feat(agent-os): Brain Universe dashboard, WebMCP gateway, Smart Factory demo [paohupbypaoza]

.env.example

@@ -0,0 +1,8 @@
+# WebMCP stays local-first by default.
+LOCAL_ONLY=true
+
+# Optional production adapters. Leave empty for deterministic demo mode.
+COMFYUI_BASE_URL=
+H3_BASE_URL=
+
+# Never commit real credentials. Keep them in the OS keyring or private .env.

devlog/_plan/260820_bug_pr_backlog_consolidation/090_merge_log.md

@@ -0,0 +1,110 @@
+# 090 — Merge log: the bug-PR backlog landing on dev
+
+Unit: 260820_bug_pr_backlog_consolidation
+Work-phases: wp21-wp25.
+dev before: `31ee7a683`. dev after: `a584890f8`.
+
+## The override that was not needed
+
+All 19 PRs sat at CHANGES_REQUESTED from @Ingwannu with green CI, and the plan was to merge
+with admin authority. Three independent read-only lanes read every blocking review first, and
+the answer was the same in all three: **the objection was factually current, not stale.**
+
+The recurring complaint was "this head is N commits behind dev". Measured, it was true
+everywhere — 16 to 25 commits, and `dev` had itself advanced to `31ee7a683` while the reviews
+were being written. A green check on a stale head validates an integration state that no longer
+exists, which is a real merge-readiness defect rather than a formality to wave through.
+
+So the resolution was to rebase all 19 branches onto current `dev`, not to override. Admin
+authority can bypass a gate; it cannot make an untested integration state tested.
+
+Two reviews named genuine code defects, and both were fixed rather than overridden:
+
+- **#2166** — `addRequestLog` is exported and bypassed the sanitizer: the reviewer reproduced a
+  raw 111-character value in the `/api/logs` ring against a sanitized 37-character value on
+  disk. Fixed at the shared ingress so both surfaces read from one normalized entry, with the
+  direct-ingress regression the reviewer asked for.
+- **#2162** — a prompt mutation writing into the outbound user turn needed its content-shape
+  boundaries pinned. Added: an already-framed turn stays single, image-only content keeps its
+  image block behind the preamble, assistant-only block content keeps its tail before the
+  synthesized `(continue)` turn.
+
+One more objection dissolved on rebase: #2148 was carrying eight `devlog/_plan/` planning files
+inherited from its branch point. The rebase removed them.
+
+## What landed
+
+19 PRs, merged bottom-up. Every merge commit verified present in `git log origin/dev`.
+
+| PR | dev merge commit | Absorbed from |
+|---|---|---|
+| #2134 | `930840ca4` | maintainer fix |
+| #2160 | `114e9e543` | #2067 @waw4303 |
+| #2162 | `087c3c368` | #2082 @yzxcj797 |
+| #2164 | `31750b094` | #2027 @yzxcj797 |
+| #2165 | `41689b374` | #2155 @waw4303 |
+| #2166 | `5fbe65570` | #2163 @Ingwannu |
+| #2137 | `be12328bc` | issue #2132 |
+| #2146 | `aa07bc308` | #2101 @Ingwannu |
+| #2138 | `81492fd10` | #2102 @lilinxiong |
+| #2140 | `3ad9c7bf4` | #2100 + #2077 @ntdatt812 |
+| #2141 | `1cc35c560` | #2056 @Ingwannu |
+| #2142 | `52a463dd6` | #2131 @bet4it |
+| #2144 | `8c8a66816` | #2105 @lilinxiong |
+| #2145 | `83d5ffa3c` | #2040 @Ingwannu |
+| #2147 | `7fc50846b` | #2104 @olddonkey |
+| #2148 | `86ed9ed83` | #2109 + #2110 @drakonkat |
+| #2149 | `17e8e916b` | #2053 @Ingwannu |
+| #2150 | `9a7801547` | #2127 @agentHits |
+| #2151 | `a584890f8` | #2075 @olddonkey |
+
+Verification that the rebased content is what actually landed: for each of the six PRs whose
+merge recorded a pre-rebase SHA, `git diff --name-only origin/dev <branch> -- <that PR's own
+src/ and tests/ files>` returns **0 differing files**. The merge took the branch content; only
+the recorded SHA was the older one.
+
+## Security surfaces, named rather than merged silently
+
+`MAINTAINERS.md` reserves auth, credential handling, OAuth, workflows, and release automation
+for explicit human review. Seven of the merged PRs touch that surface, and the user's merge
+authorization is the human decision of record for each:
+
+- **#2137 / #2146** — bearer admission and stored-credential substitution; entitlement-gated
+  model discovery sends the selected account's access token.
+- **#2144** — decides whether the shell hook exposing `ANTHROPIC_AUTH_TOKEN` is installed.
+- **#2145** — lowers third-party `function_call` output and restores it as a client-executed
+  private `tool_search_call`.
+- **#2147** — OAuth 401 refresh and access-token replay.
+- **#2148** — operator-selected destinations for Anthropic/Antigravity OAuth bearers. The
+  transport gate still rejects public cleartext HTTP; only explicitly opted-in local/private
+  relays may use it.
+- **#2149** — OAuth credential commit ownership under the store lock.
+
+## Issue closure
+
+Every issue named by a merged PR is closed: #2133, #2132, #2092, #2047, #1950, #2097, #1886,
+#2125, #2074, #1924, plus the superseded contributor PRs. Verified by `gh api` state, not by
+assuming GitHub auto-closed them — these PRs targeted `dev`, not `main`, so auto-close does not
+fire.
+
+## Release readiness — not a release
+
+At `a584890f8`:
+
+- `bun run test` — 13716 pass / 10 skip / 0 fail across 866 files.
+- `bun x tsc --noEmit` — exit 0.
+- `bun run privacy:scan` — passed.
+- `package.json` version line: **2.27.0** (unchanged by this campaign).
+
+Changed surfaces: provider registry and transport headers, quota dispatch, routing capability
+resolution, the Anthropic/OpenAI-chat/Google adapters, Responses core and compact, OAuth store
+and credential commit, request logging and usage persistence, subagent roster management.
+
+Not done, and deliberately: no `scripts/release.ts`, no npm publish, no tag, no change to
+`main` or `preview`. Release execution needs its own authorization.
+
+## Still open
+
+**#2054** (@keepitmello) stays open by explicit instruction, carrying the wire-probe request.
+**#2167** (@ntdatt812) arrived after this campaign and is untriaged.
+

devlog/_plan/260820_bug_pr_backlog_consolidation/110_three_bug_issues.md

@@ -0,0 +1,103 @@
+# 110 — Three open bug issues: #2152, #2157, #2156
+
+Unit: 260820_bug_pr_backlog_consolidation
+Verification host: `ssh lidge:~/ci-wp3/opencodex`.
+
+Three issues, three different shapes of answer. Two shipped fixes; one is honestly blocked.
+
+## #2152 — Windows CI, three groups (PR #2178)
+
+Three read-only lanes read the three groups. The shape PR #2178 already had was right, and two
+of the issue's own premises turned out to be wrong — the fix follows the evidence:
+
+- **Group 1** is not "the case budget is too small". `A-reduced` failed at 79,978 ms against a
+  150 s ceiling, so the outer budget was never the constraint. The real abort came from
+  `Fixture.request`'s unscaled 10 s `AbortSignal` firing from inside. And `E` does not start
+  `ocx` at all — it starts two lock helpers, and its holder released after a fixed 3 s wait
+  that a Windows contender's spawn can outlast.
+- **Group 2** is not "an unprivileged Windows user cannot create symlinks". The runner can, so
+  `canSymlink` was true and the cases ran — then failed on Unix mode semantics that a Windows
+  directory cannot satisfy. Production already returns `windows_skip` for exactly that reason,
+  which is what makes the platform guard a correct skip rather than a masked failure.
+- **Group 3** needed the crash retry the macOS leg already had.
+
+### The defect I found in the fix
+
+Group 3's retry grepped for `panic(thread`. This repository already worked that out and wrote
+it down: `devlog/_fin/260731_pr_issue_triage_round/050_windows_ci_flake_rca.md:172` says not to
+key on it, because Bun emits **both** `panic(thread 2852)` and `panic(main thread)` for the
+same failure, and names `Internal assertion failure` as the stable fingerprint. Probed:
+
+```
+MATCH   panic(thread 3960): Internal assertion failure
+MISS    panic(main thread): Internal assertion failure
+MISS    panic(main thread): PANIC: reached unreachable code
+```
+
+The retry would have failed the shard on roughly half the crashes it exists to absorb, while
+looking correct.
+
+Three copies of that signature list exist — macOS inline, the new Windows inline, and
+`is_bun_runtime_crash` — and the workflow comment already said to keep them in sync with
+nothing enforcing it. They had drifted. All three now match, and the contract test pins **the
+sync itself**, not the literal text, so the same drift cannot recur. RED-proven: restoring the
+bad signature fails it with `windows:Internal assertion failure:false`.
+
+`hasShellCommandHead` was added because the existing exact-whole-line matcher rejected the
+`| tee` the retry requires — that is why the Windows step assertion went red — while still
+rejecting an echoed or commented-out copy.
+
+**What no local run can prove:** whether 45 s suffices under real Windows contention, the actual
+skip result on the runner, and `PIPESTATUS` under Git Bash. Those need a `workflow_dispatch`,
+and a useful proof run must exercise the crash path — a green Windows run shows the suite runs,
+not that the retry fires.
+
+## #2157 — shadow-helper observability (PR #2179)
+
+The dashboard half of the attribution field #2166 landed. Delivered.
+
+## #2156 — muse-spark truncation: BLOCKED, deliberately
+
+PR #2180 was opened claiming to fix this. An adversarial review found the attribution wrong, and
+the source agrees:
+
+- A stall abort emits `response.incomplete` / `upstream_stall_timeout` (`bridge.ts:1371-1396`),
+  after which the bridge has cancelled upstream, closed, and explicitly discards any late
+  adapter event (`bridge.ts:837-845`).
+- The reporter's error is emitted only after `reader.read()` returns EOF with tool calls still
+  pending (`openai-chat.ts:1819-1827`), surfacing as `response.failed`.
+
+Different path, different client frame. The heartbeat **cannot** produce the reported error.
+
+What the heartbeat does fix is real and worth landing alone: tool-call deltas are buffered, the
+bridge arms its watchdog on adapter activity rather than socket activity, so a large argument
+payload was indistinguishable from a hung upstream. The `#2156` references were reworded to
+"found while investigating", and the closing keyword removed.
+
+**Second finding, fixed in the same PR.** Making the adapter emit one heartbeat per delta
+exposed that `guardTerminalEventStream` retained every nonterminal event in `seen`, which feeds
+both the continuation analysis and the rebuilt request. A large argument payload could grow it
+without bound wherever `terminalContinuationGuard` is on. The empty-completion guard already
+passes heartbeats through unretained; the terminal guard now matches it.
+
+**Why blocked rather than fixed.** The adapter is reporting truthfully: that stream really did
+end. What cannot be determined from here is why it ended for ocx and not for Pi direct.
+`hadUsage: false` is suggestive — ocx does send `stream_options.include_usage` — but a provider
+may simply ignore that flag, so it is not decisive either way.
+
+Asked the reporter for the one thing that settles it: redacted raw SSE captures from a
+Pi-direct success and an ocx failure for an equivalent request, through socket close, and
+whether either carried `finish_reason`, `[DONE]`, or a usage-only final chunk. If ocx's
+upstream closes without a terminal frame while Pi's does not, the difference is in what we send
+or how we read it and it is ours. If both close identically and Pi is merely more tolerant, the
+right answer is the buffered-mode fallback the reporter suggested — and that choice should rest
+on their capture, not on a guess.
+
+## Verification
+
+At the branch tips, on `ssh lidge`:
+
+- #2178: `bun test` 13719 pass / 15 skip / 0 fail; `tests/ci-workflows.test.ts` 132 pass / 0 fail.
+- #2180: `bun test` 13722 pass / 15 skip / 0 fail; focused trio 112 pass / 0 fail.
+- `bun x tsc --noEmit` exit 0 and `bun run privacy:scan` passed on both.
+