┌──────────────────────────────────────────────────────────────┐
│ Tool layer: file I/O · web · email · LLM · payments · drive │
│ • TNR snapshots (R100) on irreversible calls — undoable │
│ • Tracing spans (R101) parent-linked into causality tree │
│ • Admission control (R102) priority pool + rate limit │
└──────────────────────────────────────────────────────────────┘
│
▼
PostgreSQL + pgvector (tenant-isolated; every WHERE filters tenant_id)
```
Browse the full lineup: [tools index](docs/tools.md) · [personas index](docs/personas.md).
---
## Tested & CI-protected
This is not vibe-coded. Every push runs against a real test suite gated by GitHub Actions. **Note:** the public-mirror CI workflow at `.github/workflows/ci.yml` is preserved on every snapshot since 2026-05-06 (HyperAgent review followup) — earlier mirrors stripped `.github/` entirely, which made the badge above 404 and the "every push" claim incorrect for the public mirror specifically. Counts and badges below now reflect what actually runs on the public mirror; for the live source-of-truth platform metrics, see [`docs/CURRENT_PLATFORM_TOTALS.md`](docs/CURRENT_PLATFORM_TOTALS.md) (auto-regenerated from live registries).
| Gate | What it proves | Status |
|---|---|---|
| `build` | Production bundle compiles end-to-end | ✅ hard gate |
| `security-tests` | **158 tests across 16 files in 6 categories** — SSRF/DNS-rebinding, admin auth, recipe validation + atomic writes, webhook signatures, trigger rate-limit, tenant isolation, conversation IDOR, background-queue durability + reclaim boundaries, destructive-command rails (the deny-list that blocks `db:push --force`, `DROP TABLE`, `git push --force`, `rm -rf /`, etc.), LLM cost-rate-card correctness, tool-dispatch contract, **tenant-context hardening** (41 tests — the strict `tenantScope()` storage helper that rejects every fail-open shape, the `STRICT_TENANT_CONTEXT` env flag with `assertTenantContext()` runtime guard, and end-to-end propagation through chat → assertTenantContext → step-ledger → AsyncLocalStorage → recordExecution with a live-DB persist round-trip; full source paths and call-site line numbers in [`docs/EVIDENCE.md`](docs/EVIDENCE.md)) | ✅ hard gate |
| `docker` | Multi-stage image builds, container boots clean, `/healthz` returns 200 | ✅ hard gate |
| `typecheck` | `tsc --noEmit` — tracked and burning down | informational |
| `silent-failure-hunter` | Greps `server/` + `shared/` for the silent-failure shapes that bit us before (`tenantId ?? 1`, default-1 params, log-and-swallow catches, literal-secret fallbacks); uploads the full scan report as a 30-day workflow artifact on every PR | informational |
| `tool-smoke-test` | Staged smoke-test + documentation program across all 407 tools (20 stages of 20; doc-only tools are never auto-invoked); $0 / no LLM / no tenant, one stage per session | **COMPLETE — 396 of 396 cataloged verified at the 2026-07-11 refresh; the 3 sandbox tools added in R125+137.39/.43 await the next re-scan · 20/20 stages signed off · 0 flags** (refreshed 2026-07-11) |
Run locally with `bash tests/run.sh`. The full receipts (CI history, the destructive-command deny-list, the silent-failure baseline) are in [`docs/`](docs/).
---
## ⚡ Deploy your own copy
| Platform | One-click |
|---|---|
| **Replit** | [Open in Replit →](https://replit.com/github/Huskyauto/VisionClaw-Agent-Public-Release) |
| **Render** | [](https://render.com/deploy?repo=https://github.com/Huskyauto/VisionClaw-Agent-Public-Release) |
| **Railway** | [](https://railway.app/template?template=https%3A%2F%2Fgithub.com%2FHuskyauto%2FVisionClaw-Agent-Public-Release) |
| **Docker** | `docker compose up` — see [FORK-SETUP.md](FORK-SETUP.md) |
After deploy, you'll need a Postgres database with the `vector` extension (Render and Railway can provision one for you), one LLM key (`OPENAI_API_KEY` or `ANTHROPIC_API_KEY`), and a `SESSION_SECRET`. Everything else is optional.
### 🛠 Want it installed for you?
The platform is free and always will be — but standing up a production instance (database, keys, integrations, governance, backups) takes real platform knowledge. I offer a **done-for-you deployment service**: your own instance, on your infrastructure, configured safely by the author.
- **Standard Install — $750**: live in under a week, keys + core integrations wired, governance defaults reviewed with you, live walkthrough, 2 weeks of email support
- **Pro Setup — $1,500**: everything above plus up to 3 custom personas for your workflows, Stripe/multi-tenant setup, automated backups, 30 days of priority support
You own everything — code, data, keys, infrastructure. No lock-in, ever. **Email huskyauto@gmail.com with subject "Deploy"** — tell me your hosting preference and what you want the agents doing. Launch price: first 5 installs at these rates.
Landing page with live agent activity feed and command center stats
First-run setup dashboard — real-time status of every integration
---
## Try These Prompts
Once you're set up, paste any of these into the chat to see the platform in action:
| Prompt | What Happens |
|--------|-------------|
| "Research the top 5 competitors in [your industry] and build me a comparison spreadsheet" | Radar researches, Atlas structures data, exports a formatted .xlsx to Google Drive |
| "Draft a professional proposal for [client name] based on our last conversation" | Scribe pulls context from memory, writes a styled PDF, Proof reviews it for quality |
| "Analyze this contract for risks" *(attach a PDF)* | Luna scans for 20 risk patterns across 9 regulatory frameworks, scores compliance |
| "Create a weekly content calendar for our social media" | Teagan builds a structured plan with post ideas, hashtags, and optimal timing |
| "Give me a financial forecast for Q3 based on current revenue trends" | Cassandra models projections, generates charts, delivers an executive summary |
| "What happened in AI news this week?" | Neptune runs a deep research sweep across arXiv, HN, Reddit, and tech blogs |
---
## 📸 Tour — what you actually see
Real screenshots from the live instance at [agenticcorporation.net](https://agenticcorporation.net).
Landing hero — value prop in one line, with three real CTAs.
Command Center — live counts, recent ops with status pills, capability chips.
Agent Activity Feed — Neptune ships research, Luna runs compliance, Cassandra builds the Excel model, Felix delivers the styled PDF.
Mixture of Agents — 4 frontier proposers (Sonnet · GPT-4.1 · Gemini 2.5 Pro · DeepSeek Reasoner) feed a Claude Opus aggregator for ensemble-quality answers.
Gated Code Proposals (R25) — nightly research generates real edits; a shadow verifier compiles each in an isolated git worktree before any human reviewer sees it.
Glasses Gateway — Meta Ray-Ban smart glasses stream POV video and audio to a tenant-isolated gateway with sub-second voice replies via Gemini Live.
---
## Platform at a Glance
> Authoritative counts live in [docs/CURRENT_PLATFORM_TOTALS.md](docs/CURRENT_PLATFORM_TOTALS.md). If any number on this page conflicts with that doc, the truth doc wins.
| Metric | Count |
|--------|-------|
| AI Agents (Personas) | 16 |
| Built-in Tools | 407 |
| AI Models in Core Registry | 41 curated |
| Daily Catalog Discovery | 1000+ models scanned on OpenRouter |
| AI Providers | 6 (OpenAI, Anthropic, Google, xAI, OpenRouter, Perplexity) |
| Governance Rules | 41 |
| Corporate Operation Scaffolds | 75 |
| Corporate Departments | 12 |
| Agent Skills | 62 |
| Frontend Pages | 40+ |
| API Endpoints | 300+ |
| Database Tables | 222 live (declared delta in schema.ts) |
---
## How It Works
```
User Request
│
▼
┌──────────────────┐ ┌─────────────────────────────┐
│ Chat Engine │────▶│ Agent Router │
│ (SSE streaming) │ │ picks best agent for task │
└──────────────────┘ └──────────┬──────────────────┘
│
┌──────────────┼──────────────┐
▼ ▼ ▼
┌──────────┐ ┌──────────┐ ┌──────────┐
│ Felix │ │ Minerva │ │ Neptune │ ... 16 agents
│ (CEO) │ │(Strategy)│ │(Research)│
└────┬─────┘ └────┬─────┘ └────┬─────┘
│ │ │
▼ ▼ ▼
┌─────────────────────────────────────────┐
│ 407 Tools │
│ Search · Write · Build · Analyze · │
│ Email · Pay · Generate · Research │
└──────────────────┬──────────────────────┘
│
┌────────────────┼────────────────┐
▼ ▼ ▼
┌──────────┐ ┌────────────┐ ┌────────────┐
│ PostgreSQL│ │ Google │ │ 6 AI │
│ + pgvector│ │ Drive │ │ Providers │
│ 223 tables│ │ Storage │ │ 41 curated │
└──────────┘ └────────────┘ └────────────┘
```
**Example flow:** You say "Research competitor pricing and build me a comparison spreadsheet."
1. The **Chat Engine** routes to **Felix** (CEO) who sees this needs research + document production
2. Felix spawns **Radar** (Intelligence) to research competitors and **Atlas** (Metrics) to structure the data
3. Radar uses web search and scraping tools, deposits findings into the knowledge base
4. Atlas pulls findings, builds a formatted Excel spreadsheet, uploads to Google Drive
5. You get back a summary with a download link — no manual steps
---
## The 16-Agent Team
Every agent has a defined role, personality, skill set, and operating rules. They work independently or collaborate through orchestration engines.
| Agent | Role | What They Do |
|-------|------|-------------|
| **VisionClaw** | Personal Assistant | Default conversational agent — handles general tasks, delegates complex ones |
| **Felix** | CEO / COO | Revenue strategy, task orchestration, multi-agent DAG decomposition |
| **Forge** | Staff Engineer | Code execution, engineering standards, infrastructure, security review |
| **Teagan** | Content Marketing | Social media strategy, content calendars, brand voice, ad copy |
| **Blueprint** | Innovation Lead | Skill creation, tool learning, self-improvement, capability expansion |
| **Chief of Staff** | Operations Director | System health monitoring, task routing, scheduling, daily operations |
| **Scribe** | Content Creator | Long-form writing, editing, SEO content, documentation, blog posts |
| **Proof** | Quality Reviewer | Proofreading, fact-checking, QA, content review, accuracy scoring |
| **Radar** | Intelligence Analyst | Market intelligence, competitive analysis, trend tracking, OSINT |
| **Neptune** | Deep Research | Academic analysis, overnight autonomous research, multimedia deep dives |
| **Apollo** | Revenue & Pipeline | Sales outreach, lead qualification, pipeline management, CRM |
| **Atlas** | Metrics & Reporting | Analytics, dashboards, KPI tracking, data visualization |
| **Cassandra** | CFO | Budgets, forecasting, P&L modeling, financial analysis |
| **Luna** | Legal & Compliance | Contract review, regulatory compliance, risk assessment, legal drafting |
| **Minerva** | Strategic Planner | Plan-of-record drafting, decision-theory analysis, Felix approval-loop partner; closes the auto-apply → strategic-plan loop for the proactive self-healing engine (R63) |
---
## Feature Overview
### AI & Intelligence
- **41 Curated AI Models in the Core Registry** with cost-aware auto-routing across OpenAI, Anthropic, Google Gemini, xAI Grok, OpenRouter, and Perplexity. Bring your own provider credentials — API billing is governed by each provider's own terms.
- **Adaptive Model Discovery (R73)** — a daily background task scans OpenRouter's full catalog of 1000+ models, tier-classifies each by completion price (reasoning / powerful / balanced / fast), probes the Replit gateway for new releases, and emails the owner a ranked digest of new models worth adding to the registry. Hard caps prevent inbox spam (10 alerts/run max), lifetime dedupe prevents re-alerts, and silent days mean nothing changed.
- **Streaming Responses** via Server-Sent Events (SSE) — real-time token-by-token output
- **Thinking Mode** — explainable reasoning with decision traces for complex problems
- **Model Failover** — automatic fallback to healthy providers when one goes down
- **Context Window Management** — automatic conversation compaction that preserves every fact before summarizing
- **Cost Ledger with Token Telemetry** — every byte across every provider boundary is tracked in a per-tenant cost ledger; orchestrator bills callers automatically via `onTokenUsage` callbacks with row-level pg_advisory locks preventing double-counting
### Document & Content Production
- **PDF Reports** — executive-quality styled PDFs with cover pages, branded headers/footers, charts, and tables
- **Word Documents (.docx)** — professional documents with formatting, headers, and styles
- **Excel Spreadsheets (.xlsx)** — auto-formatted workbooks with formulas and conditional formatting
- **Google Slides** — automated presentation generation delivered to Google Drive
- **Charts & Diagrams** — Recharts visualizations and Mermaid.js diagrams rendered to PNG
- **PDF Form Filling** — fill existing PDF forms programmatically
- **Invoices** — professional invoices with line items, taxes, and branding
### Research & Intelligence
- **Autonomous Overnight Research** — configurable research programs that run autonomously, with LLM-judged experiment scoring and auto-deposit of findings into your knowledge base
- **Web Search** — powered by Perplexity with Wikipedia and Jina fallbacks
- **Deep Web Scraping** — Firecrawl integration for full-site crawling and markdown extraction
- **Trend Research** — parallel scanning across Reddit, Hacker News, Polymarket, and X/Twitter
- **Competitive Intelligence** — automated competitor analysis with structured output
### Memory & Knowledge
- **Semantic Memory Palace** — hierarchical memory organized by Wing and Room with three-tier recall (Hot/Warm/Cold)
- **Zero-Loss Compaction** — full pre-compaction transcripts archived and recoverable; every fact extracted before conversation summarization
- **Vector Knowledge Base** — RAG-powered knowledge retrieval with MMR diversity re-ranking
- **Temporal Knowledge** — subject-predicate-object facts with time validity tracking
- **Dialectic User Modeling** — three internal agents (Deriver, Dialectic, Dreamer) progressively build a profile of each user from conversations
### Multi-Agent Orchestration
- **Crews** — agent teams with defined roles, goals, and backstories working toward a shared objective
- **Flows** — event-driven workflow pipelines that chain agent actions
- **Minds** — 4-role deliberation system (Proposer, Critic, Synthesizer, Judge) for complex decisions
- **Auto-Orchestration** — the COO automatically decomposes complex requests into DAG task graphs and delegates to specialists
- **Subagent Spawning** — agents can spawn child agents for sub-tasks with full tool access
- **Chain of Debates** — multi-persona deliberation where 3-6 specialists argue complex questions from different perspectives
### Communication & Integrations
- **Email** — built-in email server with tenant-specific inboxes, send/reply, and notification handling
- **WhatsApp** — full bot integration for sending/receiving messages and approval workflows
- **Telegram** — bot integration for external interaction
- **Discord** — bot integration for team communication
- **Google Workspace** — Gmail, Calendar, Sheets, Docs, Slides, and Contacts integration
- **Google Drive** — primary storage for generated deliverables; every project gets a dedicated Drive folder with automatic backup
### Payment Processing
- **Stripe** — subscription management, checkout sessions, usage billing, and customer portal
- **Stripe Connect** — tenants can connect their own Stripe accounts for white-label payment processing
- **Coinbase Commerce** — cryptocurrency payments via hosted checkout
- **Coinbase CDP** — on-chain wallet management and balance checks
- **Usage Metering** — token tracking and feature access limits tied to billing tiers
### Voice & Media
- **Text-to-Speech** — ElevenLabs integration with 23+ voice profiles
- **Voice Conversations** — real-time voice input/output with configurable wake words
- **Image Generation** — DALL-E and Replit AI image generation
- **Video Production** — scene-based MP4 pipeline with parallel TTS, Ken Burns motion, 25+ transitions, and background music
### Project Management
- **Project Brain** — filing cabinet system linking conversations, files, notes, and Google Drive assets to projects
- **Scheduled Tasks** — cron-like automation for recurring agent work
- **Activity Logging** — comprehensive system-wide activity tracking
- **Agent Board** — visual overview of all agent activities and status
### Governance & Safety
- **41 Governance Rules** — built-in rules controlling agent autonomy and behavior
- **Process Governor** — enforces execution limits and approval requirements
- **Trust Engine** — evaluates safety and reliability of tool calls; high-risk actions require human approval
- **Prompt Injection Scanner** — detects and blocks malicious injection attempts
- **3-Layer Failure Recovery:**
1. Self-correction retry with adjusted parameters
2. Lean mode fallback to a lighter model on overload
3. Backup agent reroute to mapped specialist
- **5-Part Failure Transparency** — when recovery can't fully succeed, the user is told what failed, why, what was tried, what succeeded, and what they should know
- **Critique Agent** — every response auto-evaluated on accuracy, completeness, relevance, and clarity (scored 1-10); low scores trigger auto-refinement
### Multi-Tenant Architecture
- **Full Tenant Isolation** — each tenant has separate conversations, memory, projects, files, settings, and billing; isolation extends to background services so the heartbeat engine's working memory, knowledge writes, daily notes, task list, and activity logs are all tenant-scoped at the storage layer
- **Per-Tenant WhatsApp/Email/Payment** — communication and payment channels isolated by tenant
- **Encryption at Rest** — Telegram bot tokens and WhatsApp/Baileys session credentials are encrypted with AES-256-GCM via a key derived from `SESSION_SECRET`; backward-compatible with legacy plaintext rows so existing installs auto-upgrade on first write
- **Team Management** — invite users, manage roles, and control access
- **API Keys** — per-tenant API key management for external integrations
### Developer & Admin Tools
- **Settings Dashboard** — comprehensive admin panel with tabs for General, Payments, Integrations, Voice, Tools, Security, Data, and Tenants
- **Diagnostics** — stuck task detection, health monitoring, provider latency testing
- **Heartbeat Engine** — system health monitoring with configurable check intervals
- **Auto-Tuner** — autonomous performance optimization that runs daily
- **Webhook System** — inbound/outbound webhook triggers for external automation
- **MCP Server** — Model Context Protocol server for AI tool integration
- **Backup & Restore** — automated daily backups to Google Drive with manual export/import
- **Vault** — secure credential storage for sensitive data
---
## Technical Stack
| Layer | Technology |
|-------|-----------|
| **Frontend** | React 18, TypeScript, Vite, TailwindCSS, shadcn/ui, Wouter, TanStack Query v5 |
| **Backend** | Express.js, TypeScript, Node.js 20+ |
| **Database** | PostgreSQL with pgvector extension, Drizzle ORM |
| **AI Routing** | OpenAI, Anthropic, Google Gemini, xAI Grok, OpenRouter, Perplexity |
| **Real-time** | Server-Sent Events (SSE) for streaming |
| **Auth** | Email/Password with HMAC-SHA256, Admin PIN, Replit OAuth, Google OAuth |
| **Validation** | Zod schemas with drizzle-zod integration |
| **Security** | Helmet, CSRF protection, rate limiting, injection scanning |
| **File Storage** | Google Drive (primary), local uploads (fallback) |
| **Payments** | Stripe, Coinbase Commerce, Coinbase CDP |
| **Voice** | ElevenLabs TTS (23+ voices) |
| **Search** | Perplexity, Firecrawl, Jina, Wikipedia |
---
## Repository Structure
```
client/ # React frontend
src/
pages/ # 40+ route pages
components/ # Reusable UI components (shadcn/ui)
hooks/ # Custom React hooks
lib/ # Utilities, query client, API helpers
server/ # Express backend
chat-engine.ts # Core AI conversation engine with streaming
tools.ts # Legacy tool facade + dispatcher (strangler-fig split in progress)
tools/ # 407 tools — per-domain modules (70+ domains) + shared middleware
domains/ # crm, finance, media, legal, knowledge, delivery, governance, ...
middleware/ # Extracted dispatch middleware (policy, telemetry, tenant seam)
routes.ts # 300+ API endpoints
site-config.ts # Centralized env-driven configuration
seed.ts # Database seeding (223 tables, 41 rules, 16 personas)
heartbeat.ts # Background task scheduler with model-catalog sync (R73)
model-catalog.ts # Daily OpenRouter catalog scan + gateway probe (R73)
orchestrator-ledger.ts # Per-tenant cost ledger with pg_advisory locks (R73.B)
agent-manager.ts # Autonomous agent orchestration
subagents.ts # Hierarchical agent spawning
agent-channels.ts # Internal agent messaging system
google-drive.ts # Google Drive integration
stripe-connect.ts # Stripe payment processing
coinbase-commerce.ts # Crypto payment processing
whatsapp.ts # WhatsApp bot integration
email.ts # Email server and tenant inboxes
scaffolding.ts # 75 corporate operation scaffolds
shared/
schema.ts # Drizzle ORM schema (223 tables)
scripts/
clean-for-release.sh # Sanitize codebase for public release
FORK-SETUP.md # Detailed setup instructions
```
---
## Getting Started
### Prerequisites
- **Node.js 20+** (or a Replit account)
- **PostgreSQL** database
- **At least one AI provider API key** (OpenAI, Anthropic, Google, or xAI)
### Quick Start
```bash
# 1. Clone the repo
git clone https://github.com/Huskyauto/VisionClaw-Agent-Public-Release.git
cd VisionClaw-Agent-Public-Release
# 2. Install dependencies
npm install
# 3. Set required environment variables
export DATABASE_URL="postgresql://user:pass@host:5432/dbname"
export SESSION_SECRET="$(openssl rand -hex 32)"
export OPENAI_API_KEY="sk-..." # Or ANTHROPIC_API_KEY, XAI_API_KEY, etc.
# 4. Start the platform
npm run dev
# 5. Open your browser
# Visit http://localhost:5000
# Fresh deploys auto-redirect to /setup
```
### What Happens on First Run
In under 10 minutes, you go from `git clone` to a live dashboard with 16 agents, seeded governance, and a `/setup` checklist that tells you exactly what's configured and what's missing.
1. The database auto-creates all 223 tables and full index set
2. 41 governance rules and 16 AI personas are seeded automatically
3. You're redirected to the **Setup Checklist** at `/setup` showing what's configured
4. Click **Create Account** — the first account becomes the admin
5. Start chatting — the AI is ready to work
### Environment Variables
See [FORK-SETUP.md](./FORK-SETUP.md) for the complete list. Here's the quick reference:
#### Required
| Variable | What It Does |
|----------|-------------|
| `DATABASE_URL` | PostgreSQL connection string |
| `SESSION_SECRET` | Random string for session encryption |
| One AI key | `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `XAI_API_KEY`, or `OPENROUTER_API_KEY` |
#### Recommended (Branding)
| Variable | What It Does | Default |
|----------|-------------|---------|
| `SITE_PLATFORM_NAME` | Your platform's display name everywhere | `VisionClaw` |
| `SITE_COMPANY_NAME` | Company name for branding | `Your Company` |
| `SITE_OWNER_EMAIL` | Admin contact email | _(empty)_ |
| `SITE_WEBSITE_URL` | Your public URL | _(empty)_ |
#### Optional (Unlock More Features)
| Variable | What It Unlocks |
|----------|----------------|
| `ELEVENLABS_API_KEY` | Voice synthesis (23+ voices, text-to-speech) |
| `FIRECRAWL_API_KEY` | Advanced web scraping and full-site crawling |
| `BROWSERLESS_API_KEY` | PDF generation and browser automation |
| `STRIPE_LIVE_SECRET_KEY` + `STRIPE_LIVE_PUBLISHABLE_KEY` | Payment processing and subscriptions |
| `COINBASE_COMMERCE_API_KEY` | Cryptocurrency payments |
| `GOOGLE_DRIVE_ROOT_FOLDER_ID` | Google Drive file storage and backups |
| `AGENTMAIL_API_KEY` + `AGENTMAIL_INBOX` | Email sending/receiving |
| `TELEGRAM_BOT_TOKEN` | Telegram bot integration |
| `DISCORD_BOT_TOKEN` | Discord bot integration |
| `X_API_KEY` + `X_API_SECRET` + `X_ACCESS_TOKEN` + `X_ACCESS_TOKEN_SECRET` | X/Twitter posting and search |
---
## Graceful Degradation
Features that aren't configured don't break the app — they gracefully disappear:
| Missing Config | What Happens |
|---------------|-------------|
| No email key | Email, WhatsApp pages hidden from sidebar |
| No Telegram token | Telegram page hidden |
| No Stripe keys | Payments page hidden from admin panel |
| No Drive folder | Files saved locally; Drive tools show "not configured" |
| No ElevenLabs key | Voice tools return "not configured" |
| No Firecrawl/Browserless | Scraping tools fall back gracefully |
| No Coinbase keys | Crypto payment features disabled |
| No OAuth client IDs | OAuth connection buttons hidden |
The `/setup` page gives you a real-time checklist showing exactly what's configured and what's not.
---
## Admin Settings
Once logged in as admin, the **Settings** page (`/settings`) gives you control over everything:
| Tab | What You Configure |
|-----|-------------------|
| **General** | Agent name, personality, default AI model, API keys, OAuth connections, billing |
| **Payments** | Stripe/Coinbase integration, pricing plans, subscription tiers |
| **Integrations** | Discord bot, public chat settings, webhooks, system hooks |
| **Voice** | Wake words, text-to-speech provider, voice profiles |
| **Tools** | Browser/search settings, code sandbox, safety limits, rate limiting |
| **Security** | Access PIN, auth health monitoring |
| **Data** | Backup to Google Drive (manual + automated at 3 AM UTC), export/import |
| **Tenants** | Multi-tenant management for agency deployments |
---
## Pages & Navigation
The platform includes 40+ pages organized by function:
**Core:** Home, Chat, Inbox, Email, Projects, Files, Documents
**AI Management:** Personas, Memory, Knowledge, Skills, Skills Marketplace, Agent Board, Agentic Operations
**Intelligence:** Research, Insights, Content Writing, Scheduled Tasks
**Communication:** WhatsApp, Telegram, Discord (with approval workflows)
**Admin:** Settings, Analytics, Activity Logs, Heartbeat, Team, API Keys, MCP, Webhooks, Channel Routing, Payments
**Public:** Landing Page, Architecture Overview, Login/Signup, Legal Pages (Terms, Privacy, About, Contact, Refund)
---
## Agentic Design Patterns
These are the patterns we actually use in daily production — not just research papers:
1. **Parallel Tool Execution** — read-only tools run concurrently via Promise.all; mutating tools execute sequentially for causal ordering
2. **Critique Agent / Self-Correction** — every response auto-evaluated across 4 dimensions (accuracy, completeness, relevance, clarity); scores below 6/10 trigger auto-refinement
3. **Chain of Debates** — 3-6 specialist agents argue complex questions from their domain expertise; synthesizes a recommendation with consensus level
4. **Tree-of-Thought Reasoning** — 2-5 distinct analytical branches evaluated by a meta-reasoning judge for optimal answers
5. **Auto-Orchestration** — complex requests decomposed into DAG task graphs with dependency tracking and parallel execution
6. **Dialectic User Modeling** — three agents (Deriver, Dialectic, Dreamer) progressively understand user preferences and behavior
---
## Deployment
> **Self-hosted only.** You must deploy on your own infrastructure — your own Replit account, your own server, your own Docker host. We do not provide hosting, shared instances, or managed deployments. Every fork runs independently with its own database, API keys, and configuration.
The platform works on any Node.js hosting:
- **Replit:** Create your own Replit account, import the repo, set secrets in the Secrets panel, hit Run
- **Railway/Render:** Connect your repo, set env vars, deploy
- **Docker:** `docker-compose up -d` — includes PostgreSQL with pgvector, ready out of the box
- **VPS:** Clone, `npm install`, set env vars, `npm run dev`
- **Port:** Serves frontend and backend on a single port (default: 5000)
```bash
git clone https://github.com/Huskyauto/VisionClaw-Agent-Public-Release.git
cd VisionClaw-Agent-Public-Release
cp .env.example .env # edit with your API keys
docker-compose up -d # or: npm install && npm run dev
```
---
## About the Name
**VisionClaw Agent** is an independent AI agent platform — not related to the [Intent-Lab/VisionClaw](https://github.com/Intent-Lab/VisionClaw) project (a smart glasses AI assistant for Meta Ray-Ban). This repo is a standalone, self-hosted multi-tenant operations platform. It works with just an LLM provider and PostgreSQL — no external ecosystem required.
---
## Roadmap
Areas under active development:
- **Modularization** — Breaking down large server files (routes, tools) into domain-specific modules for easier navigation and community contribution
- **Type safety** — Incremental migration from `any` types to strict TypeScript interfaces
- **CI/CD** — GitHub Actions pipeline for lint, typecheck, and automated testing
- **Plugin architecture** — Making it easier to add custom tools and agents without modifying core files
- **API documentation** — OpenAPI/Swagger spec for the 300+ endpoints
Community contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
---
## Built With
VisionClaw Agent was originally built and hosted on [Replit](https://replit.com) — a collaborative cloud development platform that makes it easy to build, deploy, and share full-stack applications. Replit's integrated environment, managed PostgreSQL, one-click deployments, and AI-assisted development made it possible to go from idea to production-ready platform without managing infrastructure. If you're looking for the fastest way to fork and run your own instance, Replit is a great place to start.
---
## License
MIT License — free to fork, modify, and deploy for any purpose. See [LICENSE](LICENSE).
---
**Created by Robert Washburn** | huskyauto@gmail.com
---
## Revision History
Brief one-liners. Full play-by-play in [REVISIONS.md](REVISIONS.md).
| Round | Date | Headline |
|---|---|---|
| **R125+137.77+sec → +137.79+sec** | 2026-07-23 | **A second 72h security sweep closes 2 HIGHs + 3 MEDIUMs on the Stripe paid-state gate and fulfillment tenancy, Revenue Missions lands its validation gate + per-tenant capital pool, and a third 72h whole-app review comes back 0 CRITICAL / 0 HIGH.** **.77+sec — 2 HIGHs:** the Stripe paid-state gate now sits at the TOP of the delivery-event handler — no fulfillment handler (setup fee, subscription activation, paid flips, delivery) can fire on an unpaid delayed-payment completion, with `async_payment_succeeded` re-entry and idempotent handlers making paid-event replay safe; the heartbeat delegate route gained strict Zod validation. **3 MEDIUMs:** audit fulfillment tenant identity fail-closed; a write-time SSRF assert on connector base URLs (HTTPS-only, no internal hosts/IP literals); paid-flow tenant derived from the env-configurable owner-tenant single source of truth. **.78 — Revenue Missions validation & capital:** a deterministic $0 pre-launch validation gate (40/30/30 scoring, threshold 70, fail-closed ABOVE every experiment insert), a per-tenant agent-capital pool (tables 222 → 223; unseeded = no ceiling, seeded = 25% risk ceiling) with idempotent realized-margin settlement (advisory lock + CAS), and retrospective→scanner advisory re-ranking; the auto-approve tier was explicitly REJECTED — human approval stays fail-closed by design; guard tests 81 → 133. **.79+sec — third 72h whole-app review (3 parallel architect passes over ~120 files + the sensitive core): 0 CRITICAL / 0 HIGH.** 2 MEDIUMs fixed — a durable capital-settlement retry sweep (idempotent, degraded-sweep telemetry; double-settle race verified safe on a second pass) and a public changelog resync. Gates: tsc 0, mission guards 133/133, suite 150/150, seamtests 69/69, wiring audit CLEAN, stale-strings CLEAN 13/13. |
| **R125+137.73+sec → +137.76+sec** | 2026-07-23 | **The platform closes its first full sell-and-fulfill loop and burns down the tenant-isolation audit backlog, capped by a 72h whole-app architect review.** **.73+sec — tenant-isolation burn-down:** all 99 kept HIGH/CRITICAL nightly-audit findings triaged in 5 parallel passes — 17 REAL fixed across 15 sites (fail-closed tenant identity in storage/compaction/data-protection, ownership checks across revenue-missions/business-tools/agent-channels, scoped SELECTs, tenant defaults removed with a live schema ALTER), 82 named-benign false positives, and the nightly audit gained a strict suppressible system-sweep pattern. **.74 — sell & fulfill closed:** a products DB catalog (path-validated at register AND webhook lookup), 3 owner-only commerce tools (tools 404 → 407; Stripe calls carry deterministic idempotency keys), and a self-serve audit product that auto-fulfills on Stripe payment with post-purchase sequence enrollment. **.75 — Revenue Missions gap closures:** a mission retrospective hook (0-100 scoring + lessons/ROI on kill/scale), a fail-closed pre-spawn budget gate (explicit null-spend refuse), and a $0/no-LLM background opportunity scanner (proposal-only, capacity-guarded); guard tests 60 → 81. **.76+sec — 72h whole-app review (3 parallel architect passes):** 1 HIGH closed (a paid webhook hardcoded the owner tenant; now derives it from the env-configurable single source of truth) + 3 MEDIUMs (tenant-scoped atomic soft-delete with RETURNING; the compaction memory extractor now routes through the storage-boundary PII redaction guard — closing the last durable-store redaction bypass; the experiment concurrency cap is race-proofed with a per-tenant advisory transaction lock after round 2 correctly rejected a bare count-guard at READ COMMITTED). Gates: tsc 0, suite 150/150, seamtests 69/69, guards 81/81, architect PASS. |
| **R125+137.66 → +137.72** | 2026-07-23 | **The Revenue Missions engine ships end-to-end (S1–S5) — the platform can propose, draft, and run capped revenue experiments under owner-only gates, with every claim backed by verifiable evidence — plus a 72h architect review closing one HIGH owner-gate finding.** **S1+S2 (.66):** 3 new tables (tables 218 → 221), a deterministic mission stage machine (kill-from-any-stage), an owner-only 7-endpoint router, and a read-only Gmail sample harvest → draft packet with zero send paths pre-approval; hard caps clamp at 25 prospects / 3 contacts / $25 per experiment — mission rows can tighten, never raise. **S3 (.67):** approve → capped outreach send with a race-safe claim + rollback, a fail-closed pre-send spend gate, a mandatory opt-out line, and a read-only reply scan feeding deduped evidence. **S4 (.68):** the Stripe evidence hook (fail-closed metadata, per-refund identity, post-approval stage gate) + an admin mission console. **S5 (.69/.70):** 5 owner-only mission tools (tools 399 → 404; approve/kill deliberately NOT tools — human-in-the-loop only), an autonomy ladder (reinvestment 10% / $250 cap), a capital allocator + portfolio review, an evidence-gated scoring rubric, and a max-3-concurrent-experiments cap enforced fail-closed above the draft insert. **Security (.71/.72):** a 72h whole-app review closed ONE HIGH — an owner-only tool gate had hardcoded the owner tenant and diverged from the env-configurable single source of truth; mission AND cost-ledger owner tools now derive the owner tenant from one place, pinned by env-driven regression tests; all other sensitive surfaces verified clean. Gates: tsc 0, suite 150/150, seamtests 69/69, 89 guard tests, architect PASS. |
| **R125+137.65+sec** | 2026-07-22 | **72h full-app review round 4 — the platform's most sensitive core (intent gate, tool policy, dispatcher, chat engine, auth, storage) comes back CLEAN across 3 parallel architect passes over 110 changed files, and the last isolation gap in the autonomous wake scheduler is closed fail-closed.** The scheduler that wakes agents for future work now refuses to write anything without a verified positive-integer tenant identity — guarded before any database write and pinned by a 7-case regression test added to the permanent suite. A flagged `/api/v1/a2a` scope concern was verified FALSE POSITIVE (scope enforcement is central: `authMiddleware` → `checkApiKeyScopes` with the `POST /api/v1/a2a → chat` rule). Rounds 2–4 of the 72h series total: 5 MEDIUM tenant-isolation findings closed, 0 CRITICAL/HIGH. Gates: tsc 0, seamtests 69/69, suite 149/149, preflight-stale CLEAN, architect PASS. |
| **R125+137.59 → +137.64+sec** | 2026-07-22 | **The platform starts learning from its own tool choices and opens an agent-to-agent front door** — all five Kimi-K3 review recommendations land (condition-based wakes, episode playbooks, outcome-learned persona routing, inbound A2A task acceptance via JSON-RPC 2.0, an Autonomy Scoreboard), a record-only tool mis-pick telemetry ledger goes live, the TOOL RECALL doctrine makes every persona re-scan its full inventory before saying "I can't", a production maintenance-cron incident is fixed at the root, and two 72h security review rounds close four MEDIUM tenant-isolation findings. |
| **R125+137.51 → +137.58** | 2026-07-21 | **The platform starts auditing its own model reality — every hardcoded model id verified weekly against LIVE provider lists (Pass 16) and every pricing map against live OpenRouter rates (Pass 17); a CRITICAL tar CVE patched; a 72h review lands two remediation batches; every autonomous loop gets a mechanically-proven L0–L3 readiness grade.** **R125+137.51:** Loop Doctor L0–L3 rubric — per-loop grades with mechanically-proven kill-switch/attempt-cap/run-log evidence (declared-but-absent token = ERROR); fleet L3=3, L2=6. **R125+137.52:** wiring-audit health pass closes 9 orphan tables (introspect script's hardcoded list predated the research/sandbox/social tables). **R125+137.53:** CI-failure backlog triage — 48 digest items → 4 root causes, all fixed, incl. a CRITICAL tar CVE (GHSA-vmf3-w455-68vh) patched via surgical lockfile bump (0 critical vulns); silent-failure HIGH budget locked DOWN 53→52. **R125+137.54:** 72h remediation batch 1 — sandbox tool handlers admin-tenant-gated, Zod/tenant validation on sandbox PATCH + insights-apply + agentic sweep, seed heartbeat DELETE sentinel-restricted, portfolio script onto the mandatory delivery pipeline. **R125+137.55:** self-healing scorer model — pinned id verified against live /v1/models, LOUD fallback to the newest live Sonnet on retirement. **R125+137.56:** model-currency audit (weekly Pass 16) — first run caught 4 retired dated Anthropic ids still serving as the DEFAULT fallback across ~20 active files, all swept to live aliases. **R125+137.57:** model-pricing audit (weekly Pass 17) — all 3 pricing maps verified against live OpenRouter rates; first run reconciled 28 stale prices. **R125+137.58:** 72h remediation batch 2 — ~20 research-engine sites gain explicit tenant filters, 5 research routes Zod-validated, gmail refresh log redacted to an allowlist, skill-seeker fails closed on missing tenant, tables count resynced to the live 216. Gates: tsc 0, seamtests 69/69, suite 147/147, cost 49/49, preflight CLEAN, architect PASS. |
| **R125+137.45 → +137.50** | 2026-07-20 | **The platform starts working ahead of you — Proactive Commitment Drafting turns approaching deadlines into ready-to-approve HITL draft cards (structurally send-incapable); a CRITICAL credential-file leak in the uploads sync is closed with a boot-time dotfile purge; all 10 maintenance crons are prebundled so production can never lose them; a 10-file god-file cleanup locks its ceilings DOWN; and an IdeaBrowser MASTER sweep simulates the best of the 256-idea scored archive (winner: AI-Native Readiness Audit, ~$38.9k probability-weighted expected profit).** 72h retrospective (3 architect passes over 80 files / 223 commits) closed 1 MEDIUM (per-tenant boot-backfill skip check) + 3 LOW. Gates: tsc 0, suite 147/147, seamtests 69/69, wiring CLEAN, preflight CLEAN. |
| **R125+137.41 → +137.44** | 2026-07-19 | **The Simulation Sandbox becomes actionable — jury-vetted promotion of sandbox findings into a reviewed Improvement list (never auto-apply), TTL retention, and honest INCONCLUSIVE verdicts — plus a weekly IdeaBrowser money-scenario pipeline and a review/sync round with permanent race-regression pins.** **R125+137.41 (72h review, 2 HIGH + 1 MEDIUM):** an `INCONCLUSIVE` verdict added to BOTH sandbox report unions — a run with zero replays, zero graded results, or more errors than successes can never collapse to a reassuring NO_CHANGE (CRITICAL/DRIFT still win); grading failures emit `[sandbox-grade]` telemetry, failed-status UPDATE catches log loud, and a read-time `stale` marker (running >30 min) surfaces on the sandbox routes + an ecosystem-health `staleRunningCount`. **R125+137.42:** the IdeaBrowser weekly money-scenario pipeline — a Monday cron ingests 7 days of captured business ideas, scores them, runs per-idea scenario simulations producing `successProbabilityPct` + probability-weighted `expectedProfitUsd`, ranks the top 5, and delivers the report through the delivery pipeline + owner email (safe `--test` mode with zero side effects; live run verified). **R125+137.43:** a new `sandbox_promote` tool (trusted-personas-only, sensitive/HIGH fail-closed policy; tools 398 → 399) routes sandbox findings through the 3-frontier-model jury into a durable `sandbox_improvements` table — a `jury_pending` row is INSERTed BEFORE triage so a jury failure leaves an auditable record; ACCEPT/FIX → approved, REJECT → rejected, anything else escalates; nothing ever auto-applies. Plus admin GET/PATCH routes, an Improvement list card on `/admin/sandbox`, and weekly TTL retention (improvements survive run deletion via `ON DELETE SET NULL`). **R125+137.44:** permanent promote-race regression pins in the canonical suite (concurrent promotes of the same run can never double-insert or double-triage), the stale-string preflight gains a `scripts/` surface rule (stale counts in operator scripts now trip CI), and every marketing/dashboard/README surface resynced. Gates: tsc 0, seamtests 69/69, suite 146/146, wiring audit CLEAN, preflight CLEAN, architect PASS. |
| **R125+137.30 → +137.40** | 2026-07-19 | **The Simulation Sandbox contract completes S1–S5 — the platform can replay its own past safety decisions and model choices offline, under a hard per-run spend cap, and report what WOULD have changed.** `sandbox_run`/`sandbox_report` registered as a born-migrated domain (fail-closed tool policies, trusted-personas-only; tools 396 → 398), sandbox tables extracted to `shared/models/sandbox.ts` (tables 213 → 215), a `/admin/sandbox` admin UI over admin-gated launch routes (5s-wait/202-detach with race-safe timer cleanup), Sandbox probe #16 on the ecosystem-health dashboard, and the model-swap helper's cap clamped to the shared `MAX_PER_RUN_CAP_USD = 5` (architect-caught drift from 50). E2E smoke replayed 5/5 live safety decisions with verdict NO_CHANGE. Also in the window: a metered escalation valve for the self-repair loop (exactly ONE frontier diagnostic turn on a prior-collapse stall — judgment only, fail-OPEN, never on the final attempt), two standing-registry model registrations (`meta/muse-spark-1.1` paid + `nvidia/nemotron-3-ultra-550b:free` — neither touches the jury pools or the frontier reserve), the weekly video recap made self-healing and incident-proof (explicit date-window extraction cures the wrong-week incident; labeled weight-fact extraction cures the wrong-numbers incident), and a Tool Reliability card (SQL-bounded worst/top-N with redacted failure reasons). Gates: tsc 0, seamtests 69/69, suite 146/146, sandbox tests 16/16, architect PASS. |
| **R125+137.26 → +137.29-review** | 2026-07-17 | **An external frontier-model code review of this very repo, triaged end-to-end — the owner's email purged from every server runtime path, the changelog becomes data, the mirror gains a DDL schema snapshot + fail-closed stats refresh + tagged releases, an `: any` ratchet gate lands, Kimi-K3 joins as a frontier reserve, and a 72h review closes 3 MEDIUMs with permanent regression pins.** **R125+137.26:** `moonshotai/kimi-k3` (1M context) registered across all 5 model maps as a frontier RESERVE — never in the standing proposer set; a pure gate fires at most one backfill call, only when a main-round frontier proposer fails on the metered path (9/9 gate tests). **R125+137.27:** an external Kimi-K3 review ran against this public mirror; every finding was re-verified on main and the hardcoded owner email was removed from ALL server runtime paths — policy seeding, inbox-quarantine allowlist, ingest identity (new `GMAIL_INGEST_ADDRESS` env, fails closed loudly when unset), and the security.txt contact chain are now env-driven, with fail-closed refusal wherever the address is missing. **R125+137.28:** the mirror build refreshes the authoritative platform-totals doc BEFORE copying (fail-closed if still dirty — the count doc can no longer ship stale) and a ratchet-DOWN-only `: any`/`as any` budget gate (baseline 6,949) runs as weekly-maintenance Pass 14. **R125+137.29:** the 190-entry changelog extracted to data (`updates.json` + a 42-icon map), the mirror emits `docs/schema-snapshot.sql` via pg_dump so forkers can diff DDL between snapshots, and every mirror push is now stamped with a `r125.137.x` tag + GitHub Release. **72h review (2 architect rounds):** 3 MEDIUMs closed fail-closed — an api-v1 conversation-messages query re-anchored on a tenant-scoping JOIN + tenant filter, the tag-release CLI rejects unknown flags before any GitHub call, and the any-budget gate stops safely on an unreadable scan file with the baseline untouched — each pinned by a permanent regression test (suite 144/144). |
| **R125+137.23 → +137.25-review** | 2026-07-16 | **The platform learns to retire its own dead tools and forge new ones from unmet demand, the tool-router gains a hard cap, the public API speaks the AG-UI protocol, and a 72h review closes 2 MEDIUMs.** **R125+137.23:** a Tool Eviction/Retirement loop — a flag-only classifier with human-in-the-loop approvals (exemptions fail CLOSED via strict parsing, a registry sanity guard, and a ≤10-candidates/run dedupe; 20 candidates queued across the first 2 runs) — plus Tool Forge Phase 2, which turns recorded unmet-capability demand into budget-claimed LLM module proposals (≤1/run, nothing ever auto-lands); both run as weekly heartbeat crons. **R125+137.23-fable:** external-review follow-ups — the admin PIN check consolidated onto the one canonical peppered hasher, curing a boot reconciler that had been silently re-downgrading the stored hash to a public static salt every boot; a static guard test pins the salt literal to its single legitimate home. **R125+137.24:** a verified external-review finding fixed — the tool router could exceed its own `maxTools` budget with no slice-back; a new pure `enforceToolCap()` trims by priority order at both overshoot sites, never trims always-included tools, leaves escape hatches deliberately uncapped, and logs per-turn trim counts + a schema-token estimate (invariant tests in the suite). **R125+137.25:** an AG-UI protocol adapter — `POST /api/v1/agui/run` on the public API v1 surface (Bearer key, chat scope, with a static scope-parity guard test pinning every mounted api-v1 POST to an auth rule) replays a completed chat turn as ordered AG-UI SSE events (RUN_STARTED → TOOL_CALL_* → TEXT_MESSAGE_* → RUN_FINISHED/RUN_ERROR); fail-closed thread parsing, tenant-scoped continuation, keepalives + timeout race + client-disconnect handling. **72h review (2 architect rounds):** 2 MEDIUMs closed — a public checkout error handler was logging raw provider error objects (now message + type/status/requestId only), and the scope-parity guard test was bypassable (rewritten to a structural comment-stripped parse with first-match-wins semantics mirroring the runtime checker). Gates: tsc 0, stale-string preflight CLEAN, seam tests 68/68, suite 143/143, wiring audit CLEAN. |
| **R125+137.20 → +137.22** | 2026-07-15 | **Six OpenClaw-inspired native features + seeded-fraud judge proof + spec-vs-test authority + a Drive connector-lookup fix + a clean 72h review (indexes 626 → 627).** **R125+137.20:** the Google Drive connector lookup now falls back to the unfiltered connection list when the filtered query returns 0 items, curing broken document uploads, memory backups, and reconnects (verified live). **R125+137.21 (Fable-method borrows):** seeded-fraud completion fixtures in CI prove the deterministic verification layer fails CLOSED against a deliberately gullible LLM judge (a live probe caught 4/4 planted frauds), and a spec-vs-test authority rule in the repo-surgeon forces "cannot fix" on any spec/test conflict — authoritative at the executor and pinned by an adversarial regression test. **R125+137.22 (OpenClaw-inspired, all native):** a tenant-guarded, PII-redacted, race-safe commitments/open-loop miner (unique partial index + ON CONFLICT — indexes 626 → 627); a summary-quality audit with a deterministic fallback wired as a fail-open backstop at the conversation-compaction chokepoint (a failed compaction can no longer silently lose file paths or identifiers); operator-text-as-untrusted wrapping; first-failure-wins health root-cause ordering; a skill code-safety scanner; and a record-only egress telemetry ring buffer. **72h review:** 1 HIGH closed (the summary-quality lib had zero runtime callsites — now wired), 2 MEDIUM closed (two public/tenant routes moved onto centralized Zod validation), 1 FALSE POSITIVE logged (a cross-tenant read already admin-gated at dispatch). Gates: tsc 0, build 0, seam tests green, stale-string preflight CLEAN, architect PASS twice. |
| **R125+137.14 → +137.19** | 2026-07-14 | **Skill-optimizer evaluation upgrades + two god-file splits + Tool Forge Phase 1 + a clean 72h review — no advertised-count change, all gates green.** **Skill-optimizer:** RULER-style relative group ranking added as a measure-first, NON-blocking third judge lane in the evaluator A/B (one anonymized, seed-shuffled group-ranking call per case; parsing fails CLOSED, runtime fails OPEN, never touches the apply decision; kill switch `SKILL_OPT_RULER=off`); plus prior-collapse detection — an embedding-space near-dupe tracker over prior failed/rejected proposals (fail-OPEN on every path, kill switch `PRIOR_COLLAPSE=off`), wired opt-in into the skill-optimizer and repo-surgeon so a semantic re-proposal of an already-rejected/failed change skips the spend and escalates instead of looping. **God-file splits:** the `server/routes.ts` monolith had its Tier-1 auth/tenants/admin endpoints extracted verbatim (≈7,794 → 7,329 lines, behavior-preserving) alongside a new regression proof that the code-execution sandbox's real control is the VM layer (the keyword blocklist is defense-in-depth only); and tools-layer split slice S34 moved `google_workspace` out of the legacy `tools.ts` switch into a per-domain module with the fail-closed tenant seam preserved verbatim (tools.ts 9,785 → 9,668 lines, 295/395 tools migrated). **Tool Forge Phase 1 (observability only):** when a customer asks for a capability the platform can't do yet, that unmet demand is now folded into the existing capability-gaps table with an atomic miss-count bump (insert-race safe) and surfaced as a tenant-scoped Unmet Capabilities probe + card on the ecosystem-health dashboard; an architect finding was fixed before ship so repeat demand can never be absorbed invisibly. **72h post-edit review:** 3 architect prongs over the window closed 1 MEDIUM fail-CLOSED (autonomous capability-gap writes now pass a tenant-validation helper before ANY insert) plus silent-failure fixes (tenant-audit unreadable-file accounting end-to-end, degraded fields surfaced, email-flush stack logging); no CRITICAL/HIGH. Still 396 tools. Gates: tsc 0, build 0, seam 68/68, full suite green, wiring 0 dead/0 drift, smoke 396/396, architect PASS every slice. |
| **R125+137.4 → +137.13** | 2026-07-12 | **Action Ledger shipped end-to-end (5 slices) — a durable, tenant-scoped record of every destructive tool action from prepare through settlement.** Every destructive action now gets a ledger row before it runs (a missing row fails CLOSED — no unrecorded side effect), money-movement calls carry unforgeable idempotency keys, and a periodic reconciler resolves outcomes the platform couldn't confirm at execution time — an inconclusive probe stays "unknown", never guessed as failed. Timeout retries, previously disabled platform-wide, are re-enabled ONLY for ledgered tools on **proven** non-commit: a confirmed commit refuses loudly, an unknown outcome escalates instead of retrying, and a kill switch turns the lane off. Also in the window: hardened AI-CLI streaming (empty/error streams can no longer look like success) and honest completion statuses for unverifiable work. 72h review: 1 MEDIUM + 2 LOW closed. Gates: full test suite green across all slices, tsc 0, build 0, architect PASS every slice. |
| **R125+134 → +137.3** | 2026-07-11 | **Grok 4.5 wired in additively, a pricing-accuracy campaign, PROOF_LOOPS v2, a full wiring review, and a full-platform post-edit review — 1 CRITICAL + 1 MEDIUM closed fail-CLOSED.** **CRITICAL (tenant isolation, architect-verified):** the transactional no-regression snapshot — the safety net that captures state before an irreversible tool action and restores it on failure — had a rollback UPDATE missing its tenant scope, so the restore write itself was not bound to the owning tenant; caught by a full-platform review (3 architect surface passes + a silent-failure-hunter LLM pass + a regex hunter + a clean wiring audit over the prior 72h's changes) and fixed — the rollback is now tenant-scoped like every other write. **MEDIUM:** the platform's default flagship model was absent from all 3 pricing maps (one meter silently priced it at $0, the ledger billed via an unknown-model fallback); explicit flagship-class rows + a presence regression test now guarantee a default model can never ship unpriced. Earlier in the window: a model-pricing drift-guard test (fails on any NEW cross-map disagreement, pre-existing drift snapshotted in an allowlist with a heal-ratchet) + live-rate reconciliation fixing 2 real ledger gaps; PROOF_LOOPS v2 (a per-run proof-level knob L1–L5, advisory, default byte-identical to prior behavior) + Chronicle-precision telemetry; a full wiring review that regenerated the tool smoke-test catalog 396/396 after fixing a static-doc parser blind spot that left 302 post-split tool docs dark; and Grok 4.5 registered additively (verified live before registration; deliberately NOT swapped into router defaults). Gates: tsc 0, build 0, suite green, wiring CLEAN, architect PASS after fixes. |
| **R125+125** | 2026-07-07 | **72h post-edit security review over the tools-layer-split window (slices S24–S33, ~230 files) — 1 HIGH + 4 MEDIUM closed fail-CLOSED; plus the split march R125+77 → +124.** **HIGH — `list_uploads` cross-tenant information disclosure:** the file-listing handler unconditionally enumerated the platform's internal `data/` directory into ANY tenant's listing, and derived each entry's path/url by re-probing the filesystem, so a name collision between `uploads/` and `data/` could map a file to the wrong location; fixed with admin-tenant-only `data/` enumeration + an explicit `source: "uploads"\|"data"` tag read directly by path/url derivation (a second confirming architect pass verified the residual collision vector closed). **MEDIUM ×4:** fail-closed tenant guards on `run/check/list_background_tasks` + treasury `forecast_ticker`/`analyze_portfolio`; the weekly god-file girth gate now returns RED + a HIGH finding when the gate itself throws (was a silent YELLOW). 1 MEDIUM deferred + logged (browser-replay's direct Browserless fetch — fixed env-configured host, known-gaps ledger). The split march moved 294/395 tools out of the legacy `tools.ts` monolith into per-domain modules with the fail-closed tenant seam preserved verbatim; tool count 394 → 395 (+`aeo_score`); girth ceiling ratcheted down every slice. tsc/build 0, seam tests 67/67, wiring 0 dead/0 drift, architect confirming PASS. |
| **R125+77** | 2026-07-03 | **Whole-app + 72h post-edit code review (3 parallel architect passes + wiring audit exit 0: 394 tools, 0 dead/drift/leak/schema-gap).** Public landing headline resynced 392 → 394 (it had slipped past the stale-string preflight band); the count-verifier's release-row exemption narrowed to the public README only so stale counts can't hide in other docs; and 3 unbounded `Number(env)` timeout parses clamped via a new shared `parseTimeoutMs()` (1s–120s band, loud one-time warning on an invalid value) across the auto-router classifier, the routing hard-timeout, and the chat-engine routing cap. Deliberately deferred (defended): the model-failover `format`/`unknown` eligibility classes stay (cross-provider param adaptation and the empty-completion incident require them; the last-resort lane is spend-bounded). tsc 0, count + stale-string verifiers exit 0, confirming architect PASS + a focused silent-failure scan PASS. No new tools/tables/personas/capabilities. |
| **R125+76** | 2026-07-01 | **Whole-app post-edit code review — 2 MEDIUM + 2 LOW closed fail-CLOSED in the deliverable-verifier + storage-redaction + memory-ranking surface.** **MEDIUM #1** the required-MIME verifier gate silently PASSED an undeterminable type: `server/deliverable-verifier.ts` only ran the `requiredMimePattern` check when a MIME could be inferred from the file extension, so a MIME-gated deliverable whose extension yielded no MIME slipped through as a PASS; an undeterminable MIME on a MIME-gated contract is now a verification FAILURE. **MEDIUM #2** the verifier's best-effort audit-log write swallowed its failure while the result still returned as though the check were recorded (a repudiation gap); the result now carries an `auditPersisted` boolean (true on insert, false in the catch) so a persistence failure is visible instead of silently claimed. **LOW #1** `server/storage-helpers/pii-redaction-guard.ts` returned the raw value on a non-string / empty input, breaking the declared `redacted: string` contract; it now coerces non-string input to a string. **LOW #2** a stale default-comment in `server/memory-ranking.ts` described the exploration bonus as OFF by default when the live default is ON; corrected. tsc 0, PII-guard tests 15/15, confirming architect PASS. No new tools/tables/personas/capabilities, no stat change. |
| **R125+75** | 2026-06-29 | **Whole-app + 72h post-edit code review (agent-wiring audit exit 0: 394 tools, 0 dead/drift/leak/schema-gap) — 3 pre-existing MEDIUMs closed fail-CLOSED in the tenant-isolation + silent-failure surface.** **#1** the central guarded-tool executor sourced its tenant from `ctx.tenantId || args._tenantId`, so a model-authored `_tenantId` in a tool's args could steer the execution tenant if a caller ever forgot `ctx.tenantId`; the fallback is removed so the tenant comes ONLY from the trusted `ctx` (every real caller sets it). **#2** both `UPDATE event_log` status writes in `server/event-bus.ts` matched on the event id alone, so a status write could touch another tenant's row; both now carry an explicit `tenant_id` scope. **#3** the failed-event `UPDATE event_log SET status='failed'` in `server/heartbeat.ts` had a bare empty catch that swallowed persistence failures (the event stayed pending and re-fired with a misleading symptom) and matched on id alone; it now logs loud and is tenant-scoped. Live-stat resync: tables 211→212, indexes 620→623. tsc 0, regression suites green, architect PASS. No new tools/tables/personas/capabilities. |
| **R125+74** | 2026-06-29 | **Whole-app + 72h post-edit code review (4 parallel surface-split architect passes + wiring audit exit 0: 394 tools, 0 dead/drift/leak/schema-gap) — 1 MEDIUM closed, plus an owner-jury concurrency fix.** **MEDIUM — markdown injection in the failure contract:** `clampLine` HTML-escaped only `<`/`>`, so untrusted approval-note / question / tool-error text could still inject INLINE markdown (links, images, emphasis, code, tables) when the block is rendered; a new `mdEscape()` backslash-escapes markdown special characters for all untrusted text fields (real artifact URLs pass `mdSafe=false` so they aren't mangled). **Owner-jury metered ceiling concurrency:** overlapping owner-initiated jury runs could each clear the daily-$ ceiling pre-check before any recorded spend; `server/moa.ts` now accrues a conservative per-run reservation when the metered override is granted and settles only the excess (additive ⇒ a throw mid-run fails SAFE / over-counts, self-heals on the daily roll). +3 regression tests (suites 9/9 and 7/7), tsc clean, confirming architect PASS. No new tools/tables/personas/capabilities. |
| **R125+73** | 2026-06-28 | **Structured failure contract for terminal agentic failures.** A new pure renderer (`server/agentic/failure-contract.ts`) emits a consistent "✅ what completed / ❌ what failed (+why) / 📎 what exists now / 👉 exact next step (+owner)" block plus structured meta, replacing bare operator error strings — wired into ALL terminal-failure exits: approval rejection + expiry (tenant-scoped, jsonb-merged into `agentRuns.result.failureContract`) and all four executor halts (wallclock / budget / stuck / max-turns). It deliberately does NOT auto-route around a rejected approval (that would weaken the AHB approval gate) — it only makes an already-decided failure legible. Defense-in-depth: `clampLine` HTML-escapes `<`/`>` on every field. 8/8 new unit tests, tsc exit 0, preflight clean; architect PASS twice. No new tools/tables/personas/capabilities. |
| **R125+72** | 2026-06-28 | **Closed threat-model gap #1 — the gate-1 storage-boundary PII/secret redaction.** A new central guard (`server/storage-helpers/pii-redaction-guard.ts`) composes the existing 48-pattern secret scanner and is wired into EVERY durable-store write path (`createMemoryEntry`/`updateMemoryEntry`, `createKnowledge`/`updateKnowledge`, `createConversationFact`) plus the one direct `agent_knowledge` insert in `step-ledger.ts` (rg-audited as the only write paths to those three tables). It ALWAYS strips credential-shaped secrets, Luhn-validated credit cards and US SSNs; email/phone are detected-only by default (legit CRM facts; opt-in stripping via `redactContactInfo`). Architect found + closed: a HIGH step-ledger direct-insert bypass, a MEDIUM unguarded update path, and a MEDIUM where string-redacting a JSON blob could corrupt it on a numeric-CC leaf (now redacts the OBJECT before `JSON.stringify`). Fresh dependency/SAST/HoundDog scans triggered ZERO new findings; `threat_model.md` AML.T0070 + LLM04 rows moved ◑→✓. 15/15 unit tests, tsc exit 0, confirming architect PASS. No new tools/tables/personas/capabilities. |
| **R125+71** | 2026-06-28 | **Whole-app + 72h post-edit code review (4 parallel surface-split architect passes + wiring audit exit 0, 394 tools, 0 dead/drift/leak/schema-gap) — 2 MEDIUM closed fail-CLOSED.** **MEDIUM #1 — the plan-executor's autonomous tool-step watchdog was OBSERVATIONAL only:** `server/plan-executor.ts` registered a watchdog whose returned `AbortSignal` was discarded, and the bare `executeTool()` it guarded is signal-less, so a hung autonomous tool step neither aborted nor bounded the `await`; the step now runs through `executeToolWithTimeout()` (a per-tool `Promise.race` + `AbortController` that also aborts in-flight network tools) for bounded, fail-CLOSED plan progress (the AHB destructive-tool policy still runs BEFORE the call and still fails closed). **MEDIUM #2 — a prod-bundle existence probe degraded on any fault:** `scripts/lib/bwb-script-runner.ts` used a bare `fs.existsSync` inside a catch-all that returned `false` on ANY error, so a transient overlayFS EIO silently fell back to the deterministically-broken `npx tsx` prod path; it now uses `existsSyncEIO` (retries transient EIO, throws on a persistent fault) and PREFERS the prebuilt bundle (`node dist/*.cjs`) on a persistent throw. Architect confirming pass PASS — 0 new issues; typecheck + step-executor policy guard exit 0, regression suites green. No new tools/tables/personas/capabilities. |
| **R125+70** | 2026-06-28 | **Whole-app + 72h post-edit code review (4 parallel surface-split architect passes + wiring audit exit 0) — 2 HIGH + 1 MEDIUM closed fail-CLOSED; the self-approval-bypass class is now closed end-to-end.** **HIGH #1 — the CENTRAL guarded-tool executor trusted a model-authored approval flag:** `server/guarded-tool-executor.ts` still READ `args._approvedByGate` to set BOTH `hasApproval` (the AHB destructive-tool gate) AND the HITL `skipGate` — the consumer-side complement to R125+69+sec, which had only stripped that signal at the producer step executors. Both reads are removed; approval is now sourced ONLY from the trusted `ctx.skipApprovalGate` (main chat's own SSE human-in-the-loop gate) plus `self_heal` context, so even a path that forgets to strip the signal can never self-approve at the chokepoint (verified repo-wide that nothing legitimately produces `_approvedByGate:true`). **HIGH #2 — schema drift:** `shared/schema.ts`'s `agentJobs` lacked the live `failure_class` / `rollback_note` columns + partial index the running code already uses; an additive schema-only sync mirrors the live DB (psql confirmed cols + index already present — no DB change). **MEDIUM — heartbeat `self_initiative` had no cross-process re-fire floor:** a 12h DB-`lastRunAt` guard now runs before the prod-only skip so cron drift can't double-fire it. Architect confirming pass PASS — 0 remaining CRITICAL/HIGH; typecheck + step-executor guard + regression suites green. No new tools/tables/personas/capabilities. |
| **R125+69+sec** | 2026-06-28 | **Whole-app + 72h post-edit code review — 1 HIGH + 1 MEDIUM closed fail-CLOSED, plus a platform-wide sweep of the same self-approval-bypass bug class.** **HIGH — a lobster workflow step could self-approve a destructive tool:** an autonomous lobster step could set `_approvedByGate:true` (and spoof `_conversationId`) in its `toolArgs` to self-approve a requiresApproval/destructive tool and bypass the AHB destructive-tool gate; `server/lobster.ts` now strips BOTH signals and hard-sets `hasApproval:false`, so an autonomous step can NEVER self-approve. **MEDIUM — plan-executor identity fail-open:** `server/plan-executor.ts` fell back to the admin tenant on a non-numeric `plan.tenant_id` (a NOT-NULL column, so a corrupt/forged identity); it now fails CLOSED before any stamp. **SWEEP (same bug class, platform-wide):** a 3rd self-approval sibling in `server/task-planner.ts`'s autonomous step executor was closed, the `server/tools.ts` glued-name recovery hardened to `hasApproval:false`, and a fail-CLOSED **invariant 3** added to the step-executor policy guard so no executor can ever source `hasApproval` off `_approvedByGate` again. Architect confirming pass PASS — 0 remaining CRITICAL/HIGH; typecheck + agent-wiring audit exit 0. No new tools/tables/personas/capabilities. |
| **R125+68** | 2026-06-27 | **Release-sync round — a step-executor guard-coverage HIGH closed, plus a whole-platform live-stat resync (tools 393→394, capabilities 128→129).** The task-planner's autonomous step executor (`plan-executor.ts`) ran plan steps through a dispatch path the AHB destructive-tool-policy AUDIT didn't recognize as a guarded executor, so the coverage check couldn't prove those steps were policed — it's now registered in the guard's `STEP_EXECUTORS` + `EXECUTETOOL_ALLOWLIST` (`server/safety/guard-step-executor-policy.ts`), so every autonomous step executor on the platform is accounted for. The new live counts (394 tools, 129 capabilities) were propagated to every website surface, the comprehensive features doc, and both GitHub READMEs. Architect PASS; preflight + tsc + agent-wiring audit exit 0. No new tools/tables/personas/capabilities. |
| **R125+67** | 2026-06-26 | **Whole-app + 72h code review — 2 multi-tenant HIGH closed, plus a heartbeat prod-isolation fix and a stats resync.** **HIGH #1 — lobster pause→resume dropped the invoker's identity:** when an autonomous lobster workflow pauses for human approval and later resumes, it lost the original invoker's tenant and persona, so a non-admin launcher's post-approval steps ran as the admin/`system`-trusted identity (lobster's `undefined` invoker fails OPEN to the admin tenant, not closed); the fix persists the invoker tenant + persona in the paused state and restores them on resume, so resumed steps carry exactly the launcher's original authority. **HIGH #2 — cross-tenant attachment restore:** the attachment DB→disk restore path looked up `file_storage` by a user-derived filename with NO tenant scope, so a crafted filename could read another tenant's stored file; the lookup is now scoped to the conversation's tenant. **Plus:** the heartbeat `self_initiative` task is now prod-only (a shared-DB dev box no longer double-runs the prod-seeded row), and the landing-page + features-doc statistics were resynced to the live database. Architect post-fix pass PASS — 0 new CRITICAL/HIGH. No new tools/tables/personas/capabilities. |
| **R125+66** | 2026-06-25 | **Whole-app + 72h post-edit code review (clean) + a delivery-pipeline tenant-attribution telemetry fix.** Four parallel architect passes (sensitive core / revenue + background / SSRF + delivery / frontend) over the last 72 hours returned PASS with 0 CRITICAL / 0 HIGH. The one delivery-cluster MEDIUM was verified a security FALSE POSITIVE — delivery assets are capability-gated at the `/uploads` middleware, not tenant-gated — and downgraded to a telemetry-accuracy LOW, then fixed: the delivery pipeline was stamping a hardcoded default tenant onto the signed download URL, both delivery-engagement events, and both publish-to-own-server callers; it now threads the real request tenant end-to-end so delivery telemetry and signed-URL scoping reflect the true tenant. Live capabilities count resynced 126 → 128. typecheck + agent-wiring audit green. No new tools/tables/personas/capabilities. |
| **R125+64 → +65** | 2026-06-25 | **Whole-app + 72h security review — 2 HIGH closed — plus a governance round that made the autonomous-loop contracts mechanically checkable (architect PASS, +1 security regression test).** **HIGH #1 (R125+65):** the autonomous plan/lobster step executors ran every plan/workflow step through the RAW tool dispatcher, which skips the destructive-tool policy layer (trusted-persona / structured-args / approval / value-cap gates live only on the guarded path) — both now enforce the policy BEFORE each step and fail CLOSED, the policy persona resolving from the run TENANT so internal/autonomous and admin/owner runs act as the trusted `system` persona while any real non-admin invoker gets no trusted name (trusted-only and approval-required tools fail closed); deliberately NOT routed through the guarded executor, whose human-in-the-loop await would deadlock an autonomous run. **HIGH #2 (R125+65):** project-create linked a new project to a conversation id with an UNSCOPED UPDATE, and that id (unlike `_tenantId`/`_personaId`) wasn't stripped from model-authored step args, so a step could spoof a victim tenant's conversation — now tenant-scoped with a `RETURNING` guard, the link INSERT gated on a matched row in the caller's own tenant. **R125+64 (governance + security):** the 8 autonomous-loop contracts gained `verifier` (`independent`/`self`/`deterministic` — a loop must not grade its own output) and `spend` (`capped`/`bounded`/`none`/`unbounded` — token-blowout ceiling) fields, and the Loop Doctor now ERRORs on a self-grading loop, an unbounded-spend loop, and any `capped` loop whose source doesn't reference the atomic claim-before-spend seam (it honestly downgraded one mislabeled loop); plus an intra-tenant persona-knowledge leak in capability-recall was closed (it now returns the active persona's own rows plus global rows, not other personas' private rows). No new tools/tables/personas/capabilities. |
| **R125+62 → +63** | 2026-06-23 | **Autonomous-loop contracts (governance) + a top-tier model-lineup refresh.** **R125+62:** the Forward-Future Loop Library reviewed out as curated prompts + doctrine with zero importable code, so the discipline was built natively — all 8 real autonomous loops (CI self-healer, auto-git-push, jury-queue drainer, skill-optimizer, tenant-isolation audit, BWB weekly render, agent-knowledge refresh, heartbeat tasks) now declare a typed objective / check / feedback / stop-conditions / escalation / authority / fail-mode contract (every mutating or destructive loop fails CLOSED), validated by a new "Loop Doctor" audit that derives the live workflow set and ERRORs on any uncontracted loop (it caught a real umbrella workflow on the first run), harnessed as weekly-maintenance Pass 12, with the contracts indexed into agent-knowledge + the capability registry so personas know the loops exist (34/34 unit tests). **R125+63:** removed `claude-fable-5` entirely (Anthropic's Fable 5 was shut down) and added `z-ai/glm-5.2` as a new top-tier OpenRouter model (verified live: 1M-token context) across the powerful/reasoning ladders, free-model rotation, resource predictor, context-window guard and cost ledger; the locked 4-model jury frontier is unchanged. Architect PASS throughout. No new tools/tables/personas/capabilities. |
| **R125+60 → +61** | 2026-06-23 | **Two whole-app + 72h security reviews — 3 HIGH closed (architect PASS, 0 new CRITICAL/HIGH, +2 auth regression tests).** A plan/lobster step-executor tenant+persona escalation let a non-admin tenant run owner-only tools via a plan/lobster step — the executor force-stamped the admin tenant but never the persona, and the forced tenant auto-satisfied the RCE guard's tenant check, leaving the persona stamp the only gate. Fix: the real invoker tenant + persona are now threaded through the plan and force-stamped, any model-supplied `_tenantId`/`_personaId` is stripped first, and the persona-stamp is gated on the caller's REAL pre-force tenant — so non-admin plans still run but RCE steps fail closed. An SSRF DNS-rebind TOCTOU was closed at 4 more public-fetch callsites by pinning the undici dispatcher to the already-validated resolved addresses (destroyed in a `finally`). And a `vc_` API-key admin confusion was closed so an admin-tenant API key never confers platform-admin when `ADMIN_PIN` is unset. No new tools/tables/personas/capabilities. |
| **R125+56 → +59** | 2026-06-21 | **BWB render-reliability + chat-context-hygiene hardening sprint.** EIO-resilient reads across the video render-farm path (Replit's Reserved-VM overlayFS intermittently throws `EIO` on ordinary reads — a new helper retries only on EIO and re-throws once exhausted so a dead disk still fails closed); a bounded auto-retry on TRANSIENT infra faults in the weekly-recap orchestrator (fails closed on real content/config errors, claims the spend governor fresh before each attempt); an AST regression guard that fails CI if an unguarded read-class fs op is reintroduced on a render-path file; and observation masking in the chat round loop that trims stale tool-output bodies (dropping stale images — the biggest token win) while preserving call↔result pairing, cutting Lost-in-the-Middle rot on long agentic turns. Every round architect PASS (0 CRITICAL/HIGH/MEDIUM), unit-tested, typecheck clean. No new tools/tables/personas/capabilities. |
| **R125+55** | 2026-06-20 | **Proactive skill-aware re-decomposition in the task planner (SkillWeaver SAD, arXiv:2606.18051).** The planner used to discover an unusable tool only reactively — a step fails mid-run, triggering a costly replan. Now, right after it decomposes a task, it validates every step's tool against the real registry BEFORE execution and re-decomposes ONCE with explicit feedback if any step references a blocked or hallucinated tool. A single acceptance gate accepts the revision only if it strictly reduces the tool-mismatch count AND is structurally sound (no dangling/cyclic step dependencies via topological sort), so a refine can never hand back a worse plan; bounded to one iteration, fails OPEN. Shipped behind a code review — architect PASS after closing 1 HIGH (a mismatch-only check could adopt a deadlocked plan). Wiring audit CLEAN (393 tools). A behaviour layer over the existing planner — no new tools/tables/personas/capabilities. |
| **R125+54** | 2026-06-20 | **Difficulty-adaptive UP-route in the AUTO path.** The platform already down-routed trivial requests away from the expensive multi-model heavy loop (arXiv:2605.22687, the "illusory AI productivity" finding); this round adds the mirror direction — when a request looks genuinely hard (complexity markers / length / cross-domain reasoning) but wouldn't otherwise trip the heavy ensemble, the AUTO path UP-routes it to the high-end model instead of answering cheap-and-shallow, tagged `request_class='adaptive-hard-route'` and counted by a new `upRouteCount` metric on the Orchestration Efficiency card on `/admin/ecosystem-health`. ADVISORY + fail-open (only shapes the AUTOMATIC route, never blocks an explicit `ensemble_query`/`jury_triage`; telemetry fire-and-forget); the cost-exempt scoping of the sanctioned up-route is locked by a static regression test. Shipped behind a whole-app + 72h code review — two parallel architect passes (sensitive core + revenue/agentic/jobs), both PASS, 0 CRITICAL/HIGH/MEDIUM. Wiring audit CLEAN (393 tools), tsc + esbuild build green, preflight stale-strings CLEAN. A behaviour layer over the existing AUTO path — no new tools/tables/personas/capabilities. |
| **R125+53** | 2026-06-19 | **Actor-Critic Reflection in the supervisor loop.** When an agent tries something, it fails, loops, retries and STILL spins with no success, the platform no longer just halts or blindly upgrades the model: a SECOND independent LLM (the critic-coach) reads the actual failed output, diagnoses WHY it failed, and hands targeted "do this / don't repeat that" guidance back to the SAME primary loop for one more INFORMED retry — paired with a model escalation (the "Combined" mode). The critic runs as an ISOLATED completion (reviewer-independence invariant — failed output passed as DATA, never by threading live conversation history); fails OPEN (any error/unparseable result falls through to the existing halt); a single `decideStuckRecovery` gate; escalation clamped at 2 and never downgrades. Shipped behind a whole-app + 72h code review — architect PASS, 0 CRITICAL/HIGH — that closed 2 MEDIUM (a session-scoped advisory lock in auto-consolidation now released in a `finally` so it can't starve future tenant consolidation; a stale "208 tables" → "210" corrected on the pricing + about pages). Wiring audit CLEAN (393 tools), tsc + esbuild build green, preflight stale-strings CLEAN. A behaviour layer over the existing loop — no new tools/tables/personas/capabilities. |
| **R125+52.48+sec** | 2026-06-19 | **Whole-app + 72h code review (two parallel architect passes — sensitive core + revenue engines/jobs) — architect PASS, 0 CRITICAL/HIGH/MEDIUM.** Closed 1 LOW client information-leak finding: the AI Daily Briefing routes were returning raw server `err.message` text to the browser on 500 errors (9 handlers); all nine now log the real error server-side and return a generic "Internal server error" so internal database/provider detail can't leak to the client. Wiring audit CLEAN (393 tools), tsc + esbuild build green, preflight stale-strings CLEAN. No new tools/tables/personas/capabilities. |
| **R125+52.47+sec** | 2026-06-18 | **Whole-app + 72h code review (3rd pass) — 4 findings closed (architect PASS).** A cost-cap backstop added the two most expensive autonomous tools (`second_opinion`, `venture_discovery`) to the dispatcher's hardcoded expensive-tool set so the per-call spend throttle still fires even if the rate-limiter config fails to load; a projects lookup in the auto-transcript path is now tenant-scoped and fails closed so a poisoned conversation project id can't redirect downstream file writes onto a foreign project; the Token Efficiency probe import on the ecosystem-health dashboard moved inside its per-probe try with a full default shape so a probe-module load error degrades just that one card; and a founder-quote tool count was corrected 392 → 393. Wiring audit CLEAN (393 tools), tsc + esbuild build green. No new tools/tables/personas/capabilities. |
| **R125+52.44 → +52.46** | 2026-06-18 | **Token Efficiency telemetry + two whole-app security/correctness reviews.** A new **Token Efficiency** card on the ecosystem-health dashboard surfaces three READ-ONLY per-request overhead metrics so wasted spend is measurable, not a vibe: cache-hit starvation (cache-hit % on large ≥5000-token prompts over 30 days), instruction bloat (the fixed system-prompt token tax, measured live), and MCP tool bloat (the serialized tool-catalog token tax) — tenant-scoped, fail-soft, purely additive (no writes, no schema change). Two whole-app + 72h code reviews (architect PASS): **2 HIGH** closed in the Venture Discovery loop (a budget reservation that settled even on $0 real spend now releases instead of settling; a non-atomic stage-advance that two concurrent approvals could double-execute now uses an atomic compare-and-set) and **2 MEDIUM** closed (a linked-conversation backfill now joins through `projects` with a tenant guard so a poisoned cross-tenant link can't stamp a foreign project onto a conversation; the briefings routes gained Zod validation plus a 0-coordinate fix). No new tools/tables/personas/capabilities. |
| **R125+52.43+sec** | 2026-06-17 | **Tenant-isolation nightly-audit hardening + triage.** The nightly cross-tenant security audit was silently skipping oversized source files (they blew the model's input cap), so the green/exit-0 result wasn't honest; it now splits big files into overlapping windows and only counts a file audited when *every* window passes. A triage of 62 flagged findings closed **8 genuine cross-tenant isolation defects** — the skill-synthesizer's writes and several skill-library reads now require an explicit tenant id and fail closed — with the remainder verified as false positives (intentional platform-global tables, guards enforced at another layer, stale source-drift). 3 architect passes → PASS, typecheck green. |
| **R125+52.42** | 2026-06-17 | A new **agent second-opinion / cross-check** (the `second_opinion` tool, wired to all 16 personas, no count changes): when the native multi-model ensemble returns a low-confidence answer (concordance κ < 0.5 or a single proposer), the platform automatically fetches an independent cross-check verdict *before* escalating to a human. That spend routes through a managed panel → judge → synthesize backend behind a hard **$25/day owner-only cost cap**, which this round hardened against cost-drift overshoot (architect HIGH → accepted LOW): a deterministic worst-case reservation clamp (every call reserves a deliberately pessimistic estimate before any money moves), a fail-closed cost-drift latch (the first time a real bill exceeds its reservation the whole feature disables itself and pages the owner instead of quietly spending more), and a dynamic reserve floor (each later reservation rises to the highest real cost seen that day). +11 query-free guard tests (20/20), whole-app + 72h code review (architect PASS). |
| **R125+52.39** | 2026-06-15 | A nine-round security + reliability hardening sprint (+1 skill, no other count changes): the run-completion judge now runs on a model distinct from the worker set, an SSRF DNS-rebinding TOCTOU was closed by pinning the high-risk public-fetch socket to the already-validated IPs, the multi-model jury's proposer set now fails OPEN to the default pool when caller ids dedupe to empty, every health probe now carries a `degraded` marker (a failed probe shows "telemetry unavailable" instead of healthy zeros), self-heal attempt updates are tenant-scoped, a mid-run bu