From 8aefe8479a42a068150d5b37495728a9baa48b8f Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 11:52:50 -0400
Subject: [PATCH 01/14] =?UTF-8?q?=F0=9F=90=9B=20fix:=20dashboard=20init=20?=
 =?UTF-8?q?panic=20from=20lookahead=20in=20feedback=20login=20regexp?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

regexp.MustCompile at package init used (?=...), which Go's RE2 engine
does not support, so pkg/dashboard panicked on load (spoke startup and
every dashboard test). Express the no-double-hyphen rule without
lookahead and enforce the 39-char cap explicitly; add a table test.

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 .../fixed-feedback-login-regexp-panic.md      |   1 +
 src/pkg/dashboard/feedback.go                 |  13 +-
 src/pkg/dashboard/feedback_login_test.go      |  21 +
 src/pkg/dashboard/mcp_knowledge.go            | 505 ++++++++++++++++++
 src/pkg/dashboard/mcp_knowledge_test.go       | 327 ++++++++++++
 5 files changed, 866 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/fixed-feedback-login-regexp-panic.md
 create mode 100644 src/pkg/dashboard/feedback_login_test.go
 create mode 100644 src/pkg/dashboard/mcp_knowledge.go
 create mode 100644 src/pkg/dashboard/mcp_knowledge_test.go

diff --git a/changelog.d/fixed-feedback-login-regexp-panic.md b/changelog.d/fixed-feedback-login-regexp-panic.md
new file mode 100644
index 0000000000..ddb7f63dbb
--- /dev/null
+++ b/changelog.d/fixed-feedback-login-regexp-panic.md
@@ -0,0 +1 @@
+Fixed a `pkg/dashboard` init panic: the feedback GitHub-login validator used a Perl lookahead that Go's RE2 regexp engine rejects, which crashed the spoke on startup and every dashboard test.
diff --git a/src/pkg/dashboard/feedback.go b/src/pkg/dashboard/feedback.go
index 10f000b904..669eeb9dde 100644
--- a/src/pkg/dashboard/feedback.go
+++ b/src/pkg/dashboard/feedback.go
@@ -77,10 +77,21 @@ func sanitizeFeedbackIdentityValue(v string) string {
 	return feedbackRedact(v)
 }
 
-var feedbackGitHubLoginPattern = regexp.MustCompile(`^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}(?:\[bot\])?$`)
+// feedbackGitHubLoginPattern accepts GitHub logins: alphanumerics with single,
+// non-leading, non-trailing hyphens, plus an optional "[bot]" suffix. Go's RE2
+// engine has no lookahead, so "no double hyphen" is expressed by requiring
+// every hyphen to be followed by an alphanumeric; the 39-character cap is
+// enforced separately in githubLoginForMention.
+var feedbackGitHubLoginPattern = regexp.MustCompile(`^[A-Za-z0-9](?:-?[A-Za-z0-9])*(?:\[bot\])?$`)
+
+// gitHubLoginMaxLen is GitHub's documented username length limit.
+const gitHubLoginMaxLen = 39
 
 func githubLoginForMention(login string) string {
 	login = strings.TrimPrefix(strings.TrimSpace(login), "@")
+	if len(strings.TrimSuffix(login, "[bot]")) > gitHubLoginMaxLen {
+		return ""
+	}
 	if feedbackGitHubLoginPattern.MatchString(login) {
 		return login
 	}
diff --git a/src/pkg/dashboard/feedback_login_test.go b/src/pkg/dashboard/feedback_login_test.go
new file mode 100644
index 0000000000..2fa198627c
--- /dev/null
+++ b/src/pkg/dashboard/feedback_login_test.go
@@ -0,0 +1,21 @@
+package dashboard
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGithubLoginForMention(t *testing.T) {
+	accept := []string{"octocat", "@octocat", "a", "a-b", "hive-quality", "dependabot[bot]", strings.Repeat("a", 39)}
+	for _, in := range accept {
+		if got := githubLoginForMention(in); got != strings.TrimPrefix(in, "@") {
+			t.Errorf("%q: got %q, want accepted", in, got)
+		}
+	}
+	reject := []string{"", "-octo", "octo-", "oc--to", "oc to", "oc_to", "@", strings.Repeat("a", 40), "<script>", "a[bot]x"}
+	for _, in := range reject {
+		if got := githubLoginForMention(in); got != "" {
+			t.Errorf("%q: got %q, want rejected", in, got)
+		}
+	}
+}
diff --git a/src/pkg/dashboard/mcp_knowledge.go b/src/pkg/dashboard/mcp_knowledge.go
new file mode 100644
index 0000000000..c1c45d94f6
--- /dev/null
+++ b/src/pkg/dashboard/mcp_knowledge.go
@@ -0,0 +1,505 @@
+package dashboard
+
+import (
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"sort"
+	"strings"
+
+	"github.com/hivecommons/hive/pkg/knowledge"
+)
+
+// Public knowledge MCP endpoint (#10615).
+//
+// A hive owner can flip HIVE_PUBLIC_KNOWLEDGE on to let ANY external agent
+// (Goose, Claude, Copilot, a curl loop) read this hive's operational knowledge
+// over a Model Context Protocol endpoint with no hub session, dashboard token,
+// or contributor registration. The surface is strictly read-only: the only
+// JSON-RPC methods served are the MCP handshake plus tools/list and
+// tools/call, and the only tools are search/get/export. There is no code path
+// from this handler to CreateFact/UpdateFact/DeleteFact or any vault mutation,
+// so an anonymous caller can never overwrite a knowledge base.
+//
+// Default is OFF and the endpoint 404s. isPublicPath and the hub's
+// publicExactPaths admit /mcp/knowledge past authentication only so this
+// handler can run its own fail-closed check; they do not weaken anything else.
+
+const (
+	// publicKnowledgeMCPPath is the spoke endpoint external agents connect to.
+	publicKnowledgeMCPPath = "/mcp/knowledge"
+
+	// publicKnowledgeEnabledEnv is the owner switch. Same spelling as
+	// HIVE_METRICS_ENABLED: 1|true|yes|on. Read on each request so an owner
+	// can close the surface without a pod roll.
+	publicKnowledgeEnabledEnv = "HIVE_PUBLIC_KNOWLEDGE"
+
+	// publicKnowledgeTagsEnv optionally narrows the public projection to facts
+	// carrying at least one of the listed (comma-separated) tags. Empty means
+	// every fact of a public type is exposed.
+	publicKnowledgeTagsEnv = "HIVE_PUBLIC_KNOWLEDGE_TAGS"
+
+	// mcpProtocolVersion is the MCP spec revision this endpoint speaks.
+	mcpProtocolVersion = "2025-03-26"
+
+	// publicKnowledgeDefaultLimit / MaxLimit bound knowledge_search results so
+	// an anonymous caller cannot pull the whole base one query at a time
+	// faster than knowledge_export already allows.
+	publicKnowledgeDefaultLimit = 10
+	publicKnowledgeMaxLimit     = 50
+
+	// publicKnowledgeMaxBodyBytes caps a JSON-RPC request body.
+	publicKnowledgeMaxBodyBytes = 64 << 10
+
+	// JSON-RPC 2.0 error codes.
+	jsonRPCParseError     = -32700
+	jsonRPCInvalidRequest = -32600
+	jsonRPCMethodNotFound = -32601
+	jsonRPCInvalidParams  = -32602
+)
+
+// publicKnowledgeTypes is the allow-list of fact types that leave the hive
+// through the public endpoint. Operational knowledge only — ideation and
+// governance types (idea, vision, constitution, requirement, constraint,
+// stakeholder, decision) describe the project's internal direction and stay
+// behind authentication.
+var publicKnowledgeTypes = map[string]struct{}{
+	"pattern":       {},
+	"gotcha":        {},
+	"regression":    {},
+	"test_scaffold": {},
+	"integration":   {},
+	"coverage_rule": {},
+	"general":       {},
+	"":              {}, // untyped facts render under "general"
+}
+
+// publicKnowledgeTypeOrder fixes section order in knowledge_export output.
+var publicKnowledgeTypeOrder = []string{
+	"pattern", "gotcha", "regression", "coverage_rule", "test_scaffold", "integration", "general",
+}
+
+var publicKnowledgeTypeLabels = map[string]string{
+	"pattern":       "Patterns",
+	"gotcha":        "Gotchas",
+	"regression":    "Regressions",
+	"test_scaffold": "Test Scaffolds",
+	"integration":   "Integration",
+	"coverage_rule": "Coverage Rules",
+	"general":       "General",
+}
+
+// publicKnowledgeEnabled reports whether the owner has opened the read-only
+// knowledge endpoint.
+func publicKnowledgeEnabled() bool {
+	switch strings.ToLower(strings.TrimSpace(os.Getenv(publicKnowledgeEnabledEnv))) {
+	case "1", "true", "yes", "on":
+		return true
+	}
+	return false
+}
+
+// publicKnowledgeTags returns the lower-cased tag allow-list, or nil for "all".
+func publicKnowledgeTags() []string {
+	raw := strings.TrimSpace(os.Getenv(publicKnowledgeTagsEnv))
+	if raw == "" {
+		return nil
+	}
+	var tags []string
+	for _, t := range strings.Split(raw, ",") {
+		if t = strings.ToLower(strings.TrimSpace(t)); t != "" {
+			tags = append(tags, t)
+		}
+	}
+	return tags
+}
+
+// publicFact is the outward projection of a knowledge.Fact. Sources (PR,
+// comment, author), usage counters, confidence reasoning, and lifecycle
+// phase are deliberately absent.
+type publicFact struct {
+	Slug       string   `json:"slug"`
+	Title      string   `json:"title"`
+	Type       string   `json:"type"`
+	Body       string   `json:"body"`
+	Confidence float64  `json:"confidence,omitempty"`
+	Tags       []string `json:"tags,omitempty"`
+	Related    []string `json:"related,omitempty"`
+}
+
+func toPublicFact(f knowledge.Fact) publicFact {
+	t := string(f.Type)
+	if t == "" {
+		t = "general"
+	}
+	pf := publicFact{Slug: f.Slug, Title: f.Title, Type: t, Body: f.Body, Tags: f.Tags, Related: f.Related}
+	if f.ConfidenceScored {
+		pf.Confidence = f.Confidence
+	}
+	return pf
+}
+
+// publicKnowledgeFilter keeps only facts of a public type that match the tag
+// allow-list (if any). It is the single choke point every tool goes through.
+func publicKnowledgeFilter(facts []knowledge.Fact, tags []string) []knowledge.Fact {
+	out := make([]knowledge.Fact, 0, len(facts))
+	for _, f := range facts {
+		if _, ok := publicKnowledgeTypes[string(f.Type)]; !ok {
+			continue
+		}
+		if len(tags) > 0 && !factHasAnyTag(f, tags) {
+			continue
+		}
+		out = append(out, f)
+	}
+	return out
+}
+
+func factHasAnyTag(f knowledge.Fact, tags []string) bool {
+	for _, have := range f.Tags {
+		have = strings.ToLower(have)
+		for _, want := range tags {
+			if have == want {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// renderPublicKnowledgeMarkdown is the knowledge_export body. It mirrors the
+// authenticated /api/knowledge/export layout but only over the public
+// projection, and sorts deterministically so unchanged knowledge yields an
+// identical document.
+func renderPublicKnowledgeMarkdown(facts []knowledge.Fact) string {
+	grouped := make(map[string][]knowledge.Fact)
+	for _, f := range facts {
+		t := string(f.Type)
+		if t == "" {
+			t = "general"
+		}
+		grouped[t] = append(grouped[t], f)
+	}
+
+	var sb strings.Builder
+	sb.WriteString("# Hive Public Knowledge\n\n")
+	sb.WriteString("This document is auto-generated from a hive knowledge base and served read-only.\n")
+	sb.WriteString("It refreshes as the hive learns — do not edit manually.\n\n")
+
+	for _, t := range publicKnowledgeTypeOrder {
+		ff := grouped[t]
+		if len(ff) == 0 {
+			continue
+		}
+		sortFactsStable(ff)
+		label := publicKnowledgeTypeLabels[t]
+		if label == "" {
+			label = titleCaseWords(t)
+		}
+		sb.WriteString("## " + label + "\n\n")
+		for _, f := range ff {
+			sb.WriteString("### " + f.Title + "\n\n")
+			if f.Body != "" {
+				sb.WriteString(f.Body + "\n\n")
+			}
+			if len(f.Tags) > 0 {
+				sb.WriteString("Tags: " + strings.Join(f.Tags, ", ") + "\n\n")
+			}
+		}
+	}
+	return sb.String()
+}
+
+// --- JSON-RPC / MCP wire types -------------------------------------------
+
+type jsonRPCRequest struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      json.RawMessage `json:"id,omitempty"`
+	Method  string          `json:"method"`
+	Params  json.RawMessage `json:"params,omitempty"`
+}
+
+type jsonRPCError struct {
+	Code    int    `json:"code"`
+	Message string `json:"message"`
+}
+
+type jsonRPCResponse struct {
+	JSONRPC string          `json:"jsonrpc"`
+	ID      json.RawMessage `json:"id"`
+	Result  interface{}     `json:"result,omitempty"`
+	Error   *jsonRPCError   `json:"error,omitempty"`
+}
+
+type mcpToolDef struct {
+	Name        string      `json:"name"`
+	Description string      `json:"description"`
+	InputSchema interface{} `json:"inputSchema"`
+	Annotations interface{} `json:"annotations,omitempty"`
+}
+
+type mcpContent struct {
+	Type string `json:"type"`
+	Text string `json:"text"`
+}
+
+type mcpToolResult struct {
+	Content []mcpContent `json:"content"`
+	IsError bool         `json:"isError,omitempty"`
+}
+
+// mcpReadOnlyAnnotations tells MCP clients every tool here is safe to call
+// without confirmation: it neither mutates nor reaches outside the hive.
+var mcpReadOnlyAnnotations = map[string]interface{}{
+	"readOnlyHint":    true,
+	"destructiveHint": false,
+	"idempotentHint":  true,
+	"openWorldHint":   false,
+}
+
+func publicKnowledgeToolDefs() []mcpToolDef {
+	return []mcpToolDef{
+		{
+			Name:        "knowledge_search",
+			Description: "Search this hive's public operational knowledge (patterns, gotchas, regressions, integrations) by free-text query. Returns matching facts as JSON.",
+			InputSchema: map[string]interface{}{
+				"type": "object",
+				"properties": map[string]interface{}{
+					"query": map[string]interface{}{"type": "string", "description": "Free-text search query."},
+					"type":  map[string]interface{}{"type": "string", "description": "Optional fact type filter: pattern, gotcha, regression, test_scaffold, integration, coverage_rule, general."},
+					"limit": map[string]interface{}{"type": "integer", "description": fmt.Sprintf("Max results (default %d, max %d).", publicKnowledgeDefaultLimit, publicKnowledgeMaxLimit)},
+				},
+				"required": []string{"query"},
+			},
+			Annotations: mcpReadOnlyAnnotations,
+		},
+		{
+			Name:        "knowledge_get",
+			Description: "Fetch a single public knowledge fact by slug (as returned by knowledge_search).",
+			InputSchema: map[string]interface{}{
+				"type": "object",
+				"properties": map[string]interface{}{
+					"slug": map[string]interface{}{"type": "string", "description": "Fact slug."},
+				},
+				"required": []string{"slug"},
+			},
+			Annotations: mcpReadOnlyAnnotations,
+		},
+		{
+			Name:        "knowledge_export",
+			Description: "Export the entire public knowledge base as a single Markdown document, grouped by fact type.",
+			InputSchema: map[string]interface{}{
+				"type":       "object",
+				"properties": map[string]interface{}{},
+			},
+			Annotations: mcpReadOnlyAnnotations,
+		},
+	}
+}
+
+// handlePublicKnowledgeMCP serves POST /mcp/knowledge. It is the ONLY
+// anonymous entry point into knowledge and fails closed when the owner switch
+// is off, regardless of what the auth middleware admitted.
+func (s *Server) handlePublicKnowledgeMCP(w http.ResponseWriter, r *http.Request) {
+	if !publicKnowledgeEnabled() {
+		http.NotFound(w, r)
+		return
+	}
+	if r.Method != http.MethodPost {
+		w.Header().Set("Allow", http.MethodPost)
+		jsonError(w, "public knowledge MCP endpoint accepts POST only (no SSE stream)", http.StatusMethodNotAllowed)
+		return
+	}
+
+	body, err := io.ReadAll(io.LimitReader(r.Body, publicKnowledgeMaxBodyBytes+1))
+	if err != nil || len(body) > publicKnowledgeMaxBodyBytes {
+		writeJSONRPC(w, http.StatusRequestEntityTooLarge, jsonRPCResponse{JSONRPC: "2.0", ID: nullID, Error: &jsonRPCError{Code: jsonRPCInvalidRequest, Message: "request body too large"}})
+		return
+	}
+
+	var req jsonRPCRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		writeJSONRPC(w, http.StatusBadRequest, jsonRPCResponse{JSONRPC: "2.0", ID: nullID, Error: &jsonRPCError{Code: jsonRPCParseError, Message: "invalid JSON"}})
+		return
+	}
+	if req.JSONRPC != "2.0" || req.Method == "" {
+		writeJSONRPC(w, http.StatusBadRequest, jsonRPCResponse{JSONRPC: "2.0", ID: idOrNull(req.ID), Error: &jsonRPCError{Code: jsonRPCInvalidRequest, Message: "expected JSON-RPC 2.0 request with a method"}})
+		return
+	}
+
+	// Notifications carry no id and get no body (MCP Streamable HTTP: 202).
+	if strings.HasPrefix(req.Method, "notifications/") {
+		w.WriteHeader(http.StatusAccepted)
+		return
+	}
+
+	resp := jsonRPCResponse{JSONRPC: "2.0", ID: idOrNull(req.ID)}
+	switch req.Method {
+	case "initialize":
+		resp.Result = map[string]interface{}{
+			"protocolVersion": mcpProtocolVersion,
+			"capabilities":    map[string]interface{}{"tools": map[string]interface{}{"listChanged": false}},
+			"serverInfo":      map[string]interface{}{"name": "hive-public-knowledge", "version": "1"},
+			"instructions":    "Read-only access to this hive's operational knowledge. Use knowledge_search for targeted lookups and knowledge_export for the full Markdown document.",
+		}
+	case "ping":
+		resp.Result = map[string]interface{}{}
+	case "tools/list":
+		resp.Result = map[string]interface{}{"tools": publicKnowledgeToolDefs()}
+	case "tools/call":
+		result, rpcErr := s.callPublicKnowledgeTool(r, req.Params)
+		if rpcErr != nil {
+			resp.Error = rpcErr
+		} else {
+			resp.Result = result
+		}
+	default:
+		resp.Error = &jsonRPCError{Code: jsonRPCMethodNotFound, Message: "method not found: " + req.Method}
+	}
+	writeJSONRPC(w, http.StatusOK, resp)
+}
+
+var nullID = json.RawMessage("null")
+
+func idOrNull(id json.RawMessage) json.RawMessage {
+	if len(id) == 0 {
+		return nullID
+	}
+	return id
+}
+
+func writeJSONRPC(w http.ResponseWriter, status int, resp jsonRPCResponse) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(resp)
+}
+
+type mcpToolCallParams struct {
+	Name      string          `json:"name"`
+	Arguments json.RawMessage `json:"arguments"`
+}
+
+// callPublicKnowledgeTool dispatches tools/call. Unknown tool names are a
+// JSON-RPC invalid-params error; tool-level problems (fact not found) come
+// back as isError results per the MCP spec so the model can recover.
+func (s *Server) callPublicKnowledgeTool(r *http.Request, raw json.RawMessage) (interface{}, *jsonRPCError) {
+	var params mcpToolCallParams
+	if len(raw) > 0 {
+		if err := json.Unmarshal(raw, &params); err != nil {
+			return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "invalid tools/call params"}
+		}
+	}
+	if !s.ensureKnowledge() {
+		return toolText("Knowledge base not available."), nil
+	}
+	tags := publicKnowledgeTags()
+
+	switch params.Name {
+	case "knowledge_search":
+		var args struct {
+			Query string `json:"query"`
+			Type  string `json:"type"`
+			Limit int    `json:"limit"`
+		}
+		if len(params.Arguments) > 0 {
+			if err := json.Unmarshal(params.Arguments, &args); err != nil {
+				return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "invalid knowledge_search arguments"}
+			}
+		}
+		args.Query = strings.TrimSpace(args.Query)
+		if args.Query == "" {
+			return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "query is required"}
+		}
+		if _, ok := publicKnowledgeTypes[args.Type]; !ok {
+			return toolError(fmt.Sprintf("type %q is not a public fact type", args.Type)), nil
+		}
+		limit := args.Limit
+		if limit <= 0 {
+			limit = publicKnowledgeDefaultLimit
+		}
+		if limit > publicKnowledgeMaxLimit {
+			limit = publicKnowledgeMaxLimit
+		}
+		// Over-fetch so the public filter does not starve the result set, then
+		// trim to the requested bound.
+		facts := s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, args.Query, args.Type, publicKnowledgeMaxLimit*2)
+		facts = publicKnowledgeFilter(facts, tags)
+		if len(facts) > limit {
+			facts = facts[:limit]
+		}
+		out := make([]publicFact, 0, len(facts))
+		for _, f := range facts {
+			out = append(out, toPublicFact(f))
+		}
+		return toolJSON(map[string]interface{}{"query": args.Query, "count": len(out), "results": out})
+
+	case "knowledge_get":
+		var args struct {
+			Slug string `json:"slug"`
+		}
+		if len(params.Arguments) > 0 {
+			if err := json.Unmarshal(params.Arguments, &args); err != nil {
+				return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "invalid knowledge_get arguments"}
+			}
+		}
+		args.Slug = strings.TrimSpace(args.Slug)
+		if args.Slug == "" {
+			return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "slug is required"}
+		}
+		// Resolve through the same filtered listing search uses so a private
+		// fact can never be fetched by guessing its slug.
+		all := publicKnowledgeFilter(s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, "", "", 0), tags)
+		for _, f := range all {
+			if f.Slug == args.Slug {
+				return toolJSON(toPublicFact(f))
+			}
+		}
+		return toolError("fact not found: " + args.Slug), nil
+
+	case "knowledge_export":
+		all := publicKnowledgeFilter(s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, "", "", 0), tags)
+		md := renderPublicKnowledgeMarkdown(all)
+		sum := sha256.Sum256([]byte(md))
+		return map[string]interface{}{
+			"content": []mcpContent{{Type: "text", Text: md}},
+			"_meta":   map[string]interface{}{"etag": fmt.Sprintf(`"%x"`, sum), "facts": len(all)},
+		}, nil
+
+	case "":
+		return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "tool name is required"}
+	default:
+		return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "unknown tool: " + params.Name}
+	}
+}
+
+func toolText(text string) mcpToolResult {
+	return mcpToolResult{Content: []mcpContent{{Type: "text", Text: text}}}
+}
+
+func toolError(text string) mcpToolResult {
+	return mcpToolResult{Content: []mcpContent{{Type: "text", Text: text}}, IsError: true}
+}
+
+func toolJSON(v interface{}) (interface{}, *jsonRPCError) {
+	b, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return toolError("failed to encode result"), nil
+	}
+	return toolText(string(b)), nil
+}
+
+// publicKnowledgeTypeList is exported for docs/tests: the sorted public types.
+func publicKnowledgeTypeList() []string {
+	out := make([]string, 0, len(publicKnowledgeTypes))
+	for t := range publicKnowledgeTypes {
+		if t != "" {
+			out = append(out, t)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
diff --git a/src/pkg/dashboard/mcp_knowledge_test.go b/src/pkg/dashboard/mcp_knowledge_test.go
new file mode 100644
index 0000000000..3a5f248f4d
--- /dev/null
+++ b/src/pkg/dashboard/mcp_knowledge_test.go
@@ -0,0 +1,327 @@
+package dashboard
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/hivecommons/hive/pkg/knowledge"
+)
+
+// publicKnowledgeServer builds a token-secured spoke with a vault holding one
+// fact of every interesting kind: a public gotcha, a tagged public pattern,
+// and a private governance fact that must never leave through /mcp/knowledge.
+func publicKnowledgeServer(t *testing.T) *Server {
+	t.Helper()
+	logger := slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{Level: slog.LevelError}))
+	s := NewServerWithAuth(0, "dashboard-secret", logger)
+	s.RegisterAPI(testDeps(t))
+
+	vault := filepath.Join(t.TempDir(), "vault")
+	if err := os.MkdirAll(vault, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	write := func(name, body string) {
+		t.Helper()
+		if err := os.WriteFile(filepath.Join(vault, name), []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write("gotcha-nil-map.md", "---\ntitle: Nil Map Gotcha\ntype: gotcha\n---\nAlways initialize maps before use.\n")
+	write("pattern-caching.md", "---\ntitle: Caching Pattern\ntype: pattern\ntags:\n  - linux\n  - public\n---\nUse Redis for caching hot paths.\n")
+	write("vision-world-domination.md", "---\ntitle: Secret Roadmap\ntype: vision\n---\nWe will acquire a competitor in Q3.\n")
+
+	api := knowledge.NewKnowledgeAPI(nil, knowledge.KnowledgeConfig{Enabled: true, Engine: "file"}, logger)
+	if err := api.ConnectVault(vault, "vault"); err != nil {
+		t.Fatalf("ConnectVault: %v", err)
+	}
+	s.deps.Knowledge = api
+	return s
+}
+
+func mcpCall(t *testing.T, s *Server, payload string) *httptest.ResponseRecorder {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, publicKnowledgeMCPPath, bytes.NewBufferString(payload))
+	req.Header.Set("Content-Type", "application/json")
+	// Deliberately anonymous: no Authorization, no X-Hive-* headers. Goes
+	// through the full handler chain so the authenticate middleware is tested.
+	s.Handler().ServeHTTP(rec, req)
+	return rec
+}
+
+func decodeRPC(t *testing.T, rec *httptest.ResponseRecorder) jsonRPCResponse {
+	t.Helper()
+	var resp jsonRPCResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode %q: %v", rec.Body.String(), err)
+	}
+	return resp
+}
+
+// toolText extracts the single text content of a tools/call result.
+func rpcToolText(t *testing.T, resp jsonRPCResponse) (string, bool) {
+	t.Helper()
+	if resp.Error != nil {
+		t.Fatalf("unexpected rpc error: %+v", resp.Error)
+	}
+	raw, _ := json.Marshal(resp.Result)
+	var res mcpToolResult
+	if err := json.Unmarshal(raw, &res); err != nil {
+		t.Fatalf("decode tool result %s: %v", raw, err)
+	}
+	if len(res.Content) != 1 {
+		t.Fatalf("content = %+v, want 1 item", res.Content)
+	}
+	return res.Content[0].Text, res.IsError
+}
+
+func TestPublicKnowledgeMCPDisabledByDefault(t *testing.T) {
+	t.Setenv(publicKnowledgeEnabledEnv, "")
+	s := publicKnowledgeServer(t)
+
+	rec := mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/list"}`)
+	if rec.Code == http.StatusOK {
+		t.Fatalf("switch off: status = %d, want non-200; body=%q", rec.Code, rec.Body.String())
+	}
+	if isPublicPath(publicKnowledgeMCPPath) {
+		t.Fatal("switch off: /mcp/knowledge must not be a public path")
+	}
+}
+
+func TestPublicKnowledgeMCPDisabledEvenWhenAuthenticated(t *testing.T) {
+	t.Setenv(publicKnowledgeEnabledEnv, "0")
+	s := publicKnowledgeServer(t)
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, publicKnowledgeMCPPath, strings.NewReader(`{"jsonrpc":"2.0","id":1,"method":"tools/list"}`))
+	req.Header.Set("Authorization", "Bearer dashboard-secret")
+	s.Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("switch off + owner token: status = %d, want 404 (the surface does not exist until the owner opens it)", rec.Code)
+	}
+}
+
+func TestPublicKnowledgeMCPEnabledSpellings(t *testing.T) {
+	for _, v := range []string{"1", "true", "YES", " on "} {
+		t.Setenv(publicKnowledgeEnabledEnv, v)
+		if !publicKnowledgeEnabled() {
+			t.Errorf("%q should enable", v)
+		}
+	}
+	for _, v := range []string{"", "0", "false", "off", "maybe"} {
+		t.Setenv(publicKnowledgeEnabledEnv, v)
+		if publicKnowledgeEnabled() {
+			t.Errorf("%q should not enable", v)
+		}
+	}
+}
+
+func TestPublicKnowledgeMCPHandshakeAndToolsList(t *testing.T) {
+	t.Setenv(publicKnowledgeEnabledEnv, "1")
+	s := publicKnowledgeServer(t)
+
+	if !isPublicPath(publicKnowledgeMCPPath) {
+		t.Fatal("switch on: /mcp/knowledge must be public")
+	}
+
+	rec := mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"goose","version":"1"}}}`)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("initialize anonymous: status = %d body=%q", rec.Code, rec.Body.String())
+	}
+	resp := decodeRPC(t, rec)
+	if resp.Error != nil {
+		t.Fatalf("initialize error: %+v", resp.Error)
+	}
+	init := resp.Result.(map[string]interface{})
+	if init["protocolVersion"] != mcpProtocolVersion {
+		t.Errorf("protocolVersion = %v", init["protocolVersion"])
+	}
+
+	rec = mcpCall(t, s, `{"jsonrpc":"2.0","method":"notifications/initialized"}`)
+	if rec.Code != http.StatusAccepted || rec.Body.Len() != 0 {
+		t.Fatalf("notification: status = %d body=%q, want 202 and empty", rec.Code, rec.Body.String())
+	}
+
+	rec = mcpCall(t, s, `{"jsonrpc":"2.0","id":"abc","method":"ping"}`)
+	if resp = decodeRPC(t, rec); resp.Error != nil || string(resp.ID) != `"abc"` {
+		t.Fatalf("ping: %+v id=%s", resp.Error, resp.ID)
+	}
+
+	rec = mcpCall(t, s, `{"jsonrpc":"2.0","id":2,"method":"tools/list"}`)
+	resp = decodeRPC(t, rec)
+	raw, _ := json.Marshal(resp.Result)
+	var list struct {
+		Tools []mcpToolDef `json:"tools"`
+	}
+	if err := json.Unmarshal(raw, &list); err != nil {
+		t.Fatal(err)
+	}
+	var names []string
+	for _, td := range list.Tools {
+		names = append(names, td.Name)
+		ann, _ := td.Annotations.(map[string]interface{})
+		if ann["readOnlyHint"] != true || ann["destructiveHint"] != false {
+			t.Errorf("tool %s must be annotated read-only, got %v", td.Name, td.Annotations)
+		}
+		for _, verb := range []string{"create", "update", "delete", "write", "import", "promote"} {
+			if strings.Contains(td.Name, verb) {
+				t.Errorf("tool %s looks like a write tool; public surface must be read-only", td.Name)
+			}
+		}
+	}
+	if got := strings.Join(names, ","); got != "knowledge_search,knowledge_get,knowledge_export" {
+		t.Fatalf("tools = %s", got)
+	}
+}
+
+func TestPublicKnowledgeMCPSearchGetExportHidePrivateTypes(t *testing.T) {
+	t.Setenv(publicKnowledgeEnabledEnv, "true")
+	t.Setenv(publicKnowledgeTagsEnv, "")
+	s := publicKnowledgeServer(t)
+
+	// Export: public types present, vision absent, sources never rendered.
+	resp := decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_export","arguments":{}}}`))
+	md, isErr := rpcToolText(t, resp)
+	if isErr {
+		t.Fatalf("export isError: %s", md)
+	}
+	for _, want := range []string{"# Hive Public Knowledge", "## Gotchas", "### Nil Map Gotcha", "## Patterns", "### Caching Pattern", "Tags: linux, public"} {
+		if !strings.Contains(md, want) {
+			t.Errorf("export missing %q:\n%s", want, md)
+		}
+	}
+	for _, leak := range []string{"Secret Roadmap", "acquire a competitor", "## Vision"} {
+		if strings.Contains(md, leak) {
+			t.Errorf("export leaked private content %q:\n%s", leak, md)
+		}
+	}
+
+	// Get: public slug resolves, private slug is "not found" (not 'forbidden',
+	// which would confirm existence).
+	resp = decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"knowledge_get","arguments":{"slug":"gotcha-nil-map"}}}`))
+	text, isErr := rpcToolText(t, resp)
+	if isErr || !strings.Contains(text, "Always initialize maps") {
+		t.Fatalf("get public: isErr=%v text=%s", isErr, text)
+	}
+	var pf publicFact
+	if err := json.Unmarshal([]byte(text), &pf); err != nil {
+		t.Fatalf("get result not a publicFact: %v", err)
+	}
+	var generic map[string]interface{}
+	_ = json.Unmarshal([]byte(text), &generic)
+	for _, hidden := range []string{"sources", "usage_count", "confidence_reason", "last_used", "phase"} {
+		if _, ok := generic[hidden]; ok {
+			t.Errorf("public fact exposes %q", hidden)
+		}
+	}
+
+	resp = decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"knowledge_get","arguments":{"slug":"vision-world-domination"}}}`))
+	text, isErr = rpcToolText(t, resp)
+	if !isErr || !strings.Contains(text, "fact not found") {
+		t.Fatalf("get private: isErr=%v text=%s, want not-found", isErr, text)
+	}
+
+	// Search: a query that only matches the private fact returns nothing.
+	resp = decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"competitor"}}}`))
+	text, _ = rpcToolText(t, resp)
+	if strings.Contains(text, "Secret Roadmap") {
+		t.Fatalf("search leaked private fact: %s", text)
+	}
+	resp = decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"maps","limit":1000}}}`))
+	text, _ = rpcToolText(t, resp)
+	if !strings.Contains(text, "Nil Map Gotcha") {
+		t.Fatalf("search did not find public fact: %s", text)
+	}
+}
+
+func TestPublicKnowledgeMCPTagAllowList(t *testing.T) {
+	t.Setenv(publicKnowledgeEnabledEnv, "1")
+	t.Setenv(publicKnowledgeTagsEnv, "Public, troubleshooting")
+	s := publicKnowledgeServer(t)
+
+	resp := decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_export"}}`))
+	md, _ := rpcToolText(t, resp)
+	if !strings.Contains(md, "Caching Pattern") {
+		t.Errorf("tagged fact missing:\n%s", md)
+	}
+	if strings.Contains(md, "Nil Map Gotcha") {
+		t.Errorf("untagged fact exposed despite tag allow-list:\n%s", md)
+	}
+}
+
+func TestPublicKnowledgeMCPRejectsWritesAndBadInput(t *testing.T) {
+	t.Setenv(publicKnowledgeEnabledEnv, "1")
+	s := publicKnowledgeServer(t)
+
+	cases := map[string]int{
+		`{"jsonrpc":"2.0","id":1,"method":"resources/write"}`:                                                    jsonRPCMethodNotFound,
+		`{"jsonrpc":"2.0","id":1,"method":"knowledge/create"}`:                                                   jsonRPCMethodNotFound,
+		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_create","arguments":{}}}`:     jsonRPCInvalidParams,
+		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_delete","arguments":{}}}`:     jsonRPCInvalidParams,
+		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_search","arguments":{}}}`:     jsonRPCInvalidParams,
+		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_get","arguments":{}}}`:        jsonRPCInvalidParams,
+		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_search","arguments":"nope"}}`: jsonRPCInvalidParams,
+		`{"jsonrpc":"1.0","id":1,"method":"tools/list"}`:                                                         jsonRPCInvalidRequest,
+		`not json`: jsonRPCParseError,
+	}
+	for payload, wantCode := range cases {
+		resp := decodeRPC(t, mcpCall(t, s, payload))
+		if resp.Error == nil || resp.Error.Code != wantCode {
+			t.Errorf("%s: error = %+v, want code %d", payload, resp.Error, wantCode)
+		}
+	}
+
+	// Non-POST verbs are refused outright; there is no SSE stream to open.
+	for _, m := range []string{http.MethodGet, http.MethodDelete, http.MethodPut} {
+		rec := httptest.NewRecorder()
+		s.Handler().ServeHTTP(rec, httptest.NewRequest(m, publicKnowledgeMCPPath, nil))
+		if rec.Code != http.StatusMethodNotAllowed {
+			t.Errorf("%s: status = %d, want 405", m, rec.Code)
+		}
+	}
+
+	// Oversized bodies are rejected before parsing.
+	big := `{"jsonrpc":"2.0","id":1,"method":"ping","params":{"pad":"` + strings.Repeat("x", publicKnowledgeMaxBodyBytes) + `"}}`
+	if rec := mcpCall(t, s, big); rec.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("oversized: status = %d, want 413", rec.Code)
+	}
+
+	// Search with a private type filter is refused as a tool error.
+	resp := decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"x","type":"vision"}}}`))
+	if text, isErr := rpcToolText(t, resp); !isErr || !strings.Contains(text, "not a public fact type") {
+		t.Errorf("private type filter: isErr=%v text=%s", isErr, text)
+	}
+}
+
+func TestPublicKnowledgeMCPNoKnowledgeBase(t *testing.T) {
+	t.Setenv(publicKnowledgeEnabledEnv, "1")
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	s := NewServerWithAuth(0, "", logger)
+	// deps nil → ensureKnowledge false → graceful text, never a panic.
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, publicKnowledgeMCPPath, strings.NewReader(`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_export"}}`))
+	s.handlePublicKnowledgeMCP(rec, req)
+	resp := decodeRPC(t, rec)
+	if text, _ := rpcToolText(t, resp); !strings.Contains(text, "not available") {
+		t.Fatalf("text = %s", text)
+	}
+}
+
+func TestPublicKnowledgeTypeListExcludesGovernance(t *testing.T) {
+	got := strings.Join(publicKnowledgeTypeList(), ",")
+	for _, private := range []string{"idea", "vision", "constitution", "requirement", "constraint", "stakeholder", "decision"} {
+		if strings.Contains(got, private) {
+			t.Errorf("public type list includes private type %q: %s", private, got)
+		}
+	}
+	if !strings.Contains(got, "gotcha") || !strings.Contains(got, "pattern") {
+		t.Errorf("public type list = %s", got)
+	}
+}

From 71d34d4eb6aa1afab2fc0a7c63accab79cdca855 Mon Sep 17 00:00:00 2001
From: clubanderson <407614+clubanderson@users.noreply.github.com>
Date: Mon, 5 Oct 2026 15:54:00 +0000
Subject: [PATCH 02/14] changelog: fragment for #10617

Generated by changelog-fragment-guard from the PR title (#5675).
Edit the wording freely, or replace this file with the no-changelog
label if the change is not user-visible.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: clubanderson <407614+clubanderson@users.noreply.github.com>
---
 changelog.d/fixed-10617.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/fixed-10617.md

diff --git a/changelog.d/fixed-10617.md b/changelog.d/fixed-10617.md
new file mode 100644
index 0000000000..f247f51320
--- /dev/null
+++ b/changelog.d/fixed-10617.md
@@ -0,0 +1 @@
+- fix: dashboard init panic from lookahead in feedback login regexp (#10617)

From 9d8804b9e92540e66bae2f33047e2a954a43e649 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:01:46 -0400
Subject: [PATCH 03/14] =?UTF-8?q?=F0=9F=90=9B=20fix:=20same=20lookahead=20?=
 =?UTF-8?q?regexp=20panic=20in=20pkg/hub=20feedback=20login=20validator?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pkg/hub/feedback.go carried the identical (?=...) pattern, so the hub
binary and every hub test panicked at init too. Same rewrite + length
cap + table test.

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 .../fixed-feedback-login-regexp-panic.md      |  2 +-
 src/pkg/hub/feedback.go                       | 12 ++++++++++-
 src/pkg/hub/feedback_login_test.go            | 21 +++++++++++++++++++
 3 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 src/pkg/hub/feedback_login_test.go

diff --git a/changelog.d/fixed-feedback-login-regexp-panic.md b/changelog.d/fixed-feedback-login-regexp-panic.md
index ddb7f63dbb..38b90b4220 100644
--- a/changelog.d/fixed-feedback-login-regexp-panic.md
+++ b/changelog.d/fixed-feedback-login-regexp-panic.md
@@ -1 +1 @@
-Fixed a `pkg/dashboard` init panic: the feedback GitHub-login validator used a Perl lookahead that Go's RE2 regexp engine rejects, which crashed the spoke on startup and every dashboard test.
+Fixed `pkg/dashboard` and `pkg/hub` init panics: the feedback GitHub-login validators used a Perl lookahead that Go's RE2 regexp engine rejects, which crashed spoke and hub on startup and every dashboard/hub test.
diff --git a/src/pkg/hub/feedback.go b/src/pkg/hub/feedback.go
index 20bc3eace9..7671dc03e4 100644
--- a/src/pkg/hub/feedback.go
+++ b/src/pkg/hub/feedback.go
@@ -375,10 +375,20 @@ func sanitizeHubFeedbackIdentityValue(v string) string {
 	return hubFeedbackRedact(v)
 }
 
-var hubFeedbackGitHubLoginPattern = regexp.MustCompile(`^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}(?:\[bot\])?$`)
+// hubFeedbackGitHubLoginPattern mirrors dashboard.feedbackGitHubLoginPattern:
+// GitHub logins with single, non-leading, non-trailing hyphens and an optional
+// "[bot]" suffix. RE2 has no lookahead, so the length cap lives in
+// hubGitHubLoginForMention.
+var hubFeedbackGitHubLoginPattern = regexp.MustCompile(`^[A-Za-z0-9](?:-?[A-Za-z0-9])*(?:\[bot\])?$`)
+
+// hubGitHubLoginMaxLen is GitHub's documented username length limit.
+const hubGitHubLoginMaxLen = 39
 
 func hubGitHubLoginForMention(login string) string {
 	login = strings.TrimPrefix(strings.TrimSpace(login), "@")
+	if len(strings.TrimSuffix(login, "[bot]")) > hubGitHubLoginMaxLen {
+		return ""
+	}
 	if hubFeedbackGitHubLoginPattern.MatchString(login) {
 		return login
 	}
diff --git a/src/pkg/hub/feedback_login_test.go b/src/pkg/hub/feedback_login_test.go
new file mode 100644
index 0000000000..546ff6de72
--- /dev/null
+++ b/src/pkg/hub/feedback_login_test.go
@@ -0,0 +1,21 @@
+package hub
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestHubGitHubLoginForMention(t *testing.T) {
+	accept := []string{"octocat", "@octocat", "a", "a-b", "hive-quality", "dependabot[bot]", strings.Repeat("a", 39)}
+	for _, in := range accept {
+		if got := hubGitHubLoginForMention(in); got != strings.TrimPrefix(in, "@") {
+			t.Errorf("%q: got %q, want accepted", in, got)
+		}
+	}
+	reject := []string{"", "-octo", "octo-", "oc--to", "oc to", "oc_to", "@", strings.Repeat("a", 40), "<script>", "a[bot]x"}
+	for _, in := range reject {
+		if got := hubGitHubLoginForMention(in); got != "" {
+			t.Errorf("%q: got %q, want rejected", in, got)
+		}
+	}
+}

From 978e8b31d16ef62b3b0b7bc9ff2b0eac04ad7d52 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:02:27 -0400
Subject: [PATCH 04/14] changelog: drop duplicate fragment (bot added
 fixed-10617.md)

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 changelog.d/fixed-feedback-login-regexp-panic.md | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 changelog.d/fixed-feedback-login-regexp-panic.md

diff --git a/changelog.d/fixed-feedback-login-regexp-panic.md b/changelog.d/fixed-feedback-login-regexp-panic.md
deleted file mode 100644
index 38b90b4220..0000000000
--- a/changelog.d/fixed-feedback-login-regexp-panic.md
+++ /dev/null
@@ -1 +0,0 @@
-Fixed `pkg/dashboard` and `pkg/hub` init panics: the feedback GitHub-login validators used a Perl lookahead that Go's RE2 regexp engine rejects, which crashed spoke and hub on startup and every dashboard/hub test.

From 6259b95335f591465618d2900699124e706aee43 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 11:53:29 -0400
Subject: [PATCH 05/14] =?UTF-8?q?=E2=9C=A8=20knowledge:=20owner-switched?=
 =?UTF-8?q?=20read-only=20public=20MCP=20endpoint=20(#10615)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add POST /mcp/knowledge, a Model Context Protocol endpoint any external
agent can use anonymously to read this hive's operational knowledge —
but only after the owner sets HIVE_PUBLIC_KNOWLEDGE. Default off (404).

Strictly read-only: the surface serves initialize/ping/tools/list and
three tools (knowledge_search, knowledge_get, knowledge_export). No
code path reaches CreateFact/UpdateFact/DeleteFact or vault mutation.
Only operational fact types are projected; ideation/governance types,
sources, usage counters and confidence reasoning never leave the hive.
Optional HIVE_PUBLIC_KNOWLEDGE_TAGS narrows the projection further.

isPublicPath (spoke) and publicExactPaths (hub nginx auth_request) wave
the path through only so the handler can run its own fail-closed check.

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 src/pkg/dashboard/api.go    |  4 ++++
 src/pkg/dashboard/server.go |  5 +++++
 src/pkg/hub/saas_auth.go    | 10 ++++++++++
 3 files changed, 19 insertions(+)

diff --git a/src/pkg/dashboard/api.go b/src/pkg/dashboard/api.go
index ff4f06f22d..71c054f2eb 100644
--- a/src/pkg/dashboard/api.go
+++ b/src/pkg/dashboard/api.go
@@ -319,6 +319,10 @@ func (s *Server) RegisterAPI(deps *Dependencies) {
 	s.mux.HandleFunc("GET /api/knowledge", s.handleKnowledgeList)
 	s.mux.HandleFunc("GET /api/knowledge/export", s.handleKnowledgeExport)
 	s.mux.HandleFunc("GET /api/knowledge/search", s.handleKnowledgeSearch)
+	// Anonymous, owner-switched, read-only MCP surface (#10615). Registered
+	// without a method so GET/DELETE get a deliberate 405 instead of falling
+	// through to another handler.
+	s.mux.HandleFunc(publicKnowledgeMCPPath, s.handlePublicKnowledgeMCP)
 	s.mux.HandleFunc("GET /api/knowledge/health", s.handleKnowledgeHealth)
 	s.mux.HandleFunc("GET /api/knowledge/stats", s.handleKnowledgeStats)
 	s.mux.HandleFunc("GET /api/knowledge/graph", s.handleKnowledgeGraph)
diff --git a/src/pkg/dashboard/server.go b/src/pkg/dashboard/server.go
index 46670fdc88..ae2252d26b 100644
--- a/src/pkg/dashboard/server.go
+++ b/src/pkg/dashboard/server.go
@@ -1836,6 +1836,11 @@ func isPublicPath(path string) bool {
 		return true
 	case path == "/auth/return":
 		return true
+	case path == publicKnowledgeMCPPath && publicKnowledgeEnabled():
+		// Owner-switched, read-only MCP knowledge endpoint (#10615). Public only
+		// while HIVE_PUBLIC_KNOWLEDGE is on; handlePublicKnowledgeMCP re-checks
+		// the switch and 404s otherwise, and serves no write method at all.
+		return true
 	case path == "/metrics" && metricsEnabled():
 		// Prometheus scrape target — bypasses dashboard auth only when
 		// explicitly enabled via HIVE_METRICS_ENABLED (Prometheus cannot
diff --git a/src/pkg/hub/saas_auth.go b/src/pkg/hub/saas_auth.go
index 5e5834ad72..215a358030 100644
--- a/src/pkg/hub/saas_auth.go
+++ b/src/pkg/hub/saas_auth.go
@@ -783,6 +783,7 @@ func (s *HubServer) handleUserToken(w http.ResponseWriter, r *http.Request) {
 
 var publicExactPaths = map[string]struct{}{
 	knowledgeExportPath:        {},
+	publicKnowledgeMCPPath:     {},
 	"/api/gh-user-auth/status": {},
 	"/api/style":               {},
 	"/api/theme.css":           {},
@@ -853,6 +854,15 @@ func isSaaSPublicPath(originalURI string) bool {
 // #4050 (/api/v1) and #7453 (/api/contribute/me).
 const knowledgeExportPath = "/api/knowledge/export"
 
+// publicKnowledgeMCPPath is the spoke's owner-switched, read-only MCP
+// knowledge endpoint (#10615). External agents (Goose, Claude, Copilot) reach
+// it with no browser session, so the hub's nginx auth_request gate must wave
+// it through for the same reason as knowledgeExportPath. This does NOT open
+// anything by itself: the spoke's handlePublicKnowledgeMCP 404s unless the
+// owner set HIVE_PUBLIC_KNOWLEDGE, and the endpoint serves only
+// search/get/export — there is no write method on that surface.
+const publicKnowledgeMCPPath = "/mcp/knowledge"
+
 // ssoHandoffPath is the spoke's SSO handoff endpoint. It MUST bypass the hub's
 // nginx auth_request gate.
 //

From 370250464313d22db2015fc052fa7a4b134ae454 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:03:59 -0400
Subject: [PATCH 06/14] =?UTF-8?q?=F0=9F=93=96=20knowledge:=20document=20th?=
 =?UTF-8?q?e=20public=20knowledge=20MCP=20endpoint?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

env-vars, api-reference (+citation refresh), documentation map, a new
public-knowledge-mcp.md with Goose/Claude/Copilot client snippets, and
the changelog fragment for #10615.

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 .../added-public-knowledge-mcp-10615.md       |   1 +
 src/docs/api-reference.md                     | 531 +++++++++---------
 src/docs/documentation-map.md                 |   1 +
 src/docs/env-vars.md                          |   2 +
 src/docs/public-knowledge-mcp.md              | 105 ++++
 src/pkg/dashboard/mcp_knowledge_test.go       |   2 +-
 6 files changed, 376 insertions(+), 266 deletions(-)
 create mode 100644 changelog.d/added-public-knowledge-mcp-10615.md
 create mode 100644 src/docs/public-knowledge-mcp.md

diff --git a/changelog.d/added-public-knowledge-mcp-10615.md b/changelog.d/added-public-knowledge-mcp-10615.md
new file mode 100644
index 0000000000..af38081e5c
--- /dev/null
+++ b/changelog.d/added-public-knowledge-mcp-10615.md
@@ -0,0 +1 @@
+Added an owner-switched, **read-only** public knowledge MCP endpoint (`POST /mcp/knowledge`, `HIVE_PUBLIC_KNOWLEDGE=1`) so any external agent — Goose, Claude, Copilot — can search, fetch, and export a hive's operational knowledge without credentials. Only operational fact types are served, sources/usage data are stripped, and no write method exists on the surface (#10615).
diff --git a/src/docs/api-reference.md b/src/docs/api-reference.md
index f7d4f4d48d..f1ee2410af 100644
--- a/src/docs/api-reference.md
+++ b/src/docs/api-reference.md
@@ -30,31 +30,31 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 | `PUT` | `/api/swarm/themes` | Owner only | Set a per-repo swarm theme (`event_name`, `call_to_arms`, `leaderboard_title`). | `pkg/dashboard/swarm.go:316` |
 | `PATCH` | `/api/swarm/objectives` | Owner only | Update the active swarm SDLC objective checklist completion state. | `pkg/dashboard/swarm.go:317` |
 | `GET` | `/api/leaderboard/swarm` | Public | Stable public JSON record of swarm history, leaderboard, top players, and achievements. | `pkg/dashboard/swarm.go:318` |
-| `GET` | `/api/runs` | Dashboard auth/session | Active staged runs projected from task leases, plans, and lifecycle timeline. Returns an array of `Run` objects: canonical `key` (`owner/repo#number`), current-stage `lease_key`, `title`, `repo` (`owner/repo`), `stage`, `gen`, `stage_started_at`, `waiting_on` (`agent`, `remote`, `human`, `ci`, `none`), `waiting_since`, `assignee`, `last_receipt`, `plan_epic_id`, and `stages[]` (`name`, `status`, `gen`, `receipt`). | `pkg/dashboard/api.go:77` |
-| `GET` | `/api/runs/audit` | Owner only | Read-only cross-repo audit query over existing retained artifacts. Query `repo`, canonical `run` (`owner/repo#number`), RFC3339 `since`/`until`, `kind`, `limit` (default 100, max 500), and `page_token`. Returns `{items,next_page_token,retention}`; each item has `source` (`audit_log`, `timeline`, `lease_receipt`, `plan_epic`), `kind`, `run`, `repo`, `at`, `actor`, `artifact_id`, `attrs`, or an explicit `kind=expired,status=expired,state=Unknown` marker when requested history may have aged out. | `pkg/dashboard/api.go:78` |
-| `POST` | `/api/runs/audit` | Owner only | Activate the convergence audit campaign over a scope directory. Body `{"campaign_key":"audit-campaign","scope_dir":"/data/convergence/audit/scope","store":"audit","generation":1,"run_key":"","run_url":""}`; `scope_dir` defaults to `/data/convergence/audit/scope`, `store` defaults to `audit`, `auditor`, `scanner`, `supervisor`, then the first configured bead store. Runs inspection even when `publication.enabled` is false, but then skips the publisher and returns `publication_skipped:true` with reason `publication.disabled`. | `pkg/dashboard/api.go:79` |
-| `GET` | `/api/runs/{key}/checkpoint` | Dashboard auth/session | Compact mobile/chat checkpoint review payload for a held run. Returns `run_key`, `stage`, lease `gen`, `repo`, `title`, capped plain-text `summary`, approve/reject `decisions`, dashboard deep link, `lease_gen` staleness fence, and verified-owner approver rule. | `pkg/dashboard/api.go:81` |
-| `POST` | `/api/runs/{key}/checkpoint` | Owner only | Resolve a compact checkpoint decision. Body `{"action":"approve"|"reject","gen":<lease generation>}`; refuses stale generations with 409 and non-owner callers with 403 before mutating the plan. | `pkg/dashboard/api.go:82` |
-| `GET` | `/api/runs/{key}` | Dashboard auth/session | One run by URL-escaped canonical run key (`owner/repo%23number`); early lease-shaped keys (`repo!run-key:stage`) and queued Wavefront run-stage keys (`owner/repo!graph:node`) are also accepted. Includes timeline-derived stage history in the same `Run` shape as `/api/runs` when a lease/timeline exists. History entries that came from an owner reset carry the owner's `reason`. When the key belongs to a wired convergence campaign, the detail response also includes an optional `burndown` block with `source`, `satisfied`, `remaining`, `unknown`, and `scope`; the list endpoint omits this block. | `pkg/dashboard/api.go:83` |
-| `POST` | `/api/runs/{key}/reset` | Owner only | Move a run's lease back to an earlier stage (for example `implement` to `plan` after a rejected plan). Body `{"to": "<stage>", "reason": "<why>"}`, both required. Mints a new generation so the relay holding the old one can no longer resume, persists before answering, and records the reason on the agent audit sink, the lifecycle timeline, and the `stage_completed` hook payload (`attrs.reset = "true"`). Returns `{ok, key, stage_from, stage, gen, reason}`. 400 for the same or a later stage or a missing reason, 404 when no live staged lease holds the key, 409 when the lease expired, 500 when the registry could not be written. | `pkg/dashboard/api.go:84` |
-| `GET` | `/api/campaigns` | Dashboard auth/session | List resumable campaigns from archived Inception sessions and retained Spektacular (Spek) runs. Query `search`/`q`, `repo`, `stage`, `status`, and `owner`; each campaign is keyed by stable spec/session id and includes title, source, repos, current stage/step, artifact links, linked issues/PRs, contributors, last activity, status, engine, type, and run link when applicable. | `pkg/dashboard/api.go:85` |
-| `GET` | `/api/campaigns/{id}` | Dashboard auth/session | Return one campaign by URL-escaped stable campaign id or run key, using the same campaign shape as `/api/campaigns`. | `pkg/dashboard/api.go:86` |
-| `POST` | `/api/campaigns/{id}/resume` | Owner only | Resume or pick up a campaign. Archived Inception campaigns take a durable campaign lease, restore their saved state and wiki working files; Spek campaigns return the retained run detail plus a CLI status command that reloads state from Spek artifacts. Body may include `{ "surface": "chat"|"contributor"|"cli"|"dashboard" }`; 409 means another user holds the lease. | `pkg/dashboard/api.go:87` |
-| `POST` | `/api/campaigns/{id}/release` | Owner only | Release the caller's Inception campaign lease and write a `campaign_release` audit entry so another user can continue it. Run-backed Spektacular campaigns return `409 Conflict`; this endpoint never revokes their run-lifecycle stage leases. | `pkg/dashboard/api.go:88` |
-| `POST` | `/api/campaigns/{id}/revise` | Owner only | Create a linked revision campaign (`revision_of`, `revision`) for revisiting shipped or parked Inception/Spek work without overwriting the previous campaign. The new revision is leased to the caller and audit-logged as `campaign_revise`. | `pkg/dashboard/api.go:89` |
-| `GET` | `/api/campaigns/{id}/jam` | Dashboard auth/session | Return the per-campaign Jam workspace: section-anchored threads, comments, suggestions, polls, poll decisions, current spec revision and attributed revision history. | `pkg/dashboard/api.go:90` |
-| `POST` | `/api/campaigns/{id}/jam` | Read-write role | Record an attributed spec revision for a campaign. Body includes `spec_content`, optional `reason`, and optional agent/model attribution fields. | `pkg/dashboard/api.go:91` |
-| `GET` | `/api/campaigns/{id}/jam/threads` | Dashboard auth/session | List async Jam threads anchored to spec sections, including comments and author attribution. | `pkg/dashboard/api.go:92` |
-| `POST` | `/api/campaigns/{id}/jam/threads` | Read-write role | Create a section-anchored Jam thread or add a comment to an existing thread. Body includes `section` and `body`, or `thread_id` and `body`. | `pkg/dashboard/api.go:93` |
-| `POST` | `/api/campaigns/{id}/jam/agents` | Maintainer only | Invite Spektacular or a configured hive agent into a Jam thread. The agent reply is posted as an attributed thread comment and an open suggestion for human accept/reject; no spec revision is auto-applied. | `pkg/dashboard/api.go:94` |
-| `GET` | `/api/campaigns/{id}/jam/suggestions` | Dashboard auth/session | List Jam suggestions with open/accepted/rejected status, proposed text, attribution and applied revision id when accepted. | `pkg/dashboard/api.go:95` |
-| `POST` | `/api/campaigns/{id}/jam/suggestions` | Read-write role; maintainer for accept | Create a suggestion (`section`, `proposed_text`) or resolve it with `action: "accept"`/`"reject"` and `suggestion_id`. Accepting records a new attributed spec revision. | `pkg/dashboard/api.go:96` |
-| `GET` | `/api/campaigns/{id}/jam/polls` | Dashboard auth/session | List Jam polls, advisory vote tallies and maintainer decisions stored against spec revisions. | `pkg/dashboard/api.go:97` |
-| `POST` | `/api/campaigns/{id}/jam/polls` | Read-write role; maintainer for decide | Create polls (`section`, `question`, `options`), cast/update advisory votes (`action: "vote"`), or record a maintainer decision with rationale (`action: "decide"`). | `pkg/dashboard/api.go:98` |
-| `GET` | `/api/campaigns/{id}/jam/project-sync` | Dashboard auth/session | Return the campaign's GitHub Projects sync configuration, last published items, last status, and retry guidance for failures. | `pkg/dashboard/api.go:99` |
-| `POST` | `/api/campaigns/{id}/jam/project-sync` | Maintainer only | Enable/disable opt-in GitHub Projects sync, publish campaign specs/decisions/derived issues to the linked project, or record inbound project status updates without losing local Jam decisions. | `pkg/dashboard/api.go:100` |
-| `GET` | `/api/campaigns/{id}/jam/ws` | Dashboard auth/session | Upgrade to a Jam WebSocket for live participant presence, section focus, and conflict-aware spec co-edit messages. Live edits require read-write role and stale `base_revision_id` values are rejected with a conflict message. | `pkg/dashboard/api.go:101` |
-| `GET` | `/api/runs/{key}/trace` | Dashboard auth/session | Resolve `Hive-Run`, `Hive-Plan`, and `Hive-Spec` commit trailers for `?sha=...`, returning the linked plan section, spek clause, approval audit record, rationale audit entries, and typed no-linkage results when trailers are missing. | `pkg/dashboard/api.go:80` |
+| `GET` | `/api/runs` | Dashboard auth/session | Active staged runs projected from task leases, plans, and lifecycle timeline. Returns an array of `Run` objects: canonical `key` (`owner/repo#number`), current-stage `lease_key`, `title`, `repo` (`owner/repo`), `stage`, `gen`, `stage_started_at`, `waiting_on` (`agent`, `remote`, `human`, `ci`, `none`), `waiting_since`, `assignee`, `last_receipt`, `plan_epic_id`, and `stages[]` (`name`, `status`, `gen`, `receipt`). | `pkg/dashboard/api.go:78` |
+| `GET` | `/api/runs/audit` | Owner only | Read-only cross-repo audit query over existing retained artifacts. Query `repo`, canonical `run` (`owner/repo#number`), RFC3339 `since`/`until`, `kind`, `limit` (default 100, max 500), and `page_token`. Returns `{items,next_page_token,retention}`; each item has `source` (`audit_log`, `timeline`, `lease_receipt`, `plan_epic`), `kind`, `run`, `repo`, `at`, `actor`, `artifact_id`, `attrs`, or an explicit `kind=expired,status=expired,state=Unknown` marker when requested history may have aged out. | `pkg/dashboard/api.go:79` |
+| `POST` | `/api/runs/audit` | Owner only | Activate the convergence audit campaign over a scope directory. Body `{"campaign_key":"audit-campaign","scope_dir":"/data/convergence/audit/scope","store":"audit","generation":1,"run_key":"","run_url":""}`; `scope_dir` defaults to `/data/convergence/audit/scope`, `store` defaults to `audit`, `auditor`, `scanner`, `supervisor`, then the first configured bead store. Runs inspection even when `publication.enabled` is false, but then skips the publisher and returns `publication_skipped:true` with reason `publication.disabled`. | `pkg/dashboard/api.go:80` |
+| `GET` | `/api/runs/{key}/checkpoint` | Dashboard auth/session | Compact mobile/chat checkpoint review payload for a held run. Returns `run_key`, `stage`, lease `gen`, `repo`, `title`, capped plain-text `summary`, approve/reject `decisions`, dashboard deep link, `lease_gen` staleness fence, and verified-owner approver rule. | `pkg/dashboard/api.go:82` |
+| `POST` | `/api/runs/{key}/checkpoint` | Owner only | Resolve a compact checkpoint decision. Body `{"action":"approve"|"reject","gen":<lease generation>}`; refuses stale generations with 409 and non-owner callers with 403 before mutating the plan. | `pkg/dashboard/api.go:83` |
+| `GET` | `/api/runs/{key}` | Dashboard auth/session | One run by URL-escaped canonical run key (`owner/repo%23number`); early lease-shaped keys (`repo!run-key:stage`) and queued Wavefront run-stage keys (`owner/repo!graph:node`) are also accepted. Includes timeline-derived stage history in the same `Run` shape as `/api/runs` when a lease/timeline exists. History entries that came from an owner reset carry the owner's `reason`. When the key belongs to a wired convergence campaign, the detail response also includes an optional `burndown` block with `source`, `satisfied`, `remaining`, `unknown`, and `scope`; the list endpoint omits this block. | `pkg/dashboard/api.go:84` |
+| `POST` | `/api/runs/{key}/reset` | Owner only | Move a run's lease back to an earlier stage (for example `implement` to `plan` after a rejected plan). Body `{"to": "<stage>", "reason": "<why>"}`, both required. Mints a new generation so the relay holding the old one can no longer resume, persists before answering, and records the reason on the agent audit sink, the lifecycle timeline, and the `stage_completed` hook payload (`attrs.reset = "true"`). Returns `{ok, key, stage_from, stage, gen, reason}`. 400 for the same or a later stage or a missing reason, 404 when no live staged lease holds the key, 409 when the lease expired, 500 when the registry could not be written. | `pkg/dashboard/api.go:85` |
+| `GET` | `/api/campaigns` | Dashboard auth/session | List resumable campaigns from archived Inception sessions and retained Spektacular (Spek) runs. Query `search`/`q`, `repo`, `stage`, `status`, and `owner`; each campaign is keyed by stable spec/session id and includes title, source, repos, current stage/step, artifact links, linked issues/PRs, contributors, last activity, status, engine, type, and run link when applicable. | `pkg/dashboard/api.go:86` |
+| `GET` | `/api/campaigns/{id}` | Dashboard auth/session | Return one campaign by URL-escaped stable campaign id or run key, using the same campaign shape as `/api/campaigns`. | `pkg/dashboard/api.go:87` |
+| `POST` | `/api/campaigns/{id}/resume` | Owner only | Resume or pick up a campaign. Archived Inception campaigns take a durable campaign lease, restore their saved state and wiki working files; Spek campaigns return the retained run detail plus a CLI status command that reloads state from Spek artifacts. Body may include `{ "surface": "chat"|"contributor"|"cli"|"dashboard" }`; 409 means another user holds the lease. | `pkg/dashboard/api.go:88` |
+| `POST` | `/api/campaigns/{id}/release` | Owner only | Release the caller's Inception campaign lease and write a `campaign_release` audit entry so another user can continue it. Run-backed Spektacular campaigns return `409 Conflict`; this endpoint never revokes their run-lifecycle stage leases. | `pkg/dashboard/api.go:89` |
+| `POST` | `/api/campaigns/{id}/revise` | Owner only | Create a linked revision campaign (`revision_of`, `revision`) for revisiting shipped or parked Inception/Spek work without overwriting the previous campaign. The new revision is leased to the caller and audit-logged as `campaign_revise`. | `pkg/dashboard/api.go:90` |
+| `GET` | `/api/campaigns/{id}/jam` | Dashboard auth/session | Return the per-campaign Jam workspace: section-anchored threads, comments, suggestions, polls, poll decisions, current spec revision and attributed revision history. | `pkg/dashboard/api.go:91` |
+| `POST` | `/api/campaigns/{id}/jam` | Read-write role | Record an attributed spec revision for a campaign. Body includes `spec_content`, optional `reason`, and optional agent/model attribution fields. | `pkg/dashboard/api.go:92` |
+| `GET` | `/api/campaigns/{id}/jam/threads` | Dashboard auth/session | List async Jam threads anchored to spec sections, including comments and author attribution. | `pkg/dashboard/api.go:93` |
+| `POST` | `/api/campaigns/{id}/jam/threads` | Read-write role | Create a section-anchored Jam thread or add a comment to an existing thread. Body includes `section` and `body`, or `thread_id` and `body`. | `pkg/dashboard/api.go:94` |
+| `POST` | `/api/campaigns/{id}/jam/agents` | Maintainer only | Invite Spektacular or a configured hive agent into a Jam thread. The agent reply is posted as an attributed thread comment and an open suggestion for human accept/reject; no spec revision is auto-applied. | `pkg/dashboard/api.go:95` |
+| `GET` | `/api/campaigns/{id}/jam/suggestions` | Dashboard auth/session | List Jam suggestions with open/accepted/rejected status, proposed text, attribution and applied revision id when accepted. | `pkg/dashboard/api.go:96` |
+| `POST` | `/api/campaigns/{id}/jam/suggestions` | Read-write role; maintainer for accept | Create a suggestion (`section`, `proposed_text`) or resolve it with `action: "accept"`/`"reject"` and `suggestion_id`. Accepting records a new attributed spec revision. | `pkg/dashboard/api.go:97` |
+| `GET` | `/api/campaigns/{id}/jam/polls` | Dashboard auth/session | List Jam polls, advisory vote tallies and maintainer decisions stored against spec revisions. | `pkg/dashboard/api.go:98` |
+| `POST` | `/api/campaigns/{id}/jam/polls` | Read-write role; maintainer for decide | Create polls (`section`, `question`, `options`), cast/update advisory votes (`action: "vote"`), or record a maintainer decision with rationale (`action: "decide"`). | `pkg/dashboard/api.go:99` |
+| `GET` | `/api/campaigns/{id}/jam/project-sync` | Dashboard auth/session | Return the campaign's GitHub Projects sync configuration, last published items, last status, and retry guidance for failures. | `pkg/dashboard/api.go:100` |
+| `POST` | `/api/campaigns/{id}/jam/project-sync` | Maintainer only | Enable/disable opt-in GitHub Projects sync, publish campaign specs/decisions/derived issues to the linked project, or record inbound project status updates without losing local Jam decisions. | `pkg/dashboard/api.go:101` |
+| `GET` | `/api/campaigns/{id}/jam/ws` | Dashboard auth/session | Upgrade to a Jam WebSocket for live participant presence, section focus, and conflict-aware spec co-edit messages. Live edits require read-write role and stale `base_revision_id` values are rejected with a conflict message. | `pkg/dashboard/api.go:102` |
+| `GET` | `/api/runs/{key}/trace` | Dashboard auth/session | Resolve `Hive-Run`, `Hive-Plan`, and `Hive-Spec` commit trailers for `?sha=...`, returning the linked plan section, spek clause, approval audit record, rationale audit entries, and typed no-linkage results when trailers are missing. | `pkg/dashboard/api.go:81` |
 
 ## Snapshots and style
 
@@ -62,21 +62,21 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 |---|---|---|---|---|
 | `GET` | `/api/style` | Public | Sanitized custom dashboard CSS | `pkg/dashboard/api.go:37` |
 | `GET` | `/branding/custom.css` | Dashboard auth/session | Operator branding stylesheet override, read per request (see [branding](branding.md)) | `pkg/dashboard/server.go:1279` |
-| `GET` | `/api/snapshot/frame-ancestors` | Public | Snapshot framing allowlist | `pkg/dashboard/api.go:69` |
-| `GET` | `/api/snapshot` | Public | Snapshot data | `pkg/dashboard/api.go:70` |
-| `GET` | `/snapshot` | Public | Public read-only snapshot page | `pkg/dashboard/api.go:71` |
+| `GET` | `/api/snapshot/frame-ancestors` | Public | Snapshot framing allowlist | `pkg/dashboard/api.go:70` |
+| `GET` | `/api/snapshot` | Public | Snapshot data | `pkg/dashboard/api.go:71` |
+| `GET` | `/snapshot` | Public | Public read-only snapshot page | `pkg/dashboard/api.go:72` |
 
 ## Auth and external accounts
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/gh-auth` | Dashboard auth/session | GitHub Auth | `pkg/dashboard/api.go:157` |
-| `GET` | `/api/gh-rate-limits` | Dashboard auth/session | GitHub Rate Limits | `pkg/dashboard/api.go:158` |
-| `GET` | `/api/gh-user-auth/status` | Public | GitHub User Auth Status | `pkg/dashboard/api.go:159` |
-| `POST` | `/api/gh-user-auth/start` | Public | GitHub User Auth Start | `pkg/dashboard/api.go:160` |
-| `POST` | `/api/gh-user-auth/poll` | Public | GitHub User Auth Poll | `pkg/dashboard/api.go:161` |
-| `POST` | `/api/gh-user-auth/logout` | Public | GitHub User Auth Logout | `pkg/dashboard/api.go:162` |
-| `GET` | `/api/gh-user-auth/session` | Public | GitHub User Auth Session | `pkg/dashboard/api.go:163` |
+| `GET` | `/api/gh-auth` | Dashboard auth/session | GitHub Auth | `pkg/dashboard/api.go:158` |
+| `GET` | `/api/gh-rate-limits` | Dashboard auth/session | GitHub Rate Limits | `pkg/dashboard/api.go:159` |
+| `GET` | `/api/gh-user-auth/status` | Public | GitHub User Auth Status | `pkg/dashboard/api.go:160` |
+| `POST` | `/api/gh-user-auth/start` | Public | GitHub User Auth Start | `pkg/dashboard/api.go:161` |
+| `POST` | `/api/gh-user-auth/poll` | Public | GitHub User Auth Poll | `pkg/dashboard/api.go:162` |
+| `POST` | `/api/gh-user-auth/logout` | Public | GitHub User Auth Logout | `pkg/dashboard/api.go:163` |
+| `GET` | `/api/gh-user-auth/session` | Public | GitHub User Auth Session | `pkg/dashboard/api.go:164` |
 | `GET` | `/api/claude-auth/status` | Dashboard auth/session | Claude Auth Status | `pkg/dashboard/claude_auth.go:54` |
 | `POST` | `/api/claude-auth/start` | Dashboard auth/session | Claude Auth Start | `pkg/dashboard/claude_auth.go:55` |
 | `POST` | `/api/claude-auth/exchange` | Dashboard auth/session | Claude Auth Exchange | `pkg/dashboard/claude_auth.go:56` |
@@ -110,122 +110,122 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 | `PUT` | `/api/config/variables/{name}` | Owner only | Variable Upsert | `pkg/dashboard/api.go:49` |
 | `DELETE` | `/api/config/variables/{name}` | Owner only | Variable Delete | `pkg/dashboard/api.go:50` |
 
-| `GET` | `/api/config/agent/{name}` | Dashboard auth/session | Agent Config Get | `pkg/dashboard/api.go:170` |
-| `PUT` | `/api/config/agent/{name}/general` | Owner only | Agent Config General | `pkg/dashboard/api.go:171` |
-| `PUT` | `/api/config/agent/{name}/cadences` | Owner only | Agent Config Cadences | `pkg/dashboard/api.go:172` |
-| `PUT` | `/api/config/agent/{name}/models` | Owner only | Agent Config Models | `pkg/dashboard/api.go:173` |
-| `PUT` | `/api/config/agent/{name}/pipeline` | Owner only | Agent Config Pipeline | `pkg/dashboard/api.go:174` |
-| `PUT` | `/api/config/agent/{name}/hooks` | Owner only | Agent Config Hooks | `pkg/dashboard/api.go:175` |
-| `PUT` | `/api/config/agent/{name}/restrictions` | Owner only | Agent Config Restrictions | `pkg/dashboard/api.go:176` |
-| `PUT` | `/api/config/agent/{name}/stats` | Owner only | Agent Config Stats | `pkg/dashboard/api.go:177` |
-| `GET` | `/api/config/agent/{name}/prompt` | Dashboard auth/session | Agent Prompt | `pkg/dashboard/api.go:178` |
-| `PUT` | `/api/config/agent/{name}/prompt` | Owner only | Agent Prompt Save | `pkg/dashboard/api.go:179` |
-| `GET` | `/api/config/agent/{name}/export` | Dashboard auth/session | Agent Export | `pkg/dashboard/api.go:180` |
-| `PUT` | `/api/config/agent/{name}/channels` | Owner only | Agent Config Channels | `pkg/dashboard/api.go:181` |
-| `PUT` | `/api/config/agent/{name}/tools` | Owner only | Agent Config Tools | `pkg/dashboard/api.go:182` |
-| `PUT` | `/api/config/agent/{name}/connections` | Owner only | Agent Config Connections | `pkg/dashboard/api.go:183` |
-| `GET` | `/api/config/stat-sources` | Dashboard auth/session | Stat Sources | `pkg/dashboard/api.go:184` |
-| `GET` | `/api/config/governor` | Dashboard auth/session | Governor Config Get | `pkg/dashboard/api.go:186` |
-| `PUT` | `/api/config/governor/sensing` | Owner only | Governor Sensing | `pkg/dashboard/api.go:187` |
-| `PUT` | `/api/config/governor/thresholds` | Owner only | Governor Thresholds | `pkg/dashboard/api.go:188` |
-| `PUT` | `/api/config/governor/labels` | Owner only | Governor Labels | `pkg/dashboard/api.go:193` |
-| `PUT` | `/api/config/governor/budget` | Owner only | Governor Budget | `pkg/dashboard/api.go:194` |
-| `PUT` | `/api/config/governor/notifications` | Owner only | Governor Notifications | `pkg/dashboard/api.go:198` |
-| `PUT` | `/api/config/governor/health` | Owner only | Governor Health | `pkg/dashboard/api.go:199` |
-| `PUT` | `/api/config/governor/logging` | Owner only | Governor Logging | `pkg/dashboard/api.go:211` |
-| `PUT` | `/api/config/governor/attribution` | Owner only | Governor Attribution | `pkg/dashboard/api.go:212` |
-| `PUT` | `/api/config/governor/hub` | Owner only | Governor Hub | `pkg/dashboard/api.go:213` |
-| `PUT` | `/api/config/governor/litellm` | Owner only | Governor Lite LLM | `pkg/dashboard/api.go:214` |
-| `PUT` | `/api/config/governor/trajectory` | Owner only | Governor Trajectory | `pkg/dashboard/api.go:215` |
+| `GET` | `/api/config/agent/{name}` | Dashboard auth/session | Agent Config Get | `pkg/dashboard/api.go:171` |
+| `PUT` | `/api/config/agent/{name}/general` | Owner only | Agent Config General | `pkg/dashboard/api.go:172` |
+| `PUT` | `/api/config/agent/{name}/cadences` | Owner only | Agent Config Cadences | `pkg/dashboard/api.go:173` |
+| `PUT` | `/api/config/agent/{name}/models` | Owner only | Agent Config Models | `pkg/dashboard/api.go:174` |
+| `PUT` | `/api/config/agent/{name}/pipeline` | Owner only | Agent Config Pipeline | `pkg/dashboard/api.go:175` |
+| `PUT` | `/api/config/agent/{name}/hooks` | Owner only | Agent Config Hooks | `pkg/dashboard/api.go:176` |
+| `PUT` | `/api/config/agent/{name}/restrictions` | Owner only | Agent Config Restrictions | `pkg/dashboard/api.go:177` |
+| `PUT` | `/api/config/agent/{name}/stats` | Owner only | Agent Config Stats | `pkg/dashboard/api.go:178` |
+| `GET` | `/api/config/agent/{name}/prompt` | Dashboard auth/session | Agent Prompt | `pkg/dashboard/api.go:179` |
+| `PUT` | `/api/config/agent/{name}/prompt` | Owner only | Agent Prompt Save | `pkg/dashboard/api.go:180` |
+| `GET` | `/api/config/agent/{name}/export` | Dashboard auth/session | Agent Export | `pkg/dashboard/api.go:181` |
+| `PUT` | `/api/config/agent/{name}/channels` | Owner only | Agent Config Channels | `pkg/dashboard/api.go:182` |
+| `PUT` | `/api/config/agent/{name}/tools` | Owner only | Agent Config Tools | `pkg/dashboard/api.go:183` |
+| `PUT` | `/api/config/agent/{name}/connections` | Owner only | Agent Config Connections | `pkg/dashboard/api.go:184` |
+| `GET` | `/api/config/stat-sources` | Dashboard auth/session | Stat Sources | `pkg/dashboard/api.go:185` |
+| `GET` | `/api/config/governor` | Dashboard auth/session | Governor Config Get | `pkg/dashboard/api.go:187` |
+| `PUT` | `/api/config/governor/sensing` | Owner only | Governor Sensing | `pkg/dashboard/api.go:188` |
+| `PUT` | `/api/config/governor/thresholds` | Owner only | Governor Thresholds | `pkg/dashboard/api.go:189` |
+| `PUT` | `/api/config/governor/labels` | Owner only | Governor Labels | `pkg/dashboard/api.go:194` |
+| `PUT` | `/api/config/governor/budget` | Owner only | Governor Budget | `pkg/dashboard/api.go:195` |
+| `PUT` | `/api/config/governor/notifications` | Owner only | Governor Notifications | `pkg/dashboard/api.go:199` |
+| `PUT` | `/api/config/governor/health` | Owner only | Governor Health | `pkg/dashboard/api.go:200` |
+| `PUT` | `/api/config/governor/logging` | Owner only | Governor Logging | `pkg/dashboard/api.go:212` |
+| `PUT` | `/api/config/governor/attribution` | Owner only | Governor Attribution | `pkg/dashboard/api.go:213` |
+| `PUT` | `/api/config/governor/hub` | Owner only | Governor Hub | `pkg/dashboard/api.go:214` |
+| `PUT` | `/api/config/governor/litellm` | Owner only | Governor Lite LLM | `pkg/dashboard/api.go:215` |
+| `PUT` | `/api/config/governor/trajectory` | Owner only | Governor Trajectory | `pkg/dashboard/api.go:216` |
 | `GET` | `/api/config/governor/backup` | Owner only | Backup Key Status (presence + safe source label; never the key value) | `pkg/dashboard/backup_key.go` |
 | `PUT` | `/api/config/governor/backup` | Owner only | Backup Key Set (64-hex AES-256 key; stored 0600, path-only in `hive.yaml`) | `pkg/dashboard/backup_key.go` |
 | `DELETE` | `/api/config/governor/backup` | Owner only | Backup Key Clear (backups are refused again) | `pkg/dashboard/backup_key.go` |
-| `GET` | `/api/config/governor/bob` | Dashboard auth/session | Governor Bob Status | `pkg/dashboard/api.go:254` |
-| `PUT` | `/api/config/governor/bob` | Owner only | Governor Bob Key | `pkg/dashboard/api.go:255` |
-| `DELETE` | `/api/config/governor/bob` | Owner only | Governor Bob Key Clear | `pkg/dashboard/api.go:256` |
-
-| `GET` | `/api/config/governor/cadence-scope` | Owner only | Governor Cadence Scope Get (`aggregate` or `per_repo`) | `pkg/dashboard/api.go:189` |
-| `PUT` | `/api/config/governor/cadence-scope` | Owner only | Governor Cadence Scope Set (`cadenceScope`/`cadence_scope`: `aggregate`, `per_repo`, or empty for default) | `pkg/dashboard/api.go:190` |
-| `POST` | `/api/config/governor/bob/test` | Dashboard auth/session | Governor Bob Key Test | `pkg/dashboard/api.go:258` |
-| `POST` | `/api/config/governor/litellm/test` | Dashboard auth/session | Governor Lite LLMTest | `pkg/dashboard/api.go:259` |
-| `GET` | `/api/config/governor/gateways` | Dashboard auth/session | Governor Gateways List | `pkg/dashboard/api.go:262` |
-| `PUT` | `/api/config/governor/gateways` | Owner only | Governor Gateways Upsert | `pkg/dashboard/api.go:263` |
-| `DELETE` | `/api/config/governor/gateways/{name}` | Owner only | Governor Gateways Delete | `pkg/dashboard/api.go:264` |
-| `POST` | `/api/config/governor/gateways/{name}/test` | Dashboard auth/session | Governor Gateways Test | `pkg/dashboard/api.go:265` |
-| `POST` | `/api/config/governor/gateways/discover` | Owner only | Governor Gateways Discover | `pkg/dashboard/api.go:266` |
-| `POST` | `/api/config/governor/agents` | Owner only | Governor Add Agent | `pkg/dashboard/api.go:270` |
-| `DELETE` | `/api/config/governor/agents/{name}` | Owner only | Governor Remove Agent | `pkg/dashboard/api.go:271` |
-| `PUT` | `/api/config/governor/repos` | Owner only | Governor Repos | `pkg/dashboard/api.go:272` |
-| `POST` | `/api/config/governor/repos/check-access` | Dashboard auth/session | Governor Repo Check Access | `pkg/dashboard/api.go:276` |
-| `PUT` | `/api/config/github` | Owner only | Config GitHub | `pkg/dashboard/api.go:277` |
-| `GET` | `/api/config/github/forge-apps` | Dashboard auth/session | Config GitHub Forge Apps | `pkg/dashboard/api.go:280` |
-| `GET` | `/api/config/sidebar` | Dashboard auth/session | Sidebar Get | `pkg/dashboard/api.go:313` |
-| `PUT` | `/api/config/sidebar` | Dashboard auth/session | Sidebar Set | `pkg/dashboard/api.go:314` |
-| `GET` | `/api/config/backends` | Dashboard auth/session | Backends | `pkg/dashboard/api.go:315` |
-
-| `GET` | `/api/config/governor/threshold-scaling` | Owner only | Governor Threshold Scaling Get | `pkg/dashboard/api.go:191` |
-| `PUT` | `/api/config/governor/threshold-scaling` | Owner only | Governor Threshold Scaling Set | `pkg/dashboard/api.go:192` |
-| `POST` | `/api/config/governor/budget/reset` | Owner only | Governor Budget Reset | `pkg/dashboard/api.go:195` |
-| `PUT` | `/api/config/governor/watchdog` | Owner only | Governor Watchdog | `pkg/dashboard/api.go:200` |
-| `GET` | `/api/config/escalation` | Owner only | Escalation Config Get | `pkg/dashboard/api.go:203` |
-| `PUT` | `/api/config/escalation` | Owner only | Escalation Config Set | `pkg/dashboard/api.go:204` |
-| `GET` | `/api/config/write-surface` | Owner only | Lane write allowlist (`write_surface.allowlist`, [#9587](https://github.com/hivecommons/hive/issues/9587)): `allowlist`, `ops`, `warnings` | `pkg/dashboard/api.go:433` |
-| `PUT` | `/api/config/write-surface` | Owner only | Replace the lane write allowlist; `{"allowlist": {}}` clears it; unknown operation or bad lane name is a 400 with nothing changed | `pkg/dashboard/api.go:434` |
-| `GET` | `/api/config/review` | Dashboard auth/session | Review Config Get | `pkg/dashboard/api.go:207` |
-| `PUT` | `/api/config/review` | Owner only | Review Config Set | `pkg/dashboard/api.go:210` |
-| `PUT` | `/api/config/governor/features` | Owner only | Governor Features | `pkg/dashboard/api.go:216` |
-| `GET` | `/api/config/governor/general-advanced` | Owner only | Governor General Advanced Get | `pkg/dashboard/api.go:217` |
-| `PUT` | `/api/config/governor/general-advanced` | Owner only | Governor General Advanced Set | `pkg/dashboard/api.go:218` |
-| `GET` | `/api/config/auto-merge` | Owner only | Auto-Merge Config Get | `pkg/dashboard/api.go:222` |
-| `PUT` | `/api/config/auto-merge` | Owner only | Auto-Merge Config Set | `pkg/dashboard/api.go:223` |
-| `GET` | `/api/config/convergence` | Owner only | Convergence Config Get | `pkg/dashboard/api.go:228` |
-| `PUT` | `/api/config/convergence` | Owner only | Convergence Config Set | `pkg/dashboard/api.go:229` |
-| `GET` | `/api/config/governor/advisory` | Owner only | Governor Advisory Get | `pkg/dashboard/api.go:231` |
-| `PUT` | `/api/config/governor/advisory` | Owner only | Governor Advisory Set | `pkg/dashboard/api.go:232` |
-| `GET` | `/api/config/governor/replan` | Owner only | Governor Replan Get | `pkg/dashboard/api.go:233` |
-| `PUT` | `/api/config/governor/replan` | Owner only | Governor Replan Set | `pkg/dashboard/api.go:234` |
-| `GET` | `/api/config/governor/work-source` | Owner only | Governor Work Source Get (Jira secrets/TLS fields reported as set/unset only) | `pkg/dashboard/api.go:241` |
-| `PUT` | `/api/config/governor/work-source` | Owner only | Governor Work Source Set (including Jira Data Center TLS settings) | `pkg/dashboard/api.go:242` |
-| `PUT` | `/api/config/governor/security` | Owner only | Governor Security | `pkg/dashboard/api.go:243` |
-| `GET` | `/api/config/governor/project-observability` | Owner only | Governor Project Observability Get | `pkg/dashboard/api.go:244` |
-| `PUT` | `/api/config/governor/project-observability` | Owner only | Governor Project Observability Set | `pkg/dashboard/api.go:245` |
-| `GET` | `/api/config/governor/inference-auth` | Owner only | Governor Inference Auth Get | `pkg/dashboard/api.go:260` |
-| `PUT` | `/api/config/governor/inference-auth` | Owner only | Governor Inference Auth Set | `pkg/dashboard/api.go:261` |
+| `GET` | `/api/config/governor/bob` | Dashboard auth/session | Governor Bob Status | `pkg/dashboard/api.go:255` |
+| `PUT` | `/api/config/governor/bob` | Owner only | Governor Bob Key | `pkg/dashboard/api.go:256` |
+| `DELETE` | `/api/config/governor/bob` | Owner only | Governor Bob Key Clear | `pkg/dashboard/api.go:257` |
+
+| `GET` | `/api/config/governor/cadence-scope` | Owner only | Governor Cadence Scope Get (`aggregate` or `per_repo`) | `pkg/dashboard/api.go:190` |
+| `PUT` | `/api/config/governor/cadence-scope` | Owner only | Governor Cadence Scope Set (`cadenceScope`/`cadence_scope`: `aggregate`, `per_repo`, or empty for default) | `pkg/dashboard/api.go:191` |
+| `POST` | `/api/config/governor/bob/test` | Dashboard auth/session | Governor Bob Key Test | `pkg/dashboard/api.go:259` |
+| `POST` | `/api/config/governor/litellm/test` | Dashboard auth/session | Governor Lite LLMTest | `pkg/dashboard/api.go:260` |
+| `GET` | `/api/config/governor/gateways` | Dashboard auth/session | Governor Gateways List | `pkg/dashboard/api.go:263` |
+| `PUT` | `/api/config/governor/gateways` | Owner only | Governor Gateways Upsert | `pkg/dashboard/api.go:264` |
+| `DELETE` | `/api/config/governor/gateways/{name}` | Owner only | Governor Gateways Delete | `pkg/dashboard/api.go:265` |
+| `POST` | `/api/config/governor/gateways/{name}/test` | Dashboard auth/session | Governor Gateways Test | `pkg/dashboard/api.go:266` |
+| `POST` | `/api/config/governor/gateways/discover` | Owner only | Governor Gateways Discover | `pkg/dashboard/api.go:267` |
+| `POST` | `/api/config/governor/agents` | Owner only | Governor Add Agent | `pkg/dashboard/api.go:271` |
+| `DELETE` | `/api/config/governor/agents/{name}` | Owner only | Governor Remove Agent | `pkg/dashboard/api.go:272` |
+| `PUT` | `/api/config/governor/repos` | Owner only | Governor Repos | `pkg/dashboard/api.go:273` |
+| `POST` | `/api/config/governor/repos/check-access` | Dashboard auth/session | Governor Repo Check Access | `pkg/dashboard/api.go:277` |
+| `PUT` | `/api/config/github` | Owner only | Config GitHub | `pkg/dashboard/api.go:278` |
+| `GET` | `/api/config/github/forge-apps` | Dashboard auth/session | Config GitHub Forge Apps | `pkg/dashboard/api.go:281` |
+| `GET` | `/api/config/sidebar` | Dashboard auth/session | Sidebar Get | `pkg/dashboard/api.go:314` |
+| `PUT` | `/api/config/sidebar` | Dashboard auth/session | Sidebar Set | `pkg/dashboard/api.go:315` |
+| `GET` | `/api/config/backends` | Dashboard auth/session | Backends | `pkg/dashboard/api.go:316` |
+
+| `GET` | `/api/config/governor/threshold-scaling` | Owner only | Governor Threshold Scaling Get | `pkg/dashboard/api.go:192` |
+| `PUT` | `/api/config/governor/threshold-scaling` | Owner only | Governor Threshold Scaling Set | `pkg/dashboard/api.go:193` |
+| `POST` | `/api/config/governor/budget/reset` | Owner only | Governor Budget Reset | `pkg/dashboard/api.go:196` |
+| `PUT` | `/api/config/governor/watchdog` | Owner only | Governor Watchdog | `pkg/dashboard/api.go:201` |
+| `GET` | `/api/config/escalation` | Owner only | Escalation Config Get | `pkg/dashboard/api.go:204` |
+| `PUT` | `/api/config/escalation` | Owner only | Escalation Config Set | `pkg/dashboard/api.go:205` |
+| `GET` | `/api/config/write-surface` | Owner only | Lane write allowlist (`write_surface.allowlist`, [#9587](https://github.com/hivecommons/hive/issues/9587)): `allowlist`, `ops`, `warnings` | `pkg/dashboard/api.go:438` |
+| `PUT` | `/api/config/write-surface` | Owner only | Replace the lane write allowlist; `{"allowlist": {}}` clears it; unknown operation or bad lane name is a 400 with nothing changed | `pkg/dashboard/api.go:439` |
+| `GET` | `/api/config/review` | Dashboard auth/session | Review Config Get | `pkg/dashboard/api.go:208` |
+| `PUT` | `/api/config/review` | Owner only | Review Config Set | `pkg/dashboard/api.go:211` |
+| `PUT` | `/api/config/governor/features` | Owner only | Governor Features | `pkg/dashboard/api.go:217` |
+| `GET` | `/api/config/governor/general-advanced` | Owner only | Governor General Advanced Get | `pkg/dashboard/api.go:218` |
+| `PUT` | `/api/config/governor/general-advanced` | Owner only | Governor General Advanced Set | `pkg/dashboard/api.go:219` |
+| `GET` | `/api/config/auto-merge` | Owner only | Auto-Merge Config Get | `pkg/dashboard/api.go:223` |
+| `PUT` | `/api/config/auto-merge` | Owner only | Auto-Merge Config Set | `pkg/dashboard/api.go:224` |
+| `GET` | `/api/config/convergence` | Owner only | Convergence Config Get | `pkg/dashboard/api.go:229` |
+| `PUT` | `/api/config/convergence` | Owner only | Convergence Config Set | `pkg/dashboard/api.go:230` |
+| `GET` | `/api/config/governor/advisory` | Owner only | Governor Advisory Get | `pkg/dashboard/api.go:232` |
+| `PUT` | `/api/config/governor/advisory` | Owner only | Governor Advisory Set | `pkg/dashboard/api.go:233` |
+| `GET` | `/api/config/governor/replan` | Owner only | Governor Replan Get | `pkg/dashboard/api.go:234` |
+| `PUT` | `/api/config/governor/replan` | Owner only | Governor Replan Set | `pkg/dashboard/api.go:235` |
+| `GET` | `/api/config/governor/work-source` | Owner only | Governor Work Source Get (Jira secrets/TLS fields reported as set/unset only) | `pkg/dashboard/api.go:242` |
+| `PUT` | `/api/config/governor/work-source` | Owner only | Governor Work Source Set (including Jira Data Center TLS settings) | `pkg/dashboard/api.go:243` |
+| `PUT` | `/api/config/governor/security` | Owner only | Governor Security | `pkg/dashboard/api.go:244` |
+| `GET` | `/api/config/governor/project-observability` | Owner only | Governor Project Observability Get | `pkg/dashboard/api.go:245` |
+| `PUT` | `/api/config/governor/project-observability` | Owner only | Governor Project Observability Set | `pkg/dashboard/api.go:246` |
+| `GET` | `/api/config/governor/inference-auth` | Owner only | Governor Inference Auth Get | `pkg/dashboard/api.go:261` |
+| `PUT` | `/api/config/governor/inference-auth` | Owner only | Governor Inference Auth Set | `pkg/dashboard/api.go:262` |
 
 ## Agents and controls
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
 
-| `POST` | `/api/kick/{agent}` | Owner only | Kick — asynchronous; answers `202` once queued (see below) | `pkg/dashboard/api.go:119` |
-| `GET` | `/api/kick/{agent}/status` | Dashboard auth/session | Outcome of the most recent kick | `pkg/dashboard/api.go:123` |
-| `POST` | `/api/switch/{agent}/{backend}` | Owner only | Switch | `pkg/dashboard/api.go:124` |
-| `POST` | `/api/model/{agent}/{model}` | Owner only | Model Set | `pkg/dashboard/api.go:125` |
-| `POST` | `/api/effort/{agent}/{effort}` | Owner only | Set launch-only reasoning effort after validating against the agent's live backend (including runtime override); persists config/agent overlay, restarts the session, and `default` clears the stored effort | `pkg/dashboard/api.go:126` |
-| `POST` | `/api/pause/{agent}` | Owner only | Pause | `pkg/dashboard/api.go:127` |
-| `POST` | `/api/resume/{agent}` | Owner only | Resume | `pkg/dashboard/api.go:128` |
-| `GET` | `/api/agent-state/{agent}` | Dashboard auth/session | Agent State | `pkg/dashboard/api.go:129` |
-| `GET` | `/api/breaker` | Dashboard auth/session | Breaker State | `pkg/dashboard/api.go:130` |
-| `POST` | `/api/breaker/engage` | Owner only | Breaker Engage | `pkg/dashboard/api.go:131` |
-| `POST` | `/api/breaker/release` | Owner only | Breaker Release | `pkg/dashboard/api.go:132` |
-| `POST` | `/api/pin/{agent}/{dimension}` | Owner only | Pin | `pkg/dashboard/api.go:133` |
-| `POST` | `/api/unpin/{agent}/{dimension}` | Owner only | Unpin | `pkg/dashboard/api.go:134` |
-| `POST` | `/api/restart/{agent}` | Owner only | Restart | `pkg/dashboard/api.go:138` |
-| `GET` | `/api/model-advisor` | Dashboard auth/session | Model Advisor | `pkg/dashboard/api.go:152` |
-| `GET` | `/api/governor/pr-models` | Dashboard auth/session | Agent-authored PR distribution by normalized attribution model/backend for `window=7d`, `30d`, or `all`, including per-model rework stats and the top 10 most-reworked PRs | `pkg/dashboard/api.go:153` |
-| `GET` | `/api/reviewer/accuracy` | Dashboard auth/session | Reviewer verdict calibration for the configured window: false-approve/false-block rates and confidence buckets per perspective and reviewer model | `pkg/dashboard/api.go:209` |
-| `GET` | `/api/review/queue` | Dashboard auth/session | PR review queue: every open PR (agent and contributor, actionable and held) ranked by triage class, confidence band, CI state and age, with per-PR `reasons`; paged with `limit` (1-200, default 50) and `offset` | `pkg/dashboard/api.go:430` |
-| `GET` | `/api/agents` | Dashboard auth/session | Agents List | `pkg/dashboard/api.go:282` |
-| `POST` | `/api/agents` | Owner only | Agent Create | `pkg/dashboard/api.go:283` |
-| `POST` | `/api/agents/import` | Owner only | Agent Import | `pkg/dashboard/api.go:284` |
-| `DELETE` | `/api/agents/{name}` | Owner only | Agent Delete | `pkg/dashboard/api.go:285` |
-
-| `GET` | `/api/agents/{name}/log` | Dashboard auth/session | Agent Full Log | `pkg/dashboard/api.go:106` |
-| `GET` | `/api/agents/{name}/terminal-urls` | Dashboard auth/session | Agent Terminal URLs | `pkg/dashboard/api.go:110` |
-| `GET` | `/api/agents/{name}/kicks` | Dashboard auth/session | Agent Kick Log List | `pkg/dashboard/api.go:113` |
-| `GET` | `/api/agents/{name}/kicks/{id}` | Dashboard auth/session | Agent Kick Log Get | `pkg/dashboard/api.go:114` |
-| `GET` | `/agents/{name}/kicks` | Dashboard auth/session | Agent Kick History Page (HTML) | `pkg/dashboard/api.go:115` |
-| `POST` | `/api/agents/{name}/login-code` | Owner only | Agent Login Code | `pkg/dashboard/api.go:137` |
+| `POST` | `/api/kick/{agent}` | Owner only | Kick — asynchronous; answers `202` once queued (see below) | `pkg/dashboard/api.go:120` |
+| `GET` | `/api/kick/{agent}/status` | Dashboard auth/session | Outcome of the most recent kick | `pkg/dashboard/api.go:124` |
+| `POST` | `/api/switch/{agent}/{backend}` | Owner only | Switch | `pkg/dashboard/api.go:125` |
+| `POST` | `/api/model/{agent}/{model}` | Owner only | Model Set | `pkg/dashboard/api.go:126` |
+| `POST` | `/api/effort/{agent}/{effort}` | Owner only | Set launch-only reasoning effort after validating against the agent's live backend (including runtime override); persists config/agent overlay, restarts the session, and `default` clears the stored effort | `pkg/dashboard/api.go:127` |
+| `POST` | `/api/pause/{agent}` | Owner only | Pause | `pkg/dashboard/api.go:128` |
+| `POST` | `/api/resume/{agent}` | Owner only | Resume | `pkg/dashboard/api.go:129` |
+| `GET` | `/api/agent-state/{agent}` | Dashboard auth/session | Agent State | `pkg/dashboard/api.go:130` |
+| `GET` | `/api/breaker` | Dashboard auth/session | Breaker State | `pkg/dashboard/api.go:131` |
+| `POST` | `/api/breaker/engage` | Owner only | Breaker Engage | `pkg/dashboard/api.go:132` |
+| `POST` | `/api/breaker/release` | Owner only | Breaker Release | `pkg/dashboard/api.go:133` |
+| `POST` | `/api/pin/{agent}/{dimension}` | Owner only | Pin | `pkg/dashboard/api.go:134` |
+| `POST` | `/api/unpin/{agent}/{dimension}` | Owner only | Unpin | `pkg/dashboard/api.go:135` |
+| `POST` | `/api/restart/{agent}` | Owner only | Restart | `pkg/dashboard/api.go:139` |
+| `GET` | `/api/model-advisor` | Dashboard auth/session | Model Advisor | `pkg/dashboard/api.go:153` |
+| `GET` | `/api/governor/pr-models` | Dashboard auth/session | Agent-authored PR distribution by normalized attribution model/backend for `window=7d`, `30d`, or `all`, including per-model rework stats and the top 10 most-reworked PRs | `pkg/dashboard/api.go:154` |
+| `GET` | `/api/reviewer/accuracy` | Dashboard auth/session | Reviewer verdict calibration for the configured window: false-approve/false-block rates and confidence buckets per perspective and reviewer model | `pkg/dashboard/api.go:210` |
+| `GET` | `/api/review/queue` | Dashboard auth/session | PR review queue: every open PR (agent and contributor, actionable and held) ranked by triage class, confidence band, CI state and age, with per-PR `reasons`; paged with `limit` (1-200, default 50) and `offset` | `pkg/dashboard/api.go:435` |
+| `GET` | `/api/agents` | Dashboard auth/session | Agents List | `pkg/dashboard/api.go:283` |
+| `POST` | `/api/agents` | Owner only | Agent Create | `pkg/dashboard/api.go:284` |
+| `POST` | `/api/agents/import` | Owner only | Agent Import | `pkg/dashboard/api.go:285` |
+| `DELETE` | `/api/agents/{name}` | Owner only | Agent Delete | `pkg/dashboard/api.go:286` |
+
+| `GET` | `/api/agents/{name}/log` | Dashboard auth/session | Agent Full Log | `pkg/dashboard/api.go:107` |
+| `GET` | `/api/agents/{name}/terminal-urls` | Dashboard auth/session | Agent Terminal URLs | `pkg/dashboard/api.go:111` |
+| `GET` | `/api/agents/{name}/kicks` | Dashboard auth/session | Agent Kick Log List | `pkg/dashboard/api.go:114` |
+| `GET` | `/api/agents/{name}/kicks/{id}` | Dashboard auth/session | Agent Kick Log Get | `pkg/dashboard/api.go:115` |
+| `GET` | `/agents/{name}/kicks` | Dashboard auth/session | Agent Kick History Page (HTML) | `pkg/dashboard/api.go:116` |
+| `POST` | `/api/agents/{name}/login-code` | Owner only | Agent Login Code | `pkg/dashboard/api.go:138` |
 
 ### Kick is asynchronous
 
@@ -246,80 +246,81 @@ Read the result from `GET /api/kick/{agent}/status`, which returns `status` of `
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/packs` | Dashboard auth/session | Packs List | `pkg/dashboard/api.go:287` |
-| `POST` | `/api/packs/{level}/apply` | Owner only | Pack Apply | `pkg/dashboard/api.go:288` |
-| `PUT` | `/api/packs/level` | Owner only | Set the ACMM level. Body `{"level": N}` persists and applies the pack; optional `{"release_level_holds": true}` performs a deliberate one-off release of Hive App level-applied `hold` labels for the transition. Level holds are otherwise never auto-released. When the change makes the L6 self-authored merge sweep eligible, the success body adds `self_merge_sweep_active`, `level_changed_at`, `level_holds_pending: [{repo, number, title, url, agent}]`, and `repos: [{repo, auto_merge}]` so the dashboard can show the owner an informational notice and repo toggles. | `pkg/dashboard/api.go:289` |
+| `GET` | `/api/packs` | Dashboard auth/session | Packs List | `pkg/dashboard/api.go:288` |
+| `POST` | `/api/packs/{level}/apply` | Owner only | Pack Apply | `pkg/dashboard/api.go:289` |
+| `PUT` | `/api/packs/level` | Owner only | Set the ACMM level. Body `{"level": N}` persists and applies the pack; optional `{"release_level_holds": true}` performs a deliberate one-off release of Hive App level-applied `hold` labels for the transition. Level holds are otherwise never auto-released. When the change makes the L6 self-authored merge sweep eligible, the success body adds `self_merge_sweep_active`, `level_changed_at`, `level_holds_pending: [{repo, number, title, url, agent}]`, and `repos: [{repo, auto_merge}]` so the dashboard can show the owner an informational notice and repo toggles. | `pkg/dashboard/api.go:290` |
 | `POST` | `/api/repos/rescan` | Dashboard auth/session | Re-enumerate watched repositories' open issues/PRs for the dashboard Projects cards. The scan is read-only with respect to agents/governor actions, collapses concurrent requests, and debounces repeated presses for 30 seconds (`repoRescanDebounce`) so the button cannot hammer GitHub | `pkg/dashboard/api.go`, `pkg/dashboard/api_repos_rescan.go` |
 | `POST` | `/api/repos/pause` | Owner | Quiet ONE repository without stopping the hive: agents stop writing to it and stop being handed work on it, while it keeps its dashboard card and ACMM eval. Body `{"repo": "...", "reason": "..."}` — the repo travels in the body because a `project.repos` entry may be an explicit cross-org `owner/name`. Records who/when/why; `changed: false` marks a no-op re-pause and leaves the original provenance intact; `persisted: false` means the pause is in force but could not be written to config. Rejects a repo outside `project.repos`. See [per-repo agent pause](repo-pause.md) | `pkg/dashboard/api_repo_pause.go` |
 | `POST` | `/api/repos/resume` | Owner | Lift a repository's pause. Unlike pause, does not require the repo to be in `project.repos`, so a pause left behind by a removed repo can still be cleared | `pkg/dashboard/api_repo_pause.go` |
 | `GET` | `/api/repos/pauses` | Dashboard auth/session | Every repo pause with its provenance. Read-only — the same state is already on the repository cards | `pkg/dashboard/api_repo_pause.go` |
 
 
-| `GET` | `/api/repos/{owner}/{repo}/hold-permission` | Dashboard auth/session | Reports whether the signed-in user can toggle hold chips for a repository card. Owners are allowed; otherwise the server checks GitHub `repos/{owner}/{repo}/collaborators/{user}/permission` and briefly caches the effective permission | `pkg/dashboard/api.go:304`, `pkg/dashboard/api_repo_hold.go` |
-| `POST` | `/api/repos/{owner}/{repo}/items/{number}/hold` | Owner or repo write/maintain/admin | Add or remove a dashboard hold chip for an issue or PR. Body `{"held": true}` adds the hive's exact-match canonical `hive-pause/<hive-id>` label; `{"held": false}` removes exactly the labels causing the hold (`hive-pause/<hive-id>` and/or generic hold labels) and never removes `hive/<hive-id>` provenance. Every toggle writes an audit-log entry; the #8851 upgrade migration writes `/data/hive-hold-migration-<hive-id>.json` with audit-backed, provenance-only, and ambiguous legacy `hive/<hive-id>` classifications. | `pkg/dashboard/api.go:305`, `pkg/dashboard/api_repo_hold.go` |
-| `GET` | `/api/acmm/evaluation` | Dashboard auth/session | ACMMEvaluation — combined codebase + operational result, cached server-side for 1 hour (`acmmEvalTTL`). `?refresh=1` (the dashboard's "🔄 Re-evaluate" button, #5877) bypasses the hourly TTL but is debounced server-side: requests within 1 minute of the last evaluation (`acmmRefreshDebounce`) still serve the cache, since a full refresh costs up to ~29 GitHub GetContents calls per repo. The response's `last_evaluated_at` timestamp reports when the cached evaluation was computed | `pkg/dashboard/api.go:307`, `pkg/dashboard/api_acmm_eval.go` |
-| `POST` | `/api/acmm/issue` | Owner only | ACMMCreate Issue — files on GitHub or, with `governor.acmm.issue_tracker: work_source` / body `tracker: "work_source"` on a Linear-sourced hive, on Linear; response `tracker` says which. See [ACMM policy matrix](acmm-policy-matrix.md#where-acmm-gap-issues-are-filed) | `pkg/dashboard/api.go:308` |
-| `GET` | `/api/acmm-recommendation` | Dashboard auth/session | Advisory level-up recommendation (`acmmadvisor.Recommendation`, JSON): never changes the applied level — see [ACMM advisor](acmm-advisor.md) | `pkg/dashboard/api.go:309` |
-| `GET` | `/api/hive-advice` | Dashboard auth/session | Weekly owner advice (`hiveadvisor.Result`, JSON) shared with the advisory digest: recommendations with `items`, `links` (Overview export paths) and `bands`; `bands[]` rule text; `counts` naming the governor actionable queue vs. the Overview total. Which recommendations show is frozen for 7 days; their numbers refresh every call — see [Owner advice](advisory.md#owner-advice) | `pkg/dashboard/api.go:311`, `pkg/dashboard/api_hive_advice.go` |
+| `GET` | `/api/repos/{owner}/{repo}/hold-permission` | Dashboard auth/session | Reports whether the signed-in user can toggle hold chips for a repository card. Owners are allowed; otherwise the server checks GitHub `repos/{owner}/{repo}/collaborators/{user}/permission` and briefly caches the effective permission | `pkg/dashboard/api.go:305`, `pkg/dashboard/api_repo_hold.go` |
+| `POST` | `/api/repos/{owner}/{repo}/items/{number}/hold` | Owner or repo write/maintain/admin | Add or remove a dashboard hold chip for an issue or PR. Body `{"held": true}` adds the hive's exact-match canonical `hive-pause/<hive-id>` label; `{"held": false}` removes exactly the labels causing the hold (`hive-pause/<hive-id>` and/or generic hold labels) and never removes `hive/<hive-id>` provenance. Every toggle writes an audit-log entry; the #8851 upgrade migration writes `/data/hive-hold-migration-<hive-id>.json` with audit-backed, provenance-only, and ambiguous legacy `hive/<hive-id>` classifications. | `pkg/dashboard/api.go:306`, `pkg/dashboard/api_repo_hold.go` |
+| `GET` | `/api/acmm/evaluation` | Dashboard auth/session | ACMMEvaluation — combined codebase + operational result, cached server-side for 1 hour (`acmmEvalTTL`). `?refresh=1` (the dashboard's "🔄 Re-evaluate" button, #5877) bypasses the hourly TTL but is debounced server-side: requests within 1 minute of the last evaluation (`acmmRefreshDebounce`) still serve the cache, since a full refresh costs up to ~29 GitHub GetContents calls per repo. The response's `last_evaluated_at` timestamp reports when the cached evaluation was computed | `pkg/dashboard/api.go:308`, `pkg/dashboard/api_acmm_eval.go` |
+| `POST` | `/api/acmm/issue` | Owner only | ACMMCreate Issue — files on GitHub or, with `governor.acmm.issue_tracker: work_source` / body `tracker: "work_source"` on a Linear-sourced hive, on Linear; response `tracker` says which. See [ACMM policy matrix](acmm-policy-matrix.md#where-acmm-gap-issues-are-filed) | `pkg/dashboard/api.go:309` |
+| `GET` | `/api/acmm-recommendation` | Dashboard auth/session | Advisory level-up recommendation (`acmmadvisor.Recommendation`, JSON): never changes the applied level — see [ACMM advisor](acmm-advisor.md) | `pkg/dashboard/api.go:310` |
+| `GET` | `/api/hive-advice` | Dashboard auth/session | Weekly owner advice (`hiveadvisor.Result`, JSON) shared with the advisory digest: recommendations with `items`, `links` (Overview export paths) and `bands`; `bands[]` rule text; `counts` naming the governor actionable queue vs. the Overview total. Which recommendations show is frozen for 7 days; their numbers refresh every call — see [Owner advice](advisory.md#owner-advice) | `pkg/dashboard/api.go:312`, `pkg/dashboard/api_hive_advice.go` |
 
 ## Cost, tokens, telemetry
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/trends` | Dashboard auth/session | Trends | `pkg/dashboard/api.go:73` |
-| `GET` | `/api/token-access` | Dashboard auth/session | Token Access | `pkg/dashboard/api.go:141` |
-| `GET` | `/api/tokens` | Dashboard auth/session | Tokens | `pkg/dashboard/api.go:142` |
-| `GET` | `/api/cost` | Dashboard auth/session | Cost | `pkg/dashboard/api.go:143` |
+| `GET` | `/api/trends` | Dashboard auth/session | Trends | `pkg/dashboard/api.go:74` |
+| `GET` | `/api/token-access` | Dashboard auth/session | Token Access | `pkg/dashboard/api.go:142` |
+| `GET` | `/api/tokens` | Dashboard auth/session | Tokens | `pkg/dashboard/api.go:143` |
+| `GET` | `/api/cost` | Dashboard auth/session | Cost | `pkg/dashboard/api.go:144` |
 | `GET` | `/api/repo-activity` | Dashboard auth/session | Per-repo audited activity | `pkg/dashboard/api.go` |
 | `GET` | `/api/repo-cost` | Dashboard auth/session | Per-repo estimated token cost (interval join, cached) | `pkg/dashboard/api.go` |
-| `GET` | `/api/cost/history` | Dashboard auth/session | Cost History | `pkg/dashboard/api.go:146` |
-| `GET` | `/api/trend/history` | Dashboard auth/session | Trend History | `pkg/dashboard/api.go:149` |
-| `GET` | `/api/timeseries` | Dashboard auth/session | Time Series | `pkg/dashboard/api.go:151` |
+| `GET` | `/api/cost/history` | Dashboard auth/session | Cost History | `pkg/dashboard/api.go:147` |
+| `GET` | `/api/trend/history` | Dashboard auth/session | Trend History | `pkg/dashboard/api.go:150` |
+| `GET` | `/api/timeseries` | Dashboard auth/session | Time Series | `pkg/dashboard/api.go:152` |
 | `GET` | `/api/providers/headroom` | Dashboard auth/session | Providers Headroom | `pkg/dashboard/api.go:52` |
-| `GET` | `/api/budget/history` | Dashboard auth/session | Budget History | `pkg/dashboard/api.go:148` |
+| `GET` | `/api/budget/history` | Dashboard auth/session | Budget History | `pkg/dashboard/api.go:149` |
 
 ## Knowledge
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/knowledge` | Dashboard auth/session | Knowledge List | `pkg/dashboard/api.go:318` |
-| `GET` | `/api/knowledge/export` | Dashboard auth/session | Knowledge Export | `pkg/dashboard/api.go:319` |
-| `GET` | `/api/knowledge/search` | Dashboard auth/session | Knowledge Search | `pkg/dashboard/api.go:320` |
-| `GET` | `/api/knowledge/health` | Dashboard auth/session | Knowledge Health | `pkg/dashboard/api.go:321` |
-| `GET` | `/api/knowledge/stats` | Dashboard auth/session | Knowledge Stats | `pkg/dashboard/api.go:322` |
-| `GET` | `/api/knowledge/graph` | Dashboard auth/session | Knowledge Graph | `pkg/dashboard/api.go:323` |
-| `GET` | `/api/knowledge/fact-history` | Dashboard auth/session | Fact History | `pkg/dashboard/api.go:324` |
-| `POST` | `/api/knowledge/create` | Dashboard auth/session | Knowledge Create | `pkg/dashboard/api.go:325` |
-| `POST` | `/api/knowledge/import` | Dashboard auth/session | Knowledge Import | `pkg/dashboard/api.go:326` |
-| `POST` | `/api/knowledge/promote` | Dashboard auth/session | Knowledge Promote | `pkg/dashboard/api.go:332` |
-| `GET` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs List | `pkg/dashboard/api.go:333` |
-| `POST` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Add | `pkg/dashboard/api.go:334` |
-| `DELETE` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Remove | `pkg/dashboard/api.go:335` |
-| `PUT` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Update | `pkg/dashboard/api.go:336` |
-| `DELETE` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Delete | `pkg/dashboard/api.go:337` |
-| `GET` | `/api/knowledge/{layer}` | Dashboard auth/session | Knowledge Layer | `pkg/dashboard/api.go:338` |
-| `GET` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Fact | `pkg/dashboard/api.go:339` |
-| `PUT` | `/api/knowledge/enabled` | Owner only | Knowledge Toggle | `pkg/dashboard/api.go:340` |
-| `GET` | `/api/knowledge/bead-synthesizer` | Dashboard auth/session | Bead Synth Status | `pkg/dashboard/api.go:341` |
-| `PUT` | `/api/knowledge/bead-synthesizer/enabled` | Owner only | Bead Synth Toggle | `pkg/dashboard/api.go:342` |
-| `GET` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults List | `pkg/dashboard/api.go:343` |
-| `POST` | `/api/knowledge/vaults` | Owner only | Vaults Connect | `pkg/dashboard/api.go:344` |
-| `DELETE` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults Disconnect | `pkg/dashboard/api.go:345` |
-| `POST` | `/api/knowledge/vaults/reindex` | Dashboard auth/session | Vaults Reindex | `pkg/dashboard/api.go:346` |
-| `GET` | `/api/knowledge/vaults/{name}/facts` | Dashboard auth/session | Vault Facts | `pkg/dashboard/api.go:347` |
-| `GET` | `/api/knowledge/git-sources` | Dashboard auth/session | Git Sources List | `pkg/dashboard/api.go:348` |
-| `POST` | `/api/knowledge/git-sources` | Owner only | Git Sources Connect | `pkg/dashboard/api.go:349` |
-| `DELETE` | `/api/knowledge/git-sources` | Owner only | Git Sources Disconnect | `pkg/dashboard/api.go:350` |
-| `POST` | `/api/knowledge/obsidian/sync` | Dashboard auth/session | Obsidian Sync | `pkg/dashboard/api.go:351` |
-| `GET` | `/api/knowledge/documents` | Dashboard auth/session | Documents List | `pkg/dashboard/api.go:352` |
-| `POST` | `/api/knowledge/documents` | Dashboard auth/session | Documents Import | `pkg/dashboard/api.go:353` |
-| `GET` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Get | `pkg/dashboard/api.go:354` |
-| `DELETE` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Delete | `pkg/dashboard/api.go:355` |
-| `POST` | `/api/knowledge/documents/{slug}/reimport` | Dashboard auth/session | Document Reimport | `pkg/dashboard/api.go:356` |
-| `GET` | `/api/knowledge/context7/search` | Dashboard auth/session | Context7 Search | `pkg/dashboard/api.go:357` |
-| `POST` | `/api/knowledge/cleanup-orphans` | Dashboard auth/session | Cleanup Orphans | `pkg/dashboard/api.go:358` |
-| `GET` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channels List | `pkg/dashboard/api.go:330` |
-| `POST` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channel Create | `pkg/dashboard/api.go:331` |
+| `GET` | `/api/knowledge` | Dashboard auth/session | Knowledge List | `pkg/dashboard/api.go:319` |
+| `GET` | `/api/knowledge/export` | Dashboard auth/session | Knowledge Export | `pkg/dashboard/api.go:320` |
+| `GET` | `/api/knowledge/search` | Dashboard auth/session | Knowledge Search | `pkg/dashboard/api.go:321` |
+| `POST` | `/mcp/knowledge` | Public (read-only) when `HIVE_PUBLIC_KNOWLEDGE` is on; 404 otherwise | Public Knowledge MCP endpoint — `initialize`, `tools/list`, `tools/call` for `knowledge_search`/`knowledge_get`/`knowledge_export` ([docs](public-knowledge-mcp.md)) | `pkg/dashboard/api.go:325` |
+| `GET` | `/api/knowledge/health` | Dashboard auth/session | Knowledge Health | `pkg/dashboard/api.go:326` |
+| `GET` | `/api/knowledge/stats` | Dashboard auth/session | Knowledge Stats | `pkg/dashboard/api.go:327` |
+| `GET` | `/api/knowledge/graph` | Dashboard auth/session | Knowledge Graph | `pkg/dashboard/api.go:328` |
+| `GET` | `/api/knowledge/fact-history` | Dashboard auth/session | Fact History | `pkg/dashboard/api.go:329` |
+| `POST` | `/api/knowledge/create` | Dashboard auth/session | Knowledge Create | `pkg/dashboard/api.go:330` |
+| `POST` | `/api/knowledge/import` | Dashboard auth/session | Knowledge Import | `pkg/dashboard/api.go:331` |
+| `POST` | `/api/knowledge/promote` | Dashboard auth/session | Knowledge Promote | `pkg/dashboard/api.go:337` |
+| `GET` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs List | `pkg/dashboard/api.go:338` |
+| `POST` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Add | `pkg/dashboard/api.go:339` |
+| `DELETE` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Remove | `pkg/dashboard/api.go:340` |
+| `PUT` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Update | `pkg/dashboard/api.go:341` |
+| `DELETE` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Delete | `pkg/dashboard/api.go:342` |
+| `GET` | `/api/knowledge/{layer}` | Dashboard auth/session | Knowledge Layer | `pkg/dashboard/api.go:343` |
+| `GET` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Fact | `pkg/dashboard/api.go:344` |
+| `PUT` | `/api/knowledge/enabled` | Owner only | Knowledge Toggle | `pkg/dashboard/api.go:345` |
+| `GET` | `/api/knowledge/bead-synthesizer` | Dashboard auth/session | Bead Synth Status | `pkg/dashboard/api.go:346` |
+| `PUT` | `/api/knowledge/bead-synthesizer/enabled` | Owner only | Bead Synth Toggle | `pkg/dashboard/api.go:347` |
+| `GET` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults List | `pkg/dashboard/api.go:348` |
+| `POST` | `/api/knowledge/vaults` | Owner only | Vaults Connect | `pkg/dashboard/api.go:349` |
+| `DELETE` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults Disconnect | `pkg/dashboard/api.go:350` |
+| `POST` | `/api/knowledge/vaults/reindex` | Dashboard auth/session | Vaults Reindex | `pkg/dashboard/api.go:351` |
+| `GET` | `/api/knowledge/vaults/{name}/facts` | Dashboard auth/session | Vault Facts | `pkg/dashboard/api.go:352` |
+| `GET` | `/api/knowledge/git-sources` | Dashboard auth/session | Git Sources List | `pkg/dashboard/api.go:353` |
+| `POST` | `/api/knowledge/git-sources` | Owner only | Git Sources Connect | `pkg/dashboard/api.go:354` |
+| `DELETE` | `/api/knowledge/git-sources` | Owner only | Git Sources Disconnect | `pkg/dashboard/api.go:355` |
+| `POST` | `/api/knowledge/obsidian/sync` | Dashboard auth/session | Obsidian Sync | `pkg/dashboard/api.go:356` |
+| `GET` | `/api/knowledge/documents` | Dashboard auth/session | Documents List | `pkg/dashboard/api.go:357` |
+| `POST` | `/api/knowledge/documents` | Dashboard auth/session | Documents Import | `pkg/dashboard/api.go:358` |
+| `GET` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Get | `pkg/dashboard/api.go:359` |
+| `DELETE` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Delete | `pkg/dashboard/api.go:360` |
+| `POST` | `/api/knowledge/documents/{slug}/reimport` | Dashboard auth/session | Document Reimport | `pkg/dashboard/api.go:361` |
+| `GET` | `/api/knowledge/context7/search` | Dashboard auth/session | Context7 Search | `pkg/dashboard/api.go:362` |
+| `POST` | `/api/knowledge/cleanup-orphans` | Dashboard auth/session | Cleanup Orphans | `pkg/dashboard/api.go:363` |
+| `GET` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channels List | `pkg/dashboard/api.go:335` |
+| `POST` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channel Create | `pkg/dashboard/api.go:336` |
 
 ## Contribute
 
@@ -427,99 +428,99 @@ always resolved server-side from the validated token.
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/nous/status` | Dashboard auth/session | Nous Status | `pkg/dashboard/api.go:392` |
-| `GET` | `/api/nous/ledger` | Dashboard auth/session | Nous Ledger | `pkg/dashboard/api.go:393` |
-| `GET` | `/api/nous/principles` | Dashboard auth/session | Nous Principles | `pkg/dashboard/api.go:394` |
-| `POST` | `/api/nous/approve` | Owner only | Nous Approve | `pkg/dashboard/api.go:395` |
-| `POST` | `/api/nous/abort` | Owner only | Nous Abort | `pkg/dashboard/api.go:396` |
-| `PUT` | `/api/nous/mode` | Owner only | Nous Mode | `pkg/dashboard/api.go:397` |
-| `PUT` | `/api/nous/scope` | Owner only | Nous Scope | `pkg/dashboard/api.go:398` |
-| `GET` | `/api/nous/phase` | Dashboard auth/session | Nous Phase | `pkg/dashboard/api.go:399` |
-| `PUT` | `/api/nous/gate-decision` | Owner only | Nous Gate Decision | `pkg/dashboard/api.go:400` |
-| `GET` | `/api/nous/gate-pending` | Dashboard auth/session | Nous Gate Pending | `pkg/dashboard/api.go:401` |
-| `POST` | `/api/nous/gate-respond` | Owner only | Nous Gate Respond | `pkg/dashboard/api.go:402` |
-| `GET` | `/api/nous/gate-response` | Dashboard auth/session | Nous Gate Response | `pkg/dashboard/api.go:403` |
-| `GET` | `/api/nous/config` | Dashboard auth/session | Nous Config Get | `pkg/dashboard/api.go:404` |
-| `PUT` | `/api/nous/config/goals` | Owner only | Nous Config Goals | `pkg/dashboard/api.go:405` |
-| `PUT` | `/api/nous/config/repos` | Owner only | Nous Config Repos | `pkg/dashboard/api.go:406` |
-| `PUT` | `/api/nous/config/output` | Owner only | Nous Config Output | `pkg/dashboard/api.go:407` |
-| `PUT` | `/api/nous/config/fast-fail` | Owner only | Nous Config Fast Fail | `pkg/dashboard/api.go:408` |
-| `PUT` | `/api/nous/config/schedule` | Owner only | Nous Config Schedule | `pkg/dashboard/api.go:409` |
-| `PUT` | `/api/nous/config/controllables` | Owner only | Nous Config Controllables | `pkg/dashboard/api.go:410` |
-| `PUT` | `/api/nous/config/principles` | Owner only | Nous Config Principles | `pkg/dashboard/api.go:411` |
-| `DELETE` | `/api/nous/principles/{id}` | Owner only | Nous Delete Principle | `pkg/dashboard/api.go:412` |
+| `GET` | `/api/nous/status` | Dashboard auth/session | Nous Status | `pkg/dashboard/api.go:397` |
+| `GET` | `/api/nous/ledger` | Dashboard auth/session | Nous Ledger | `pkg/dashboard/api.go:398` |
+| `GET` | `/api/nous/principles` | Dashboard auth/session | Nous Principles | `pkg/dashboard/api.go:399` |
+| `POST` | `/api/nous/approve` | Owner only | Nous Approve | `pkg/dashboard/api.go:400` |
+| `POST` | `/api/nous/abort` | Owner only | Nous Abort | `pkg/dashboard/api.go:401` |
+| `PUT` | `/api/nous/mode` | Owner only | Nous Mode | `pkg/dashboard/api.go:402` |
+| `PUT` | `/api/nous/scope` | Owner only | Nous Scope | `pkg/dashboard/api.go:403` |
+| `GET` | `/api/nous/phase` | Dashboard auth/session | Nous Phase | `pkg/dashboard/api.go:404` |
+| `PUT` | `/api/nous/gate-decision` | Owner only | Nous Gate Decision | `pkg/dashboard/api.go:405` |
+| `GET` | `/api/nous/gate-pending` | Dashboard auth/session | Nous Gate Pending | `pkg/dashboard/api.go:406` |
+| `POST` | `/api/nous/gate-respond` | Owner only | Nous Gate Respond | `pkg/dashboard/api.go:407` |
+| `GET` | `/api/nous/gate-response` | Dashboard auth/session | Nous Gate Response | `pkg/dashboard/api.go:408` |
+| `GET` | `/api/nous/config` | Dashboard auth/session | Nous Config Get | `pkg/dashboard/api.go:409` |
+| `PUT` | `/api/nous/config/goals` | Owner only | Nous Config Goals | `pkg/dashboard/api.go:410` |
+| `PUT` | `/api/nous/config/repos` | Owner only | Nous Config Repos | `pkg/dashboard/api.go:411` |
+| `PUT` | `/api/nous/config/output` | Owner only | Nous Config Output | `pkg/dashboard/api.go:412` |
+| `PUT` | `/api/nous/config/fast-fail` | Owner only | Nous Config Fast Fail | `pkg/dashboard/api.go:413` |
+| `PUT` | `/api/nous/config/schedule` | Owner only | Nous Config Schedule | `pkg/dashboard/api.go:414` |
+| `PUT` | `/api/nous/config/controllables` | Owner only | Nous Config Controllables | `pkg/dashboard/api.go:415` |
+| `PUT` | `/api/nous/config/principles` | Owner only | Nous Config Principles | `pkg/dashboard/api.go:416` |
+| `DELETE` | `/api/nous/principles/{id}` | Owner only | Nous Delete Principle | `pkg/dashboard/api.go:417` |
 
 ## Inception
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `POST` | `/api/inception/start` | Owner only | Inception Start | `pkg/dashboard/api.go:363` |
-| `POST` | `/api/inception/scan` | Owner only | Inception Scan | `pkg/dashboard/api.go:364` |
-| `GET` | `/api/inception/state` | Dashboard auth/session | Inception State | `pkg/dashboard/api.go:365` |
-| `POST` | `/api/inception/questions` | Owner only | Inception Set Questions | `pkg/dashboard/api.go:366` |
-| `POST` | `/api/inception/answer` | Owner only | Inception Answer | `pkg/dashboard/api.go:367` |
-| `POST` | `/api/inception/facts` | Owner only | Inception Record Facts | `pkg/dashboard/api.go:368` |
-| `GET` | `/api/inception/scaffold` | Dashboard auth/session | Inception Scaffold | `pkg/dashboard/api.go:369` |
-| `POST` | `/api/inception/approve` | Owner only | Inception Approve | `pkg/dashboard/api.go:370` |
-| `POST` | `/api/inception/reset` | Owner only | Inception Reset | `pkg/dashboard/api.go:371` |
-| `GET` | `/api/inception/ideation-facts` | Dashboard auth/session | Inception Ideation Facts | `pkg/dashboard/api.go:372` |
-| `GET` | `/api/inception/download` | Dashboard auth/session | Inception Download | `pkg/dashboard/api.go:373` |
-| `GET` | `/api/inception/has-files` | Dashboard auth/session | Inception Has Files | `pkg/dashboard/api.go:374` |
-| `PUT` | `/api/inception/wiki-name` | Owner only | Inception Rename Wiki | `pkg/dashboard/api.go:375` |
-| `POST` | `/api/inception/import` | Owner only | Inception Import | `pkg/dashboard/api.go:376` |
+| `POST` | `/api/inception/start` | Owner only | Inception Start | `pkg/dashboard/api.go:368` |
+| `POST` | `/api/inception/scan` | Owner only | Inception Scan | `pkg/dashboard/api.go:369` |
+| `GET` | `/api/inception/state` | Dashboard auth/session | Inception State | `pkg/dashboard/api.go:370` |
+| `POST` | `/api/inception/questions` | Owner only | Inception Set Questions | `pkg/dashboard/api.go:371` |
+| `POST` | `/api/inception/answer` | Owner only | Inception Answer | `pkg/dashboard/api.go:372` |
+| `POST` | `/api/inception/facts` | Owner only | Inception Record Facts | `pkg/dashboard/api.go:373` |
+| `GET` | `/api/inception/scaffold` | Dashboard auth/session | Inception Scaffold | `pkg/dashboard/api.go:374` |
+| `POST` | `/api/inception/approve` | Owner only | Inception Approve | `pkg/dashboard/api.go:375` |
+| `POST` | `/api/inception/reset` | Owner only | Inception Reset | `pkg/dashboard/api.go:376` |
+| `GET` | `/api/inception/ideation-facts` | Dashboard auth/session | Inception Ideation Facts | `pkg/dashboard/api.go:377` |
+| `GET` | `/api/inception/download` | Dashboard auth/session | Inception Download | `pkg/dashboard/api.go:378` |
+| `GET` | `/api/inception/has-files` | Dashboard auth/session | Inception Has Files | `pkg/dashboard/api.go:379` |
+| `PUT` | `/api/inception/wiki-name` | Owner only | Inception Rename Wiki | `pkg/dashboard/api.go:380` |
+| `POST` | `/api/inception/import` | Owner only | Inception Import | `pkg/dashboard/api.go:381` |
 
 ## Beads
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/beads` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:414` |
-| `GET` | `/api/beads/{agent}` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:415` |
-| `POST` | `/api/beads/{agent}` | Owner only | Beads Create | `pkg/dashboard/api.go:416` |
-| `POST` | `/api/beads/reset` | Owner only | Beads Reset | `pkg/dashboard/api.go:417` |
-| `POST` | `/api/beads/reset/{agent}` | Owner only | Beads Reset Agent | `pkg/dashboard/api.go:418` |
+| `GET` | `/api/beads` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:419` |
+| `GET` | `/api/beads/{agent}` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:420` |
+| `POST` | `/api/beads/{agent}` | Owner only | Beads Create | `pkg/dashboard/api.go:421` |
+| `POST` | `/api/beads/reset` | Owner only | Beads Reset | `pkg/dashboard/api.go:422` |
+| `POST` | `/api/beads/reset/{agent}` | Owner only | Beads Reset Agent | `pkg/dashboard/api.go:423` |
 
 ## Dashboard miscellaneous
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
 | `GET` | `/api/audit` | Read-write role | Audit Log — `{"entries": [...]}` envelope, newest first, capped at 200; response shape and the serve-time `user_name` field in [audit-log.md](audit-log.md#get-apiaudit) | `pkg/dashboard/api.go:51` |
-| `GET` | `/api/watchdog/activity` | Read-write role | Watchdog activity readout for the Health tab (#7254): `watchdog-*` audit actions over `?days=` (default 30, clamped to 90) — total / taken / observed / `byAction`, a zero-filled per-day `daily` histogram, per-agent `agents` liveness, and the Observe → Heal `promotion` hint; see [agent-watchdog.md](agent-watchdog.md#watchdog-activity-strip) | `pkg/dashboard/api.go:425` |
+| `GET` | `/api/watchdog/activity` | Read-write role | Watchdog activity readout for the Health tab (#7254): `watchdog-*` audit actions over `?days=` (default 30, clamped to 90) — total / taken / observed / `byAction`, a zero-filled per-day `daily` histogram, per-agent `agents` liveness, and the Observe → Heal `promotion` hint; see [agent-watchdog.md](agent-watchdog.md#watchdog-activity-strip) | `pkg/dashboard/api.go:430` |
 | `POST` | `/api/presence` | Dashboard auth/session | Presence | `pkg/dashboard/api.go:54` |
 | `GET` | `/api/prompt-history` | Dashboard auth/session | Prompt History | `pkg/dashboard/api.go:55` |
 | `POST` | `/api/self-upgrade` | Owner only | Self Upgrade | `pkg/dashboard/api.go:56` |
 | `GET` | `/api/backup/status` | Owner only | Backup Status — `available:false` with a reason when no encryption key is configured | `pkg/dashboard/api.go:60` |
 | `POST` | `/api/backup` | Owner only | Backup Download — `412` when no encryption key is configured (never an unencrypted archive) | `pkg/dashboard/api.go:61` |
 | `POST` | `/api/banner-dismissed` | Dashboard auth/session | Banner Dismissed | `pkg/dashboard/api.go:62` |
-| `GET` | `/api/history` | Dashboard auth/session | History | `pkg/dashboard/api.go:72` |
-| `GET` | `/api/timeline` | Dashboard auth/session | Timeline | `pkg/dashboard/api.go:74` |
-| `GET` | `/api/lifecycle-timeline` | Dashboard auth/session | Issue→PR lifecycle journeys plus derived stage timeline. Each journey keeps the dense `stages` map and adds a backwards-compatible `details` object for expandable rows: chronological stages with durations, current-stage age, agent, classification attrs, issue/PR links, blocked reason, and kick/run identifiers when recorded. | `pkg/dashboard/api.go:75` |
-| `GET` | `/api/pr-throughput` | Dashboard auth/session | Throughput: pull/merge requests and issues across tracked forges. Counts hive-created PRs/issues, hive/observed reviews, observed PR merges/closures, and issue closes over `?hours=N` (default 24, capped at audit retention; `hours=0` = all time from durable counters in `/data/pr-throughput-counters.json`) with optional exact case-insensitive `?repo=owner/name` and `?role=created\|reviewed\|merged` for the actor trend. The response keeps legacy `opened`/`merged`/`closed`, `merged_by_path`, `buckets`, velocity metrics, previous-window trends, top agents/repos/reasons, and `recorded_since`, and adds `by_actor` (`pr`/`issue` × `created`/`reviewed`/`merged`/`closed` × `hive`/`human`/`other`) plus `series` points (`t`, `hive`, `human`, `other`) for the selected role. | `pkg/dashboard/api.go:76` |
-
-
-| `GET` | `/api/convergence/soak` | Owner only | Convergence Soak Status | `pkg/dashboard/api.go:230` |
-| `POST` | `/api/plan/from-issue` | Dashboard auth/session | Plan From Issue | `pkg/dashboard/api.go:381` |
-| `GET` | `/api/plan/{epicID}` | Dashboard auth/session | Plan Tree | `pkg/dashboard/api.go:384` |
-| `POST` | `/api/plan/{epicID}/approve` | Owner only | Plan Approve | `pkg/dashboard/api.go:385` |
-| `POST` | `/api/plan/{epicID}/reject` | Owner only | Plan Reject | `pkg/dashboard/api.go:387` |
-| `POST` | `/api/plan/{epicID}/child/{childID}` | Owner only | Plan Child Action | `pkg/dashboard/api.go:388` |
+| `GET` | `/api/history` | Dashboard auth/session | History | `pkg/dashboard/api.go:73` |
+| `GET` | `/api/timeline` | Dashboard auth/session | Timeline | `pkg/dashboard/api.go:75` |
+| `GET` | `/api/lifecycle-timeline` | Dashboard auth/session | Issue→PR lifecycle journeys plus derived stage timeline. Each journey keeps the dense `stages` map and adds a backwards-compatible `details` object for expandable rows: chronological stages with durations, current-stage age, agent, classification attrs, issue/PR links, blocked reason, and kick/run identifiers when recorded. | `pkg/dashboard/api.go:76` |
+| `GET` | `/api/pr-throughput` | Dashboard auth/session | Throughput: pull/merge requests and issues across tracked forges. Counts hive-created PRs/issues, hive/observed reviews, observed PR merges/closures, and issue closes over `?hours=N` (default 24, capped at audit retention; `hours=0` = all time from durable counters in `/data/pr-throughput-counters.json`) with optional exact case-insensitive `?repo=owner/name` and `?role=created\|reviewed\|merged` for the actor trend. The response keeps legacy `opened`/`merged`/`closed`, `merged_by_path`, `buckets`, velocity metrics, previous-window trends, top agents/repos/reasons, and `recorded_since`, and adds `by_actor` (`pr`/`issue` × `created`/`reviewed`/`merged`/`closed` × `hive`/`human`/`other`) plus `series` points (`t`, `hive`, `human`, `other`) for the selected role. | `pkg/dashboard/api.go:77` |
+
+
+| `GET` | `/api/convergence/soak` | Owner only | Convergence Soak Status | `pkg/dashboard/api.go:231` |
+| `POST` | `/api/plan/from-issue` | Dashboard auth/session | Plan From Issue | `pkg/dashboard/api.go:386` |
+| `GET` | `/api/plan/{epicID}` | Dashboard auth/session | Plan Tree | `pkg/dashboard/api.go:389` |
+| `POST` | `/api/plan/{epicID}/approve` | Owner only | Plan Approve | `pkg/dashboard/api.go:390` |
+| `POST` | `/api/plan/{epicID}/reject` | Owner only | Plan Reject | `pkg/dashboard/api.go:392` |
+| `POST` | `/api/plan/{epicID}/child/{childID}` | Owner only | Plan Child Action | `pkg/dashboard/api.go:393` |
 | `POST` | `/api/linear/agent/install` | Owner only | Linear Agent Install (OAuth start) | `pkg/dashboard/api_linear_agent.go:215` |
 | `GET` | `/api/linear/agent/status` | Owner only | Linear Agent Status | `pkg/dashboard/api_linear_agent.go:216` |
 | `POST` | `/api/linear/agent/disconnect` | Owner only | Linear Agent Disconnect | `pkg/dashboard/api_linear_agent.go:217` |
-| `GET` | `/api/upstream-watch` | Owner only | Upstream-watch divergence: per watched fork the upstream followed, the watermark and last-run time, surfaced/ported/dismissed/skipped counts, and the recent upstream refs with their upstream URL, diff URL, fork issue number and state. Read-only — it reads the config and the watch state file, never GitHub. | `pkg/dashboard/api.go:269` |
-
-| `GET` | `/api/widget` | Dashboard auth/session | Widget | `pkg/dashboard/api.go:102` |
-| `GET` | `/api/pane/{agent}` | Dashboard auth/session | Pane | `pkg/dashboard/api.go:103` |
-| `GET` | `/api/role` | Dashboard auth/session | Role | `pkg/dashboard/api.go:117` |
-| `POST` | `/api/reset-restarts/{agent}` | Owner only | Reset Restarts | `pkg/dashboard/api.go:139` |
-| `GET` | `/api/budget-ignore` | Dashboard auth/session | Budget Ignore Get | `pkg/dashboard/api.go:154` |
-| `POST` | `/api/budget-ignore` | Owner only | Budget Ignore Set | `pkg/dashboard/api.go:155` |
-| `GET` | `/api/summaries` | Dashboard auth/session | Summaries | `pkg/dashboard/api.go:167` |
-| `POST` | `/api/prs/{owner}/{repo}/{number}/queue-automerge` | Merger/owner role | Queue PRAuto Merge | `pkg/dashboard/api.go:168` |
-| `GET` | `/api/inference/models/{backend}` | Dashboard auth/session | Inference Models | `pkg/dashboard/api.go:316` |
-| `GET` | `/api/hive-id` | Dashboard auth/session | Hive IDGet | `pkg/dashboard/api.go:360` |
-| `PUT` | `/api/hive-id` | Owner only | Hive IDSet | `pkg/dashboard/api.go:361` |
-| `POST` | `/api/chat` | Dashboard auth/session | Chat | `pkg/dashboard/api.go:390` |
-| `GET` | `/api/auth/token` | Public | Auth Token | `pkg/dashboard/api.go:420` |
+| `GET` | `/api/upstream-watch` | Owner only | Upstream-watch divergence: per watched fork the upstream followed, the watermark and last-run time, surfaced/ported/dismissed/skipped counts, and the recent upstream refs with their upstream URL, diff URL, fork issue number and state. Read-only — it reads the config and the watch state file, never GitHub. | `pkg/dashboard/api.go:270` |
+
+| `GET` | `/api/widget` | Dashboard auth/session | Widget | `pkg/dashboard/api.go:103` |
+| `GET` | `/api/pane/{agent}` | Dashboard auth/session | Pane | `pkg/dashboard/api.go:104` |
+| `GET` | `/api/role` | Dashboard auth/session | Role | `pkg/dashboard/api.go:118` |
+| `POST` | `/api/reset-restarts/{agent}` | Owner only | Reset Restarts | `pkg/dashboard/api.go:140` |
+| `GET` | `/api/budget-ignore` | Dashboard auth/session | Budget Ignore Get | `pkg/dashboard/api.go:155` |
+| `POST` | `/api/budget-ignore` | Owner only | Budget Ignore Set | `pkg/dashboard/api.go:156` |
+| `GET` | `/api/summaries` | Dashboard auth/session | Summaries | `pkg/dashboard/api.go:168` |
+| `POST` | `/api/prs/{owner}/{repo}/{number}/queue-automerge` | Merger/owner role | Queue PRAuto Merge | `pkg/dashboard/api.go:169` |
+| `GET` | `/api/inference/models/{backend}` | Dashboard auth/session | Inference Models | `pkg/dashboard/api.go:317` |
+| `GET` | `/api/hive-id` | Dashboard auth/session | Hive IDGet | `pkg/dashboard/api.go:365` |
+| `PUT` | `/api/hive-id` | Owner only | Hive IDSet | `pkg/dashboard/api.go:366` |
+| `POST` | `/api/chat` | Dashboard auth/session | Chat | `pkg/dashboard/api.go:395` |
+| `GET` | `/api/auth/token` | Public | Auth Token | `pkg/dashboard/api.go:425` |
 | `GET` | `/api/v1/` | GitHub token | Contributor v1 API dispatcher | `pkg/dashboard/api_contribute.go:236` |
 | `POST` | `/api/v1/` | GitHub token | Contributor v1 API dispatcher | `pkg/dashboard/api_contribute.go:237` |
 | `GET` | `/api/docs` | Dashboard auth/session | APIDocs | `pkg/dashboard/api_contribute.go:238` |
diff --git a/src/docs/documentation-map.md b/src/docs/documentation-map.md
index c76997cd99..e6043dc149 100644
--- a/src/docs/documentation-map.md
+++ b/src/docs/documentation-map.md
@@ -118,6 +118,7 @@ Documentation for the current Hive line (branch `v5`; the code and docs live und
 - [Branding a hive](branding.md) — persistent per-deployment name, mark, and colours via `<data>/branding/branding.json` and `custom.css` (`HIVE_BRANDING_JSON`/`HIVE_BRANDING_CSS`); distinct from the per-request `?style=` stylesheets above.
 - [Portable AgentDefinition format](../AGENT-DEFINITION.md) — standalone YAML schema for importing/exporting agent definitions.
 - [Knowledge curator](knowledge-curator.md) — automatic fact extraction and promotion knobs, plus the other `knowledge:` sub-sections: `git_sources` (indexing a remote repo, layer semantics, private-repo auth (unsupported), diagnosing a failed source), `vaults` (local Obsidian vaults, git-sync), `documents` (PDF/URL import), and `bead_synthesizer` (on-by-default bead→wiki synthesis and retention policy, and how to turn it off). See also [knowledge confidence scoring](knowledge-confidence.md) for dashboard confidence badges and score explanations.
+- [Public knowledge MCP endpoint](public-knowledge-mcp.md) — the owner-switched, read-only `POST /mcp/knowledge` surface that lets any external agent (Goose, Claude, Copilot) read a hive's operational knowledge without a session; what is and is not exposed, and client configuration.
 - [Skill registry](skills.md) — the `/data/skills/` file format and front-matter fields. **Delivered to agents today**: skills are opt-in per agent via `skills: [name, ...]`, resolved registry-first with an `AGENTS.md` repo-local fallback, and the rendered block is prepended to the kick's `${KNOWLEDGE}`. Both sources reload on every kick. An 8 KiB whole-skill cap applies; a skill that would exceed it is dropped whole, never truncated.
 - [AGENTS.md repo instructions](agents-md.md) — the per-repo `AGENTS.md` file format Hive's parser (`pkg/agentsmd`) understands, including front-matter `skills:` and inline `## Skill:` sections. **Wired into kicks, but needs a checkout**: Hive agents keep no clones, so set `project.checkouts_dir` to a directory holding one checkout per repo. Without it there is no root to read and injection stays a no-op, which is the default.
 - [Agent peer-awareness logging (pluk)](agent-logging.md) — pluk log format, `hive-panes`, availability, and retention.
diff --git a/src/docs/env-vars.md b/src/docs/env-vars.md
index 76f816f3d2..640068edfb 100644
--- a/src/docs/env-vars.md
+++ b/src/docs/env-vars.md
@@ -48,6 +48,8 @@ This reference is compiled by hand from the Go source under `src/`, the deployme
 | `HIVE_METRICS_ENABLED` | No | disabled | Registers Prometheus `/metrics` when set to `1`, `true`, `yes`, or `on`. Requires `HIVE_METRICS_TOKEN` — enabled-but-tokenless returns 403 ([#3804](https://github.com/hivecommons/hive/pull/3804)). |
 | `HIVE_METRICS_TOKEN` | Yes when metrics enabled | none | Bearer token read by `pkg/dashboard/metrics_prometheus.go` for `/metrics` (`Authorization: Bearer ...`; Prometheus `bearer_token`). `/metrics` bypasses dashboard session auth, so this token is its only guard; enabled-but-tokenless fails closed and the cost/agent series are never served without it. |
 | `HIVE_METRICS_FILE` | No | `/var/run/hive-metrics/contribute.json` | Contributor metrics JSON file override. |
+| `HIVE_PUBLIC_KNOWLEDGE` | No | disabled | Owner switch for the anonymous, **read-only** MCP knowledge endpoint `POST /mcp/knowledge` (`1`, `true`, `yes`, or `on` — same spelling as `HIVE_METRICS_ENABLED`). Off → 404 even for authenticated callers. Read on each request so it can be closed without a pod roll. Only operational fact types (pattern, gotcha, regression, test_scaffold, integration, coverage_rule, general) are served; ideation/governance types, sources, and usage data never leave the hive. See [public-knowledge-mcp.md](public-knowledge-mcp.md) ([#10615](https://github.com/hivecommons/hive/issues/10615)). |
+| `HIVE_PUBLIC_KNOWLEDGE_TAGS` | No | none (all public-type facts) | Comma-separated tag allow-list that further narrows what `/mcp/knowledge` serves to facts carrying at least one listed tag (case-insensitive). |
 | `HIVE_COPILOT_INTEGRATION_ID` | No | compiled Copilot integration id | Overrides the integration id used by Copilot model discovery. |
 | `HIVE_CONTRIBUTORS_DIR` | No | hub default | Contributor registry directory override. |
 | `HIVE_CONTRIBUTE_SKIP_LABELS` | No | `blocked,tracking,epic,discussion,question,needs-decision,needs-triage` | Comma-separated, case-insensitive label patterns for issues that are not contributor work and must never be offered by the relay. Patterns use `path.Match`-style `*` globs; `blocked` is always unioned into the effective set even if omitted. Same setting as `hub.contribute_skip_labels`. |
diff --git a/src/docs/public-knowledge-mcp.md b/src/docs/public-knowledge-mcp.md
new file mode 100644
index 0000000000..76fe8af4f3
--- /dev/null
+++ b/src/docs/public-knowledge-mcp.md
@@ -0,0 +1,105 @@
+# Public knowledge MCP endpoint
+
+A hive accumulates operational knowledge — gotchas, patterns, regressions,
+integration notes — as its agents work. Normally that knowledge is reachable
+only with a hub session, the dashboard token, or a contributor registration
+token (`/api/knowledge/*`, `hivectl knowledge export`).
+
+The **public knowledge** switch lets a hive owner open a second, strictly
+**read-only** surface so *any* agent — Goose, Claude Desktop/Code, Copilot
+CLI, a shell script — can consult the hive without credentials. The
+motivating case is a distro's troubleshooting assistant reasoning from the
+project's own accumulated fixes instead of only what its model was trained on
+([#10615](https://github.com/hivecommons/hive/issues/10615)).
+
+## Owner switch
+
+| Variable | Effect |
+|---|---|
+| `HIVE_PUBLIC_KNOWLEDGE=1` (`true`/`yes`/`on`) | Enables `POST /mcp/knowledge`. Unset or anything else → the path returns **404**, even to the owner. |
+| `HIVE_PUBLIC_KNOWLEDGE_TAGS=linux,troubleshooting` | Optional. Only facts carrying at least one listed tag are served. |
+
+Both are read on every request, so the surface can be closed instantly
+without restarting the spoke.
+
+## What is exposed
+
+Only operational fact types leave the hive:
+
+`pattern`, `gotcha`, `regression`, `test_scaffold`, `integration`,
+`coverage_rule`, `general`
+
+Ideation and governance types (`idea`, `vision`, `constitution`,
+`requirement`, `constraint`, `stakeholder`, `decision`) are never served,
+and a request for one by slug answers "not found" rather than "forbidden".
+
+Each public fact carries `slug`, `title`, `type`, `body`, `tags`, `related`
+and (only when scored) `confidence`. Sources (PR, comment, author), usage
+counters, confidence reasoning, and lifecycle phase are stripped.
+
+## What is *not* possible
+
+There is no write method on this surface. The endpoint serves the MCP
+handshake (`initialize`, `ping`, `notifications/*`), `tools/list`, and
+`tools/call` for three tools. Nothing in the handler reaches
+`CreateFact`, `UpdateFact`, `DeleteFact`, import, promotion, or vault
+mutation. Anonymous callers cannot alter a knowledge base, and every tool is
+annotated `readOnlyHint: true` so MCP clients run them without confirmation.
+
+Other hard limits: POST only (no SSE stream), 64 KiB request body,
+`knowledge_search` returns at most 50 results per call.
+
+## Tools
+
+| Tool | Arguments | Returns |
+|---|---|---|
+| `knowledge_search` | `query` (required), `type`, `limit` (default 10, max 50) | JSON `{query, count, results[]}` |
+| `knowledge_get` | `slug` (required) | One public fact as JSON, or an `isError` "fact not found" |
+| `knowledge_export` | none | The whole public base as one Markdown document, grouped by type; `_meta.etag` and `_meta.facts` |
+
+## Client configuration
+
+The endpoint speaks MCP Streamable HTTP with plain JSON responses.
+
+**Goose** (`~/.config/goose/config.yaml`):
+
+```yaml
+extensions:
+  bluefin-hive:
+    type: streamable_http
+    uri: https://hive.example.org/mcp/knowledge
+    enabled: true
+```
+
+**Claude Code**:
+
+```sh
+claude mcp add --transport http bluefin-hive https://hive.example.org/mcp/knowledge
+```
+
+**Copilot CLI** (`~/.copilot/mcp-config.json`):
+
+```json
+{ "mcpServers": { "bluefin-hive": { "type": "http", "url": "https://hive.example.org/mcp/knowledge" } } }
+```
+
+**curl**:
+
+```sh
+curl -s https://hive.example.org/mcp/knowledge \
+  -H 'Content-Type: application/json' \
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"bluetooth"}}}'
+```
+
+## Hub-fronted spokes
+
+On hosted hives the hub's nginx `auth_request` gate waves `/mcp/knowledge`
+through (same mechanism as `/api/knowledge/export`, #8294) so an agent with
+no browser session is not bounced to the login page. This opens nothing by
+itself: the spoke re-checks `HIVE_PUBLIC_KNOWLEDGE` and 404s when it is off.
+
+## Related
+
+- [Environment variable reference](env-vars.md)
+- [Knowledge curator](knowledge-curator.md) — how facts are produced and promoted
+- [Knowledge system design](design/knowledge-system.md)
diff --git a/src/pkg/dashboard/mcp_knowledge_test.go b/src/pkg/dashboard/mcp_knowledge_test.go
index 3a5f248f4d..8d9ef6edf7 100644
--- a/src/pkg/dashboard/mcp_knowledge_test.go
+++ b/src/pkg/dashboard/mcp_knowledge_test.go
@@ -35,7 +35,7 @@ func publicKnowledgeServer(t *testing.T) *Server {
 		}
 	}
 	write("gotcha-nil-map.md", "---\ntitle: Nil Map Gotcha\ntype: gotcha\n---\nAlways initialize maps before use.\n")
-	write("pattern-caching.md", "---\ntitle: Caching Pattern\ntype: pattern\ntags:\n  - linux\n  - public\n---\nUse Redis for caching hot paths.\n")
+	write("pattern-caching.md", "---\ntitle: Caching Pattern\ntype: pattern\ntags: [linux, public]\n---\nUse Redis for caching hot paths.\n")
 	write("vision-world-domination.md", "---\ntitle: Secret Roadmap\ntype: vision\n---\nWe will acquire a competitor in Q3.\n")
 
 	api := knowledge.NewKnowledgeAPI(nil, knowledge.KnowledgeConfig{Enabled: true, Engine: "file"}, logger)

From fa6f72cfc3a1af8043ba0e3435c876cd52c19107 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:04:51 -0400
Subject: [PATCH 07/14] knowledge: register /mcp/knowledge with a literal so
 api-reference citations verify

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 src/docs/api-reference.md               | 178 ++++++++++++------------
 src/pkg/dashboard/api.go                |   7 +-
 src/pkg/dashboard/mcp_knowledge.go      |   6 -
 src/pkg/dashboard/mcp_knowledge_test.go |   8 ++
 4 files changed, 100 insertions(+), 99 deletions(-)

diff --git a/src/docs/api-reference.md b/src/docs/api-reference.md
index f1ee2410af..fd67aedfbc 100644
--- a/src/docs/api-reference.md
+++ b/src/docs/api-reference.md
@@ -169,8 +169,8 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 | `PUT` | `/api/config/governor/watchdog` | Owner only | Governor Watchdog | `pkg/dashboard/api.go:201` |
 | `GET` | `/api/config/escalation` | Owner only | Escalation Config Get | `pkg/dashboard/api.go:204` |
 | `PUT` | `/api/config/escalation` | Owner only | Escalation Config Set | `pkg/dashboard/api.go:205` |
-| `GET` | `/api/config/write-surface` | Owner only | Lane write allowlist (`write_surface.allowlist`, [#9587](https://github.com/hivecommons/hive/issues/9587)): `allowlist`, `ops`, `warnings` | `pkg/dashboard/api.go:438` |
-| `PUT` | `/api/config/write-surface` | Owner only | Replace the lane write allowlist; `{"allowlist": {}}` clears it; unknown operation or bad lane name is a 400 with nothing changed | `pkg/dashboard/api.go:439` |
+| `GET` | `/api/config/write-surface` | Owner only | Lane write allowlist (`write_surface.allowlist`, [#9587](https://github.com/hivecommons/hive/issues/9587)): `allowlist`, `ops`, `warnings` | `pkg/dashboard/api.go:437` |
+| `PUT` | `/api/config/write-surface` | Owner only | Replace the lane write allowlist; `{"allowlist": {}}` clears it; unknown operation or bad lane name is a 400 with nothing changed | `pkg/dashboard/api.go:438` |
 | `GET` | `/api/config/review` | Dashboard auth/session | Review Config Get | `pkg/dashboard/api.go:208` |
 | `PUT` | `/api/config/review` | Owner only | Review Config Set | `pkg/dashboard/api.go:211` |
 | `PUT` | `/api/config/governor/features` | Owner only | Governor Features | `pkg/dashboard/api.go:217` |
@@ -214,7 +214,7 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 | `GET` | `/api/model-advisor` | Dashboard auth/session | Model Advisor | `pkg/dashboard/api.go:153` |
 | `GET` | `/api/governor/pr-models` | Dashboard auth/session | Agent-authored PR distribution by normalized attribution model/backend for `window=7d`, `30d`, or `all`, including per-model rework stats and the top 10 most-reworked PRs | `pkg/dashboard/api.go:154` |
 | `GET` | `/api/reviewer/accuracy` | Dashboard auth/session | Reviewer verdict calibration for the configured window: false-approve/false-block rates and confidence buckets per perspective and reviewer model | `pkg/dashboard/api.go:210` |
-| `GET` | `/api/review/queue` | Dashboard auth/session | PR review queue: every open PR (agent and contributor, actionable and held) ranked by triage class, confidence band, CI state and age, with per-PR `reasons`; paged with `limit` (1-200, default 50) and `offset` | `pkg/dashboard/api.go:435` |
+| `GET` | `/api/review/queue` | Dashboard auth/session | PR review queue: every open PR (agent and contributor, actionable and held) ranked by triage class, confidence band, CI state and age, with per-PR `reasons`; paged with `limit` (1-200, default 50) and `offset` | `pkg/dashboard/api.go:434` |
 | `GET` | `/api/agents` | Dashboard auth/session | Agents List | `pkg/dashboard/api.go:283` |
 | `POST` | `/api/agents` | Owner only | Agent Create | `pkg/dashboard/api.go:284` |
 | `POST` | `/api/agents/import` | Owner only | Agent Import | `pkg/dashboard/api.go:285` |
@@ -285,42 +285,42 @@ Read the result from `GET /api/kick/{agent}/status`, which returns `status` of `
 | `GET` | `/api/knowledge` | Dashboard auth/session | Knowledge List | `pkg/dashboard/api.go:319` |
 | `GET` | `/api/knowledge/export` | Dashboard auth/session | Knowledge Export | `pkg/dashboard/api.go:320` |
 | `GET` | `/api/knowledge/search` | Dashboard auth/session | Knowledge Search | `pkg/dashboard/api.go:321` |
-| `POST` | `/mcp/knowledge` | Public (read-only) when `HIVE_PUBLIC_KNOWLEDGE` is on; 404 otherwise | Public Knowledge MCP endpoint — `initialize`, `tools/list`, `tools/call` for `knowledge_search`/`knowledge_get`/`knowledge_export` ([docs](public-knowledge-mcp.md)) | `pkg/dashboard/api.go:325` |
-| `GET` | `/api/knowledge/health` | Dashboard auth/session | Knowledge Health | `pkg/dashboard/api.go:326` |
-| `GET` | `/api/knowledge/stats` | Dashboard auth/session | Knowledge Stats | `pkg/dashboard/api.go:327` |
-| `GET` | `/api/knowledge/graph` | Dashboard auth/session | Knowledge Graph | `pkg/dashboard/api.go:328` |
-| `GET` | `/api/knowledge/fact-history` | Dashboard auth/session | Fact History | `pkg/dashboard/api.go:329` |
-| `POST` | `/api/knowledge/create` | Dashboard auth/session | Knowledge Create | `pkg/dashboard/api.go:330` |
-| `POST` | `/api/knowledge/import` | Dashboard auth/session | Knowledge Import | `pkg/dashboard/api.go:331` |
-| `POST` | `/api/knowledge/promote` | Dashboard auth/session | Knowledge Promote | `pkg/dashboard/api.go:337` |
-| `GET` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs List | `pkg/dashboard/api.go:338` |
-| `POST` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Add | `pkg/dashboard/api.go:339` |
-| `DELETE` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Remove | `pkg/dashboard/api.go:340` |
-| `PUT` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Update | `pkg/dashboard/api.go:341` |
-| `DELETE` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Delete | `pkg/dashboard/api.go:342` |
-| `GET` | `/api/knowledge/{layer}` | Dashboard auth/session | Knowledge Layer | `pkg/dashboard/api.go:343` |
-| `GET` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Fact | `pkg/dashboard/api.go:344` |
-| `PUT` | `/api/knowledge/enabled` | Owner only | Knowledge Toggle | `pkg/dashboard/api.go:345` |
-| `GET` | `/api/knowledge/bead-synthesizer` | Dashboard auth/session | Bead Synth Status | `pkg/dashboard/api.go:346` |
-| `PUT` | `/api/knowledge/bead-synthesizer/enabled` | Owner only | Bead Synth Toggle | `pkg/dashboard/api.go:347` |
-| `GET` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults List | `pkg/dashboard/api.go:348` |
-| `POST` | `/api/knowledge/vaults` | Owner only | Vaults Connect | `pkg/dashboard/api.go:349` |
-| `DELETE` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults Disconnect | `pkg/dashboard/api.go:350` |
-| `POST` | `/api/knowledge/vaults/reindex` | Dashboard auth/session | Vaults Reindex | `pkg/dashboard/api.go:351` |
-| `GET` | `/api/knowledge/vaults/{name}/facts` | Dashboard auth/session | Vault Facts | `pkg/dashboard/api.go:352` |
-| `GET` | `/api/knowledge/git-sources` | Dashboard auth/session | Git Sources List | `pkg/dashboard/api.go:353` |
-| `POST` | `/api/knowledge/git-sources` | Owner only | Git Sources Connect | `pkg/dashboard/api.go:354` |
-| `DELETE` | `/api/knowledge/git-sources` | Owner only | Git Sources Disconnect | `pkg/dashboard/api.go:355` |
-| `POST` | `/api/knowledge/obsidian/sync` | Dashboard auth/session | Obsidian Sync | `pkg/dashboard/api.go:356` |
-| `GET` | `/api/knowledge/documents` | Dashboard auth/session | Documents List | `pkg/dashboard/api.go:357` |
-| `POST` | `/api/knowledge/documents` | Dashboard auth/session | Documents Import | `pkg/dashboard/api.go:358` |
-| `GET` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Get | `pkg/dashboard/api.go:359` |
-| `DELETE` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Delete | `pkg/dashboard/api.go:360` |
-| `POST` | `/api/knowledge/documents/{slug}/reimport` | Dashboard auth/session | Document Reimport | `pkg/dashboard/api.go:361` |
-| `GET` | `/api/knowledge/context7/search` | Dashboard auth/session | Context7 Search | `pkg/dashboard/api.go:362` |
-| `POST` | `/api/knowledge/cleanup-orphans` | Dashboard auth/session | Cleanup Orphans | `pkg/dashboard/api.go:363` |
-| `GET` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channels List | `pkg/dashboard/api.go:335` |
-| `POST` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channel Create | `pkg/dashboard/api.go:336` |
+| `POST` | `/mcp/knowledge` | Public (read-only) when `HIVE_PUBLIC_KNOWLEDGE` is on; 404 otherwise | Public Knowledge MCP endpoint — `initialize`, `tools/list`, `tools/call` for `knowledge_search`/`knowledge_get`/`knowledge_export` ([docs](public-knowledge-mcp.md)) | `pkg/dashboard/api.go:324` |
+| `GET` | `/api/knowledge/health` | Dashboard auth/session | Knowledge Health | `pkg/dashboard/api.go:325` |
+| `GET` | `/api/knowledge/stats` | Dashboard auth/session | Knowledge Stats | `pkg/dashboard/api.go:326` |
+| `GET` | `/api/knowledge/graph` | Dashboard auth/session | Knowledge Graph | `pkg/dashboard/api.go:327` |
+| `GET` | `/api/knowledge/fact-history` | Dashboard auth/session | Fact History | `pkg/dashboard/api.go:328` |
+| `POST` | `/api/knowledge/create` | Dashboard auth/session | Knowledge Create | `pkg/dashboard/api.go:329` |
+| `POST` | `/api/knowledge/import` | Dashboard auth/session | Knowledge Import | `pkg/dashboard/api.go:330` |
+| `POST` | `/api/knowledge/promote` | Dashboard auth/session | Knowledge Promote | `pkg/dashboard/api.go:336` |
+| `GET` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs List | `pkg/dashboard/api.go:337` |
+| `POST` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Add | `pkg/dashboard/api.go:338` |
+| `DELETE` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Remove | `pkg/dashboard/api.go:339` |
+| `PUT` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Update | `pkg/dashboard/api.go:340` |
+| `DELETE` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Delete | `pkg/dashboard/api.go:341` |
+| `GET` | `/api/knowledge/{layer}` | Dashboard auth/session | Knowledge Layer | `pkg/dashboard/api.go:342` |
+| `GET` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Fact | `pkg/dashboard/api.go:343` |
+| `PUT` | `/api/knowledge/enabled` | Owner only | Knowledge Toggle | `pkg/dashboard/api.go:344` |
+| `GET` | `/api/knowledge/bead-synthesizer` | Dashboard auth/session | Bead Synth Status | `pkg/dashboard/api.go:345` |
+| `PUT` | `/api/knowledge/bead-synthesizer/enabled` | Owner only | Bead Synth Toggle | `pkg/dashboard/api.go:346` |
+| `GET` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults List | `pkg/dashboard/api.go:347` |
+| `POST` | `/api/knowledge/vaults` | Owner only | Vaults Connect | `pkg/dashboard/api.go:348` |
+| `DELETE` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults Disconnect | `pkg/dashboard/api.go:349` |
+| `POST` | `/api/knowledge/vaults/reindex` | Dashboard auth/session | Vaults Reindex | `pkg/dashboard/api.go:350` |
+| `GET` | `/api/knowledge/vaults/{name}/facts` | Dashboard auth/session | Vault Facts | `pkg/dashboard/api.go:351` |
+| `GET` | `/api/knowledge/git-sources` | Dashboard auth/session | Git Sources List | `pkg/dashboard/api.go:352` |
+| `POST` | `/api/knowledge/git-sources` | Owner only | Git Sources Connect | `pkg/dashboard/api.go:353` |
+| `DELETE` | `/api/knowledge/git-sources` | Owner only | Git Sources Disconnect | `pkg/dashboard/api.go:354` |
+| `POST` | `/api/knowledge/obsidian/sync` | Dashboard auth/session | Obsidian Sync | `pkg/dashboard/api.go:355` |
+| `GET` | `/api/knowledge/documents` | Dashboard auth/session | Documents List | `pkg/dashboard/api.go:356` |
+| `POST` | `/api/knowledge/documents` | Dashboard auth/session | Documents Import | `pkg/dashboard/api.go:357` |
+| `GET` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Get | `pkg/dashboard/api.go:358` |
+| `DELETE` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Delete | `pkg/dashboard/api.go:359` |
+| `POST` | `/api/knowledge/documents/{slug}/reimport` | Dashboard auth/session | Document Reimport | `pkg/dashboard/api.go:360` |
+| `GET` | `/api/knowledge/context7/search` | Dashboard auth/session | Context7 Search | `pkg/dashboard/api.go:361` |
+| `POST` | `/api/knowledge/cleanup-orphans` | Dashboard auth/session | Cleanup Orphans | `pkg/dashboard/api.go:362` |
+| `GET` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channels List | `pkg/dashboard/api.go:334` |
+| `POST` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channel Create | `pkg/dashboard/api.go:335` |
 
 ## Contribute
 
@@ -428,63 +428,63 @@ always resolved server-side from the validated token.
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/nous/status` | Dashboard auth/session | Nous Status | `pkg/dashboard/api.go:397` |
-| `GET` | `/api/nous/ledger` | Dashboard auth/session | Nous Ledger | `pkg/dashboard/api.go:398` |
-| `GET` | `/api/nous/principles` | Dashboard auth/session | Nous Principles | `pkg/dashboard/api.go:399` |
-| `POST` | `/api/nous/approve` | Owner only | Nous Approve | `pkg/dashboard/api.go:400` |
-| `POST` | `/api/nous/abort` | Owner only | Nous Abort | `pkg/dashboard/api.go:401` |
-| `PUT` | `/api/nous/mode` | Owner only | Nous Mode | `pkg/dashboard/api.go:402` |
-| `PUT` | `/api/nous/scope` | Owner only | Nous Scope | `pkg/dashboard/api.go:403` |
-| `GET` | `/api/nous/phase` | Dashboard auth/session | Nous Phase | `pkg/dashboard/api.go:404` |
-| `PUT` | `/api/nous/gate-decision` | Owner only | Nous Gate Decision | `pkg/dashboard/api.go:405` |
-| `GET` | `/api/nous/gate-pending` | Dashboard auth/session | Nous Gate Pending | `pkg/dashboard/api.go:406` |
-| `POST` | `/api/nous/gate-respond` | Owner only | Nous Gate Respond | `pkg/dashboard/api.go:407` |
-| `GET` | `/api/nous/gate-response` | Dashboard auth/session | Nous Gate Response | `pkg/dashboard/api.go:408` |
-| `GET` | `/api/nous/config` | Dashboard auth/session | Nous Config Get | `pkg/dashboard/api.go:409` |
-| `PUT` | `/api/nous/config/goals` | Owner only | Nous Config Goals | `pkg/dashboard/api.go:410` |
-| `PUT` | `/api/nous/config/repos` | Owner only | Nous Config Repos | `pkg/dashboard/api.go:411` |
-| `PUT` | `/api/nous/config/output` | Owner only | Nous Config Output | `pkg/dashboard/api.go:412` |
-| `PUT` | `/api/nous/config/fast-fail` | Owner only | Nous Config Fast Fail | `pkg/dashboard/api.go:413` |
-| `PUT` | `/api/nous/config/schedule` | Owner only | Nous Config Schedule | `pkg/dashboard/api.go:414` |
-| `PUT` | `/api/nous/config/controllables` | Owner only | Nous Config Controllables | `pkg/dashboard/api.go:415` |
-| `PUT` | `/api/nous/config/principles` | Owner only | Nous Config Principles | `pkg/dashboard/api.go:416` |
-| `DELETE` | `/api/nous/principles/{id}` | Owner only | Nous Delete Principle | `pkg/dashboard/api.go:417` |
+| `GET` | `/api/nous/status` | Dashboard auth/session | Nous Status | `pkg/dashboard/api.go:396` |
+| `GET` | `/api/nous/ledger` | Dashboard auth/session | Nous Ledger | `pkg/dashboard/api.go:397` |
+| `GET` | `/api/nous/principles` | Dashboard auth/session | Nous Principles | `pkg/dashboard/api.go:398` |
+| `POST` | `/api/nous/approve` | Owner only | Nous Approve | `pkg/dashboard/api.go:399` |
+| `POST` | `/api/nous/abort` | Owner only | Nous Abort | `pkg/dashboard/api.go:400` |
+| `PUT` | `/api/nous/mode` | Owner only | Nous Mode | `pkg/dashboard/api.go:401` |
+| `PUT` | `/api/nous/scope` | Owner only | Nous Scope | `pkg/dashboard/api.go:402` |
+| `GET` | `/api/nous/phase` | Dashboard auth/session | Nous Phase | `pkg/dashboard/api.go:403` |
+| `PUT` | `/api/nous/gate-decision` | Owner only | Nous Gate Decision | `pkg/dashboard/api.go:404` |
+| `GET` | `/api/nous/gate-pending` | Dashboard auth/session | Nous Gate Pending | `pkg/dashboard/api.go:405` |
+| `POST` | `/api/nous/gate-respond` | Owner only | Nous Gate Respond | `pkg/dashboard/api.go:406` |
+| `GET` | `/api/nous/gate-response` | Dashboard auth/session | Nous Gate Response | `pkg/dashboard/api.go:407` |
+| `GET` | `/api/nous/config` | Dashboard auth/session | Nous Config Get | `pkg/dashboard/api.go:408` |
+| `PUT` | `/api/nous/config/goals` | Owner only | Nous Config Goals | `pkg/dashboard/api.go:409` |
+| `PUT` | `/api/nous/config/repos` | Owner only | Nous Config Repos | `pkg/dashboard/api.go:410` |
+| `PUT` | `/api/nous/config/output` | Owner only | Nous Config Output | `pkg/dashboard/api.go:411` |
+| `PUT` | `/api/nous/config/fast-fail` | Owner only | Nous Config Fast Fail | `pkg/dashboard/api.go:412` |
+| `PUT` | `/api/nous/config/schedule` | Owner only | Nous Config Schedule | `pkg/dashboard/api.go:413` |
+| `PUT` | `/api/nous/config/controllables` | Owner only | Nous Config Controllables | `pkg/dashboard/api.go:414` |
+| `PUT` | `/api/nous/config/principles` | Owner only | Nous Config Principles | `pkg/dashboard/api.go:415` |
+| `DELETE` | `/api/nous/principles/{id}` | Owner only | Nous Delete Principle | `pkg/dashboard/api.go:416` |
 
 ## Inception
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `POST` | `/api/inception/start` | Owner only | Inception Start | `pkg/dashboard/api.go:368` |
-| `POST` | `/api/inception/scan` | Owner only | Inception Scan | `pkg/dashboard/api.go:369` |
-| `GET` | `/api/inception/state` | Dashboard auth/session | Inception State | `pkg/dashboard/api.go:370` |
-| `POST` | `/api/inception/questions` | Owner only | Inception Set Questions | `pkg/dashboard/api.go:371` |
-| `POST` | `/api/inception/answer` | Owner only | Inception Answer | `pkg/dashboard/api.go:372` |
-| `POST` | `/api/inception/facts` | Owner only | Inception Record Facts | `pkg/dashboard/api.go:373` |
-| `GET` | `/api/inception/scaffold` | Dashboard auth/session | Inception Scaffold | `pkg/dashboard/api.go:374` |
-| `POST` | `/api/inception/approve` | Owner only | Inception Approve | `pkg/dashboard/api.go:375` |
-| `POST` | `/api/inception/reset` | Owner only | Inception Reset | `pkg/dashboard/api.go:376` |
-| `GET` | `/api/inception/ideation-facts` | Dashboard auth/session | Inception Ideation Facts | `pkg/dashboard/api.go:377` |
-| `GET` | `/api/inception/download` | Dashboard auth/session | Inception Download | `pkg/dashboard/api.go:378` |
-| `GET` | `/api/inception/has-files` | Dashboard auth/session | Inception Has Files | `pkg/dashboard/api.go:379` |
-| `PUT` | `/api/inception/wiki-name` | Owner only | Inception Rename Wiki | `pkg/dashboard/api.go:380` |
-| `POST` | `/api/inception/import` | Owner only | Inception Import | `pkg/dashboard/api.go:381` |
+| `POST` | `/api/inception/start` | Owner only | Inception Start | `pkg/dashboard/api.go:367` |
+| `POST` | `/api/inception/scan` | Owner only | Inception Scan | `pkg/dashboard/api.go:368` |
+| `GET` | `/api/inception/state` | Dashboard auth/session | Inception State | `pkg/dashboard/api.go:369` |
+| `POST` | `/api/inception/questions` | Owner only | Inception Set Questions | `pkg/dashboard/api.go:370` |
+| `POST` | `/api/inception/answer` | Owner only | Inception Answer | `pkg/dashboard/api.go:371` |
+| `POST` | `/api/inception/facts` | Owner only | Inception Record Facts | `pkg/dashboard/api.go:372` |
+| `GET` | `/api/inception/scaffold` | Dashboard auth/session | Inception Scaffold | `pkg/dashboard/api.go:373` |
+| `POST` | `/api/inception/approve` | Owner only | Inception Approve | `pkg/dashboard/api.go:374` |
+| `POST` | `/api/inception/reset` | Owner only | Inception Reset | `pkg/dashboard/api.go:375` |
+| `GET` | `/api/inception/ideation-facts` | Dashboard auth/session | Inception Ideation Facts | `pkg/dashboard/api.go:376` |
+| `GET` | `/api/inception/download` | Dashboard auth/session | Inception Download | `pkg/dashboard/api.go:377` |
+| `GET` | `/api/inception/has-files` | Dashboard auth/session | Inception Has Files | `pkg/dashboard/api.go:378` |
+| `PUT` | `/api/inception/wiki-name` | Owner only | Inception Rename Wiki | `pkg/dashboard/api.go:379` |
+| `POST` | `/api/inception/import` | Owner only | Inception Import | `pkg/dashboard/api.go:380` |
 
 ## Beads
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/beads` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:419` |
-| `GET` | `/api/beads/{agent}` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:420` |
-| `POST` | `/api/beads/{agent}` | Owner only | Beads Create | `pkg/dashboard/api.go:421` |
-| `POST` | `/api/beads/reset` | Owner only | Beads Reset | `pkg/dashboard/api.go:422` |
-| `POST` | `/api/beads/reset/{agent}` | Owner only | Beads Reset Agent | `pkg/dashboard/api.go:423` |
+| `GET` | `/api/beads` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:418` |
+| `GET` | `/api/beads/{agent}` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:419` |
+| `POST` | `/api/beads/{agent}` | Owner only | Beads Create | `pkg/dashboard/api.go:420` |
+| `POST` | `/api/beads/reset` | Owner only | Beads Reset | `pkg/dashboard/api.go:421` |
+| `POST` | `/api/beads/reset/{agent}` | Owner only | Beads Reset Agent | `pkg/dashboard/api.go:422` |
 
 ## Dashboard miscellaneous
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
 | `GET` | `/api/audit` | Read-write role | Audit Log — `{"entries": [...]}` envelope, newest first, capped at 200; response shape and the serve-time `user_name` field in [audit-log.md](audit-log.md#get-apiaudit) | `pkg/dashboard/api.go:51` |
-| `GET` | `/api/watchdog/activity` | Read-write role | Watchdog activity readout for the Health tab (#7254): `watchdog-*` audit actions over `?days=` (default 30, clamped to 90) — total / taken / observed / `byAction`, a zero-filled per-day `daily` histogram, per-agent `agents` liveness, and the Observe → Heal `promotion` hint; see [agent-watchdog.md](agent-watchdog.md#watchdog-activity-strip) | `pkg/dashboard/api.go:430` |
+| `GET` | `/api/watchdog/activity` | Read-write role | Watchdog activity readout for the Health tab (#7254): `watchdog-*` audit actions over `?days=` (default 30, clamped to 90) — total / taken / observed / `byAction`, a zero-filled per-day `daily` histogram, per-agent `agents` liveness, and the Observe → Heal `promotion` hint; see [agent-watchdog.md](agent-watchdog.md#watchdog-activity-strip) | `pkg/dashboard/api.go:429` |
 | `POST` | `/api/presence` | Dashboard auth/session | Presence | `pkg/dashboard/api.go:54` |
 | `GET` | `/api/prompt-history` | Dashboard auth/session | Prompt History | `pkg/dashboard/api.go:55` |
 | `POST` | `/api/self-upgrade` | Owner only | Self Upgrade | `pkg/dashboard/api.go:56` |
@@ -498,11 +498,11 @@ always resolved server-side from the validated token.
 
 
 | `GET` | `/api/convergence/soak` | Owner only | Convergence Soak Status | `pkg/dashboard/api.go:231` |
-| `POST` | `/api/plan/from-issue` | Dashboard auth/session | Plan From Issue | `pkg/dashboard/api.go:386` |
-| `GET` | `/api/plan/{epicID}` | Dashboard auth/session | Plan Tree | `pkg/dashboard/api.go:389` |
-| `POST` | `/api/plan/{epicID}/approve` | Owner only | Plan Approve | `pkg/dashboard/api.go:390` |
-| `POST` | `/api/plan/{epicID}/reject` | Owner only | Plan Reject | `pkg/dashboard/api.go:392` |
-| `POST` | `/api/plan/{epicID}/child/{childID}` | Owner only | Plan Child Action | `pkg/dashboard/api.go:393` |
+| `POST` | `/api/plan/from-issue` | Dashboard auth/session | Plan From Issue | `pkg/dashboard/api.go:385` |
+| `GET` | `/api/plan/{epicID}` | Dashboard auth/session | Plan Tree | `pkg/dashboard/api.go:388` |
+| `POST` | `/api/plan/{epicID}/approve` | Owner only | Plan Approve | `pkg/dashboard/api.go:389` |
+| `POST` | `/api/plan/{epicID}/reject` | Owner only | Plan Reject | `pkg/dashboard/api.go:391` |
+| `POST` | `/api/plan/{epicID}/child/{childID}` | Owner only | Plan Child Action | `pkg/dashboard/api.go:392` |
 | `POST` | `/api/linear/agent/install` | Owner only | Linear Agent Install (OAuth start) | `pkg/dashboard/api_linear_agent.go:215` |
 | `GET` | `/api/linear/agent/status` | Owner only | Linear Agent Status | `pkg/dashboard/api_linear_agent.go:216` |
 | `POST` | `/api/linear/agent/disconnect` | Owner only | Linear Agent Disconnect | `pkg/dashboard/api_linear_agent.go:217` |
@@ -517,10 +517,10 @@ always resolved server-side from the validated token.
 | `GET` | `/api/summaries` | Dashboard auth/session | Summaries | `pkg/dashboard/api.go:168` |
 | `POST` | `/api/prs/{owner}/{repo}/{number}/queue-automerge` | Merger/owner role | Queue PRAuto Merge | `pkg/dashboard/api.go:169` |
 | `GET` | `/api/inference/models/{backend}` | Dashboard auth/session | Inference Models | `pkg/dashboard/api.go:317` |
-| `GET` | `/api/hive-id` | Dashboard auth/session | Hive IDGet | `pkg/dashboard/api.go:365` |
-| `PUT` | `/api/hive-id` | Owner only | Hive IDSet | `pkg/dashboard/api.go:366` |
-| `POST` | `/api/chat` | Dashboard auth/session | Chat | `pkg/dashboard/api.go:395` |
-| `GET` | `/api/auth/token` | Public | Auth Token | `pkg/dashboard/api.go:425` |
+| `GET` | `/api/hive-id` | Dashboard auth/session | Hive IDGet | `pkg/dashboard/api.go:364` |
+| `PUT` | `/api/hive-id` | Owner only | Hive IDSet | `pkg/dashboard/api.go:365` |
+| `POST` | `/api/chat` | Dashboard auth/session | Chat | `pkg/dashboard/api.go:394` |
+| `GET` | `/api/auth/token` | Public | Auth Token | `pkg/dashboard/api.go:424` |
 | `GET` | `/api/v1/` | GitHub token | Contributor v1 API dispatcher | `pkg/dashboard/api_contribute.go:236` |
 | `POST` | `/api/v1/` | GitHub token | Contributor v1 API dispatcher | `pkg/dashboard/api_contribute.go:237` |
 | `GET` | `/api/docs` | Dashboard auth/session | APIDocs | `pkg/dashboard/api_contribute.go:238` |
diff --git a/src/pkg/dashboard/api.go b/src/pkg/dashboard/api.go
index 71c054f2eb..8779ce3be5 100644
--- a/src/pkg/dashboard/api.go
+++ b/src/pkg/dashboard/api.go
@@ -319,10 +319,9 @@ func (s *Server) RegisterAPI(deps *Dependencies) {
 	s.mux.HandleFunc("GET /api/knowledge", s.handleKnowledgeList)
 	s.mux.HandleFunc("GET /api/knowledge/export", s.handleKnowledgeExport)
 	s.mux.HandleFunc("GET /api/knowledge/search", s.handleKnowledgeSearch)
-	// Anonymous, owner-switched, read-only MCP surface (#10615). Registered
-	// without a method so GET/DELETE get a deliberate 405 instead of falling
-	// through to another handler.
-	s.mux.HandleFunc(publicKnowledgeMCPPath, s.handlePublicKnowledgeMCP)
+	// Anonymous, owner-switched, read-only MCP surface (#10615). POST only —
+	// the mux answers other verbs with 405, and there is no SSE stream.
+	s.mux.HandleFunc("POST /mcp/knowledge", s.handlePublicKnowledgeMCP) // path == publicKnowledgeMCPPath
 	s.mux.HandleFunc("GET /api/knowledge/health", s.handleKnowledgeHealth)
 	s.mux.HandleFunc("GET /api/knowledge/stats", s.handleKnowledgeStats)
 	s.mux.HandleFunc("GET /api/knowledge/graph", s.handleKnowledgeGraph)
diff --git a/src/pkg/dashboard/mcp_knowledge.go b/src/pkg/dashboard/mcp_knowledge.go
index c1c45d94f6..015d27cfaa 100644
--- a/src/pkg/dashboard/mcp_knowledge.go
+++ b/src/pkg/dashboard/mcp_knowledge.go
@@ -308,12 +308,6 @@ func (s *Server) handlePublicKnowledgeMCP(w http.ResponseWriter, r *http.Request
 		http.NotFound(w, r)
 		return
 	}
-	if r.Method != http.MethodPost {
-		w.Header().Set("Allow", http.MethodPost)
-		jsonError(w, "public knowledge MCP endpoint accepts POST only (no SSE stream)", http.StatusMethodNotAllowed)
-		return
-	}
-
 	body, err := io.ReadAll(io.LimitReader(r.Body, publicKnowledgeMaxBodyBytes+1))
 	if err != nil || len(body) > publicKnowledgeMaxBodyBytes {
 		writeJSONRPC(w, http.StatusRequestEntityTooLarge, jsonRPCResponse{JSONRPC: "2.0", ID: nullID, Error: &jsonRPCError{Code: jsonRPCInvalidRequest, Message: "request body too large"}})
diff --git a/src/pkg/dashboard/mcp_knowledge_test.go b/src/pkg/dashboard/mcp_knowledge_test.go
index 8d9ef6edf7..e3cefd17ff 100644
--- a/src/pkg/dashboard/mcp_knowledge_test.go
+++ b/src/pkg/dashboard/mcp_knowledge_test.go
@@ -325,3 +325,11 @@ func TestPublicKnowledgeTypeListExcludesGovernance(t *testing.T) {
 		t.Errorf("public type list = %s", got)
 	}
 }
+
+// The route is registered with a literal so docs/api-reference.md citations
+// can verify it; keep the literal and the constant in lock-step.
+func TestPublicKnowledgeMCPPathConstantMatchesRoute(t *testing.T) {
+	if publicKnowledgeMCPPath != "/mcp/knowledge" {
+		t.Fatalf("publicKnowledgeMCPPath = %q; update the HandleFunc literal in api.go and docs/api-reference.md", publicKnowledgeMCPPath)
+	}
+}

From 881c6fa89ee7888b660df9284d966f346811fd55 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:07:13 -0400
Subject: [PATCH 08/14] hub: test that /mcp/knowledge bypasses the SaaS
 auth_request gate exactly

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 ...aas_authcheck_public_knowledge_mcp_test.go | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 src/pkg/hub/saas_authcheck_public_knowledge_mcp_test.go

diff --git a/src/pkg/hub/saas_authcheck_public_knowledge_mcp_test.go b/src/pkg/hub/saas_authcheck_public_knowledge_mcp_test.go
new file mode 100644
index 0000000000..2c699410da
--- /dev/null
+++ b/src/pkg/hub/saas_authcheck_public_knowledge_mcp_test.go
@@ -0,0 +1,36 @@
+package hub
+
+import (
+	"net/http"
+	"testing"
+)
+
+// The hub cannot see a spoke's HIVE_PUBLIC_KNOWLEDGE, so it waves
+// /mcp/knowledge through the nginx auth_request gate and lets the spoke
+// fail closed (#10615) — the same arrangement as knowledgeExportPath (#8294).
+func TestSaaSAuthCheckPublicKnowledgeMCPPathBypassesGate(t *testing.T) {
+	cleanup := helperSetupTempDirs(t)
+	defer cleanup()
+	s := newHandlerHub()
+	demotedOwnerFixture(t, s, "spoke-owner", "owned-hive")
+
+	if !isSaaSPublicPath(publicKnowledgeMCPPath) || !isSaaSPublicPath(publicKnowledgeMCPPath+"?x=1") {
+		t.Fatalf("%s must be a SaaS public path", publicKnowledgeMCPPath)
+	}
+	// Only the exact path — nothing else under /mcp/ is public.
+	for _, p := range []string{"/mcp", "/mcp/", "/mcp/knowledge/admin", "/mcp/other"} {
+		if isSaaSPublicPath(p) {
+			t.Errorf("%s must NOT be public", p)
+		}
+	}
+
+	rec := publicPathAuthCheck(t, s, "owned-hive", publicKnowledgeMCPPath, "")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("%s anonymous: status = %d, want 200 (a 401 becomes an auth-signin redirect and an external agent never reaches the spoke's own switch)", publicKnowledgeMCPPath, rec.Code)
+	}
+	for _, h := range []string{"X-Hive-User", "X-Hive-Role", proxyAuthHeader} {
+		if got := rec.Header().Get(h); got != "" {
+			t.Errorf("%s anonymous: %s = %q, want unset", publicKnowledgeMCPPath, h, got)
+		}
+	}
+}

From f26876cc8dde6c1df100b870166ba6888a3f7a70 Mon Sep 17 00:00:00 2001
From: clubanderson <407614+clubanderson@users.noreply.github.com>
Date: Mon, 5 Oct 2026 16:11:42 +0000
Subject: [PATCH 09/14] changelog: fragment for #10621

Generated by changelog-fragment-guard from the PR title (#5675).
Edit the wording freely, or replace this file with the no-changelog
label if the change is not user-visible.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: clubanderson <407614+clubanderson@users.noreply.github.com>
---
 changelog.d/added-10621.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/added-10621.md

diff --git a/changelog.d/added-10621.md b/changelog.d/added-10621.md
new file mode 100644
index 0000000000..efae0b436d
--- /dev/null
+++ b/changelog.d/added-10621.md
@@ -0,0 +1 @@
+- knowledge: owner-switched, read-only public MCP endpoint for external agents (#10621)

From c6123f68944bd35a9dd9617a615a34cad8420714 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:22:12 -0400
Subject: [PATCH 10/14] changelog: drop duplicate fragment (bot added
 added-10621.md)

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 changelog.d/added-public-knowledge-mcp-10615.md | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 changelog.d/added-public-knowledge-mcp-10615.md

diff --git a/changelog.d/added-public-knowledge-mcp-10615.md b/changelog.d/added-public-knowledge-mcp-10615.md
deleted file mode 100644
index af38081e5c..0000000000
--- a/changelog.d/added-public-knowledge-mcp-10615.md
+++ /dev/null
@@ -1 +0,0 @@
-Added an owner-switched, **read-only** public knowledge MCP endpoint (`POST /mcp/knowledge`, `HIVE_PUBLIC_KNOWLEDGE=1`) so any external agent — Goose, Claude, Copilot — can search, fetch, and export a hive's operational knowledge without credentials. Only operational fact types are served, sources/usage data are stripped, and no write method exists on the surface (#10615).

From 2d44a7cfe07db056d6cc46e2ec6f8a0ed621ab83 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:29:28 -0400
Subject: [PATCH 11/14] Harden public knowledge MCP: full bodies, type filter,
 related filtering, MCP 2025-06-18

- knowledge_get/export/search re-read facts by slug so bodies are not the
  200-rune store snippets
- enforce the type filter after search (vault/git stores ignore it)
- over-fetch 10x before the public filter so private facts cannot starve
  the result window
- filter Related down to public slugs
- advertise MCP 2025-06-18 and reject JSON-RPC batches with -32600

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 src/docs/public-knowledge-mcp.md        |   9 +-
 src/pkg/dashboard/mcp_knowledge.go      | 104 ++++++++++++++++++++----
 src/pkg/dashboard/mcp_knowledge_test.go |  76 ++++++++++++++++-
 3 files changed, 171 insertions(+), 18 deletions(-)

diff --git a/src/docs/public-knowledge-mcp.md b/src/docs/public-knowledge-mcp.md
index 76fe8af4f3..3e1ecf89d9 100644
--- a/src/docs/public-knowledge-mcp.md
+++ b/src/docs/public-knowledge-mcp.md
@@ -46,9 +46,16 @@ handshake (`initialize`, `ping`, `notifications/*`), `tools/list`, and
 mutation. Anonymous callers cannot alter a knowledge base, and every tool is
 annotated `readOnlyHint: true` so MCP clients run them without confirmation.
 
-Other hard limits: POST only (no SSE stream), 64 KiB request body,
+Other hard limits: POST only (no SSE stream), 64 KiB request body, one
+JSON-RPC request per POST (batch arrays are answered with `-32600`; the
+endpoint speaks MCP `2025-06-18`, which dropped batching), and
 `knowledge_search` returns at most 50 results per call.
 
+A fact's `related` list is filtered to public slugs, so a public fact cannot
+disclose even the name of a private one. `knowledge_get` and
+`knowledge_export` return complete bodies; `knowledge_search` results do too,
+re-read per hit.
+
 ## Tools
 
 | Tool | Arguments | Returns |
diff --git a/src/pkg/dashboard/mcp_knowledge.go b/src/pkg/dashboard/mcp_knowledge.go
index 015d27cfaa..e64801e98f 100644
--- a/src/pkg/dashboard/mcp_knowledge.go
+++ b/src/pkg/dashboard/mcp_knowledge.go
@@ -1,6 +1,7 @@
 package dashboard
 
 import (
+	"bytes"
 	"crypto/sha256"
 	"encoding/json"
 	"fmt"
@@ -42,8 +43,10 @@ const (
 	// every fact of a public type is exposed.
 	publicKnowledgeTagsEnv = "HIVE_PUBLIC_KNOWLEDGE_TAGS"
 
-	// mcpProtocolVersion is the MCP spec revision this endpoint speaks.
-	mcpProtocolVersion = "2025-03-26"
+	// mcpProtocolVersion is the MCP spec revision this endpoint speaks. The
+	// 2025-06-18 revision dropped JSON-RPC batching, which this endpoint does
+	// not implement (a batch array is answered with -32600).
+	mcpProtocolVersion = "2025-06-18"
 
 	// publicKnowledgeDefaultLimit / MaxLimit bound knowledge_search results so
 	// an anonymous caller cannot pull the whole base one query at a time
@@ -51,6 +54,12 @@ const (
 	publicKnowledgeDefaultLimit = 10
 	publicKnowledgeMaxLimit     = 50
 
+	// publicKnowledgeOverfetch is how many ranked hits are pulled from the
+	// stores before the public filter runs. Stores rank across ALL types, so
+	// a hive heavy in private decision/idea facts could otherwise fill the
+	// window with facts the filter then drops and starve the result set.
+	publicKnowledgeOverfetch = publicKnowledgeMaxLimit * 10
+
 	// publicKnowledgeMaxBodyBytes caps a JSON-RPC request body.
 	publicKnowledgeMaxBodyBytes = 64 << 10
 
@@ -130,18 +139,59 @@ type publicFact struct {
 	Related    []string `json:"related,omitempty"`
 }
 
-func toPublicFact(f knowledge.Fact) publicFact {
+// toPublicFact projects f. Related is filtered against publicSlugs so a public
+// fact cannot disclose the (often descriptive) slug of a private one.
+func toPublicFact(f knowledge.Fact, publicSlugs map[string]struct{}) publicFact {
 	t := string(f.Type)
 	if t == "" {
 		t = "general"
 	}
-	pf := publicFact{Slug: f.Slug, Title: f.Title, Type: t, Body: f.Body, Tags: f.Tags, Related: f.Related}
+	pf := publicFact{Slug: f.Slug, Title: f.Title, Type: t, Body: f.Body, Tags: f.Tags}
+	for _, r := range f.Related {
+		if _, ok := publicSlugs[r]; ok {
+			pf.Related = append(pf.Related, r)
+		}
+	}
 	if f.ConfidenceScored {
 		pf.Confidence = f.Confidence
 	}
 	return pf
 }
 
+// publicListing returns every public fact (snippet bodies, as the stores list
+// them) plus the set of their slugs. It is the authority for "is this slug
+// public" used by every tool.
+func (s *Server) publicListing(tags []string) ([]knowledge.Fact, map[string]struct{}) {
+	all := publicKnowledgeFilter(s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, "", "", 0), tags)
+	slugs := make(map[string]struct{}, len(all))
+	for _, f := range all {
+		slugs[f.Slug] = struct{}{}
+	}
+	return all, slugs
+}
+
+// withFullBody re-reads f by slug so callers get the complete body rather
+// than the ~200-rune snippet store listings carry. Falls back to f unchanged
+// when the read fails or the stored page is no longer public.
+func (s *Server) withFullBody(f knowledge.Fact) knowledge.Fact {
+	full, err := s.deps.Knowledge.ReadFact(s.deps.Ctx, f.Slug)
+	if err != nil || full == nil || full.Slug != f.Slug {
+		return f
+	}
+	if _, ok := publicKnowledgeTypes[string(full.Type)]; !ok {
+		return f
+	}
+	out := *full
+	// Preserve listing-derived fields the page read does not carry.
+	if len(out.Related) == 0 {
+		out.Related = f.Related
+	}
+	if len(out.Tags) == 0 {
+		out.Tags = f.Tags
+	}
+	return out
+}
+
 // publicKnowledgeFilter keeps only facts of a public type that match the tag
 // allow-list (if any). It is the single choke point every tool goes through.
 func publicKnowledgeFilter(facts []knowledge.Fact, tags []string) []knowledge.Fact {
@@ -314,6 +364,11 @@ func (s *Server) handlePublicKnowledgeMCP(w http.ResponseWriter, r *http.Request
 		return
 	}
 
+	if trimmed := bytes.TrimSpace(body); len(trimmed) > 0 && trimmed[0] == '[' {
+		writeJSONRPC(w, http.StatusBadRequest, jsonRPCResponse{JSONRPC: "2.0", ID: nullID, Error: &jsonRPCError{Code: jsonRPCInvalidRequest, Message: "JSON-RPC batch requests are not supported; send one request per POST"}})
+		return
+	}
+
 	var req jsonRPCRequest
 	if err := json.Unmarshal(body, &req); err != nil {
 		writeJSONRPC(w, http.StatusBadRequest, jsonRPCResponse{JSONRPC: "2.0", ID: nullID, Error: &jsonRPCError{Code: jsonRPCParseError, Message: "invalid JSON"}})
@@ -418,16 +473,22 @@ func (s *Server) callPublicKnowledgeTool(r *http.Request, raw json.RawMessage) (
 		if limit > publicKnowledgeMaxLimit {
 			limit = publicKnowledgeMaxLimit
 		}
-		// Over-fetch so the public filter does not starve the result set, then
-		// trim to the requested bound.
-		facts := s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, args.Query, args.Type, publicKnowledgeMaxLimit*2)
-		facts = publicKnowledgeFilter(facts, tags)
-		if len(facts) > limit {
-			facts = facts[:limit]
-		}
-		out := make([]publicFact, 0, len(facts))
+		_, publicSlugs := s.publicListing(tags)
+		facts := publicKnowledgeFilter(s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, args.Query, args.Type, publicKnowledgeOverfetch), tags)
+		out := make([]publicFact, 0, limit)
 		for _, f := range facts {
-			out = append(out, toPublicFact(f))
+			if len(out) >= limit {
+				break
+			}
+			// Vault/git-source stores ignore the type argument; enforce it here
+			// so the advertised filter holds for every source.
+			if args.Type != "" && publicTypeName(f.Type) != args.Type {
+				continue
+			}
+			if _, ok := publicSlugs[f.Slug]; !ok {
+				continue
+			}
+			out = append(out, toPublicFact(s.withFullBody(f), publicSlugs))
 		}
 		return toolJSON(map[string]interface{}{"query": args.Query, "count": len(out), "results": out})
 
@@ -446,16 +507,19 @@ func (s *Server) callPublicKnowledgeTool(r *http.Request, raw json.RawMessage) (
 		}
 		// Resolve through the same filtered listing search uses so a private
 		// fact can never be fetched by guessing its slug.
-		all := publicKnowledgeFilter(s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, "", "", 0), tags)
+		all, publicSlugs := s.publicListing(tags)
 		for _, f := range all {
 			if f.Slug == args.Slug {
-				return toolJSON(toPublicFact(f))
+				return toolJSON(toPublicFact(s.withFullBody(f), publicSlugs))
 			}
 		}
 		return toolError("fact not found: " + args.Slug), nil
 
 	case "knowledge_export":
-		all := publicKnowledgeFilter(s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, "", "", 0), tags)
+		all, _ := s.publicListing(tags)
+		for i := range all {
+			all[i] = s.withFullBody(all[i])
+		}
 		md := renderPublicKnowledgeMarkdown(all)
 		sum := sha256.Sum256([]byte(md))
 		return map[string]interface{}{
@@ -470,6 +534,14 @@ func (s *Server) callPublicKnowledgeTool(r *http.Request, raw json.RawMessage) (
 	}
 }
 
+// publicTypeName normalises the empty type to "general" for comparisons.
+func publicTypeName(t knowledge.FactType) string {
+	if t == "" {
+		return "general"
+	}
+	return string(t)
+}
+
 func toolText(text string) mcpToolResult {
 	return mcpToolResult{Content: []mcpContent{{Type: "text", Text: text}}}
 }
diff --git a/src/pkg/dashboard/mcp_knowledge_test.go b/src/pkg/dashboard/mcp_knowledge_test.go
index e3cefd17ff..6720c80716 100644
--- a/src/pkg/dashboard/mcp_knowledge_test.go
+++ b/src/pkg/dashboard/mcp_knowledge_test.go
@@ -37,6 +37,9 @@ func publicKnowledgeServer(t *testing.T) *Server {
 	write("gotcha-nil-map.md", "---\ntitle: Nil Map Gotcha\ntype: gotcha\n---\nAlways initialize maps before use.\n")
 	write("pattern-caching.md", "---\ntitle: Caching Pattern\ntype: pattern\ntags: [linux, public]\n---\nUse Redis for caching hot paths.\n")
 	write("vision-world-domination.md", "---\ntitle: Secret Roadmap\ntype: vision\n---\nWe will acquire a competitor in Q3.\n")
+	// Long body (>200 runes) with a Related link to a private fact: exercises
+	// full-body re-reads and Related filtering.
+	write("pattern-long-body.md", "---\ntitle: Long Caching Notes\ntype: pattern\nrelated: [pattern-caching, vision-world-domination]\n---\n"+strings.Repeat("Redis caching detail sentence. ", 20)+"END-MARKER\n")
 
 	api := knowledge.NewKnowledgeAPI(nil, knowledge.KnowledgeConfig{Enabled: true, Engine: "file"}, logger)
 	if err := api.ConnectVault(vault, "vault"); err != nil {
@@ -131,7 +134,7 @@ func TestPublicKnowledgeMCPHandshakeAndToolsList(t *testing.T) {
 		t.Fatal("switch on: /mcp/knowledge must be public")
 	}
 
-	rec := mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"goose","version":"1"}}}`)
+	rec := mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"goose","version":"1"}}}`)
 	if rec.Code != http.StatusOK {
 		t.Fatalf("initialize anonymous: status = %d body=%q", rec.Code, rec.Body.String())
 	}
@@ -333,3 +336,74 @@ func TestPublicKnowledgeMCPPathConstantMatchesRoute(t *testing.T) {
 		t.Fatalf("publicKnowledgeMCPPath = %q; update the HandleFunc literal in api.go and docs/api-reference.md", publicKnowledgeMCPPath)
 	}
 }
+
+func TestPublicKnowledgeMCPRejectsBatchRequests(t *testing.T) {
+	t.Setenv("HIVE_PUBLIC_KNOWLEDGE", "1")
+	s := publicKnowledgeServer(t)
+	rec := mcpCall(t, s, `[{"jsonrpc":"2.0","id":1,"method":"ping"}]`)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	resp := decodeRPC(t, rec)
+	if resp.Error == nil || resp.Error.Code != jsonRPCInvalidRequest {
+		t.Fatalf("error = %+v, want code %d", resp.Error, jsonRPCInvalidRequest)
+	}
+}
+
+func TestPublicKnowledgeMCPGetReturnsFullBodyAndFiltersRelated(t *testing.T) {
+	t.Setenv("HIVE_PUBLIC_KNOWLEDGE", "1")
+	s := publicKnowledgeServer(t)
+	rec := mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_get","arguments":{"slug":"pattern-long-body"}}}`)
+	text, isErr := rpcToolText(t, decodeRPC(t, rec))
+	if isErr {
+		t.Fatalf("unexpected tool error: %s", text)
+	}
+	var pf publicFact
+	if err := json.Unmarshal([]byte(text), &pf); err != nil {
+		t.Fatalf("decode fact: %v", err)
+	}
+	if !strings.Contains(pf.Body, "END-MARKER") {
+		t.Fatalf("body truncated, want full text ending in END-MARKER: %q", pf.Body)
+	}
+	if len(pf.Related) != 1 || pf.Related[0] != "pattern-caching" {
+		t.Fatalf("related = %v, want only the public slug", pf.Related)
+	}
+
+	rec = mcpCall(t, s, `{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"knowledge_export","arguments":{}}}`)
+	text, _ = rpcToolText(t, decodeRPC(t, rec))
+	if !strings.Contains(text, "END-MARKER") {
+		t.Fatal("export should carry full bodies")
+	}
+	if strings.Contains(text, "vision-world-domination") || strings.Contains(text, "acquire a competitor") {
+		t.Fatal("export leaked private fact")
+	}
+}
+
+func TestPublicKnowledgeMCPSearchTypeFilterAppliesToVaultResults(t *testing.T) {
+	t.Setenv("HIVE_PUBLIC_KNOWLEDGE", "1")
+	s := publicKnowledgeServer(t)
+	// "maps" only matches the gotcha; asking for type=pattern must yield nothing
+	// even though the vault store ignores the type argument.
+	rec := mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"initialize maps","type":"pattern"}}}`)
+	text, isErr := rpcToolText(t, decodeRPC(t, rec))
+	if isErr {
+		t.Fatalf("unexpected tool error: %s", text)
+	}
+	var out struct {
+		Count   int          `json:"count"`
+		Results []publicFact `json:"results"`
+	}
+	if err := json.Unmarshal([]byte(text), &out); err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range out.Results {
+		if r.Type != "pattern" {
+			t.Fatalf("type filter leaked %q: %+v", r.Type, r)
+		}
+	}
+	rec = mcpCall(t, s, `{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"initialize maps","type":"gotcha"}}}`)
+	text, _ = rpcToolText(t, decodeRPC(t, rec))
+	if !strings.Contains(text, "gotcha-nil-map") {
+		t.Fatalf("gotcha search missing result: %s", text)
+	}
+}

From 0b040089272c0ddcc510822fcc6a8ea90bd0b13b Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:31:18 -0400
Subject: [PATCH 12/14] fix: drop public-knowledge MCP files that leaked into
 this PR (belong to #10621)

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 src/pkg/dashboard/mcp_knowledge.go      | 505 ------------------------
 src/pkg/dashboard/mcp_knowledge_test.go | 327 ---------------
 2 files changed, 832 deletions(-)
 delete mode 100644 src/pkg/dashboard/mcp_knowledge.go
 delete mode 100644 src/pkg/dashboard/mcp_knowledge_test.go

diff --git a/src/pkg/dashboard/mcp_knowledge.go b/src/pkg/dashboard/mcp_knowledge.go
deleted file mode 100644
index c1c45d94f6..0000000000
--- a/src/pkg/dashboard/mcp_knowledge.go
+++ /dev/null
@@ -1,505 +0,0 @@
-package dashboard
-
-import (
-	"crypto/sha256"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"sort"
-	"strings"
-
-	"github.com/hivecommons/hive/pkg/knowledge"
-)
-
-// Public knowledge MCP endpoint (#10615).
-//
-// A hive owner can flip HIVE_PUBLIC_KNOWLEDGE on to let ANY external agent
-// (Goose, Claude, Copilot, a curl loop) read this hive's operational knowledge
-// over a Model Context Protocol endpoint with no hub session, dashboard token,
-// or contributor registration. The surface is strictly read-only: the only
-// JSON-RPC methods served are the MCP handshake plus tools/list and
-// tools/call, and the only tools are search/get/export. There is no code path
-// from this handler to CreateFact/UpdateFact/DeleteFact or any vault mutation,
-// so an anonymous caller can never overwrite a knowledge base.
-//
-// Default is OFF and the endpoint 404s. isPublicPath and the hub's
-// publicExactPaths admit /mcp/knowledge past authentication only so this
-// handler can run its own fail-closed check; they do not weaken anything else.
-
-const (
-	// publicKnowledgeMCPPath is the spoke endpoint external agents connect to.
-	publicKnowledgeMCPPath = "/mcp/knowledge"
-
-	// publicKnowledgeEnabledEnv is the owner switch. Same spelling as
-	// HIVE_METRICS_ENABLED: 1|true|yes|on. Read on each request so an owner
-	// can close the surface without a pod roll.
-	publicKnowledgeEnabledEnv = "HIVE_PUBLIC_KNOWLEDGE"
-
-	// publicKnowledgeTagsEnv optionally narrows the public projection to facts
-	// carrying at least one of the listed (comma-separated) tags. Empty means
-	// every fact of a public type is exposed.
-	publicKnowledgeTagsEnv = "HIVE_PUBLIC_KNOWLEDGE_TAGS"
-
-	// mcpProtocolVersion is the MCP spec revision this endpoint speaks.
-	mcpProtocolVersion = "2025-03-26"
-
-	// publicKnowledgeDefaultLimit / MaxLimit bound knowledge_search results so
-	// an anonymous caller cannot pull the whole base one query at a time
-	// faster than knowledge_export already allows.
-	publicKnowledgeDefaultLimit = 10
-	publicKnowledgeMaxLimit     = 50
-
-	// publicKnowledgeMaxBodyBytes caps a JSON-RPC request body.
-	publicKnowledgeMaxBodyBytes = 64 << 10
-
-	// JSON-RPC 2.0 error codes.
-	jsonRPCParseError     = -32700
-	jsonRPCInvalidRequest = -32600
-	jsonRPCMethodNotFound = -32601
-	jsonRPCInvalidParams  = -32602
-)
-
-// publicKnowledgeTypes is the allow-list of fact types that leave the hive
-// through the public endpoint. Operational knowledge only — ideation and
-// governance types (idea, vision, constitution, requirement, constraint,
-// stakeholder, decision) describe the project's internal direction and stay
-// behind authentication.
-var publicKnowledgeTypes = map[string]struct{}{
-	"pattern":       {},
-	"gotcha":        {},
-	"regression":    {},
-	"test_scaffold": {},
-	"integration":   {},
-	"coverage_rule": {},
-	"general":       {},
-	"":              {}, // untyped facts render under "general"
-}
-
-// publicKnowledgeTypeOrder fixes section order in knowledge_export output.
-var publicKnowledgeTypeOrder = []string{
-	"pattern", "gotcha", "regression", "coverage_rule", "test_scaffold", "integration", "general",
-}
-
-var publicKnowledgeTypeLabels = map[string]string{
-	"pattern":       "Patterns",
-	"gotcha":        "Gotchas",
-	"regression":    "Regressions",
-	"test_scaffold": "Test Scaffolds",
-	"integration":   "Integration",
-	"coverage_rule": "Coverage Rules",
-	"general":       "General",
-}
-
-// publicKnowledgeEnabled reports whether the owner has opened the read-only
-// knowledge endpoint.
-func publicKnowledgeEnabled() bool {
-	switch strings.ToLower(strings.TrimSpace(os.Getenv(publicKnowledgeEnabledEnv))) {
-	case "1", "true", "yes", "on":
-		return true
-	}
-	return false
-}
-
-// publicKnowledgeTags returns the lower-cased tag allow-list, or nil for "all".
-func publicKnowledgeTags() []string {
-	raw := strings.TrimSpace(os.Getenv(publicKnowledgeTagsEnv))
-	if raw == "" {
-		return nil
-	}
-	var tags []string
-	for _, t := range strings.Split(raw, ",") {
-		if t = strings.ToLower(strings.TrimSpace(t)); t != "" {
-			tags = append(tags, t)
-		}
-	}
-	return tags
-}
-
-// publicFact is the outward projection of a knowledge.Fact. Sources (PR,
-// comment, author), usage counters, confidence reasoning, and lifecycle
-// phase are deliberately absent.
-type publicFact struct {
-	Slug       string   `json:"slug"`
-	Title      string   `json:"title"`
-	Type       string   `json:"type"`
-	Body       string   `json:"body"`
-	Confidence float64  `json:"confidence,omitempty"`
-	Tags       []string `json:"tags,omitempty"`
-	Related    []string `json:"related,omitempty"`
-}
-
-func toPublicFact(f knowledge.Fact) publicFact {
-	t := string(f.Type)
-	if t == "" {
-		t = "general"
-	}
-	pf := publicFact{Slug: f.Slug, Title: f.Title, Type: t, Body: f.Body, Tags: f.Tags, Related: f.Related}
-	if f.ConfidenceScored {
-		pf.Confidence = f.Confidence
-	}
-	return pf
-}
-
-// publicKnowledgeFilter keeps only facts of a public type that match the tag
-// allow-list (if any). It is the single choke point every tool goes through.
-func publicKnowledgeFilter(facts []knowledge.Fact, tags []string) []knowledge.Fact {
-	out := make([]knowledge.Fact, 0, len(facts))
-	for _, f := range facts {
-		if _, ok := publicKnowledgeTypes[string(f.Type)]; !ok {
-			continue
-		}
-		if len(tags) > 0 && !factHasAnyTag(f, tags) {
-			continue
-		}
-		out = append(out, f)
-	}
-	return out
-}
-
-func factHasAnyTag(f knowledge.Fact, tags []string) bool {
-	for _, have := range f.Tags {
-		have = strings.ToLower(have)
-		for _, want := range tags {
-			if have == want {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// renderPublicKnowledgeMarkdown is the knowledge_export body. It mirrors the
-// authenticated /api/knowledge/export layout but only over the public
-// projection, and sorts deterministically so unchanged knowledge yields an
-// identical document.
-func renderPublicKnowledgeMarkdown(facts []knowledge.Fact) string {
-	grouped := make(map[string][]knowledge.Fact)
-	for _, f := range facts {
-		t := string(f.Type)
-		if t == "" {
-			t = "general"
-		}
-		grouped[t] = append(grouped[t], f)
-	}
-
-	var sb strings.Builder
-	sb.WriteString("# Hive Public Knowledge\n\n")
-	sb.WriteString("This document is auto-generated from a hive knowledge base and served read-only.\n")
-	sb.WriteString("It refreshes as the hive learns — do not edit manually.\n\n")
-
-	for _, t := range publicKnowledgeTypeOrder {
-		ff := grouped[t]
-		if len(ff) == 0 {
-			continue
-		}
-		sortFactsStable(ff)
-		label := publicKnowledgeTypeLabels[t]
-		if label == "" {
-			label = titleCaseWords(t)
-		}
-		sb.WriteString("## " + label + "\n\n")
-		for _, f := range ff {
-			sb.WriteString("### " + f.Title + "\n\n")
-			if f.Body != "" {
-				sb.WriteString(f.Body + "\n\n")
-			}
-			if len(f.Tags) > 0 {
-				sb.WriteString("Tags: " + strings.Join(f.Tags, ", ") + "\n\n")
-			}
-		}
-	}
-	return sb.String()
-}
-
-// --- JSON-RPC / MCP wire types -------------------------------------------
-
-type jsonRPCRequest struct {
-	JSONRPC string          `json:"jsonrpc"`
-	ID      json.RawMessage `json:"id,omitempty"`
-	Method  string          `json:"method"`
-	Params  json.RawMessage `json:"params,omitempty"`
-}
-
-type jsonRPCError struct {
-	Code    int    `json:"code"`
-	Message string `json:"message"`
-}
-
-type jsonRPCResponse struct {
-	JSONRPC string          `json:"jsonrpc"`
-	ID      json.RawMessage `json:"id"`
-	Result  interface{}     `json:"result,omitempty"`
-	Error   *jsonRPCError   `json:"error,omitempty"`
-}
-
-type mcpToolDef struct {
-	Name        string      `json:"name"`
-	Description string      `json:"description"`
-	InputSchema interface{} `json:"inputSchema"`
-	Annotations interface{} `json:"annotations,omitempty"`
-}
-
-type mcpContent struct {
-	Type string `json:"type"`
-	Text string `json:"text"`
-}
-
-type mcpToolResult struct {
-	Content []mcpContent `json:"content"`
-	IsError bool         `json:"isError,omitempty"`
-}
-
-// mcpReadOnlyAnnotations tells MCP clients every tool here is safe to call
-// without confirmation: it neither mutates nor reaches outside the hive.
-var mcpReadOnlyAnnotations = map[string]interface{}{
-	"readOnlyHint":    true,
-	"destructiveHint": false,
-	"idempotentHint":  true,
-	"openWorldHint":   false,
-}
-
-func publicKnowledgeToolDefs() []mcpToolDef {
-	return []mcpToolDef{
-		{
-			Name:        "knowledge_search",
-			Description: "Search this hive's public operational knowledge (patterns, gotchas, regressions, integrations) by free-text query. Returns matching facts as JSON.",
-			InputSchema: map[string]interface{}{
-				"type": "object",
-				"properties": map[string]interface{}{
-					"query": map[string]interface{}{"type": "string", "description": "Free-text search query."},
-					"type":  map[string]interface{}{"type": "string", "description": "Optional fact type filter: pattern, gotcha, regression, test_scaffold, integration, coverage_rule, general."},
-					"limit": map[string]interface{}{"type": "integer", "description": fmt.Sprintf("Max results (default %d, max %d).", publicKnowledgeDefaultLimit, publicKnowledgeMaxLimit)},
-				},
-				"required": []string{"query"},
-			},
-			Annotations: mcpReadOnlyAnnotations,
-		},
-		{
-			Name:        "knowledge_get",
-			Description: "Fetch a single public knowledge fact by slug (as returned by knowledge_search).",
-			InputSchema: map[string]interface{}{
-				"type": "object",
-				"properties": map[string]interface{}{
-					"slug": map[string]interface{}{"type": "string", "description": "Fact slug."},
-				},
-				"required": []string{"slug"},
-			},
-			Annotations: mcpReadOnlyAnnotations,
-		},
-		{
-			Name:        "knowledge_export",
-			Description: "Export the entire public knowledge base as a single Markdown document, grouped by fact type.",
-			InputSchema: map[string]interface{}{
-				"type":       "object",
-				"properties": map[string]interface{}{},
-			},
-			Annotations: mcpReadOnlyAnnotations,
-		},
-	}
-}
-
-// handlePublicKnowledgeMCP serves POST /mcp/knowledge. It is the ONLY
-// anonymous entry point into knowledge and fails closed when the owner switch
-// is off, regardless of what the auth middleware admitted.
-func (s *Server) handlePublicKnowledgeMCP(w http.ResponseWriter, r *http.Request) {
-	if !publicKnowledgeEnabled() {
-		http.NotFound(w, r)
-		return
-	}
-	if r.Method != http.MethodPost {
-		w.Header().Set("Allow", http.MethodPost)
-		jsonError(w, "public knowledge MCP endpoint accepts POST only (no SSE stream)", http.StatusMethodNotAllowed)
-		return
-	}
-
-	body, err := io.ReadAll(io.LimitReader(r.Body, publicKnowledgeMaxBodyBytes+1))
-	if err != nil || len(body) > publicKnowledgeMaxBodyBytes {
-		writeJSONRPC(w, http.StatusRequestEntityTooLarge, jsonRPCResponse{JSONRPC: "2.0", ID: nullID, Error: &jsonRPCError{Code: jsonRPCInvalidRequest, Message: "request body too large"}})
-		return
-	}
-
-	var req jsonRPCRequest
-	if err := json.Unmarshal(body, &req); err != nil {
-		writeJSONRPC(w, http.StatusBadRequest, jsonRPCResponse{JSONRPC: "2.0", ID: nullID, Error: &jsonRPCError{Code: jsonRPCParseError, Message: "invalid JSON"}})
-		return
-	}
-	if req.JSONRPC != "2.0" || req.Method == "" {
-		writeJSONRPC(w, http.StatusBadRequest, jsonRPCResponse{JSONRPC: "2.0", ID: idOrNull(req.ID), Error: &jsonRPCError{Code: jsonRPCInvalidRequest, Message: "expected JSON-RPC 2.0 request with a method"}})
-		return
-	}
-
-	// Notifications carry no id and get no body (MCP Streamable HTTP: 202).
-	if strings.HasPrefix(req.Method, "notifications/") {
-		w.WriteHeader(http.StatusAccepted)
-		return
-	}
-
-	resp := jsonRPCResponse{JSONRPC: "2.0", ID: idOrNull(req.ID)}
-	switch req.Method {
-	case "initialize":
-		resp.Result = map[string]interface{}{
-			"protocolVersion": mcpProtocolVersion,
-			"capabilities":    map[string]interface{}{"tools": map[string]interface{}{"listChanged": false}},
-			"serverInfo":      map[string]interface{}{"name": "hive-public-knowledge", "version": "1"},
-			"instructions":    "Read-only access to this hive's operational knowledge. Use knowledge_search for targeted lookups and knowledge_export for the full Markdown document.",
-		}
-	case "ping":
-		resp.Result = map[string]interface{}{}
-	case "tools/list":
-		resp.Result = map[string]interface{}{"tools": publicKnowledgeToolDefs()}
-	case "tools/call":
-		result, rpcErr := s.callPublicKnowledgeTool(r, req.Params)
-		if rpcErr != nil {
-			resp.Error = rpcErr
-		} else {
-			resp.Result = result
-		}
-	default:
-		resp.Error = &jsonRPCError{Code: jsonRPCMethodNotFound, Message: "method not found: " + req.Method}
-	}
-	writeJSONRPC(w, http.StatusOK, resp)
-}
-
-var nullID = json.RawMessage("null")
-
-func idOrNull(id json.RawMessage) json.RawMessage {
-	if len(id) == 0 {
-		return nullID
-	}
-	return id
-}
-
-func writeJSONRPC(w http.ResponseWriter, status int, resp jsonRPCResponse) {
-	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("Cache-Control", "no-store")
-	w.WriteHeader(status)
-	_ = json.NewEncoder(w).Encode(resp)
-}
-
-type mcpToolCallParams struct {
-	Name      string          `json:"name"`
-	Arguments json.RawMessage `json:"arguments"`
-}
-
-// callPublicKnowledgeTool dispatches tools/call. Unknown tool names are a
-// JSON-RPC invalid-params error; tool-level problems (fact not found) come
-// back as isError results per the MCP spec so the model can recover.
-func (s *Server) callPublicKnowledgeTool(r *http.Request, raw json.RawMessage) (interface{}, *jsonRPCError) {
-	var params mcpToolCallParams
-	if len(raw) > 0 {
-		if err := json.Unmarshal(raw, &params); err != nil {
-			return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "invalid tools/call params"}
-		}
-	}
-	if !s.ensureKnowledge() {
-		return toolText("Knowledge base not available."), nil
-	}
-	tags := publicKnowledgeTags()
-
-	switch params.Name {
-	case "knowledge_search":
-		var args struct {
-			Query string `json:"query"`
-			Type  string `json:"type"`
-			Limit int    `json:"limit"`
-		}
-		if len(params.Arguments) > 0 {
-			if err := json.Unmarshal(params.Arguments, &args); err != nil {
-				return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "invalid knowledge_search arguments"}
-			}
-		}
-		args.Query = strings.TrimSpace(args.Query)
-		if args.Query == "" {
-			return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "query is required"}
-		}
-		if _, ok := publicKnowledgeTypes[args.Type]; !ok {
-			return toolError(fmt.Sprintf("type %q is not a public fact type", args.Type)), nil
-		}
-		limit := args.Limit
-		if limit <= 0 {
-			limit = publicKnowledgeDefaultLimit
-		}
-		if limit > publicKnowledgeMaxLimit {
-			limit = publicKnowledgeMaxLimit
-		}
-		// Over-fetch so the public filter does not starve the result set, then
-		// trim to the requested bound.
-		facts := s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, args.Query, args.Type, publicKnowledgeMaxLimit*2)
-		facts = publicKnowledgeFilter(facts, tags)
-		if len(facts) > limit {
-			facts = facts[:limit]
-		}
-		out := make([]publicFact, 0, len(facts))
-		for _, f := range facts {
-			out = append(out, toPublicFact(f))
-		}
-		return toolJSON(map[string]interface{}{"query": args.Query, "count": len(out), "results": out})
-
-	case "knowledge_get":
-		var args struct {
-			Slug string `json:"slug"`
-		}
-		if len(params.Arguments) > 0 {
-			if err := json.Unmarshal(params.Arguments, &args); err != nil {
-				return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "invalid knowledge_get arguments"}
-			}
-		}
-		args.Slug = strings.TrimSpace(args.Slug)
-		if args.Slug == "" {
-			return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "slug is required"}
-		}
-		// Resolve through the same filtered listing search uses so a private
-		// fact can never be fetched by guessing its slug.
-		all := publicKnowledgeFilter(s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, "", "", 0), tags)
-		for _, f := range all {
-			if f.Slug == args.Slug {
-				return toolJSON(toPublicFact(f))
-			}
-		}
-		return toolError("fact not found: " + args.Slug), nil
-
-	case "knowledge_export":
-		all := publicKnowledgeFilter(s.deps.Knowledge.SearchAllWithVaults(s.deps.Ctx, "", "", 0), tags)
-		md := renderPublicKnowledgeMarkdown(all)
-		sum := sha256.Sum256([]byte(md))
-		return map[string]interface{}{
-			"content": []mcpContent{{Type: "text", Text: md}},
-			"_meta":   map[string]interface{}{"etag": fmt.Sprintf(`"%x"`, sum), "facts": len(all)},
-		}, nil
-
-	case "":
-		return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "tool name is required"}
-	default:
-		return nil, &jsonRPCError{Code: jsonRPCInvalidParams, Message: "unknown tool: " + params.Name}
-	}
-}
-
-func toolText(text string) mcpToolResult {
-	return mcpToolResult{Content: []mcpContent{{Type: "text", Text: text}}}
-}
-
-func toolError(text string) mcpToolResult {
-	return mcpToolResult{Content: []mcpContent{{Type: "text", Text: text}}, IsError: true}
-}
-
-func toolJSON(v interface{}) (interface{}, *jsonRPCError) {
-	b, err := json.MarshalIndent(v, "", "  ")
-	if err != nil {
-		return toolError("failed to encode result"), nil
-	}
-	return toolText(string(b)), nil
-}
-
-// publicKnowledgeTypeList is exported for docs/tests: the sorted public types.
-func publicKnowledgeTypeList() []string {
-	out := make([]string, 0, len(publicKnowledgeTypes))
-	for t := range publicKnowledgeTypes {
-		if t != "" {
-			out = append(out, t)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
diff --git a/src/pkg/dashboard/mcp_knowledge_test.go b/src/pkg/dashboard/mcp_knowledge_test.go
deleted file mode 100644
index 3a5f248f4d..0000000000
--- a/src/pkg/dashboard/mcp_knowledge_test.go
+++ /dev/null
@@ -1,327 +0,0 @@
-package dashboard
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/hivecommons/hive/pkg/knowledge"
-)
-
-// publicKnowledgeServer builds a token-secured spoke with a vault holding one
-// fact of every interesting kind: a public gotcha, a tagged public pattern,
-// and a private governance fact that must never leave through /mcp/knowledge.
-func publicKnowledgeServer(t *testing.T) *Server {
-	t.Helper()
-	logger := slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{Level: slog.LevelError}))
-	s := NewServerWithAuth(0, "dashboard-secret", logger)
-	s.RegisterAPI(testDeps(t))
-
-	vault := filepath.Join(t.TempDir(), "vault")
-	if err := os.MkdirAll(vault, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	write := func(name, body string) {
-		t.Helper()
-		if err := os.WriteFile(filepath.Join(vault, name), []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	write("gotcha-nil-map.md", "---\ntitle: Nil Map Gotcha\ntype: gotcha\n---\nAlways initialize maps before use.\n")
-	write("pattern-caching.md", "---\ntitle: Caching Pattern\ntype: pattern\ntags:\n  - linux\n  - public\n---\nUse Redis for caching hot paths.\n")
-	write("vision-world-domination.md", "---\ntitle: Secret Roadmap\ntype: vision\n---\nWe will acquire a competitor in Q3.\n")
-
-	api := knowledge.NewKnowledgeAPI(nil, knowledge.KnowledgeConfig{Enabled: true, Engine: "file"}, logger)
-	if err := api.ConnectVault(vault, "vault"); err != nil {
-		t.Fatalf("ConnectVault: %v", err)
-	}
-	s.deps.Knowledge = api
-	return s
-}
-
-func mcpCall(t *testing.T, s *Server, payload string) *httptest.ResponseRecorder {
-	t.Helper()
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPost, publicKnowledgeMCPPath, bytes.NewBufferString(payload))
-	req.Header.Set("Content-Type", "application/json")
-	// Deliberately anonymous: no Authorization, no X-Hive-* headers. Goes
-	// through the full handler chain so the authenticate middleware is tested.
-	s.Handler().ServeHTTP(rec, req)
-	return rec
-}
-
-func decodeRPC(t *testing.T, rec *httptest.ResponseRecorder) jsonRPCResponse {
-	t.Helper()
-	var resp jsonRPCResponse
-	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("decode %q: %v", rec.Body.String(), err)
-	}
-	return resp
-}
-
-// toolText extracts the single text content of a tools/call result.
-func rpcToolText(t *testing.T, resp jsonRPCResponse) (string, bool) {
-	t.Helper()
-	if resp.Error != nil {
-		t.Fatalf("unexpected rpc error: %+v", resp.Error)
-	}
-	raw, _ := json.Marshal(resp.Result)
-	var res mcpToolResult
-	if err := json.Unmarshal(raw, &res); err != nil {
-		t.Fatalf("decode tool result %s: %v", raw, err)
-	}
-	if len(res.Content) != 1 {
-		t.Fatalf("content = %+v, want 1 item", res.Content)
-	}
-	return res.Content[0].Text, res.IsError
-}
-
-func TestPublicKnowledgeMCPDisabledByDefault(t *testing.T) {
-	t.Setenv(publicKnowledgeEnabledEnv, "")
-	s := publicKnowledgeServer(t)
-
-	rec := mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/list"}`)
-	if rec.Code == http.StatusOK {
-		t.Fatalf("switch off: status = %d, want non-200; body=%q", rec.Code, rec.Body.String())
-	}
-	if isPublicPath(publicKnowledgeMCPPath) {
-		t.Fatal("switch off: /mcp/knowledge must not be a public path")
-	}
-}
-
-func TestPublicKnowledgeMCPDisabledEvenWhenAuthenticated(t *testing.T) {
-	t.Setenv(publicKnowledgeEnabledEnv, "0")
-	s := publicKnowledgeServer(t)
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPost, publicKnowledgeMCPPath, strings.NewReader(`{"jsonrpc":"2.0","id":1,"method":"tools/list"}`))
-	req.Header.Set("Authorization", "Bearer dashboard-secret")
-	s.Handler().ServeHTTP(rec, req)
-	if rec.Code != http.StatusNotFound {
-		t.Fatalf("switch off + owner token: status = %d, want 404 (the surface does not exist until the owner opens it)", rec.Code)
-	}
-}
-
-func TestPublicKnowledgeMCPEnabledSpellings(t *testing.T) {
-	for _, v := range []string{"1", "true", "YES", " on "} {
-		t.Setenv(publicKnowledgeEnabledEnv, v)
-		if !publicKnowledgeEnabled() {
-			t.Errorf("%q should enable", v)
-		}
-	}
-	for _, v := range []string{"", "0", "false", "off", "maybe"} {
-		t.Setenv(publicKnowledgeEnabledEnv, v)
-		if publicKnowledgeEnabled() {
-			t.Errorf("%q should not enable", v)
-		}
-	}
-}
-
-func TestPublicKnowledgeMCPHandshakeAndToolsList(t *testing.T) {
-	t.Setenv(publicKnowledgeEnabledEnv, "1")
-	s := publicKnowledgeServer(t)
-
-	if !isPublicPath(publicKnowledgeMCPPath) {
-		t.Fatal("switch on: /mcp/knowledge must be public")
-	}
-
-	rec := mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"goose","version":"1"}}}`)
-	if rec.Code != http.StatusOK {
-		t.Fatalf("initialize anonymous: status = %d body=%q", rec.Code, rec.Body.String())
-	}
-	resp := decodeRPC(t, rec)
-	if resp.Error != nil {
-		t.Fatalf("initialize error: %+v", resp.Error)
-	}
-	init := resp.Result.(map[string]interface{})
-	if init["protocolVersion"] != mcpProtocolVersion {
-		t.Errorf("protocolVersion = %v", init["protocolVersion"])
-	}
-
-	rec = mcpCall(t, s, `{"jsonrpc":"2.0","method":"notifications/initialized"}`)
-	if rec.Code != http.StatusAccepted || rec.Body.Len() != 0 {
-		t.Fatalf("notification: status = %d body=%q, want 202 and empty", rec.Code, rec.Body.String())
-	}
-
-	rec = mcpCall(t, s, `{"jsonrpc":"2.0","id":"abc","method":"ping"}`)
-	if resp = decodeRPC(t, rec); resp.Error != nil || string(resp.ID) != `"abc"` {
-		t.Fatalf("ping: %+v id=%s", resp.Error, resp.ID)
-	}
-
-	rec = mcpCall(t, s, `{"jsonrpc":"2.0","id":2,"method":"tools/list"}`)
-	resp = decodeRPC(t, rec)
-	raw, _ := json.Marshal(resp.Result)
-	var list struct {
-		Tools []mcpToolDef `json:"tools"`
-	}
-	if err := json.Unmarshal(raw, &list); err != nil {
-		t.Fatal(err)
-	}
-	var names []string
-	for _, td := range list.Tools {
-		names = append(names, td.Name)
-		ann, _ := td.Annotations.(map[string]interface{})
-		if ann["readOnlyHint"] != true || ann["destructiveHint"] != false {
-			t.Errorf("tool %s must be annotated read-only, got %v", td.Name, td.Annotations)
-		}
-		for _, verb := range []string{"create", "update", "delete", "write", "import", "promote"} {
-			if strings.Contains(td.Name, verb) {
-				t.Errorf("tool %s looks like a write tool; public surface must be read-only", td.Name)
-			}
-		}
-	}
-	if got := strings.Join(names, ","); got != "knowledge_search,knowledge_get,knowledge_export" {
-		t.Fatalf("tools = %s", got)
-	}
-}
-
-func TestPublicKnowledgeMCPSearchGetExportHidePrivateTypes(t *testing.T) {
-	t.Setenv(publicKnowledgeEnabledEnv, "true")
-	t.Setenv(publicKnowledgeTagsEnv, "")
-	s := publicKnowledgeServer(t)
-
-	// Export: public types present, vision absent, sources never rendered.
-	resp := decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_export","arguments":{}}}`))
-	md, isErr := rpcToolText(t, resp)
-	if isErr {
-		t.Fatalf("export isError: %s", md)
-	}
-	for _, want := range []string{"# Hive Public Knowledge", "## Gotchas", "### Nil Map Gotcha", "## Patterns", "### Caching Pattern", "Tags: linux, public"} {
-		if !strings.Contains(md, want) {
-			t.Errorf("export missing %q:\n%s", want, md)
-		}
-	}
-	for _, leak := range []string{"Secret Roadmap", "acquire a competitor", "## Vision"} {
-		if strings.Contains(md, leak) {
-			t.Errorf("export leaked private content %q:\n%s", leak, md)
-		}
-	}
-
-	// Get: public slug resolves, private slug is "not found" (not 'forbidden',
-	// which would confirm existence).
-	resp = decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"knowledge_get","arguments":{"slug":"gotcha-nil-map"}}}`))
-	text, isErr := rpcToolText(t, resp)
-	if isErr || !strings.Contains(text, "Always initialize maps") {
-		t.Fatalf("get public: isErr=%v text=%s", isErr, text)
-	}
-	var pf publicFact
-	if err := json.Unmarshal([]byte(text), &pf); err != nil {
-		t.Fatalf("get result not a publicFact: %v", err)
-	}
-	var generic map[string]interface{}
-	_ = json.Unmarshal([]byte(text), &generic)
-	for _, hidden := range []string{"sources", "usage_count", "confidence_reason", "last_used", "phase"} {
-		if _, ok := generic[hidden]; ok {
-			t.Errorf("public fact exposes %q", hidden)
-		}
-	}
-
-	resp = decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"knowledge_get","arguments":{"slug":"vision-world-domination"}}}`))
-	text, isErr = rpcToolText(t, resp)
-	if !isErr || !strings.Contains(text, "fact not found") {
-		t.Fatalf("get private: isErr=%v text=%s, want not-found", isErr, text)
-	}
-
-	// Search: a query that only matches the private fact returns nothing.
-	resp = decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"competitor"}}}`))
-	text, _ = rpcToolText(t, resp)
-	if strings.Contains(text, "Secret Roadmap") {
-		t.Fatalf("search leaked private fact: %s", text)
-	}
-	resp = decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"maps","limit":1000}}}`))
-	text, _ = rpcToolText(t, resp)
-	if !strings.Contains(text, "Nil Map Gotcha") {
-		t.Fatalf("search did not find public fact: %s", text)
-	}
-}
-
-func TestPublicKnowledgeMCPTagAllowList(t *testing.T) {
-	t.Setenv(publicKnowledgeEnabledEnv, "1")
-	t.Setenv(publicKnowledgeTagsEnv, "Public, troubleshooting")
-	s := publicKnowledgeServer(t)
-
-	resp := decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_export"}}`))
-	md, _ := rpcToolText(t, resp)
-	if !strings.Contains(md, "Caching Pattern") {
-		t.Errorf("tagged fact missing:\n%s", md)
-	}
-	if strings.Contains(md, "Nil Map Gotcha") {
-		t.Errorf("untagged fact exposed despite tag allow-list:\n%s", md)
-	}
-}
-
-func TestPublicKnowledgeMCPRejectsWritesAndBadInput(t *testing.T) {
-	t.Setenv(publicKnowledgeEnabledEnv, "1")
-	s := publicKnowledgeServer(t)
-
-	cases := map[string]int{
-		`{"jsonrpc":"2.0","id":1,"method":"resources/write"}`:                                                    jsonRPCMethodNotFound,
-		`{"jsonrpc":"2.0","id":1,"method":"knowledge/create"}`:                                                   jsonRPCMethodNotFound,
-		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_create","arguments":{}}}`:     jsonRPCInvalidParams,
-		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_delete","arguments":{}}}`:     jsonRPCInvalidParams,
-		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_search","arguments":{}}}`:     jsonRPCInvalidParams,
-		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_get","arguments":{}}}`:        jsonRPCInvalidParams,
-		`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_search","arguments":"nope"}}`: jsonRPCInvalidParams,
-		`{"jsonrpc":"1.0","id":1,"method":"tools/list"}`:                                                         jsonRPCInvalidRequest,
-		`not json`: jsonRPCParseError,
-	}
-	for payload, wantCode := range cases {
-		resp := decodeRPC(t, mcpCall(t, s, payload))
-		if resp.Error == nil || resp.Error.Code != wantCode {
-			t.Errorf("%s: error = %+v, want code %d", payload, resp.Error, wantCode)
-		}
-	}
-
-	// Non-POST verbs are refused outright; there is no SSE stream to open.
-	for _, m := range []string{http.MethodGet, http.MethodDelete, http.MethodPut} {
-		rec := httptest.NewRecorder()
-		s.Handler().ServeHTTP(rec, httptest.NewRequest(m, publicKnowledgeMCPPath, nil))
-		if rec.Code != http.StatusMethodNotAllowed {
-			t.Errorf("%s: status = %d, want 405", m, rec.Code)
-		}
-	}
-
-	// Oversized bodies are rejected before parsing.
-	big := `{"jsonrpc":"2.0","id":1,"method":"ping","params":{"pad":"` + strings.Repeat("x", publicKnowledgeMaxBodyBytes) + `"}}`
-	if rec := mcpCall(t, s, big); rec.Code != http.StatusRequestEntityTooLarge {
-		t.Errorf("oversized: status = %d, want 413", rec.Code)
-	}
-
-	// Search with a private type filter is refused as a tool error.
-	resp := decodeRPC(t, mcpCall(t, s, `{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_search","arguments":{"query":"x","type":"vision"}}}`))
-	if text, isErr := rpcToolText(t, resp); !isErr || !strings.Contains(text, "not a public fact type") {
-		t.Errorf("private type filter: isErr=%v text=%s", isErr, text)
-	}
-}
-
-func TestPublicKnowledgeMCPNoKnowledgeBase(t *testing.T) {
-	t.Setenv(publicKnowledgeEnabledEnv, "1")
-	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	s := NewServerWithAuth(0, "", logger)
-	// deps nil → ensureKnowledge false → graceful text, never a panic.
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPost, publicKnowledgeMCPPath, strings.NewReader(`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"knowledge_export"}}`))
-	s.handlePublicKnowledgeMCP(rec, req)
-	resp := decodeRPC(t, rec)
-	if text, _ := rpcToolText(t, resp); !strings.Contains(text, "not available") {
-		t.Fatalf("text = %s", text)
-	}
-}
-
-func TestPublicKnowledgeTypeListExcludesGovernance(t *testing.T) {
-	got := strings.Join(publicKnowledgeTypeList(), ",")
-	for _, private := range []string{"idea", "vision", "constitution", "requirement", "constraint", "stakeholder", "decision"} {
-		if strings.Contains(got, private) {
-			t.Errorf("public type list includes private type %q: %s", private, got)
-		}
-	}
-	if !strings.Contains(got, "gotcha") || !strings.Contains(got, "pattern") {
-		t.Errorf("public type list = %s", got)
-	}
-}

From 3a58d60ad6bd06db31d5d2d2d9fbb0a4884442ef Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:33:16 -0400
Subject: [PATCH 13/14] docs: refresh api-reference citations (drifted on v5)

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 src/docs/api-reference.md | 530 +++++++++++++++++++-------------------
 1 file changed, 265 insertions(+), 265 deletions(-)

diff --git a/src/docs/api-reference.md b/src/docs/api-reference.md
index f7d4f4d48d..1b6353435a 100644
--- a/src/docs/api-reference.md
+++ b/src/docs/api-reference.md
@@ -30,31 +30,31 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 | `PUT` | `/api/swarm/themes` | Owner only | Set a per-repo swarm theme (`event_name`, `call_to_arms`, `leaderboard_title`). | `pkg/dashboard/swarm.go:316` |
 | `PATCH` | `/api/swarm/objectives` | Owner only | Update the active swarm SDLC objective checklist completion state. | `pkg/dashboard/swarm.go:317` |
 | `GET` | `/api/leaderboard/swarm` | Public | Stable public JSON record of swarm history, leaderboard, top players, and achievements. | `pkg/dashboard/swarm.go:318` |
-| `GET` | `/api/runs` | Dashboard auth/session | Active staged runs projected from task leases, plans, and lifecycle timeline. Returns an array of `Run` objects: canonical `key` (`owner/repo#number`), current-stage `lease_key`, `title`, `repo` (`owner/repo`), `stage`, `gen`, `stage_started_at`, `waiting_on` (`agent`, `remote`, `human`, `ci`, `none`), `waiting_since`, `assignee`, `last_receipt`, `plan_epic_id`, and `stages[]` (`name`, `status`, `gen`, `receipt`). | `pkg/dashboard/api.go:77` |
-| `GET` | `/api/runs/audit` | Owner only | Read-only cross-repo audit query over existing retained artifacts. Query `repo`, canonical `run` (`owner/repo#number`), RFC3339 `since`/`until`, `kind`, `limit` (default 100, max 500), and `page_token`. Returns `{items,next_page_token,retention}`; each item has `source` (`audit_log`, `timeline`, `lease_receipt`, `plan_epic`), `kind`, `run`, `repo`, `at`, `actor`, `artifact_id`, `attrs`, or an explicit `kind=expired,status=expired,state=Unknown` marker when requested history may have aged out. | `pkg/dashboard/api.go:78` |
-| `POST` | `/api/runs/audit` | Owner only | Activate the convergence audit campaign over a scope directory. Body `{"campaign_key":"audit-campaign","scope_dir":"/data/convergence/audit/scope","store":"audit","generation":1,"run_key":"","run_url":""}`; `scope_dir` defaults to `/data/convergence/audit/scope`, `store` defaults to `audit`, `auditor`, `scanner`, `supervisor`, then the first configured bead store. Runs inspection even when `publication.enabled` is false, but then skips the publisher and returns `publication_skipped:true` with reason `publication.disabled`. | `pkg/dashboard/api.go:79` |
-| `GET` | `/api/runs/{key}/checkpoint` | Dashboard auth/session | Compact mobile/chat checkpoint review payload for a held run. Returns `run_key`, `stage`, lease `gen`, `repo`, `title`, capped plain-text `summary`, approve/reject `decisions`, dashboard deep link, `lease_gen` staleness fence, and verified-owner approver rule. | `pkg/dashboard/api.go:81` |
-| `POST` | `/api/runs/{key}/checkpoint` | Owner only | Resolve a compact checkpoint decision. Body `{"action":"approve"|"reject","gen":<lease generation>}`; refuses stale generations with 409 and non-owner callers with 403 before mutating the plan. | `pkg/dashboard/api.go:82` |
-| `GET` | `/api/runs/{key}` | Dashboard auth/session | One run by URL-escaped canonical run key (`owner/repo%23number`); early lease-shaped keys (`repo!run-key:stage`) and queued Wavefront run-stage keys (`owner/repo!graph:node`) are also accepted. Includes timeline-derived stage history in the same `Run` shape as `/api/runs` when a lease/timeline exists. History entries that came from an owner reset carry the owner's `reason`. When the key belongs to a wired convergence campaign, the detail response also includes an optional `burndown` block with `source`, `satisfied`, `remaining`, `unknown`, and `scope`; the list endpoint omits this block. | `pkg/dashboard/api.go:83` |
-| `POST` | `/api/runs/{key}/reset` | Owner only | Move a run's lease back to an earlier stage (for example `implement` to `plan` after a rejected plan). Body `{"to": "<stage>", "reason": "<why>"}`, both required. Mints a new generation so the relay holding the old one can no longer resume, persists before answering, and records the reason on the agent audit sink, the lifecycle timeline, and the `stage_completed` hook payload (`attrs.reset = "true"`). Returns `{ok, key, stage_from, stage, gen, reason}`. 400 for the same or a later stage or a missing reason, 404 when no live staged lease holds the key, 409 when the lease expired, 500 when the registry could not be written. | `pkg/dashboard/api.go:84` |
-| `GET` | `/api/campaigns` | Dashboard auth/session | List resumable campaigns from archived Inception sessions and retained Spektacular (Spek) runs. Query `search`/`q`, `repo`, `stage`, `status`, and `owner`; each campaign is keyed by stable spec/session id and includes title, source, repos, current stage/step, artifact links, linked issues/PRs, contributors, last activity, status, engine, type, and run link when applicable. | `pkg/dashboard/api.go:85` |
-| `GET` | `/api/campaigns/{id}` | Dashboard auth/session | Return one campaign by URL-escaped stable campaign id or run key, using the same campaign shape as `/api/campaigns`. | `pkg/dashboard/api.go:86` |
-| `POST` | `/api/campaigns/{id}/resume` | Owner only | Resume or pick up a campaign. Archived Inception campaigns take a durable campaign lease, restore their saved state and wiki working files; Spek campaigns return the retained run detail plus a CLI status command that reloads state from Spek artifacts. Body may include `{ "surface": "chat"|"contributor"|"cli"|"dashboard" }`; 409 means another user holds the lease. | `pkg/dashboard/api.go:87` |
-| `POST` | `/api/campaigns/{id}/release` | Owner only | Release the caller's Inception campaign lease and write a `campaign_release` audit entry so another user can continue it. Run-backed Spektacular campaigns return `409 Conflict`; this endpoint never revokes their run-lifecycle stage leases. | `pkg/dashboard/api.go:88` |
-| `POST` | `/api/campaigns/{id}/revise` | Owner only | Create a linked revision campaign (`revision_of`, `revision`) for revisiting shipped or parked Inception/Spek work without overwriting the previous campaign. The new revision is leased to the caller and audit-logged as `campaign_revise`. | `pkg/dashboard/api.go:89` |
-| `GET` | `/api/campaigns/{id}/jam` | Dashboard auth/session | Return the per-campaign Jam workspace: section-anchored threads, comments, suggestions, polls, poll decisions, current spec revision and attributed revision history. | `pkg/dashboard/api.go:90` |
-| `POST` | `/api/campaigns/{id}/jam` | Read-write role | Record an attributed spec revision for a campaign. Body includes `spec_content`, optional `reason`, and optional agent/model attribution fields. | `pkg/dashboard/api.go:91` |
-| `GET` | `/api/campaigns/{id}/jam/threads` | Dashboard auth/session | List async Jam threads anchored to spec sections, including comments and author attribution. | `pkg/dashboard/api.go:92` |
-| `POST` | `/api/campaigns/{id}/jam/threads` | Read-write role | Create a section-anchored Jam thread or add a comment to an existing thread. Body includes `section` and `body`, or `thread_id` and `body`. | `pkg/dashboard/api.go:93` |
-| `POST` | `/api/campaigns/{id}/jam/agents` | Maintainer only | Invite Spektacular or a configured hive agent into a Jam thread. The agent reply is posted as an attributed thread comment and an open suggestion for human accept/reject; no spec revision is auto-applied. | `pkg/dashboard/api.go:94` |
-| `GET` | `/api/campaigns/{id}/jam/suggestions` | Dashboard auth/session | List Jam suggestions with open/accepted/rejected status, proposed text, attribution and applied revision id when accepted. | `pkg/dashboard/api.go:95` |
-| `POST` | `/api/campaigns/{id}/jam/suggestions` | Read-write role; maintainer for accept | Create a suggestion (`section`, `proposed_text`) or resolve it with `action: "accept"`/`"reject"` and `suggestion_id`. Accepting records a new attributed spec revision. | `pkg/dashboard/api.go:96` |
-| `GET` | `/api/campaigns/{id}/jam/polls` | Dashboard auth/session | List Jam polls, advisory vote tallies and maintainer decisions stored against spec revisions. | `pkg/dashboard/api.go:97` |
-| `POST` | `/api/campaigns/{id}/jam/polls` | Read-write role; maintainer for decide | Create polls (`section`, `question`, `options`), cast/update advisory votes (`action: "vote"`), or record a maintainer decision with rationale (`action: "decide"`). | `pkg/dashboard/api.go:98` |
-| `GET` | `/api/campaigns/{id}/jam/project-sync` | Dashboard auth/session | Return the campaign's GitHub Projects sync configuration, last published items, last status, and retry guidance for failures. | `pkg/dashboard/api.go:99` |
-| `POST` | `/api/campaigns/{id}/jam/project-sync` | Maintainer only | Enable/disable opt-in GitHub Projects sync, publish campaign specs/decisions/derived issues to the linked project, or record inbound project status updates without losing local Jam decisions. | `pkg/dashboard/api.go:100` |
-| `GET` | `/api/campaigns/{id}/jam/ws` | Dashboard auth/session | Upgrade to a Jam WebSocket for live participant presence, section focus, and conflict-aware spec co-edit messages. Live edits require read-write role and stale `base_revision_id` values are rejected with a conflict message. | `pkg/dashboard/api.go:101` |
-| `GET` | `/api/runs/{key}/trace` | Dashboard auth/session | Resolve `Hive-Run`, `Hive-Plan`, and `Hive-Spec` commit trailers for `?sha=...`, returning the linked plan section, spek clause, approval audit record, rationale audit entries, and typed no-linkage results when trailers are missing. | `pkg/dashboard/api.go:80` |
+| `GET` | `/api/runs` | Dashboard auth/session | Active staged runs projected from task leases, plans, and lifecycle timeline. Returns an array of `Run` objects: canonical `key` (`owner/repo#number`), current-stage `lease_key`, `title`, `repo` (`owner/repo`), `stage`, `gen`, `stage_started_at`, `waiting_on` (`agent`, `remote`, `human`, `ci`, `none`), `waiting_since`, `assignee`, `last_receipt`, `plan_epic_id`, and `stages[]` (`name`, `status`, `gen`, `receipt`). | `pkg/dashboard/api.go:78` |
+| `GET` | `/api/runs/audit` | Owner only | Read-only cross-repo audit query over existing retained artifacts. Query `repo`, canonical `run` (`owner/repo#number`), RFC3339 `since`/`until`, `kind`, `limit` (default 100, max 500), and `page_token`. Returns `{items,next_page_token,retention}`; each item has `source` (`audit_log`, `timeline`, `lease_receipt`, `plan_epic`), `kind`, `run`, `repo`, `at`, `actor`, `artifact_id`, `attrs`, or an explicit `kind=expired,status=expired,state=Unknown` marker when requested history may have aged out. | `pkg/dashboard/api.go:79` |
+| `POST` | `/api/runs/audit` | Owner only | Activate the convergence audit campaign over a scope directory. Body `{"campaign_key":"audit-campaign","scope_dir":"/data/convergence/audit/scope","store":"audit","generation":1,"run_key":"","run_url":""}`; `scope_dir` defaults to `/data/convergence/audit/scope`, `store` defaults to `audit`, `auditor`, `scanner`, `supervisor`, then the first configured bead store. Runs inspection even when `publication.enabled` is false, but then skips the publisher and returns `publication_skipped:true` with reason `publication.disabled`. | `pkg/dashboard/api.go:80` |
+| `GET` | `/api/runs/{key}/checkpoint` | Dashboard auth/session | Compact mobile/chat checkpoint review payload for a held run. Returns `run_key`, `stage`, lease `gen`, `repo`, `title`, capped plain-text `summary`, approve/reject `decisions`, dashboard deep link, `lease_gen` staleness fence, and verified-owner approver rule. | `pkg/dashboard/api.go:82` |
+| `POST` | `/api/runs/{key}/checkpoint` | Owner only | Resolve a compact checkpoint decision. Body `{"action":"approve"|"reject","gen":<lease generation>}`; refuses stale generations with 409 and non-owner callers with 403 before mutating the plan. | `pkg/dashboard/api.go:83` |
+| `GET` | `/api/runs/{key}` | Dashboard auth/session | One run by URL-escaped canonical run key (`owner/repo%23number`); early lease-shaped keys (`repo!run-key:stage`) and queued Wavefront run-stage keys (`owner/repo!graph:node`) are also accepted. Includes timeline-derived stage history in the same `Run` shape as `/api/runs` when a lease/timeline exists. History entries that came from an owner reset carry the owner's `reason`. When the key belongs to a wired convergence campaign, the detail response also includes an optional `burndown` block with `source`, `satisfied`, `remaining`, `unknown`, and `scope`; the list endpoint omits this block. | `pkg/dashboard/api.go:84` |
+| `POST` | `/api/runs/{key}/reset` | Owner only | Move a run's lease back to an earlier stage (for example `implement` to `plan` after a rejected plan). Body `{"to": "<stage>", "reason": "<why>"}`, both required. Mints a new generation so the relay holding the old one can no longer resume, persists before answering, and records the reason on the agent audit sink, the lifecycle timeline, and the `stage_completed` hook payload (`attrs.reset = "true"`). Returns `{ok, key, stage_from, stage, gen, reason}`. 400 for the same or a later stage or a missing reason, 404 when no live staged lease holds the key, 409 when the lease expired, 500 when the registry could not be written. | `pkg/dashboard/api.go:85` |
+| `GET` | `/api/campaigns` | Dashboard auth/session | List resumable campaigns from archived Inception sessions and retained Spektacular (Spek) runs. Query `search`/`q`, `repo`, `stage`, `status`, and `owner`; each campaign is keyed by stable spec/session id and includes title, source, repos, current stage/step, artifact links, linked issues/PRs, contributors, last activity, status, engine, type, and run link when applicable. | `pkg/dashboard/api.go:86` |
+| `GET` | `/api/campaigns/{id}` | Dashboard auth/session | Return one campaign by URL-escaped stable campaign id or run key, using the same campaign shape as `/api/campaigns`. | `pkg/dashboard/api.go:87` |
+| `POST` | `/api/campaigns/{id}/resume` | Owner only | Resume or pick up a campaign. Archived Inception campaigns take a durable campaign lease, restore their saved state and wiki working files; Spek campaigns return the retained run detail plus a CLI status command that reloads state from Spek artifacts. Body may include `{ "surface": "chat"|"contributor"|"cli"|"dashboard" }`; 409 means another user holds the lease. | `pkg/dashboard/api.go:88` |
+| `POST` | `/api/campaigns/{id}/release` | Owner only | Release the caller's Inception campaign lease and write a `campaign_release` audit entry so another user can continue it. Run-backed Spektacular campaigns return `409 Conflict`; this endpoint never revokes their run-lifecycle stage leases. | `pkg/dashboard/api.go:89` |
+| `POST` | `/api/campaigns/{id}/revise` | Owner only | Create a linked revision campaign (`revision_of`, `revision`) for revisiting shipped or parked Inception/Spek work without overwriting the previous campaign. The new revision is leased to the caller and audit-logged as `campaign_revise`. | `pkg/dashboard/api.go:90` |
+| `GET` | `/api/campaigns/{id}/jam` | Dashboard auth/session | Return the per-campaign Jam workspace: section-anchored threads, comments, suggestions, polls, poll decisions, current spec revision and attributed revision history. | `pkg/dashboard/api.go:91` |
+| `POST` | `/api/campaigns/{id}/jam` | Read-write role | Record an attributed spec revision for a campaign. Body includes `spec_content`, optional `reason`, and optional agent/model attribution fields. | `pkg/dashboard/api.go:92` |
+| `GET` | `/api/campaigns/{id}/jam/threads` | Dashboard auth/session | List async Jam threads anchored to spec sections, including comments and author attribution. | `pkg/dashboard/api.go:93` |
+| `POST` | `/api/campaigns/{id}/jam/threads` | Read-write role | Create a section-anchored Jam thread or add a comment to an existing thread. Body includes `section` and `body`, or `thread_id` and `body`. | `pkg/dashboard/api.go:94` |
+| `POST` | `/api/campaigns/{id}/jam/agents` | Maintainer only | Invite Spektacular or a configured hive agent into a Jam thread. The agent reply is posted as an attributed thread comment and an open suggestion for human accept/reject; no spec revision is auto-applied. | `pkg/dashboard/api.go:95` |
+| `GET` | `/api/campaigns/{id}/jam/suggestions` | Dashboard auth/session | List Jam suggestions with open/accepted/rejected status, proposed text, attribution and applied revision id when accepted. | `pkg/dashboard/api.go:96` |
+| `POST` | `/api/campaigns/{id}/jam/suggestions` | Read-write role; maintainer for accept | Create a suggestion (`section`, `proposed_text`) or resolve it with `action: "accept"`/`"reject"` and `suggestion_id`. Accepting records a new attributed spec revision. | `pkg/dashboard/api.go:97` |
+| `GET` | `/api/campaigns/{id}/jam/polls` | Dashboard auth/session | List Jam polls, advisory vote tallies and maintainer decisions stored against spec revisions. | `pkg/dashboard/api.go:98` |
+| `POST` | `/api/campaigns/{id}/jam/polls` | Read-write role; maintainer for decide | Create polls (`section`, `question`, `options`), cast/update advisory votes (`action: "vote"`), or record a maintainer decision with rationale (`action: "decide"`). | `pkg/dashboard/api.go:99` |
+| `GET` | `/api/campaigns/{id}/jam/project-sync` | Dashboard auth/session | Return the campaign's GitHub Projects sync configuration, last published items, last status, and retry guidance for failures. | `pkg/dashboard/api.go:100` |
+| `POST` | `/api/campaigns/{id}/jam/project-sync` | Maintainer only | Enable/disable opt-in GitHub Projects sync, publish campaign specs/decisions/derived issues to the linked project, or record inbound project status updates without losing local Jam decisions. | `pkg/dashboard/api.go:101` |
+| `GET` | `/api/campaigns/{id}/jam/ws` | Dashboard auth/session | Upgrade to a Jam WebSocket for live participant presence, section focus, and conflict-aware spec co-edit messages. Live edits require read-write role and stale `base_revision_id` values are rejected with a conflict message. | `pkg/dashboard/api.go:102` |
+| `GET` | `/api/runs/{key}/trace` | Dashboard auth/session | Resolve `Hive-Run`, `Hive-Plan`, and `Hive-Spec` commit trailers for `?sha=...`, returning the linked plan section, spek clause, approval audit record, rationale audit entries, and typed no-linkage results when trailers are missing. | `pkg/dashboard/api.go:81` |
 
 ## Snapshots and style
 
@@ -62,21 +62,21 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 |---|---|---|---|---|
 | `GET` | `/api/style` | Public | Sanitized custom dashboard CSS | `pkg/dashboard/api.go:37` |
 | `GET` | `/branding/custom.css` | Dashboard auth/session | Operator branding stylesheet override, read per request (see [branding](branding.md)) | `pkg/dashboard/server.go:1279` |
-| `GET` | `/api/snapshot/frame-ancestors` | Public | Snapshot framing allowlist | `pkg/dashboard/api.go:69` |
-| `GET` | `/api/snapshot` | Public | Snapshot data | `pkg/dashboard/api.go:70` |
-| `GET` | `/snapshot` | Public | Public read-only snapshot page | `pkg/dashboard/api.go:71` |
+| `GET` | `/api/snapshot/frame-ancestors` | Public | Snapshot framing allowlist | `pkg/dashboard/api.go:70` |
+| `GET` | `/api/snapshot` | Public | Snapshot data | `pkg/dashboard/api.go:71` |
+| `GET` | `/snapshot` | Public | Public read-only snapshot page | `pkg/dashboard/api.go:72` |
 
 ## Auth and external accounts
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/gh-auth` | Dashboard auth/session | GitHub Auth | `pkg/dashboard/api.go:157` |
-| `GET` | `/api/gh-rate-limits` | Dashboard auth/session | GitHub Rate Limits | `pkg/dashboard/api.go:158` |
-| `GET` | `/api/gh-user-auth/status` | Public | GitHub User Auth Status | `pkg/dashboard/api.go:159` |
-| `POST` | `/api/gh-user-auth/start` | Public | GitHub User Auth Start | `pkg/dashboard/api.go:160` |
-| `POST` | `/api/gh-user-auth/poll` | Public | GitHub User Auth Poll | `pkg/dashboard/api.go:161` |
-| `POST` | `/api/gh-user-auth/logout` | Public | GitHub User Auth Logout | `pkg/dashboard/api.go:162` |
-| `GET` | `/api/gh-user-auth/session` | Public | GitHub User Auth Session | `pkg/dashboard/api.go:163` |
+| `GET` | `/api/gh-auth` | Dashboard auth/session | GitHub Auth | `pkg/dashboard/api.go:158` |
+| `GET` | `/api/gh-rate-limits` | Dashboard auth/session | GitHub Rate Limits | `pkg/dashboard/api.go:159` |
+| `GET` | `/api/gh-user-auth/status` | Public | GitHub User Auth Status | `pkg/dashboard/api.go:160` |
+| `POST` | `/api/gh-user-auth/start` | Public | GitHub User Auth Start | `pkg/dashboard/api.go:161` |
+| `POST` | `/api/gh-user-auth/poll` | Public | GitHub User Auth Poll | `pkg/dashboard/api.go:162` |
+| `POST` | `/api/gh-user-auth/logout` | Public | GitHub User Auth Logout | `pkg/dashboard/api.go:163` |
+| `GET` | `/api/gh-user-auth/session` | Public | GitHub User Auth Session | `pkg/dashboard/api.go:164` |
 | `GET` | `/api/claude-auth/status` | Dashboard auth/session | Claude Auth Status | `pkg/dashboard/claude_auth.go:54` |
 | `POST` | `/api/claude-auth/start` | Dashboard auth/session | Claude Auth Start | `pkg/dashboard/claude_auth.go:55` |
 | `POST` | `/api/claude-auth/exchange` | Dashboard auth/session | Claude Auth Exchange | `pkg/dashboard/claude_auth.go:56` |
@@ -110,122 +110,122 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 | `PUT` | `/api/config/variables/{name}` | Owner only | Variable Upsert | `pkg/dashboard/api.go:49` |
 | `DELETE` | `/api/config/variables/{name}` | Owner only | Variable Delete | `pkg/dashboard/api.go:50` |
 
-| `GET` | `/api/config/agent/{name}` | Dashboard auth/session | Agent Config Get | `pkg/dashboard/api.go:170` |
-| `PUT` | `/api/config/agent/{name}/general` | Owner only | Agent Config General | `pkg/dashboard/api.go:171` |
-| `PUT` | `/api/config/agent/{name}/cadences` | Owner only | Agent Config Cadences | `pkg/dashboard/api.go:172` |
-| `PUT` | `/api/config/agent/{name}/models` | Owner only | Agent Config Models | `pkg/dashboard/api.go:173` |
-| `PUT` | `/api/config/agent/{name}/pipeline` | Owner only | Agent Config Pipeline | `pkg/dashboard/api.go:174` |
-| `PUT` | `/api/config/agent/{name}/hooks` | Owner only | Agent Config Hooks | `pkg/dashboard/api.go:175` |
-| `PUT` | `/api/config/agent/{name}/restrictions` | Owner only | Agent Config Restrictions | `pkg/dashboard/api.go:176` |
-| `PUT` | `/api/config/agent/{name}/stats` | Owner only | Agent Config Stats | `pkg/dashboard/api.go:177` |
-| `GET` | `/api/config/agent/{name}/prompt` | Dashboard auth/session | Agent Prompt | `pkg/dashboard/api.go:178` |
-| `PUT` | `/api/config/agent/{name}/prompt` | Owner only | Agent Prompt Save | `pkg/dashboard/api.go:179` |
-| `GET` | `/api/config/agent/{name}/export` | Dashboard auth/session | Agent Export | `pkg/dashboard/api.go:180` |
-| `PUT` | `/api/config/agent/{name}/channels` | Owner only | Agent Config Channels | `pkg/dashboard/api.go:181` |
-| `PUT` | `/api/config/agent/{name}/tools` | Owner only | Agent Config Tools | `pkg/dashboard/api.go:182` |
-| `PUT` | `/api/config/agent/{name}/connections` | Owner only | Agent Config Connections | `pkg/dashboard/api.go:183` |
-| `GET` | `/api/config/stat-sources` | Dashboard auth/session | Stat Sources | `pkg/dashboard/api.go:184` |
-| `GET` | `/api/config/governor` | Dashboard auth/session | Governor Config Get | `pkg/dashboard/api.go:186` |
-| `PUT` | `/api/config/governor/sensing` | Owner only | Governor Sensing | `pkg/dashboard/api.go:187` |
-| `PUT` | `/api/config/governor/thresholds` | Owner only | Governor Thresholds | `pkg/dashboard/api.go:188` |
-| `PUT` | `/api/config/governor/labels` | Owner only | Governor Labels | `pkg/dashboard/api.go:193` |
-| `PUT` | `/api/config/governor/budget` | Owner only | Governor Budget | `pkg/dashboard/api.go:194` |
-| `PUT` | `/api/config/governor/notifications` | Owner only | Governor Notifications | `pkg/dashboard/api.go:198` |
-| `PUT` | `/api/config/governor/health` | Owner only | Governor Health | `pkg/dashboard/api.go:199` |
-| `PUT` | `/api/config/governor/logging` | Owner only | Governor Logging | `pkg/dashboard/api.go:211` |
-| `PUT` | `/api/config/governor/attribution` | Owner only | Governor Attribution | `pkg/dashboard/api.go:212` |
-| `PUT` | `/api/config/governor/hub` | Owner only | Governor Hub | `pkg/dashboard/api.go:213` |
-| `PUT` | `/api/config/governor/litellm` | Owner only | Governor Lite LLM | `pkg/dashboard/api.go:214` |
-| `PUT` | `/api/config/governor/trajectory` | Owner only | Governor Trajectory | `pkg/dashboard/api.go:215` |
+| `GET` | `/api/config/agent/{name}` | Dashboard auth/session | Agent Config Get | `pkg/dashboard/api.go:171` |
+| `PUT` | `/api/config/agent/{name}/general` | Owner only | Agent Config General | `pkg/dashboard/api.go:172` |
+| `PUT` | `/api/config/agent/{name}/cadences` | Owner only | Agent Config Cadences | `pkg/dashboard/api.go:173` |
+| `PUT` | `/api/config/agent/{name}/models` | Owner only | Agent Config Models | `pkg/dashboard/api.go:174` |
+| `PUT` | `/api/config/agent/{name}/pipeline` | Owner only | Agent Config Pipeline | `pkg/dashboard/api.go:175` |
+| `PUT` | `/api/config/agent/{name}/hooks` | Owner only | Agent Config Hooks | `pkg/dashboard/api.go:176` |
+| `PUT` | `/api/config/agent/{name}/restrictions` | Owner only | Agent Config Restrictions | `pkg/dashboard/api.go:177` |
+| `PUT` | `/api/config/agent/{name}/stats` | Owner only | Agent Config Stats | `pkg/dashboard/api.go:178` |
+| `GET` | `/api/config/agent/{name}/prompt` | Dashboard auth/session | Agent Prompt | `pkg/dashboard/api.go:179` |
+| `PUT` | `/api/config/agent/{name}/prompt` | Owner only | Agent Prompt Save | `pkg/dashboard/api.go:180` |
+| `GET` | `/api/config/agent/{name}/export` | Dashboard auth/session | Agent Export | `pkg/dashboard/api.go:181` |
+| `PUT` | `/api/config/agent/{name}/channels` | Owner only | Agent Config Channels | `pkg/dashboard/api.go:182` |
+| `PUT` | `/api/config/agent/{name}/tools` | Owner only | Agent Config Tools | `pkg/dashboard/api.go:183` |
+| `PUT` | `/api/config/agent/{name}/connections` | Owner only | Agent Config Connections | `pkg/dashboard/api.go:184` |
+| `GET` | `/api/config/stat-sources` | Dashboard auth/session | Stat Sources | `pkg/dashboard/api.go:185` |
+| `GET` | `/api/config/governor` | Dashboard auth/session | Governor Config Get | `pkg/dashboard/api.go:187` |
+| `PUT` | `/api/config/governor/sensing` | Owner only | Governor Sensing | `pkg/dashboard/api.go:188` |
+| `PUT` | `/api/config/governor/thresholds` | Owner only | Governor Thresholds | `pkg/dashboard/api.go:189` |
+| `PUT` | `/api/config/governor/labels` | Owner only | Governor Labels | `pkg/dashboard/api.go:194` |
+| `PUT` | `/api/config/governor/budget` | Owner only | Governor Budget | `pkg/dashboard/api.go:195` |
+| `PUT` | `/api/config/governor/notifications` | Owner only | Governor Notifications | `pkg/dashboard/api.go:199` |
+| `PUT` | `/api/config/governor/health` | Owner only | Governor Health | `pkg/dashboard/api.go:200` |
+| `PUT` | `/api/config/governor/logging` | Owner only | Governor Logging | `pkg/dashboard/api.go:212` |
+| `PUT` | `/api/config/governor/attribution` | Owner only | Governor Attribution | `pkg/dashboard/api.go:213` |
+| `PUT` | `/api/config/governor/hub` | Owner only | Governor Hub | `pkg/dashboard/api.go:214` |
+| `PUT` | `/api/config/governor/litellm` | Owner only | Governor Lite LLM | `pkg/dashboard/api.go:215` |
+| `PUT` | `/api/config/governor/trajectory` | Owner only | Governor Trajectory | `pkg/dashboard/api.go:216` |
 | `GET` | `/api/config/governor/backup` | Owner only | Backup Key Status (presence + safe source label; never the key value) | `pkg/dashboard/backup_key.go` |
 | `PUT` | `/api/config/governor/backup` | Owner only | Backup Key Set (64-hex AES-256 key; stored 0600, path-only in `hive.yaml`) | `pkg/dashboard/backup_key.go` |
 | `DELETE` | `/api/config/governor/backup` | Owner only | Backup Key Clear (backups are refused again) | `pkg/dashboard/backup_key.go` |
-| `GET` | `/api/config/governor/bob` | Dashboard auth/session | Governor Bob Status | `pkg/dashboard/api.go:254` |
-| `PUT` | `/api/config/governor/bob` | Owner only | Governor Bob Key | `pkg/dashboard/api.go:255` |
-| `DELETE` | `/api/config/governor/bob` | Owner only | Governor Bob Key Clear | `pkg/dashboard/api.go:256` |
-
-| `GET` | `/api/config/governor/cadence-scope` | Owner only | Governor Cadence Scope Get (`aggregate` or `per_repo`) | `pkg/dashboard/api.go:189` |
-| `PUT` | `/api/config/governor/cadence-scope` | Owner only | Governor Cadence Scope Set (`cadenceScope`/`cadence_scope`: `aggregate`, `per_repo`, or empty for default) | `pkg/dashboard/api.go:190` |
-| `POST` | `/api/config/governor/bob/test` | Dashboard auth/session | Governor Bob Key Test | `pkg/dashboard/api.go:258` |
-| `POST` | `/api/config/governor/litellm/test` | Dashboard auth/session | Governor Lite LLMTest | `pkg/dashboard/api.go:259` |
-| `GET` | `/api/config/governor/gateways` | Dashboard auth/session | Governor Gateways List | `pkg/dashboard/api.go:262` |
-| `PUT` | `/api/config/governor/gateways` | Owner only | Governor Gateways Upsert | `pkg/dashboard/api.go:263` |
-| `DELETE` | `/api/config/governor/gateways/{name}` | Owner only | Governor Gateways Delete | `pkg/dashboard/api.go:264` |
-| `POST` | `/api/config/governor/gateways/{name}/test` | Dashboard auth/session | Governor Gateways Test | `pkg/dashboard/api.go:265` |
-| `POST` | `/api/config/governor/gateways/discover` | Owner only | Governor Gateways Discover | `pkg/dashboard/api.go:266` |
-| `POST` | `/api/config/governor/agents` | Owner only | Governor Add Agent | `pkg/dashboard/api.go:270` |
-| `DELETE` | `/api/config/governor/agents/{name}` | Owner only | Governor Remove Agent | `pkg/dashboard/api.go:271` |
-| `PUT` | `/api/config/governor/repos` | Owner only | Governor Repos | `pkg/dashboard/api.go:272` |
-| `POST` | `/api/config/governor/repos/check-access` | Dashboard auth/session | Governor Repo Check Access | `pkg/dashboard/api.go:276` |
-| `PUT` | `/api/config/github` | Owner only | Config GitHub | `pkg/dashboard/api.go:277` |
-| `GET` | `/api/config/github/forge-apps` | Dashboard auth/session | Config GitHub Forge Apps | `pkg/dashboard/api.go:280` |
-| `GET` | `/api/config/sidebar` | Dashboard auth/session | Sidebar Get | `pkg/dashboard/api.go:313` |
-| `PUT` | `/api/config/sidebar` | Dashboard auth/session | Sidebar Set | `pkg/dashboard/api.go:314` |
-| `GET` | `/api/config/backends` | Dashboard auth/session | Backends | `pkg/dashboard/api.go:315` |
-
-| `GET` | `/api/config/governor/threshold-scaling` | Owner only | Governor Threshold Scaling Get | `pkg/dashboard/api.go:191` |
-| `PUT` | `/api/config/governor/threshold-scaling` | Owner only | Governor Threshold Scaling Set | `pkg/dashboard/api.go:192` |
-| `POST` | `/api/config/governor/budget/reset` | Owner only | Governor Budget Reset | `pkg/dashboard/api.go:195` |
-| `PUT` | `/api/config/governor/watchdog` | Owner only | Governor Watchdog | `pkg/dashboard/api.go:200` |
-| `GET` | `/api/config/escalation` | Owner only | Escalation Config Get | `pkg/dashboard/api.go:203` |
-| `PUT` | `/api/config/escalation` | Owner only | Escalation Config Set | `pkg/dashboard/api.go:204` |
-| `GET` | `/api/config/write-surface` | Owner only | Lane write allowlist (`write_surface.allowlist`, [#9587](https://github.com/hivecommons/hive/issues/9587)): `allowlist`, `ops`, `warnings` | `pkg/dashboard/api.go:433` |
-| `PUT` | `/api/config/write-surface` | Owner only | Replace the lane write allowlist; `{"allowlist": {}}` clears it; unknown operation or bad lane name is a 400 with nothing changed | `pkg/dashboard/api.go:434` |
-| `GET` | `/api/config/review` | Dashboard auth/session | Review Config Get | `pkg/dashboard/api.go:207` |
-| `PUT` | `/api/config/review` | Owner only | Review Config Set | `pkg/dashboard/api.go:210` |
-| `PUT` | `/api/config/governor/features` | Owner only | Governor Features | `pkg/dashboard/api.go:216` |
-| `GET` | `/api/config/governor/general-advanced` | Owner only | Governor General Advanced Get | `pkg/dashboard/api.go:217` |
-| `PUT` | `/api/config/governor/general-advanced` | Owner only | Governor General Advanced Set | `pkg/dashboard/api.go:218` |
-| `GET` | `/api/config/auto-merge` | Owner only | Auto-Merge Config Get | `pkg/dashboard/api.go:222` |
-| `PUT` | `/api/config/auto-merge` | Owner only | Auto-Merge Config Set | `pkg/dashboard/api.go:223` |
-| `GET` | `/api/config/convergence` | Owner only | Convergence Config Get | `pkg/dashboard/api.go:228` |
-| `PUT` | `/api/config/convergence` | Owner only | Convergence Config Set | `pkg/dashboard/api.go:229` |
-| `GET` | `/api/config/governor/advisory` | Owner only | Governor Advisory Get | `pkg/dashboard/api.go:231` |
-| `PUT` | `/api/config/governor/advisory` | Owner only | Governor Advisory Set | `pkg/dashboard/api.go:232` |
-| `GET` | `/api/config/governor/replan` | Owner only | Governor Replan Get | `pkg/dashboard/api.go:233` |
-| `PUT` | `/api/config/governor/replan` | Owner only | Governor Replan Set | `pkg/dashboard/api.go:234` |
-| `GET` | `/api/config/governor/work-source` | Owner only | Governor Work Source Get (Jira secrets/TLS fields reported as set/unset only) | `pkg/dashboard/api.go:241` |
-| `PUT` | `/api/config/governor/work-source` | Owner only | Governor Work Source Set (including Jira Data Center TLS settings) | `pkg/dashboard/api.go:242` |
-| `PUT` | `/api/config/governor/security` | Owner only | Governor Security | `pkg/dashboard/api.go:243` |
-| `GET` | `/api/config/governor/project-observability` | Owner only | Governor Project Observability Get | `pkg/dashboard/api.go:244` |
-| `PUT` | `/api/config/governor/project-observability` | Owner only | Governor Project Observability Set | `pkg/dashboard/api.go:245` |
-| `GET` | `/api/config/governor/inference-auth` | Owner only | Governor Inference Auth Get | `pkg/dashboard/api.go:260` |
-| `PUT` | `/api/config/governor/inference-auth` | Owner only | Governor Inference Auth Set | `pkg/dashboard/api.go:261` |
+| `GET` | `/api/config/governor/bob` | Dashboard auth/session | Governor Bob Status | `pkg/dashboard/api.go:255` |
+| `PUT` | `/api/config/governor/bob` | Owner only | Governor Bob Key | `pkg/dashboard/api.go:256` |
+| `DELETE` | `/api/config/governor/bob` | Owner only | Governor Bob Key Clear | `pkg/dashboard/api.go:257` |
+
+| `GET` | `/api/config/governor/cadence-scope` | Owner only | Governor Cadence Scope Get (`aggregate` or `per_repo`) | `pkg/dashboard/api.go:190` |
+| `PUT` | `/api/config/governor/cadence-scope` | Owner only | Governor Cadence Scope Set (`cadenceScope`/`cadence_scope`: `aggregate`, `per_repo`, or empty for default) | `pkg/dashboard/api.go:191` |
+| `POST` | `/api/config/governor/bob/test` | Dashboard auth/session | Governor Bob Key Test | `pkg/dashboard/api.go:259` |
+| `POST` | `/api/config/governor/litellm/test` | Dashboard auth/session | Governor Lite LLMTest | `pkg/dashboard/api.go:260` |
+| `GET` | `/api/config/governor/gateways` | Dashboard auth/session | Governor Gateways List | `pkg/dashboard/api.go:263` |
+| `PUT` | `/api/config/governor/gateways` | Owner only | Governor Gateways Upsert | `pkg/dashboard/api.go:264` |
+| `DELETE` | `/api/config/governor/gateways/{name}` | Owner only | Governor Gateways Delete | `pkg/dashboard/api.go:265` |
+| `POST` | `/api/config/governor/gateways/{name}/test` | Dashboard auth/session | Governor Gateways Test | `pkg/dashboard/api.go:266` |
+| `POST` | `/api/config/governor/gateways/discover` | Owner only | Governor Gateways Discover | `pkg/dashboard/api.go:267` |
+| `POST` | `/api/config/governor/agents` | Owner only | Governor Add Agent | `pkg/dashboard/api.go:271` |
+| `DELETE` | `/api/config/governor/agents/{name}` | Owner only | Governor Remove Agent | `pkg/dashboard/api.go:272` |
+| `PUT` | `/api/config/governor/repos` | Owner only | Governor Repos | `pkg/dashboard/api.go:273` |
+| `POST` | `/api/config/governor/repos/check-access` | Dashboard auth/session | Governor Repo Check Access | `pkg/dashboard/api.go:277` |
+| `PUT` | `/api/config/github` | Owner only | Config GitHub | `pkg/dashboard/api.go:278` |
+| `GET` | `/api/config/github/forge-apps` | Dashboard auth/session | Config GitHub Forge Apps | `pkg/dashboard/api.go:281` |
+| `GET` | `/api/config/sidebar` | Dashboard auth/session | Sidebar Get | `pkg/dashboard/api.go:314` |
+| `PUT` | `/api/config/sidebar` | Dashboard auth/session | Sidebar Set | `pkg/dashboard/api.go:315` |
+| `GET` | `/api/config/backends` | Dashboard auth/session | Backends | `pkg/dashboard/api.go:316` |
+
+| `GET` | `/api/config/governor/threshold-scaling` | Owner only | Governor Threshold Scaling Get | `pkg/dashboard/api.go:192` |
+| `PUT` | `/api/config/governor/threshold-scaling` | Owner only | Governor Threshold Scaling Set | `pkg/dashboard/api.go:193` |
+| `POST` | `/api/config/governor/budget/reset` | Owner only | Governor Budget Reset | `pkg/dashboard/api.go:196` |
+| `PUT` | `/api/config/governor/watchdog` | Owner only | Governor Watchdog | `pkg/dashboard/api.go:201` |
+| `GET` | `/api/config/escalation` | Owner only | Escalation Config Get | `pkg/dashboard/api.go:204` |
+| `PUT` | `/api/config/escalation` | Owner only | Escalation Config Set | `pkg/dashboard/api.go:205` |
+| `GET` | `/api/config/write-surface` | Owner only | Lane write allowlist (`write_surface.allowlist`, [#9587](https://github.com/hivecommons/hive/issues/9587)): `allowlist`, `ops`, `warnings` | `pkg/dashboard/api.go:434` |
+| `PUT` | `/api/config/write-surface` | Owner only | Replace the lane write allowlist; `{"allowlist": {}}` clears it; unknown operation or bad lane name is a 400 with nothing changed | `pkg/dashboard/api.go:435` |
+| `GET` | `/api/config/review` | Dashboard auth/session | Review Config Get | `pkg/dashboard/api.go:208` |
+| `PUT` | `/api/config/review` | Owner only | Review Config Set | `pkg/dashboard/api.go:211` |
+| `PUT` | `/api/config/governor/features` | Owner only | Governor Features | `pkg/dashboard/api.go:217` |
+| `GET` | `/api/config/governor/general-advanced` | Owner only | Governor General Advanced Get | `pkg/dashboard/api.go:218` |
+| `PUT` | `/api/config/governor/general-advanced` | Owner only | Governor General Advanced Set | `pkg/dashboard/api.go:219` |
+| `GET` | `/api/config/auto-merge` | Owner only | Auto-Merge Config Get | `pkg/dashboard/api.go:223` |
+| `PUT` | `/api/config/auto-merge` | Owner only | Auto-Merge Config Set | `pkg/dashboard/api.go:224` |
+| `GET` | `/api/config/convergence` | Owner only | Convergence Config Get | `pkg/dashboard/api.go:229` |
+| `PUT` | `/api/config/convergence` | Owner only | Convergence Config Set | `pkg/dashboard/api.go:230` |
+| `GET` | `/api/config/governor/advisory` | Owner only | Governor Advisory Get | `pkg/dashboard/api.go:232` |
+| `PUT` | `/api/config/governor/advisory` | Owner only | Governor Advisory Set | `pkg/dashboard/api.go:233` |
+| `GET` | `/api/config/governor/replan` | Owner only | Governor Replan Get | `pkg/dashboard/api.go:234` |
+| `PUT` | `/api/config/governor/replan` | Owner only | Governor Replan Set | `pkg/dashboard/api.go:235` |
+| `GET` | `/api/config/governor/work-source` | Owner only | Governor Work Source Get (Jira secrets/TLS fields reported as set/unset only) | `pkg/dashboard/api.go:242` |
+| `PUT` | `/api/config/governor/work-source` | Owner only | Governor Work Source Set (including Jira Data Center TLS settings) | `pkg/dashboard/api.go:243` |
+| `PUT` | `/api/config/governor/security` | Owner only | Governor Security | `pkg/dashboard/api.go:244` |
+| `GET` | `/api/config/governor/project-observability` | Owner only | Governor Project Observability Get | `pkg/dashboard/api.go:245` |
+| `PUT` | `/api/config/governor/project-observability` | Owner only | Governor Project Observability Set | `pkg/dashboard/api.go:246` |
+| `GET` | `/api/config/governor/inference-auth` | Owner only | Governor Inference Auth Get | `pkg/dashboard/api.go:261` |
+| `PUT` | `/api/config/governor/inference-auth` | Owner only | Governor Inference Auth Set | `pkg/dashboard/api.go:262` |
 
 ## Agents and controls
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
 
-| `POST` | `/api/kick/{agent}` | Owner only | Kick — asynchronous; answers `202` once queued (see below) | `pkg/dashboard/api.go:119` |
-| `GET` | `/api/kick/{agent}/status` | Dashboard auth/session | Outcome of the most recent kick | `pkg/dashboard/api.go:123` |
-| `POST` | `/api/switch/{agent}/{backend}` | Owner only | Switch | `pkg/dashboard/api.go:124` |
-| `POST` | `/api/model/{agent}/{model}` | Owner only | Model Set | `pkg/dashboard/api.go:125` |
-| `POST` | `/api/effort/{agent}/{effort}` | Owner only | Set launch-only reasoning effort after validating against the agent's live backend (including runtime override); persists config/agent overlay, restarts the session, and `default` clears the stored effort | `pkg/dashboard/api.go:126` |
-| `POST` | `/api/pause/{agent}` | Owner only | Pause | `pkg/dashboard/api.go:127` |
-| `POST` | `/api/resume/{agent}` | Owner only | Resume | `pkg/dashboard/api.go:128` |
-| `GET` | `/api/agent-state/{agent}` | Dashboard auth/session | Agent State | `pkg/dashboard/api.go:129` |
-| `GET` | `/api/breaker` | Dashboard auth/session | Breaker State | `pkg/dashboard/api.go:130` |
-| `POST` | `/api/breaker/engage` | Owner only | Breaker Engage | `pkg/dashboard/api.go:131` |
-| `POST` | `/api/breaker/release` | Owner only | Breaker Release | `pkg/dashboard/api.go:132` |
-| `POST` | `/api/pin/{agent}/{dimension}` | Owner only | Pin | `pkg/dashboard/api.go:133` |
-| `POST` | `/api/unpin/{agent}/{dimension}` | Owner only | Unpin | `pkg/dashboard/api.go:134` |
-| `POST` | `/api/restart/{agent}` | Owner only | Restart | `pkg/dashboard/api.go:138` |
-| `GET` | `/api/model-advisor` | Dashboard auth/session | Model Advisor | `pkg/dashboard/api.go:152` |
-| `GET` | `/api/governor/pr-models` | Dashboard auth/session | Agent-authored PR distribution by normalized attribution model/backend for `window=7d`, `30d`, or `all`, including per-model rework stats and the top 10 most-reworked PRs | `pkg/dashboard/api.go:153` |
-| `GET` | `/api/reviewer/accuracy` | Dashboard auth/session | Reviewer verdict calibration for the configured window: false-approve/false-block rates and confidence buckets per perspective and reviewer model | `pkg/dashboard/api.go:209` |
-| `GET` | `/api/review/queue` | Dashboard auth/session | PR review queue: every open PR (agent and contributor, actionable and held) ranked by triage class, confidence band, CI state and age, with per-PR `reasons`; paged with `limit` (1-200, default 50) and `offset` | `pkg/dashboard/api.go:430` |
-| `GET` | `/api/agents` | Dashboard auth/session | Agents List | `pkg/dashboard/api.go:282` |
-| `POST` | `/api/agents` | Owner only | Agent Create | `pkg/dashboard/api.go:283` |
-| `POST` | `/api/agents/import` | Owner only | Agent Import | `pkg/dashboard/api.go:284` |
-| `DELETE` | `/api/agents/{name}` | Owner only | Agent Delete | `pkg/dashboard/api.go:285` |
-
-| `GET` | `/api/agents/{name}/log` | Dashboard auth/session | Agent Full Log | `pkg/dashboard/api.go:106` |
-| `GET` | `/api/agents/{name}/terminal-urls` | Dashboard auth/session | Agent Terminal URLs | `pkg/dashboard/api.go:110` |
-| `GET` | `/api/agents/{name}/kicks` | Dashboard auth/session | Agent Kick Log List | `pkg/dashboard/api.go:113` |
-| `GET` | `/api/agents/{name}/kicks/{id}` | Dashboard auth/session | Agent Kick Log Get | `pkg/dashboard/api.go:114` |
-| `GET` | `/agents/{name}/kicks` | Dashboard auth/session | Agent Kick History Page (HTML) | `pkg/dashboard/api.go:115` |
-| `POST` | `/api/agents/{name}/login-code` | Owner only | Agent Login Code | `pkg/dashboard/api.go:137` |
+| `POST` | `/api/kick/{agent}` | Owner only | Kick — asynchronous; answers `202` once queued (see below) | `pkg/dashboard/api.go:120` |
+| `GET` | `/api/kick/{agent}/status` | Dashboard auth/session | Outcome of the most recent kick | `pkg/dashboard/api.go:124` |
+| `POST` | `/api/switch/{agent}/{backend}` | Owner only | Switch | `pkg/dashboard/api.go:125` |
+| `POST` | `/api/model/{agent}/{model}` | Owner only | Model Set | `pkg/dashboard/api.go:126` |
+| `POST` | `/api/effort/{agent}/{effort}` | Owner only | Set launch-only reasoning effort after validating against the agent's live backend (including runtime override); persists config/agent overlay, restarts the session, and `default` clears the stored effort | `pkg/dashboard/api.go:127` |
+| `POST` | `/api/pause/{agent}` | Owner only | Pause | `pkg/dashboard/api.go:128` |
+| `POST` | `/api/resume/{agent}` | Owner only | Resume | `pkg/dashboard/api.go:129` |
+| `GET` | `/api/agent-state/{agent}` | Dashboard auth/session | Agent State | `pkg/dashboard/api.go:130` |
+| `GET` | `/api/breaker` | Dashboard auth/session | Breaker State | `pkg/dashboard/api.go:131` |
+| `POST` | `/api/breaker/engage` | Owner only | Breaker Engage | `pkg/dashboard/api.go:132` |
+| `POST` | `/api/breaker/release` | Owner only | Breaker Release | `pkg/dashboard/api.go:133` |
+| `POST` | `/api/pin/{agent}/{dimension}` | Owner only | Pin | `pkg/dashboard/api.go:134` |
+| `POST` | `/api/unpin/{agent}/{dimension}` | Owner only | Unpin | `pkg/dashboard/api.go:135` |
+| `POST` | `/api/restart/{agent}` | Owner only | Restart | `pkg/dashboard/api.go:139` |
+| `GET` | `/api/model-advisor` | Dashboard auth/session | Model Advisor | `pkg/dashboard/api.go:153` |
+| `GET` | `/api/governor/pr-models` | Dashboard auth/session | Agent-authored PR distribution by normalized attribution model/backend for `window=7d`, `30d`, or `all`, including per-model rework stats and the top 10 most-reworked PRs | `pkg/dashboard/api.go:154` |
+| `GET` | `/api/reviewer/accuracy` | Dashboard auth/session | Reviewer verdict calibration for the configured window: false-approve/false-block rates and confidence buckets per perspective and reviewer model | `pkg/dashboard/api.go:210` |
+| `GET` | `/api/review/queue` | Dashboard auth/session | PR review queue: every open PR (agent and contributor, actionable and held) ranked by triage class, confidence band, CI state and age, with per-PR `reasons`; paged with `limit` (1-200, default 50) and `offset` | `pkg/dashboard/api.go:431` |
+| `GET` | `/api/agents` | Dashboard auth/session | Agents List | `pkg/dashboard/api.go:283` |
+| `POST` | `/api/agents` | Owner only | Agent Create | `pkg/dashboard/api.go:284` |
+| `POST` | `/api/agents/import` | Owner only | Agent Import | `pkg/dashboard/api.go:285` |
+| `DELETE` | `/api/agents/{name}` | Owner only | Agent Delete | `pkg/dashboard/api.go:286` |
+
+| `GET` | `/api/agents/{name}/log` | Dashboard auth/session | Agent Full Log | `pkg/dashboard/api.go:107` |
+| `GET` | `/api/agents/{name}/terminal-urls` | Dashboard auth/session | Agent Terminal URLs | `pkg/dashboard/api.go:111` |
+| `GET` | `/api/agents/{name}/kicks` | Dashboard auth/session | Agent Kick Log List | `pkg/dashboard/api.go:114` |
+| `GET` | `/api/agents/{name}/kicks/{id}` | Dashboard auth/session | Agent Kick Log Get | `pkg/dashboard/api.go:115` |
+| `GET` | `/agents/{name}/kicks` | Dashboard auth/session | Agent Kick History Page (HTML) | `pkg/dashboard/api.go:116` |
+| `POST` | `/api/agents/{name}/login-code` | Owner only | Agent Login Code | `pkg/dashboard/api.go:138` |
 
 ### Kick is asynchronous
 
@@ -246,80 +246,80 @@ Read the result from `GET /api/kick/{agent}/status`, which returns `status` of `
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/packs` | Dashboard auth/session | Packs List | `pkg/dashboard/api.go:287` |
-| `POST` | `/api/packs/{level}/apply` | Owner only | Pack Apply | `pkg/dashboard/api.go:288` |
-| `PUT` | `/api/packs/level` | Owner only | Set the ACMM level. Body `{"level": N}` persists and applies the pack; optional `{"release_level_holds": true}` performs a deliberate one-off release of Hive App level-applied `hold` labels for the transition. Level holds are otherwise never auto-released. When the change makes the L6 self-authored merge sweep eligible, the success body adds `self_merge_sweep_active`, `level_changed_at`, `level_holds_pending: [{repo, number, title, url, agent}]`, and `repos: [{repo, auto_merge}]` so the dashboard can show the owner an informational notice and repo toggles. | `pkg/dashboard/api.go:289` |
+| `GET` | `/api/packs` | Dashboard auth/session | Packs List | `pkg/dashboard/api.go:288` |
+| `POST` | `/api/packs/{level}/apply` | Owner only | Pack Apply | `pkg/dashboard/api.go:289` |
+| `PUT` | `/api/packs/level` | Owner only | Set the ACMM level. Body `{"level": N}` persists and applies the pack; optional `{"release_level_holds": true}` performs a deliberate one-off release of Hive App level-applied `hold` labels for the transition. Level holds are otherwise never auto-released. When the change makes the L6 self-authored merge sweep eligible, the success body adds `self_merge_sweep_active`, `level_changed_at`, `level_holds_pending: [{repo, number, title, url, agent}]`, and `repos: [{repo, auto_merge}]` so the dashboard can show the owner an informational notice and repo toggles. | `pkg/dashboard/api.go:290` |
 | `POST` | `/api/repos/rescan` | Dashboard auth/session | Re-enumerate watched repositories' open issues/PRs for the dashboard Projects cards. The scan is read-only with respect to agents/governor actions, collapses concurrent requests, and debounces repeated presses for 30 seconds (`repoRescanDebounce`) so the button cannot hammer GitHub | `pkg/dashboard/api.go`, `pkg/dashboard/api_repos_rescan.go` |
 | `POST` | `/api/repos/pause` | Owner | Quiet ONE repository without stopping the hive: agents stop writing to it and stop being handed work on it, while it keeps its dashboard card and ACMM eval. Body `{"repo": "...", "reason": "..."}` — the repo travels in the body because a `project.repos` entry may be an explicit cross-org `owner/name`. Records who/when/why; `changed: false` marks a no-op re-pause and leaves the original provenance intact; `persisted: false` means the pause is in force but could not be written to config. Rejects a repo outside `project.repos`. See [per-repo agent pause](repo-pause.md) | `pkg/dashboard/api_repo_pause.go` |
 | `POST` | `/api/repos/resume` | Owner | Lift a repository's pause. Unlike pause, does not require the repo to be in `project.repos`, so a pause left behind by a removed repo can still be cleared | `pkg/dashboard/api_repo_pause.go` |
 | `GET` | `/api/repos/pauses` | Dashboard auth/session | Every repo pause with its provenance. Read-only — the same state is already on the repository cards | `pkg/dashboard/api_repo_pause.go` |
 
 
-| `GET` | `/api/repos/{owner}/{repo}/hold-permission` | Dashboard auth/session | Reports whether the signed-in user can toggle hold chips for a repository card. Owners are allowed; otherwise the server checks GitHub `repos/{owner}/{repo}/collaborators/{user}/permission` and briefly caches the effective permission | `pkg/dashboard/api.go:304`, `pkg/dashboard/api_repo_hold.go` |
-| `POST` | `/api/repos/{owner}/{repo}/items/{number}/hold` | Owner or repo write/maintain/admin | Add or remove a dashboard hold chip for an issue or PR. Body `{"held": true}` adds the hive's exact-match canonical `hive-pause/<hive-id>` label; `{"held": false}` removes exactly the labels causing the hold (`hive-pause/<hive-id>` and/or generic hold labels) and never removes `hive/<hive-id>` provenance. Every toggle writes an audit-log entry; the #8851 upgrade migration writes `/data/hive-hold-migration-<hive-id>.json` with audit-backed, provenance-only, and ambiguous legacy `hive/<hive-id>` classifications. | `pkg/dashboard/api.go:305`, `pkg/dashboard/api_repo_hold.go` |
-| `GET` | `/api/acmm/evaluation` | Dashboard auth/session | ACMMEvaluation — combined codebase + operational result, cached server-side for 1 hour (`acmmEvalTTL`). `?refresh=1` (the dashboard's "🔄 Re-evaluate" button, #5877) bypasses the hourly TTL but is debounced server-side: requests within 1 minute of the last evaluation (`acmmRefreshDebounce`) still serve the cache, since a full refresh costs up to ~29 GitHub GetContents calls per repo. The response's `last_evaluated_at` timestamp reports when the cached evaluation was computed | `pkg/dashboard/api.go:307`, `pkg/dashboard/api_acmm_eval.go` |
-| `POST` | `/api/acmm/issue` | Owner only | ACMMCreate Issue — files on GitHub or, with `governor.acmm.issue_tracker: work_source` / body `tracker: "work_source"` on a Linear-sourced hive, on Linear; response `tracker` says which. See [ACMM policy matrix](acmm-policy-matrix.md#where-acmm-gap-issues-are-filed) | `pkg/dashboard/api.go:308` |
-| `GET` | `/api/acmm-recommendation` | Dashboard auth/session | Advisory level-up recommendation (`acmmadvisor.Recommendation`, JSON): never changes the applied level — see [ACMM advisor](acmm-advisor.md) | `pkg/dashboard/api.go:309` |
-| `GET` | `/api/hive-advice` | Dashboard auth/session | Weekly owner advice (`hiveadvisor.Result`, JSON) shared with the advisory digest: recommendations with `items`, `links` (Overview export paths) and `bands`; `bands[]` rule text; `counts` naming the governor actionable queue vs. the Overview total. Which recommendations show is frozen for 7 days; their numbers refresh every call — see [Owner advice](advisory.md#owner-advice) | `pkg/dashboard/api.go:311`, `pkg/dashboard/api_hive_advice.go` |
+| `GET` | `/api/repos/{owner}/{repo}/hold-permission` | Dashboard auth/session | Reports whether the signed-in user can toggle hold chips for a repository card. Owners are allowed; otherwise the server checks GitHub `repos/{owner}/{repo}/collaborators/{user}/permission` and briefly caches the effective permission | `pkg/dashboard/api.go:305`, `pkg/dashboard/api_repo_hold.go` |
+| `POST` | `/api/repos/{owner}/{repo}/items/{number}/hold` | Owner or repo write/maintain/admin | Add or remove a dashboard hold chip for an issue or PR. Body `{"held": true}` adds the hive's exact-match canonical `hive-pause/<hive-id>` label; `{"held": false}` removes exactly the labels causing the hold (`hive-pause/<hive-id>` and/or generic hold labels) and never removes `hive/<hive-id>` provenance. Every toggle writes an audit-log entry; the #8851 upgrade migration writes `/data/hive-hold-migration-<hive-id>.json` with audit-backed, provenance-only, and ambiguous legacy `hive/<hive-id>` classifications. | `pkg/dashboard/api.go:306`, `pkg/dashboard/api_repo_hold.go` |
+| `GET` | `/api/acmm/evaluation` | Dashboard auth/session | ACMMEvaluation — combined codebase + operational result, cached server-side for 1 hour (`acmmEvalTTL`). `?refresh=1` (the dashboard's "🔄 Re-evaluate" button, #5877) bypasses the hourly TTL but is debounced server-side: requests within 1 minute of the last evaluation (`acmmRefreshDebounce`) still serve the cache, since a full refresh costs up to ~29 GitHub GetContents calls per repo. The response's `last_evaluated_at` timestamp reports when the cached evaluation was computed | `pkg/dashboard/api.go:308`, `pkg/dashboard/api_acmm_eval.go` |
+| `POST` | `/api/acmm/issue` | Owner only | ACMMCreate Issue — files on GitHub or, with `governor.acmm.issue_tracker: work_source` / body `tracker: "work_source"` on a Linear-sourced hive, on Linear; response `tracker` says which. See [ACMM policy matrix](acmm-policy-matrix.md#where-acmm-gap-issues-are-filed) | `pkg/dashboard/api.go:309` |
+| `GET` | `/api/acmm-recommendation` | Dashboard auth/session | Advisory level-up recommendation (`acmmadvisor.Recommendation`, JSON): never changes the applied level — see [ACMM advisor](acmm-advisor.md) | `pkg/dashboard/api.go:310` |
+| `GET` | `/api/hive-advice` | Dashboard auth/session | Weekly owner advice (`hiveadvisor.Result`, JSON) shared with the advisory digest: recommendations with `items`, `links` (Overview export paths) and `bands`; `bands[]` rule text; `counts` naming the governor actionable queue vs. the Overview total. Which recommendations show is frozen for 7 days; their numbers refresh every call — see [Owner advice](advisory.md#owner-advice) | `pkg/dashboard/api.go:312`, `pkg/dashboard/api_hive_advice.go` |
 
 ## Cost, tokens, telemetry
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/trends` | Dashboard auth/session | Trends | `pkg/dashboard/api.go:73` |
-| `GET` | `/api/token-access` | Dashboard auth/session | Token Access | `pkg/dashboard/api.go:141` |
-| `GET` | `/api/tokens` | Dashboard auth/session | Tokens | `pkg/dashboard/api.go:142` |
-| `GET` | `/api/cost` | Dashboard auth/session | Cost | `pkg/dashboard/api.go:143` |
+| `GET` | `/api/trends` | Dashboard auth/session | Trends | `pkg/dashboard/api.go:74` |
+| `GET` | `/api/token-access` | Dashboard auth/session | Token Access | `pkg/dashboard/api.go:142` |
+| `GET` | `/api/tokens` | Dashboard auth/session | Tokens | `pkg/dashboard/api.go:143` |
+| `GET` | `/api/cost` | Dashboard auth/session | Cost | `pkg/dashboard/api.go:144` |
 | `GET` | `/api/repo-activity` | Dashboard auth/session | Per-repo audited activity | `pkg/dashboard/api.go` |
 | `GET` | `/api/repo-cost` | Dashboard auth/session | Per-repo estimated token cost (interval join, cached) | `pkg/dashboard/api.go` |
-| `GET` | `/api/cost/history` | Dashboard auth/session | Cost History | `pkg/dashboard/api.go:146` |
-| `GET` | `/api/trend/history` | Dashboard auth/session | Trend History | `pkg/dashboard/api.go:149` |
-| `GET` | `/api/timeseries` | Dashboard auth/session | Time Series | `pkg/dashboard/api.go:151` |
+| `GET` | `/api/cost/history` | Dashboard auth/session | Cost History | `pkg/dashboard/api.go:147` |
+| `GET` | `/api/trend/history` | Dashboard auth/session | Trend History | `pkg/dashboard/api.go:150` |
+| `GET` | `/api/timeseries` | Dashboard auth/session | Time Series | `pkg/dashboard/api.go:152` |
 | `GET` | `/api/providers/headroom` | Dashboard auth/session | Providers Headroom | `pkg/dashboard/api.go:52` |
-| `GET` | `/api/budget/history` | Dashboard auth/session | Budget History | `pkg/dashboard/api.go:148` |
+| `GET` | `/api/budget/history` | Dashboard auth/session | Budget History | `pkg/dashboard/api.go:149` |
 
 ## Knowledge
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/knowledge` | Dashboard auth/session | Knowledge List | `pkg/dashboard/api.go:318` |
-| `GET` | `/api/knowledge/export` | Dashboard auth/session | Knowledge Export | `pkg/dashboard/api.go:319` |
-| `GET` | `/api/knowledge/search` | Dashboard auth/session | Knowledge Search | `pkg/dashboard/api.go:320` |
-| `GET` | `/api/knowledge/health` | Dashboard auth/session | Knowledge Health | `pkg/dashboard/api.go:321` |
-| `GET` | `/api/knowledge/stats` | Dashboard auth/session | Knowledge Stats | `pkg/dashboard/api.go:322` |
-| `GET` | `/api/knowledge/graph` | Dashboard auth/session | Knowledge Graph | `pkg/dashboard/api.go:323` |
-| `GET` | `/api/knowledge/fact-history` | Dashboard auth/session | Fact History | `pkg/dashboard/api.go:324` |
-| `POST` | `/api/knowledge/create` | Dashboard auth/session | Knowledge Create | `pkg/dashboard/api.go:325` |
-| `POST` | `/api/knowledge/import` | Dashboard auth/session | Knowledge Import | `pkg/dashboard/api.go:326` |
-| `POST` | `/api/knowledge/promote` | Dashboard auth/session | Knowledge Promote | `pkg/dashboard/api.go:332` |
-| `GET` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs List | `pkg/dashboard/api.go:333` |
-| `POST` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Add | `pkg/dashboard/api.go:334` |
-| `DELETE` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Remove | `pkg/dashboard/api.go:335` |
-| `PUT` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Update | `pkg/dashboard/api.go:336` |
-| `DELETE` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Delete | `pkg/dashboard/api.go:337` |
-| `GET` | `/api/knowledge/{layer}` | Dashboard auth/session | Knowledge Layer | `pkg/dashboard/api.go:338` |
-| `GET` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Fact | `pkg/dashboard/api.go:339` |
-| `PUT` | `/api/knowledge/enabled` | Owner only | Knowledge Toggle | `pkg/dashboard/api.go:340` |
-| `GET` | `/api/knowledge/bead-synthesizer` | Dashboard auth/session | Bead Synth Status | `pkg/dashboard/api.go:341` |
-| `PUT` | `/api/knowledge/bead-synthesizer/enabled` | Owner only | Bead Synth Toggle | `pkg/dashboard/api.go:342` |
-| `GET` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults List | `pkg/dashboard/api.go:343` |
-| `POST` | `/api/knowledge/vaults` | Owner only | Vaults Connect | `pkg/dashboard/api.go:344` |
-| `DELETE` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults Disconnect | `pkg/dashboard/api.go:345` |
-| `POST` | `/api/knowledge/vaults/reindex` | Dashboard auth/session | Vaults Reindex | `pkg/dashboard/api.go:346` |
-| `GET` | `/api/knowledge/vaults/{name}/facts` | Dashboard auth/session | Vault Facts | `pkg/dashboard/api.go:347` |
-| `GET` | `/api/knowledge/git-sources` | Dashboard auth/session | Git Sources List | `pkg/dashboard/api.go:348` |
-| `POST` | `/api/knowledge/git-sources` | Owner only | Git Sources Connect | `pkg/dashboard/api.go:349` |
-| `DELETE` | `/api/knowledge/git-sources` | Owner only | Git Sources Disconnect | `pkg/dashboard/api.go:350` |
-| `POST` | `/api/knowledge/obsidian/sync` | Dashboard auth/session | Obsidian Sync | `pkg/dashboard/api.go:351` |
-| `GET` | `/api/knowledge/documents` | Dashboard auth/session | Documents List | `pkg/dashboard/api.go:352` |
-| `POST` | `/api/knowledge/documents` | Dashboard auth/session | Documents Import | `pkg/dashboard/api.go:353` |
-| `GET` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Get | `pkg/dashboard/api.go:354` |
-| `DELETE` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Delete | `pkg/dashboard/api.go:355` |
-| `POST` | `/api/knowledge/documents/{slug}/reimport` | Dashboard auth/session | Document Reimport | `pkg/dashboard/api.go:356` |
-| `GET` | `/api/knowledge/context7/search` | Dashboard auth/session | Context7 Search | `pkg/dashboard/api.go:357` |
-| `POST` | `/api/knowledge/cleanup-orphans` | Dashboard auth/session | Cleanup Orphans | `pkg/dashboard/api.go:358` |
-| `GET` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channels List | `pkg/dashboard/api.go:330` |
-| `POST` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channel Create | `pkg/dashboard/api.go:331` |
+| `GET` | `/api/knowledge` | Dashboard auth/session | Knowledge List | `pkg/dashboard/api.go:319` |
+| `GET` | `/api/knowledge/export` | Dashboard auth/session | Knowledge Export | `pkg/dashboard/api.go:320` |
+| `GET` | `/api/knowledge/search` | Dashboard auth/session | Knowledge Search | `pkg/dashboard/api.go:321` |
+| `GET` | `/api/knowledge/health` | Dashboard auth/session | Knowledge Health | `pkg/dashboard/api.go:322` |
+| `GET` | `/api/knowledge/stats` | Dashboard auth/session | Knowledge Stats | `pkg/dashboard/api.go:323` |
+| `GET` | `/api/knowledge/graph` | Dashboard auth/session | Knowledge Graph | `pkg/dashboard/api.go:324` |
+| `GET` | `/api/knowledge/fact-history` | Dashboard auth/session | Fact History | `pkg/dashboard/api.go:325` |
+| `POST` | `/api/knowledge/create` | Dashboard auth/session | Knowledge Create | `pkg/dashboard/api.go:326` |
+| `POST` | `/api/knowledge/import` | Dashboard auth/session | Knowledge Import | `pkg/dashboard/api.go:327` |
+| `POST` | `/api/knowledge/promote` | Dashboard auth/session | Knowledge Promote | `pkg/dashboard/api.go:333` |
+| `GET` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs List | `pkg/dashboard/api.go:334` |
+| `POST` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Add | `pkg/dashboard/api.go:335` |
+| `DELETE` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Remove | `pkg/dashboard/api.go:336` |
+| `PUT` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Update | `pkg/dashboard/api.go:337` |
+| `DELETE` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Delete | `pkg/dashboard/api.go:338` |
+| `GET` | `/api/knowledge/{layer}` | Dashboard auth/session | Knowledge Layer | `pkg/dashboard/api.go:339` |
+| `GET` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Fact | `pkg/dashboard/api.go:340` |
+| `PUT` | `/api/knowledge/enabled` | Owner only | Knowledge Toggle | `pkg/dashboard/api.go:341` |
+| `GET` | `/api/knowledge/bead-synthesizer` | Dashboard auth/session | Bead Synth Status | `pkg/dashboard/api.go:342` |
+| `PUT` | `/api/knowledge/bead-synthesizer/enabled` | Owner only | Bead Synth Toggle | `pkg/dashboard/api.go:343` |
+| `GET` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults List | `pkg/dashboard/api.go:344` |
+| `POST` | `/api/knowledge/vaults` | Owner only | Vaults Connect | `pkg/dashboard/api.go:345` |
+| `DELETE` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults Disconnect | `pkg/dashboard/api.go:346` |
+| `POST` | `/api/knowledge/vaults/reindex` | Dashboard auth/session | Vaults Reindex | `pkg/dashboard/api.go:347` |
+| `GET` | `/api/knowledge/vaults/{name}/facts` | Dashboard auth/session | Vault Facts | `pkg/dashboard/api.go:348` |
+| `GET` | `/api/knowledge/git-sources` | Dashboard auth/session | Git Sources List | `pkg/dashboard/api.go:349` |
+| `POST` | `/api/knowledge/git-sources` | Owner only | Git Sources Connect | `pkg/dashboard/api.go:350` |
+| `DELETE` | `/api/knowledge/git-sources` | Owner only | Git Sources Disconnect | `pkg/dashboard/api.go:351` |
+| `POST` | `/api/knowledge/obsidian/sync` | Dashboard auth/session | Obsidian Sync | `pkg/dashboard/api.go:352` |
+| `GET` | `/api/knowledge/documents` | Dashboard auth/session | Documents List | `pkg/dashboard/api.go:353` |
+| `POST` | `/api/knowledge/documents` | Dashboard auth/session | Documents Import | `pkg/dashboard/api.go:354` |
+| `GET` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Get | `pkg/dashboard/api.go:355` |
+| `DELETE` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Delete | `pkg/dashboard/api.go:356` |
+| `POST` | `/api/knowledge/documents/{slug}/reimport` | Dashboard auth/session | Document Reimport | `pkg/dashboard/api.go:357` |
+| `GET` | `/api/knowledge/context7/search` | Dashboard auth/session | Context7 Search | `pkg/dashboard/api.go:358` |
+| `POST` | `/api/knowledge/cleanup-orphans` | Dashboard auth/session | Cleanup Orphans | `pkg/dashboard/api.go:359` |
+| `GET` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channels List | `pkg/dashboard/api.go:331` |
+| `POST` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channel Create | `pkg/dashboard/api.go:332` |
 
 ## Contribute
 
@@ -427,99 +427,99 @@ always resolved server-side from the validated token.
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/nous/status` | Dashboard auth/session | Nous Status | `pkg/dashboard/api.go:392` |
-| `GET` | `/api/nous/ledger` | Dashboard auth/session | Nous Ledger | `pkg/dashboard/api.go:393` |
-| `GET` | `/api/nous/principles` | Dashboard auth/session | Nous Principles | `pkg/dashboard/api.go:394` |
-| `POST` | `/api/nous/approve` | Owner only | Nous Approve | `pkg/dashboard/api.go:395` |
-| `POST` | `/api/nous/abort` | Owner only | Nous Abort | `pkg/dashboard/api.go:396` |
-| `PUT` | `/api/nous/mode` | Owner only | Nous Mode | `pkg/dashboard/api.go:397` |
-| `PUT` | `/api/nous/scope` | Owner only | Nous Scope | `pkg/dashboard/api.go:398` |
-| `GET` | `/api/nous/phase` | Dashboard auth/session | Nous Phase | `pkg/dashboard/api.go:399` |
-| `PUT` | `/api/nous/gate-decision` | Owner only | Nous Gate Decision | `pkg/dashboard/api.go:400` |
-| `GET` | `/api/nous/gate-pending` | Dashboard auth/session | Nous Gate Pending | `pkg/dashboard/api.go:401` |
-| `POST` | `/api/nous/gate-respond` | Owner only | Nous Gate Respond | `pkg/dashboard/api.go:402` |
-| `GET` | `/api/nous/gate-response` | Dashboard auth/session | Nous Gate Response | `pkg/dashboard/api.go:403` |
-| `GET` | `/api/nous/config` | Dashboard auth/session | Nous Config Get | `pkg/dashboard/api.go:404` |
-| `PUT` | `/api/nous/config/goals` | Owner only | Nous Config Goals | `pkg/dashboard/api.go:405` |
-| `PUT` | `/api/nous/config/repos` | Owner only | Nous Config Repos | `pkg/dashboard/api.go:406` |
-| `PUT` | `/api/nous/config/output` | Owner only | Nous Config Output | `pkg/dashboard/api.go:407` |
-| `PUT` | `/api/nous/config/fast-fail` | Owner only | Nous Config Fast Fail | `pkg/dashboard/api.go:408` |
-| `PUT` | `/api/nous/config/schedule` | Owner only | Nous Config Schedule | `pkg/dashboard/api.go:409` |
-| `PUT` | `/api/nous/config/controllables` | Owner only | Nous Config Controllables | `pkg/dashboard/api.go:410` |
-| `PUT` | `/api/nous/config/principles` | Owner only | Nous Config Principles | `pkg/dashboard/api.go:411` |
-| `DELETE` | `/api/nous/principles/{id}` | Owner only | Nous Delete Principle | `pkg/dashboard/api.go:412` |
+| `GET` | `/api/nous/status` | Dashboard auth/session | Nous Status | `pkg/dashboard/api.go:393` |
+| `GET` | `/api/nous/ledger` | Dashboard auth/session | Nous Ledger | `pkg/dashboard/api.go:394` |
+| `GET` | `/api/nous/principles` | Dashboard auth/session | Nous Principles | `pkg/dashboard/api.go:395` |
+| `POST` | `/api/nous/approve` | Owner only | Nous Approve | `pkg/dashboard/api.go:396` |
+| `POST` | `/api/nous/abort` | Owner only | Nous Abort | `pkg/dashboard/api.go:397` |
+| `PUT` | `/api/nous/mode` | Owner only | Nous Mode | `pkg/dashboard/api.go:398` |
+| `PUT` | `/api/nous/scope` | Owner only | Nous Scope | `pkg/dashboard/api.go:399` |
+| `GET` | `/api/nous/phase` | Dashboard auth/session | Nous Phase | `pkg/dashboard/api.go:400` |
+| `PUT` | `/api/nous/gate-decision` | Owner only | Nous Gate Decision | `pkg/dashboard/api.go:401` |
+| `GET` | `/api/nous/gate-pending` | Dashboard auth/session | Nous Gate Pending | `pkg/dashboard/api.go:402` |
+| `POST` | `/api/nous/gate-respond` | Owner only | Nous Gate Respond | `pkg/dashboard/api.go:403` |
+| `GET` | `/api/nous/gate-response` | Dashboard auth/session | Nous Gate Response | `pkg/dashboard/api.go:404` |
+| `GET` | `/api/nous/config` | Dashboard auth/session | Nous Config Get | `pkg/dashboard/api.go:405` |
+| `PUT` | `/api/nous/config/goals` | Owner only | Nous Config Goals | `pkg/dashboard/api.go:406` |
+| `PUT` | `/api/nous/config/repos` | Owner only | Nous Config Repos | `pkg/dashboard/api.go:407` |
+| `PUT` | `/api/nous/config/output` | Owner only | Nous Config Output | `pkg/dashboard/api.go:408` |
+| `PUT` | `/api/nous/config/fast-fail` | Owner only | Nous Config Fast Fail | `pkg/dashboard/api.go:409` |
+| `PUT` | `/api/nous/config/schedule` | Owner only | Nous Config Schedule | `pkg/dashboard/api.go:410` |
+| `PUT` | `/api/nous/config/controllables` | Owner only | Nous Config Controllables | `pkg/dashboard/api.go:411` |
+| `PUT` | `/api/nous/config/principles` | Owner only | Nous Config Principles | `pkg/dashboard/api.go:412` |
+| `DELETE` | `/api/nous/principles/{id}` | Owner only | Nous Delete Principle | `pkg/dashboard/api.go:413` |
 
 ## Inception
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `POST` | `/api/inception/start` | Owner only | Inception Start | `pkg/dashboard/api.go:363` |
-| `POST` | `/api/inception/scan` | Owner only | Inception Scan | `pkg/dashboard/api.go:364` |
-| `GET` | `/api/inception/state` | Dashboard auth/session | Inception State | `pkg/dashboard/api.go:365` |
-| `POST` | `/api/inception/questions` | Owner only | Inception Set Questions | `pkg/dashboard/api.go:366` |
-| `POST` | `/api/inception/answer` | Owner only | Inception Answer | `pkg/dashboard/api.go:367` |
-| `POST` | `/api/inception/facts` | Owner only | Inception Record Facts | `pkg/dashboard/api.go:368` |
-| `GET` | `/api/inception/scaffold` | Dashboard auth/session | Inception Scaffold | `pkg/dashboard/api.go:369` |
-| `POST` | `/api/inception/approve` | Owner only | Inception Approve | `pkg/dashboard/api.go:370` |
-| `POST` | `/api/inception/reset` | Owner only | Inception Reset | `pkg/dashboard/api.go:371` |
-| `GET` | `/api/inception/ideation-facts` | Dashboard auth/session | Inception Ideation Facts | `pkg/dashboard/api.go:372` |
-| `GET` | `/api/inception/download` | Dashboard auth/session | Inception Download | `pkg/dashboard/api.go:373` |
-| `GET` | `/api/inception/has-files` | Dashboard auth/session | Inception Has Files | `pkg/dashboard/api.go:374` |
-| `PUT` | `/api/inception/wiki-name` | Owner only | Inception Rename Wiki | `pkg/dashboard/api.go:375` |
-| `POST` | `/api/inception/import` | Owner only | Inception Import | `pkg/dashboard/api.go:376` |
+| `POST` | `/api/inception/start` | Owner only | Inception Start | `pkg/dashboard/api.go:364` |
+| `POST` | `/api/inception/scan` | Owner only | Inception Scan | `pkg/dashboard/api.go:365` |
+| `GET` | `/api/inception/state` | Dashboard auth/session | Inception State | `pkg/dashboard/api.go:366` |
+| `POST` | `/api/inception/questions` | Owner only | Inception Set Questions | `pkg/dashboard/api.go:367` |
+| `POST` | `/api/inception/answer` | Owner only | Inception Answer | `pkg/dashboard/api.go:368` |
+| `POST` | `/api/inception/facts` | Owner only | Inception Record Facts | `pkg/dashboard/api.go:369` |
+| `GET` | `/api/inception/scaffold` | Dashboard auth/session | Inception Scaffold | `pkg/dashboard/api.go:370` |
+| `POST` | `/api/inception/approve` | Owner only | Inception Approve | `pkg/dashboard/api.go:371` |
+| `POST` | `/api/inception/reset` | Owner only | Inception Reset | `pkg/dashboard/api.go:372` |
+| `GET` | `/api/inception/ideation-facts` | Dashboard auth/session | Inception Ideation Facts | `pkg/dashboard/api.go:373` |
+| `GET` | `/api/inception/download` | Dashboard auth/session | Inception Download | `pkg/dashboard/api.go:374` |
+| `GET` | `/api/inception/has-files` | Dashboard auth/session | Inception Has Files | `pkg/dashboard/api.go:375` |
+| `PUT` | `/api/inception/wiki-name` | Owner only | Inception Rename Wiki | `pkg/dashboard/api.go:376` |
+| `POST` | `/api/inception/import` | Owner only | Inception Import | `pkg/dashboard/api.go:377` |
 
 ## Beads
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-| `GET` | `/api/beads` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:414` |
-| `GET` | `/api/beads/{agent}` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:415` |
-| `POST` | `/api/beads/{agent}` | Owner only | Beads Create | `pkg/dashboard/api.go:416` |
-| `POST` | `/api/beads/reset` | Owner only | Beads Reset | `pkg/dashboard/api.go:417` |
-| `POST` | `/api/beads/reset/{agent}` | Owner only | Beads Reset Agent | `pkg/dashboard/api.go:418` |
+| `GET` | `/api/beads` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:415` |
+| `GET` | `/api/beads/{agent}` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:416` |
+| `POST` | `/api/beads/{agent}` | Owner only | Beads Create | `pkg/dashboard/api.go:417` |
+| `POST` | `/api/beads/reset` | Owner only | Beads Reset | `pkg/dashboard/api.go:418` |
+| `POST` | `/api/beads/reset/{agent}` | Owner only | Beads Reset Agent | `pkg/dashboard/api.go:419` |
 
 ## Dashboard miscellaneous
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
 | `GET` | `/api/audit` | Read-write role | Audit Log — `{"entries": [...]}` envelope, newest first, capped at 200; response shape and the serve-time `user_name` field in [audit-log.md](audit-log.md#get-apiaudit) | `pkg/dashboard/api.go:51` |
-| `GET` | `/api/watchdog/activity` | Read-write role | Watchdog activity readout for the Health tab (#7254): `watchdog-*` audit actions over `?days=` (default 30, clamped to 90) — total / taken / observed / `byAction`, a zero-filled per-day `daily` histogram, per-agent `agents` liveness, and the Observe → Heal `promotion` hint; see [agent-watchdog.md](agent-watchdog.md#watchdog-activity-strip) | `pkg/dashboard/api.go:425` |
+| `GET` | `/api/watchdog/activity` | Read-write role | Watchdog activity readout for the Health tab (#7254): `watchdog-*` audit actions over `?days=` (default 30, clamped to 90) — total / taken / observed / `byAction`, a zero-filled per-day `daily` histogram, per-agent `agents` liveness, and the Observe → Heal `promotion` hint; see [agent-watchdog.md](agent-watchdog.md#watchdog-activity-strip) | `pkg/dashboard/api.go:426` |
 | `POST` | `/api/presence` | Dashboard auth/session | Presence | `pkg/dashboard/api.go:54` |
 | `GET` | `/api/prompt-history` | Dashboard auth/session | Prompt History | `pkg/dashboard/api.go:55` |
 | `POST` | `/api/self-upgrade` | Owner only | Self Upgrade | `pkg/dashboard/api.go:56` |
 | `GET` | `/api/backup/status` | Owner only | Backup Status — `available:false` with a reason when no encryption key is configured | `pkg/dashboard/api.go:60` |
 | `POST` | `/api/backup` | Owner only | Backup Download — `412` when no encryption key is configured (never an unencrypted archive) | `pkg/dashboard/api.go:61` |
 | `POST` | `/api/banner-dismissed` | Dashboard auth/session | Banner Dismissed | `pkg/dashboard/api.go:62` |
-| `GET` | `/api/history` | Dashboard auth/session | History | `pkg/dashboard/api.go:72` |
-| `GET` | `/api/timeline` | Dashboard auth/session | Timeline | `pkg/dashboard/api.go:74` |
-| `GET` | `/api/lifecycle-timeline` | Dashboard auth/session | Issue→PR lifecycle journeys plus derived stage timeline. Each journey keeps the dense `stages` map and adds a backwards-compatible `details` object for expandable rows: chronological stages with durations, current-stage age, agent, classification attrs, issue/PR links, blocked reason, and kick/run identifiers when recorded. | `pkg/dashboard/api.go:75` |
-| `GET` | `/api/pr-throughput` | Dashboard auth/session | Throughput: pull/merge requests and issues across tracked forges. Counts hive-created PRs/issues, hive/observed reviews, observed PR merges/closures, and issue closes over `?hours=N` (default 24, capped at audit retention; `hours=0` = all time from durable counters in `/data/pr-throughput-counters.json`) with optional exact case-insensitive `?repo=owner/name` and `?role=created\|reviewed\|merged` for the actor trend. The response keeps legacy `opened`/`merged`/`closed`, `merged_by_path`, `buckets`, velocity metrics, previous-window trends, top agents/repos/reasons, and `recorded_since`, and adds `by_actor` (`pr`/`issue` × `created`/`reviewed`/`merged`/`closed` × `hive`/`human`/`other`) plus `series` points (`t`, `hive`, `human`, `other`) for the selected role. | `pkg/dashboard/api.go:76` |
-
-
-| `GET` | `/api/convergence/soak` | Owner only | Convergence Soak Status | `pkg/dashboard/api.go:230` |
-| `POST` | `/api/plan/from-issue` | Dashboard auth/session | Plan From Issue | `pkg/dashboard/api.go:381` |
-| `GET` | `/api/plan/{epicID}` | Dashboard auth/session | Plan Tree | `pkg/dashboard/api.go:384` |
-| `POST` | `/api/plan/{epicID}/approve` | Owner only | Plan Approve | `pkg/dashboard/api.go:385` |
-| `POST` | `/api/plan/{epicID}/reject` | Owner only | Plan Reject | `pkg/dashboard/api.go:387` |
-| `POST` | `/api/plan/{epicID}/child/{childID}` | Owner only | Plan Child Action | `pkg/dashboard/api.go:388` |
+| `GET` | `/api/history` | Dashboard auth/session | History | `pkg/dashboard/api.go:73` |
+| `GET` | `/api/timeline` | Dashboard auth/session | Timeline | `pkg/dashboard/api.go:75` |
+| `GET` | `/api/lifecycle-timeline` | Dashboard auth/session | Issue→PR lifecycle journeys plus derived stage timeline. Each journey keeps the dense `stages` map and adds a backwards-compatible `details` object for expandable rows: chronological stages with durations, current-stage age, agent, classification attrs, issue/PR links, blocked reason, and kick/run identifiers when recorded. | `pkg/dashboard/api.go:76` |
+| `GET` | `/api/pr-throughput` | Dashboard auth/session | Throughput: pull/merge requests and issues across tracked forges. Counts hive-created PRs/issues, hive/observed reviews, observed PR merges/closures, and issue closes over `?hours=N` (default 24, capped at audit retention; `hours=0` = all time from durable counters in `/data/pr-throughput-counters.json`) with optional exact case-insensitive `?repo=owner/name` and `?role=created\|reviewed\|merged` for the actor trend. The response keeps legacy `opened`/`merged`/`closed`, `merged_by_path`, `buckets`, velocity metrics, previous-window trends, top agents/repos/reasons, and `recorded_since`, and adds `by_actor` (`pr`/`issue` × `created`/`reviewed`/`merged`/`closed` × `hive`/`human`/`other`) plus `series` points (`t`, `hive`, `human`, `other`) for the selected role. | `pkg/dashboard/api.go:77` |
+
+
+| `GET` | `/api/convergence/soak` | Owner only | Convergence Soak Status | `pkg/dashboard/api.go:231` |
+| `POST` | `/api/plan/from-issue` | Dashboard auth/session | Plan From Issue | `pkg/dashboard/api.go:382` |
+| `GET` | `/api/plan/{epicID}` | Dashboard auth/session | Plan Tree | `pkg/dashboard/api.go:385` |
+| `POST` | `/api/plan/{epicID}/approve` | Owner only | Plan Approve | `pkg/dashboard/api.go:386` |
+| `POST` | `/api/plan/{epicID}/reject` | Owner only | Plan Reject | `pkg/dashboard/api.go:388` |
+| `POST` | `/api/plan/{epicID}/child/{childID}` | Owner only | Plan Child Action | `pkg/dashboard/api.go:389` |
 | `POST` | `/api/linear/agent/install` | Owner only | Linear Agent Install (OAuth start) | `pkg/dashboard/api_linear_agent.go:215` |
 | `GET` | `/api/linear/agent/status` | Owner only | Linear Agent Status | `pkg/dashboard/api_linear_agent.go:216` |
 | `POST` | `/api/linear/agent/disconnect` | Owner only | Linear Agent Disconnect | `pkg/dashboard/api_linear_agent.go:217` |
-| `GET` | `/api/upstream-watch` | Owner only | Upstream-watch divergence: per watched fork the upstream followed, the watermark and last-run time, surfaced/ported/dismissed/skipped counts, and the recent upstream refs with their upstream URL, diff URL, fork issue number and state. Read-only — it reads the config and the watch state file, never GitHub. | `pkg/dashboard/api.go:269` |
-
-| `GET` | `/api/widget` | Dashboard auth/session | Widget | `pkg/dashboard/api.go:102` |
-| `GET` | `/api/pane/{agent}` | Dashboard auth/session | Pane | `pkg/dashboard/api.go:103` |
-| `GET` | `/api/role` | Dashboard auth/session | Role | `pkg/dashboard/api.go:117` |
-| `POST` | `/api/reset-restarts/{agent}` | Owner only | Reset Restarts | `pkg/dashboard/api.go:139` |
-| `GET` | `/api/budget-ignore` | Dashboard auth/session | Budget Ignore Get | `pkg/dashboard/api.go:154` |
-| `POST` | `/api/budget-ignore` | Owner only | Budget Ignore Set | `pkg/dashboard/api.go:155` |
-| `GET` | `/api/summaries` | Dashboard auth/session | Summaries | `pkg/dashboard/api.go:167` |
-| `POST` | `/api/prs/{owner}/{repo}/{number}/queue-automerge` | Merger/owner role | Queue PRAuto Merge | `pkg/dashboard/api.go:168` |
-| `GET` | `/api/inference/models/{backend}` | Dashboard auth/session | Inference Models | `pkg/dashboard/api.go:316` |
-| `GET` | `/api/hive-id` | Dashboard auth/session | Hive IDGet | `pkg/dashboard/api.go:360` |
-| `PUT` | `/api/hive-id` | Owner only | Hive IDSet | `pkg/dashboard/api.go:361` |
-| `POST` | `/api/chat` | Dashboard auth/session | Chat | `pkg/dashboard/api.go:390` |
-| `GET` | `/api/auth/token` | Public | Auth Token | `pkg/dashboard/api.go:420` |
+| `GET` | `/api/upstream-watch` | Owner only | Upstream-watch divergence: per watched fork the upstream followed, the watermark and last-run time, surfaced/ported/dismissed/skipped counts, and the recent upstream refs with their upstream URL, diff URL, fork issue number and state. Read-only — it reads the config and the watch state file, never GitHub. | `pkg/dashboard/api.go:270` |
+
+| `GET` | `/api/widget` | Dashboard auth/session | Widget | `pkg/dashboard/api.go:103` |
+| `GET` | `/api/pane/{agent}` | Dashboard auth/session | Pane | `pkg/dashboard/api.go:104` |
+| `GET` | `/api/role` | Dashboard auth/session | Role | `pkg/dashboard/api.go:118` |
+| `POST` | `/api/reset-restarts/{agent}` | Owner only | Reset Restarts | `pkg/dashboard/api.go:140` |
+| `GET` | `/api/budget-ignore` | Dashboard auth/session | Budget Ignore Get | `pkg/dashboard/api.go:155` |
+| `POST` | `/api/budget-ignore` | Owner only | Budget Ignore Set | `pkg/dashboard/api.go:156` |
+| `GET` | `/api/summaries` | Dashboard auth/session | Summaries | `pkg/dashboard/api.go:168` |
+| `POST` | `/api/prs/{owner}/{repo}/{number}/queue-automerge` | Merger/owner role | Queue PRAuto Merge | `pkg/dashboard/api.go:169` |
+| `GET` | `/api/inference/models/{backend}` | Dashboard auth/session | Inference Models | `pkg/dashboard/api.go:317` |
+| `GET` | `/api/hive-id` | Dashboard auth/session | Hive IDGet | `pkg/dashboard/api.go:361` |
+| `PUT` | `/api/hive-id` | Owner only | Hive IDSet | `pkg/dashboard/api.go:362` |
+| `POST` | `/api/chat` | Dashboard auth/session | Chat | `pkg/dashboard/api.go:391` |
+| `GET` | `/api/auth/token` | Public | Auth Token | `pkg/dashboard/api.go:421` |
 | `GET` | `/api/v1/` | GitHub token | Contributor v1 API dispatcher | `pkg/dashboard/api_contribute.go:236` |
 | `POST` | `/api/v1/` | GitHub token | Contributor v1 API dispatcher | `pkg/dashboard/api_contribute.go:237` |
 | `GET` | `/api/docs` | Dashboard auth/session | APIDocs | `pkg/dashboard/api_contribute.go:238` |

From 97239bff155b493b6e477801259c7b9f7fe32ac1 Mon Sep 17 00:00:00 2001
From: Andrew Anderson <andy@clubanderson.com>
Date: Mon, 5 Oct 2026 12:34:56 -0400
Subject: [PATCH 14/14] docs: resolve api-reference merge leftovers

Signed-off-by: Andrew Anderson <andy@clubanderson.com>
---
 src/docs/api-reference.md | 117 +-------------------------------------
 1 file changed, 1 insertion(+), 116 deletions(-)

diff --git a/src/docs/api-reference.md b/src/docs/api-reference.md
index 39a925876c..aaaf10e747 100644
--- a/src/docs/api-reference.md
+++ b/src/docs/api-reference.md
@@ -169,13 +169,8 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 | `PUT` | `/api/config/governor/watchdog` | Owner only | Governor Watchdog | `pkg/dashboard/api.go:201` |
 | `GET` | `/api/config/escalation` | Owner only | Escalation Config Get | `pkg/dashboard/api.go:204` |
 | `PUT` | `/api/config/escalation` | Owner only | Escalation Config Set | `pkg/dashboard/api.go:205` |
-<<<<<<< HEAD
 | `GET` | `/api/config/write-surface` | Owner only | Lane write allowlist (`write_surface.allowlist`, [#9587](https://github.com/hivecommons/hive/issues/9587)): `allowlist`, `ops`, `warnings` | `pkg/dashboard/api.go:437` |
 | `PUT` | `/api/config/write-surface` | Owner only | Replace the lane write allowlist; `{"allowlist": {}}` clears it; unknown operation or bad lane name is a 400 with nothing changed | `pkg/dashboard/api.go:438` |
-=======
-| `GET` | `/api/config/write-surface` | Owner only | Lane write allowlist (`write_surface.allowlist`, [#9587](https://github.com/hivecommons/hive/issues/9587)): `allowlist`, `ops`, `warnings` | `pkg/dashboard/api.go:437` |
-| `PUT` | `/api/config/write-surface` | Owner only | Replace the lane write allowlist; `{"allowlist": {}}` clears it; unknown operation or bad lane name is a 400 with nothing changed | `pkg/dashboard/api.go:438` |
->>>>>>> fix/feedback-login-regexp-panic
 | `GET` | `/api/config/review` | Dashboard auth/session | Review Config Get | `pkg/dashboard/api.go:208` |
 | `PUT` | `/api/config/review` | Owner only | Review Config Set | `pkg/dashboard/api.go:211` |
 | `PUT` | `/api/config/governor/features` | Owner only | Governor Features | `pkg/dashboard/api.go:217` |
@@ -219,11 +214,7 @@ Auth levels are derived from dashboard middleware (`isPublicPath`, dashboard tok
 | `GET` | `/api/model-advisor` | Dashboard auth/session | Model Advisor | `pkg/dashboard/api.go:153` |
 | `GET` | `/api/governor/pr-models` | Dashboard auth/session | Agent-authored PR distribution by normalized attribution model/backend for `window=7d`, `30d`, or `all`, including per-model rework stats and the top 10 most-reworked PRs | `pkg/dashboard/api.go:154` |
 | `GET` | `/api/reviewer/accuracy` | Dashboard auth/session | Reviewer verdict calibration for the configured window: false-approve/false-block rates and confidence buckets per perspective and reviewer model | `pkg/dashboard/api.go:210` |
-<<<<<<< HEAD
-| `GET` | `/api/review/queue` | Dashboard auth/session | PR review queue: every open PR (agent and contributor, actionable and held) ranked by triage class, confidence band, CI state and age, with per-PR `reasons`; paged with `limit` (1-200, default 50) and `offset` | `pkg/dashboard/api.go:434` |
-=======
 | `GET` | `/api/review/queue` | Dashboard auth/session | PR review queue: every open PR (agent and contributor, actionable and held) ranked by triage class, confidence band, CI state and age, with per-PR `reasons`; paged with `limit` (1-200, default 50) and `offset` | `pkg/dashboard/api.go:434` |
->>>>>>> fix/feedback-login-regexp-panic
 | `GET` | `/api/agents` | Dashboard auth/session | Agents List | `pkg/dashboard/api.go:283` |
 | `POST` | `/api/agents` | Owner only | Agent Create | `pkg/dashboard/api.go:284` |
 | `POST` | `/api/agents/import` | Owner only | Agent Import | `pkg/dashboard/api.go:285` |
@@ -293,9 +284,8 @@ Read the result from `GET /api/kick/{agent}/status`, which returns `status` of `
 |---|---|---|---|---|
 | `GET` | `/api/knowledge` | Dashboard auth/session | Knowledge List | `pkg/dashboard/api.go:319` |
 | `GET` | `/api/knowledge/export` | Dashboard auth/session | Knowledge Export | `pkg/dashboard/api.go:320` |
-| `GET` | `/api/knowledge/search` | Dashboard auth/session | Knowledge Search | `pkg/dashboard/api.go:321` |
-<<<<<<< HEAD
 | `POST` | `/mcp/knowledge` | Public (read-only) when `HIVE_PUBLIC_KNOWLEDGE` is on; 404 otherwise | Public Knowledge MCP endpoint — `initialize`, `tools/list`, `tools/call` for `knowledge_search`/`knowledge_get`/`knowledge_export` ([docs](public-knowledge-mcp.md)) | `pkg/dashboard/api.go:324` |
+| `GET` | `/api/knowledge/search` | Dashboard auth/session | Knowledge Search | `pkg/dashboard/api.go:321` |
 | `GET` | `/api/knowledge/health` | Dashboard auth/session | Knowledge Health | `pkg/dashboard/api.go:325` |
 | `GET` | `/api/knowledge/stats` | Dashboard auth/session | Knowledge Stats | `pkg/dashboard/api.go:326` |
 | `GET` | `/api/knowledge/graph` | Dashboard auth/session | Knowledge Graph | `pkg/dashboard/api.go:327` |
@@ -331,43 +321,6 @@ Read the result from `GET /api/kick/{agent}/status`, which returns `status` of `
 | `POST` | `/api/knowledge/cleanup-orphans` | Dashboard auth/session | Cleanup Orphans | `pkg/dashboard/api.go:362` |
 | `GET` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channels List | `pkg/dashboard/api.go:334` |
 | `POST` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channel Create | `pkg/dashboard/api.go:335` |
-=======
-| `GET` | `/api/knowledge/health` | Dashboard auth/session | Knowledge Health | `pkg/dashboard/api.go:325` |
-| `GET` | `/api/knowledge/stats` | Dashboard auth/session | Knowledge Stats | `pkg/dashboard/api.go:326` |
-| `GET` | `/api/knowledge/graph` | Dashboard auth/session | Knowledge Graph | `pkg/dashboard/api.go:327` |
-| `GET` | `/api/knowledge/fact-history` | Dashboard auth/session | Fact History | `pkg/dashboard/api.go:328` |
-| `POST` | `/api/knowledge/create` | Dashboard auth/session | Knowledge Create | `pkg/dashboard/api.go:329` |
-| `POST` | `/api/knowledge/import` | Dashboard auth/session | Knowledge Import | `pkg/dashboard/api.go:330` |
-| `POST` | `/api/knowledge/promote` | Dashboard auth/session | Knowledge Promote | `pkg/dashboard/api.go:336` |
-| `GET` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs List | `pkg/dashboard/api.go:337` |
-| `POST` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Add | `pkg/dashboard/api.go:338` |
-| `DELETE` | `/api/knowledge/subscriptions` | Dashboard auth/session | Knowledge Subs Remove | `pkg/dashboard/api.go:339` |
-| `PUT` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Update | `pkg/dashboard/api.go:340` |
-| `DELETE` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Delete | `pkg/dashboard/api.go:341` |
-| `GET` | `/api/knowledge/{layer}` | Dashboard auth/session | Knowledge Layer | `pkg/dashboard/api.go:342` |
-| `GET` | `/api/knowledge/{layer}/{slug}` | Dashboard auth/session | Knowledge Fact | `pkg/dashboard/api.go:343` |
-| `PUT` | `/api/knowledge/enabled` | Owner only | Knowledge Toggle | `pkg/dashboard/api.go:344` |
-| `GET` | `/api/knowledge/bead-synthesizer` | Dashboard auth/session | Bead Synth Status | `pkg/dashboard/api.go:345` |
-| `PUT` | `/api/knowledge/bead-synthesizer/enabled` | Owner only | Bead Synth Toggle | `pkg/dashboard/api.go:346` |
-| `GET` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults List | `pkg/dashboard/api.go:347` |
-| `POST` | `/api/knowledge/vaults` | Owner only | Vaults Connect | `pkg/dashboard/api.go:348` |
-| `DELETE` | `/api/knowledge/vaults` | Dashboard auth/session | Vaults Disconnect | `pkg/dashboard/api.go:349` |
-| `POST` | `/api/knowledge/vaults/reindex` | Dashboard auth/session | Vaults Reindex | `pkg/dashboard/api.go:350` |
-| `GET` | `/api/knowledge/vaults/{name}/facts` | Dashboard auth/session | Vault Facts | `pkg/dashboard/api.go:351` |
-| `GET` | `/api/knowledge/git-sources` | Dashboard auth/session | Git Sources List | `pkg/dashboard/api.go:352` |
-| `POST` | `/api/knowledge/git-sources` | Owner only | Git Sources Connect | `pkg/dashboard/api.go:353` |
-| `DELETE` | `/api/knowledge/git-sources` | Owner only | Git Sources Disconnect | `pkg/dashboard/api.go:354` |
-| `POST` | `/api/knowledge/obsidian/sync` | Dashboard auth/session | Obsidian Sync | `pkg/dashboard/api.go:355` |
-| `GET` | `/api/knowledge/documents` | Dashboard auth/session | Documents List | `pkg/dashboard/api.go:356` |
-| `POST` | `/api/knowledge/documents` | Dashboard auth/session | Documents Import | `pkg/dashboard/api.go:357` |
-| `GET` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Get | `pkg/dashboard/api.go:358` |
-| `DELETE` | `/api/knowledge/documents/{slug}` | Dashboard auth/session | Document Delete | `pkg/dashboard/api.go:359` |
-| `POST` | `/api/knowledge/documents/{slug}/reimport` | Dashboard auth/session | Document Reimport | `pkg/dashboard/api.go:360` |
-| `GET` | `/api/knowledge/context7/search` | Dashboard auth/session | Context7 Search | `pkg/dashboard/api.go:361` |
-| `POST` | `/api/knowledge/cleanup-orphans` | Dashboard auth/session | Cleanup Orphans | `pkg/dashboard/api.go:362` |
-| `GET` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channels List | `pkg/dashboard/api.go:334` |
-| `POST` | `/api/knowledge/channels` | Dashboard auth/session | Knowledge Channel Create | `pkg/dashboard/api.go:335` |
->>>>>>> fix/feedback-login-regexp-panic
 
 ## Contribute
 
@@ -475,29 +428,6 @@ always resolved server-side from the validated token.
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-<<<<<<< HEAD
-| `GET` | `/api/nous/status` | Dashboard auth/session | Nous Status | `pkg/dashboard/api.go:396` |
-| `GET` | `/api/nous/ledger` | Dashboard auth/session | Nous Ledger | `pkg/dashboard/api.go:397` |
-| `GET` | `/api/nous/principles` | Dashboard auth/session | Nous Principles | `pkg/dashboard/api.go:398` |
-| `POST` | `/api/nous/approve` | Owner only | Nous Approve | `pkg/dashboard/api.go:399` |
-| `POST` | `/api/nous/abort` | Owner only | Nous Abort | `pkg/dashboard/api.go:400` |
-| `PUT` | `/api/nous/mode` | Owner only | Nous Mode | `pkg/dashboard/api.go:401` |
-| `PUT` | `/api/nous/scope` | Owner only | Nous Scope | `pkg/dashboard/api.go:402` |
-| `GET` | `/api/nous/phase` | Dashboard auth/session | Nous Phase | `pkg/dashboard/api.go:403` |
-| `PUT` | `/api/nous/gate-decision` | Owner only | Nous Gate Decision | `pkg/dashboard/api.go:404` |
-| `GET` | `/api/nous/gate-pending` | Dashboard auth/session | Nous Gate Pending | `pkg/dashboard/api.go:405` |
-| `POST` | `/api/nous/gate-respond` | Owner only | Nous Gate Respond | `pkg/dashboard/api.go:406` |
-| `GET` | `/api/nous/gate-response` | Dashboard auth/session | Nous Gate Response | `pkg/dashboard/api.go:407` |
-| `GET` | `/api/nous/config` | Dashboard auth/session | Nous Config Get | `pkg/dashboard/api.go:408` |
-| `PUT` | `/api/nous/config/goals` | Owner only | Nous Config Goals | `pkg/dashboard/api.go:409` |
-| `PUT` | `/api/nous/config/repos` | Owner only | Nous Config Repos | `pkg/dashboard/api.go:410` |
-| `PUT` | `/api/nous/config/output` | Owner only | Nous Config Output | `pkg/dashboard/api.go:411` |
-| `PUT` | `/api/nous/config/fast-fail` | Owner only | Nous Config Fast Fail | `pkg/dashboard/api.go:412` |
-| `PUT` | `/api/nous/config/schedule` | Owner only | Nous Config Schedule | `pkg/dashboard/api.go:413` |
-| `PUT` | `/api/nous/config/controllables` | Owner only | Nous Config Controllables | `pkg/dashboard/api.go:414` |
-| `PUT` | `/api/nous/config/principles` | Owner only | Nous Config Principles | `pkg/dashboard/api.go:415` |
-| `DELETE` | `/api/nous/principles/{id}` | Owner only | Nous Delete Principle | `pkg/dashboard/api.go:416` |
-=======
 | `GET` | `/api/nous/status` | Dashboard auth/session | Nous Status | `pkg/dashboard/api.go:396` |
 | `GET` | `/api/nous/ledger` | Dashboard auth/session | Nous Ledger | `pkg/dashboard/api.go:397` |
 | `GET` | `/api/nous/principles` | Dashboard auth/session | Nous Principles | `pkg/dashboard/api.go:398` |
@@ -519,13 +449,11 @@ always resolved server-side from the validated token.
 | `PUT` | `/api/nous/config/controllables` | Owner only | Nous Config Controllables | `pkg/dashboard/api.go:414` |
 | `PUT` | `/api/nous/config/principles` | Owner only | Nous Config Principles | `pkg/dashboard/api.go:415` |
 | `DELETE` | `/api/nous/principles/{id}` | Owner only | Nous Delete Principle | `pkg/dashboard/api.go:416` |
->>>>>>> fix/feedback-login-regexp-panic
 
 ## Inception
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-<<<<<<< HEAD
 | `POST` | `/api/inception/start` | Owner only | Inception Start | `pkg/dashboard/api.go:367` |
 | `POST` | `/api/inception/scan` | Owner only | Inception Scan | `pkg/dashboard/api.go:368` |
 | `GET` | `/api/inception/state` | Dashboard auth/session | Inception State | `pkg/dashboard/api.go:369` |
@@ -540,51 +468,23 @@ always resolved server-side from the validated token.
 | `GET` | `/api/inception/has-files` | Dashboard auth/session | Inception Has Files | `pkg/dashboard/api.go:378` |
 | `PUT` | `/api/inception/wiki-name` | Owner only | Inception Rename Wiki | `pkg/dashboard/api.go:379` |
 | `POST` | `/api/inception/import` | Owner only | Inception Import | `pkg/dashboard/api.go:380` |
-=======
-| `POST` | `/api/inception/start` | Owner only | Inception Start | `pkg/dashboard/api.go:367` |
-| `POST` | `/api/inception/scan` | Owner only | Inception Scan | `pkg/dashboard/api.go:368` |
-| `GET` | `/api/inception/state` | Dashboard auth/session | Inception State | `pkg/dashboard/api.go:369` |
-| `POST` | `/api/inception/questions` | Owner only | Inception Set Questions | `pkg/dashboard/api.go:370` |
-| `POST` | `/api/inception/answer` | Owner only | Inception Answer | `pkg/dashboard/api.go:371` |
-| `POST` | `/api/inception/facts` | Owner only | Inception Record Facts | `pkg/dashboard/api.go:372` |
-| `GET` | `/api/inception/scaffold` | Dashboard auth/session | Inception Scaffold | `pkg/dashboard/api.go:373` |
-| `POST` | `/api/inception/approve` | Owner only | Inception Approve | `pkg/dashboard/api.go:374` |
-| `POST` | `/api/inception/reset` | Owner only | Inception Reset | `pkg/dashboard/api.go:375` |
-| `GET` | `/api/inception/ideation-facts` | Dashboard auth/session | Inception Ideation Facts | `pkg/dashboard/api.go:376` |
-| `GET` | `/api/inception/download` | Dashboard auth/session | Inception Download | `pkg/dashboard/api.go:377` |
-| `GET` | `/api/inception/has-files` | Dashboard auth/session | Inception Has Files | `pkg/dashboard/api.go:378` |
-| `PUT` | `/api/inception/wiki-name` | Owner only | Inception Rename Wiki | `pkg/dashboard/api.go:379` |
-| `POST` | `/api/inception/import` | Owner only | Inception Import | `pkg/dashboard/api.go:380` |
->>>>>>> fix/feedback-login-regexp-panic
 
 ## Beads
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
-<<<<<<< HEAD
-| `GET` | `/api/beads` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:418` |
-| `GET` | `/api/beads/{agent}` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:419` |
-| `POST` | `/api/beads/{agent}` | Owner only | Beads Create | `pkg/dashboard/api.go:420` |
-| `POST` | `/api/beads/reset` | Owner only | Beads Reset | `pkg/dashboard/api.go:421` |
-| `POST` | `/api/beads/reset/{agent}` | Owner only | Beads Reset Agent | `pkg/dashboard/api.go:422` |
-=======
 | `GET` | `/api/beads` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:418` |
 | `GET` | `/api/beads/{agent}` | Dashboard auth/session | Beads List | `pkg/dashboard/api.go:419` |
 | `POST` | `/api/beads/{agent}` | Owner only | Beads Create | `pkg/dashboard/api.go:420` |
 | `POST` | `/api/beads/reset` | Owner only | Beads Reset | `pkg/dashboard/api.go:421` |
 | `POST` | `/api/beads/reset/{agent}` | Owner only | Beads Reset Agent | `pkg/dashboard/api.go:422` |
->>>>>>> fix/feedback-login-regexp-panic
 
 ## Dashboard miscellaneous
 
 | Method | Path | Auth | Purpose | Source |
 |---|---|---|---|---|
 | `GET` | `/api/audit` | Read-write role | Audit Log — `{"entries": [...]}` envelope, newest first, capped at 200; response shape and the serve-time `user_name` field in [audit-log.md](audit-log.md#get-apiaudit) | `pkg/dashboard/api.go:51` |
-<<<<<<< HEAD
-| `GET` | `/api/watchdog/activity` | Read-write role | Watchdog activity readout for the Health tab (#7254): `watchdog-*` audit actions over `?days=` (default 30, clamped to 90) — total / taken / observed / `byAction`, a zero-filled per-day `daily` histogram, per-agent `agents` liveness, and the Observe → Heal `promotion` hint; see [agent-watchdog.md](agent-watchdog.md#watchdog-activity-strip) | `pkg/dashboard/api.go:429` |
-=======
 | `GET` | `/api/watchdog/activity` | Read-write role | Watchdog activity readout for the Health tab (#7254): `watchdog-*` audit actions over `?days=` (default 30, clamped to 90) — total / taken / observed / `byAction`, a zero-filled per-day `daily` histogram, per-agent `agents` liveness, and the Observe → Heal `promotion` hint; see [agent-watchdog.md](agent-watchdog.md#watchdog-activity-strip) | `pkg/dashboard/api.go:429` |
->>>>>>> fix/feedback-login-regexp-panic
 | `POST` | `/api/presence` | Dashboard auth/session | Presence | `pkg/dashboard/api.go:54` |
 | `GET` | `/api/prompt-history` | Dashboard auth/session | Prompt History | `pkg/dashboard/api.go:55` |
 | `POST` | `/api/self-upgrade` | Owner only | Self Upgrade | `pkg/dashboard/api.go:56` |
@@ -598,19 +498,11 @@ always resolved server-side from the validated token.
 
 
 | `GET` | `/api/convergence/soak` | Owner only | Convergence Soak Status | `pkg/dashboard/api.go:231` |
-<<<<<<< HEAD
 | `POST` | `/api/plan/from-issue` | Dashboard auth/session | Plan From Issue | `pkg/dashboard/api.go:385` |
 | `GET` | `/api/plan/{epicID}` | Dashboard auth/session | Plan Tree | `pkg/dashboard/api.go:388` |
 | `POST` | `/api/plan/{epicID}/approve` | Owner only | Plan Approve | `pkg/dashboard/api.go:389` |
 | `POST` | `/api/plan/{epicID}/reject` | Owner only | Plan Reject | `pkg/dashboard/api.go:391` |
 | `POST` | `/api/plan/{epicID}/child/{childID}` | Owner only | Plan Child Action | `pkg/dashboard/api.go:392` |
-=======
-| `POST` | `/api/plan/from-issue` | Dashboard auth/session | Plan From Issue | `pkg/dashboard/api.go:385` |
-| `GET` | `/api/plan/{epicID}` | Dashboard auth/session | Plan Tree | `pkg/dashboard/api.go:388` |
-| `POST` | `/api/plan/{epicID}/approve` | Owner only | Plan Approve | `pkg/dashboard/api.go:389` |
-| `POST` | `/api/plan/{epicID}/reject` | Owner only | Plan Reject | `pkg/dashboard/api.go:391` |
-| `POST` | `/api/plan/{epicID}/child/{childID}` | Owner only | Plan Child Action | `pkg/dashboard/api.go:392` |
->>>>>>> fix/feedback-login-regexp-panic
 | `POST` | `/api/linear/agent/install` | Owner only | Linear Agent Install (OAuth start) | `pkg/dashboard/api_linear_agent.go:215` |
 | `GET` | `/api/linear/agent/status` | Owner only | Linear Agent Status | `pkg/dashboard/api_linear_agent.go:216` |
 | `POST` | `/api/linear/agent/disconnect` | Owner only | Linear Agent Disconnect | `pkg/dashboard/api_linear_agent.go:217` |
@@ -625,17 +517,10 @@ always resolved server-side from the validated token.
 | `GET` | `/api/summaries` | Dashboard auth/session | Summaries | `pkg/dashboard/api.go:168` |
 | `POST` | `/api/prs/{owner}/{repo}/{number}/queue-automerge` | Merger/owner role | Queue PRAuto Merge | `pkg/dashboard/api.go:169` |
 | `GET` | `/api/inference/models/{backend}` | Dashboard auth/session | Inference Models | `pkg/dashboard/api.go:317` |
-<<<<<<< HEAD
-| `GET` | `/api/hive-id` | Dashboard auth/session | Hive IDGet | `pkg/dashboard/api.go:364` |
-| `PUT` | `/api/hive-id` | Owner only | Hive IDSet | `pkg/dashboard/api.go:365` |
-| `POST` | `/api/chat` | Dashboard auth/session | Chat | `pkg/dashboard/api.go:394` |
-| `GET` | `/api/auth/token` | Public | Auth Token | `pkg/dashboard/api.go:424` |
-=======
 | `GET` | `/api/hive-id` | Dashboard auth/session | Hive IDGet | `pkg/dashboard/api.go:364` |
 | `PUT` | `/api/hive-id` | Owner only | Hive IDSet | `pkg/dashboard/api.go:365` |
 | `POST` | `/api/chat` | Dashboard auth/session | Chat | `pkg/dashboard/api.go:394` |
 | `GET` | `/api/auth/token` | Public | Auth Token | `pkg/dashboard/api.go:424` |
->>>>>>> fix/feedback-login-regexp-panic
 | `GET` | `/api/v1/` | GitHub token | Contributor v1 API dispatcher | `pkg/dashboard/api_contribute.go:236` |
 | `POST` | `/api/v1/` | GitHub token | Contributor v1 API dispatcher | `pkg/dashboard/api_contribute.go:237` |
 | `GET` | `/api/docs` | Dashboard auth/session | APIDocs | `pkg/dashboard/api_contribute.go:238` |