{"id":"dcb70424-892d-445e-abd3-5e6e9a1b22a7","entityType":"agent","slug":"clawhub-dashclaw-dashclaw-platform-intelligence","name":"DashClaw Platform Intelligence","canonicalUrl":"https://www.xpersona.co/agent/clawhub-dashclaw-dashclaw-platform-intelligence","canonicalPath":"/agent/clawhub-dashclaw-dashclaw-platform-intelligence","generatedAt":"2026-10-12T12:54:50.240Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-10-12T01:29:39.195Z","emptyReason":null},"description":"DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via `python -m livingcode query`, or `GET {ba... Skill: DashClaw Platform Intelligence Owner: dashclaw Summary: DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via python -m livingcode query, or GET {ba... Tags: ai-agents:1.0.1, dashclaw:1.0.1, governance:1.0.1, integration:1.0.1, latest:1.1.2, platform-expert:1.0.1, troubleshooting:1.0.1 Version history: v1.1.2 | 2026-06-04T11:40:28.853Z | user - Adde","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 961 downloads reported by the source. Last updated 10/12/2026.","installCommand":"clawhub skill install s170nepp8s3xgwvnyf1aq93hz986m9gn:dashclaw-platform-intelligence","sourceUrl":"https://clawhub.ai/dashclaw/dashclaw-platform-intelligence","homepage":"https://clawhub.ai/dashclaw/skills/dashclaw-platform-intelligence","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/dashclaw/dashclaw-platform-intelligence","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/dashclaw/skills/dashclaw-platform-intelligence","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":60,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via `python -m livingcode query`, or `GET {ba..."},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-12T01:29:39.195Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-12T01:29:39.195Z","emptyReason":null},"stars":null,"forks":null,"downloads":961,"likes":null,"task":null,"library":null,"packageName":null,"latestVersion":"1.1.2","tractionLabel":"961 downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-12T01:29:39.124Z","emptyReason":null},"lastUpdatedAt":"2026-10-12T01:29:39.195Z","lastCrawledAt":"2026-10-12T01:29:39.124Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-13T01:29:39.124Z","lastVerifiedAt":null,"highlights":[{"version":"1.1.2","createdAt":"2026-06-04T11:40:28.853Z","changelog":"- Added 2 new API routes and 1 new category, increasing totals to 226 routes across 57 categories. - Expanded API surface with the new behavior recorder and invite routes. - Updated the shape snapshot to the latest schema. - Removed the skill-card.md file.","fileCount":9,"zipByteSize":45279},{"version":"1.1.1","createdAt":"2026-06-04T06:13:56.783Z","changelog":"- Expanded API coverage: increased from 212 to 224 active routes (53 to 56 categories). - Increased environment variable support: now 4 required and 137 optional (up from 119). - Database schema update: now 89 tables (up from 84). - Improved documentation: SKILL.md snapshot now includes fallback instructions for live queries (e.g., using `/api/doctor` when the CLI or repo is unavailable). - Added and updated API categories, including new `admin`, `behavior`, and `integrity` endpoints. - Removed the redundant skill-card.md file.","fileCount":9,"zipByteSize":43502},{"version":"1.1.0","createdAt":"2026-05-14T15:12:32.789Z","changelog":"- Major platform update with expanded API coverage and new features. - Added support for code session management, memos, project sessions, autopsy, and file previews under `code-sessions` routes. - Introduced new `handoffs` API for managing handoff operations. - Increased API routes from 184 to 212 and route categories from 49 to 53. - Expanded database coverage: tables up from 73 to 84. - Added new bootstrap agent script: `scripts/bootstrap-agent-quick.mjs`.","fileCount":9,"zipByteSize":42184},{"version":"1.0.1","createdAt":"2026-05-13T07:47:52.482Z","changelog":"Changelog for 1.0.1 1.0.1 — Remove bootstrap-agent-quick.mjs from the published bundle. The wrapper script was hardcoded to find scripts/bootstrap-agent.mjs at __dirname/../../../.. and only worked when invoked from inside the DashClaw repo itself. External consumers got \"Bootstrap script not found\" instead of any useful behavior, so the script never belonged in a public skill bundle. ClawScan flagged it as ASI05 (Unexpected Code Execution) for shelling out to an unauditable project-root script with the consumer's API key. Cisco's skill scanner had flagged the same file as CRITICAL in March 2026 for the same reason. Removing it eliminates both findings. Remaining scripts (diagnose.mjs, validate-integration.mjs) are read-mostly diagnostics that ClawScan rates as Notes only.","fileCount":7,"zipByteSize":38583},{"version":"1.0.0","createdAt":"2026-05-13T07:14:24.874Z","changelog":"Initial release of DashClaw Platform Intelligence skill. - Provides an expert snapshot of DashClaw's platform APIs, env vars, and database tables. - Covers 184 active API routes across 49 categories. - Lists 4 required and 120 optional environment variables. - Details 73 database tables. - Emphasizes live queries for the most up-to-date platform information. - Includes structured API endpoint summaries for troubleshooting and integration.","fileCount":8,"zipByteSize":40513}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s170nepp8s3xgwvnyf1aq93hz986m9gn:dashclaw-platform-intelligence","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-12T12:54:50.235Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-dashclaw-dashclaw-platform-intelligence/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-10-12T01:29:39.195Z","emptyReason":null},"readme":"Skill: DashClaw Platform Intelligence\n\nOwner: dashclaw\n\nSummary: DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via `python -m livingcode query`, or `GET {ba...\n\nTags: ai-agents:1.0.1, dashclaw:1.0.1, governance:1.0.1, integration:1.0.1, latest:1.1.2, platform-expert:1.0.1, troubleshooting:1.0.1\n\nVersion history:\n\nv1.1.2 | 2026-06-04T11:40:28.853Z | user\n\n- Added 2 new API routes and 1 new category, increasing totals to 226 routes across 57 categories.\n- Expanded API surface with the new behavior recorder and invite routes.\n- Updated the shape snapshot to the latest schema.\n- Removed the skill-card.md file.\n\nv1.1.1 | 2026-06-04T06:13:56.783Z | user\n\n- Expanded API coverage: increased from 212 to 224 active routes (53 to 56 categories).\n- Increased environment variable support: now 4 required and 137 optional (up from 119).\n- Database schema update: now 89 tables (up from 84).\n- Improved documentation: SKILL.md snapshot now includes fallback instructions for live queries (e.g., using `/api/doctor` when the CLI or repo is unavailable).\n- Added and updated API categories, including new `admin`, `behavior`, and `integrity` endpoints.\n- Removed the redundant skill-card.md file.\n\nv1.1.0 | 2026-05-14T15:12:32.789Z | user\n\n- Major platform update with expanded API coverage and new features.\n- Added support for code session management, memos, project sessions, autopsy, and file previews under `code-sessions` routes.\n- Introduced new `handoffs` API for managing handoff operations.\n- Increased API routes from 184 to 212 and route categories from 49 to 53.\n- Expanded database coverage: tables up from 73 to 84.\n- Added new bootstrap agent script: `scripts/bootstrap-agent-quick.mjs`.\n\nv1.0.1 | 2026-05-13T07:47:52.482Z | user\n\nChangelog for 1.0.1\n\n1.0.1 — Remove bootstrap-agent-quick.mjs from the published bundle.\n\nThe wrapper script was hardcoded to find scripts/bootstrap-agent.mjs at __dirname/../../../.. and only worked when invoked from inside the DashClaw repo itself. External consumers got \"Bootstrap script not found\" instead of any useful behavior, so the script never belonged in a public skill bundle.\n\nClawScan flagged it as ASI05 (Unexpected Code Execution) for shelling out to an unauditable project-root script with the consumer's API key. Cisco's skill scanner had flagged the same file as CRITICAL in March 2026 for the same reason. Removing it eliminates both findings.\n\nRemaining scripts (diagnose.mjs, validate-integration.mjs) are read-mostly diagnostics that ClawScan rates as Notes only.\n\nv1.0.0 | 2026-05-13T07:14:24.874Z | user\n\nInitial release of DashClaw Platform Intelligence skill.\n\n- Provides an expert snapshot of DashClaw's platform APIs, env vars, and database tables.\n- Covers 184 active API routes across 49 categories.\n- Lists 4 required and 120 optional environment variables.\n- Details 73 database tables.\n- Emphasizes live queries for the most up-to-date platform information.\n- Includes structured API endpoint summaries for troubleshooting and integration.\n\nArchive index:\n\nArchive v1.1.2: 9 files, 45279 bytes\n\nFiles: references/api-surface.md (31204b), references/platform-knowledge.md (21969b), references/troubleshooting.md (22701b), scripts/bootstrap-agent-quick.mjs (4623b), scripts/diagnose.mjs (9179b), scripts/validate-integration.mjs (9830b), skill-card.md (2640b), SKILL.md (25693b), _meta.json (149b)\n\nFile v1.1.2:SKILL.md\n\n---\r\nname: dashclaw-platform-intelligence\r\ndescription: DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via `python -m livingcode query`, or `GET {baseUrl}/api/doctor` when Python/livingcode/the repo are unavailable.\r\n---\r\n\r\n# DashClaw Platform Intelligence\r\n\r\n**Shape snapshot:** `sha1:22c84d9f7ccd4188bead232ffdde419e68578ba3`\r\n**This file is auto-generated.** Do not edit by hand — regenerate with:\r\n\r\n```bash\r\npython -m livingcode emit skill --output \r\n```\r\n\r\n## Prefer Live Queries\r\n\r\nThe facts below are a snapshot. Before answering any question about DashClaw's current\r\nstructure, routes, env vars, or schema — run a live query:\r\n\r\n```bash\r\npython -m livingcode query summary # High-level shape\r\npython -m livingcode query routes # Current API surface\r\npython -m livingcode query env # Current env vars\r\npython -m livingcode query tables # Current schema\r\npython -m livingcode query all --json # Full machine-readable shape\r\n```\r\n\r\nIf the snapshot below disagrees with a live query, **trust the live query**.\r\n\r\n### Fallback: no Python, livingcode, or repo checkout\r\n\r\n`python -m livingcode` only works where the livingcode package and the repo\r\ncheckout are present (e.g. a developer machine). In OpenClaw / the Claude app\r\nneither exists. When you cannot run the queries above, fall back **in this order**:\r\n\r\n1. **`GET {baseUrl}/api/doctor`** — live route/shape health straight from the running\r\n instance. Requires the workspace API key (`x-api-key: `); returns 401/403\r\n without it. This is the authoritative live source when the CLI is unavailable.\r\n2. **Read the committed static shape** if a repo checkout is reachable:\r\n `app/lib/doctor/generated/shape.json` (full machine-readable shape) and\r\n `docs/api-inventory.json` (route inventory). These are regenerated on every\r\n `npm run livingcode:refresh`, so they track the same facts the queries return.\r\n3. **Otherwise, treat the snapshot in this SKILL.md as authoritative** — it is the\r\n best available source when neither the API nor the repo can be reached.\r\n\r\n## At a Glance\r\n\r\n- **226** active API routes across **57** categories\r\n- **4** required + **137** optional environment variables\r\n- **89** database tables\r\n\r\n## API Surface\r\n\r\n### `actions`\r\n\r\n- `DELETE, GET, POST` `/api/actions`\r\n- `GET, PATCH` `/api/actions/[actionId]`\r\n- `GET` `/api/actions/[actionId]/artifacts`\r\n- `GET` `/api/actions/[actionId]/graph`\r\n- `GET` `/api/actions/[actionId]/messages`\r\n- `GET, POST` `/api/actions/[actionId]/outcome`\r\n- `GET` `/api/actions/[actionId]/trace`\r\n- `GET` `/api/actions/costs`\r\n- `GET, POST` `/api/actions/loops`\r\n- `GET, PATCH` `/api/actions/loops/[loopId]`\r\n- `GET` `/api/actions/stats`\r\n\r\n### `activity`\r\n\r\n- `GET` `/api/activity`\r\n\r\n### `admin`\r\n\r\n- `POST` `/api/admin/trigger-outcome-sweep`\r\n\r\n### `agents`\r\n\r\n- `GET` `/api/agents`\r\n- `GET` `/api/agents/[agentId]`\r\n- `GET` `/api/agents/[agentId]/profile`\r\n- `GET, POST` `/api/agents/connections`\r\n- `POST` `/api/agents/heartbeat`\r\n\r\n### `analytics`\r\n\r\n- `GET` `/api/analytics`\r\n\r\n### `approvals`\r\n\r\n- `POST` `/api/approvals/[actionId]`\r\n\r\n### `artifacts`\r\n\r\n- `GET, POST` `/api/artifacts`\r\n- `DELETE, GET` `/api/artifacts/[artifactId]`\r\n- `POST` `/api/artifacts/evidence-bundle`\r\n\r\n### `assumptions`\r\n\r\n- `GET, POST` `/api/assumptions`\r\n- `GET, PATCH` `/api/assumptions/[assumptionId]`\r\n\r\n### `auth`\r\n\r\n- `-` `/api/auth/[...nextauth]`\r\n- `GET` `/api/auth/config`\r\n- `DELETE, POST` `/api/auth/local`\r\n\r\n### `behavior`\r\n\r\n- `GET, POST` `/api/behavior/recorder`\r\n- `GET` `/api/behavior/samples`\r\n- `POST` `/api/behavior/simulate`\r\n- `GET, POST` `/api/behavior/suggestions`\r\n\r\n### `billing`\r\n\r\n- `POST` `/api/billing/checkout`\r\n- `GET` `/api/billing/portal`\r\n\r\n### `capabilities`\r\n\r\n- `GET, POST` `/api/capabilities`\r\n- `DELETE, GET, PATCH` `/api/capabilities/[capabilityId]`\r\n- `GET, POST` `/api/capabilities/[capabilityId]/access`\r\n- `DELETE` `/api/capabilities/[capabilityId]/access/[ruleId]`\r\n- `GET` `/api/capabilities/[capabilityId]/access/check`\r\n- `GET` `/api/capabilities/[capabilityId]/health`\r\n- `GET` `/api/capabilities/[capabilityId]/history`\r\n- `POST` `/api/capabilities/[capabilityId]/invoke`\r\n- `POST` `/api/capabilities/[capabilityId]/test`\r\n- `GET` `/api/capabilities/health`\r\n\r\n### `code-sessions`\r\n\r\n- `GET` `/api/code-sessions/alerts`\r\n- `POST` `/api/code-sessions/alerts/read-all`\r\n- `POST` `/api/code-sessions/ingest-jsonl`\r\n- `POST` `/api/code-sessions/ingest-live`\r\n- `GET` `/api/code-sessions/manifests/[manifestId]`\r\n- `GET` `/api/code-sessions/memos`\r\n- `POST` `/api/code-sessions/memos/regenerate`\r\n- `GET` `/api/code-sessions/projects`\r\n- `GET` `/api/code-sessions/projects/[projectId]/sessions`\r\n- `GET` `/api/code-sessions/sessions/[sessionId]`\r\n- `GET` `/api/code-sessions/sessions/[sessionId]/autopsy`\r\n- `GET` `/api/code-sessions/sessions/[sessionId]/insights`\r\n- `POST` `/api/code-sessions/sessions/[sessionId]/optimal-files/manifest`\r\n- `POST` `/api/code-sessions/sessions/[sessionId]/optimal-files/merge-preview`\r\n- `POST` `/api/code-sessions/sessions/[sessionId]/optimal-files/preview`\r\n- `GET` `/api/code-sessions/subagent-roi`\r\n\r\n### `compliance`\r\n\r\n- `GET` `/api/compliance/evidence`\r\n- `GET, POST` `/api/compliance/exports`\r\n- `DELETE, GET` `/api/compliance/exports/[exportId]`\r\n- `GET` `/api/compliance/exports/[exportId]/download`\r\n- `GET` `/api/compliance/frameworks`\r\n- `GET` `/api/compliance/gaps`\r\n- `GET` `/api/compliance/map`\r\n- `GET` `/api/compliance/report`\r\n- `GET, POST` `/api/compliance/schedules`\r\n- `DELETE, PATCH` `/api/compliance/schedules/[scheduleId]`\r\n- `GET` `/api/compliance/trends`\r\n\r\n### `cron`\r\n\r\n- `GET` `/api/cron/code-session-cache-crater`\r\n- `GET` `/api/cron/code-session-weekly-memo`\r\n- `GET` `/api/cron/integration-health`\r\n- `GET` `/api/cron/jti-sweep`\r\n- `GET` `/api/cron/learning-episodes-backfill`\r\n- `GET` `/api/cron/learning-recommendations`\r\n- `GET` `/api/cron/memory-maintenance`\r\n- `GET` `/api/cron/outcome-sweep`\r\n- `GET` `/api/cron/policy-suggestions`\r\n- `GET` `/api/cron/reset-meters`\r\n- `POST` `/api/cron/routing-maintenance`\r\n- `GET` `/api/cron/signals`\r\n\r\n### `discord`\r\n\r\n- `POST` `/api/discord/interactions`\r\n\r\n### `docs`\r\n\r\n- `GET` `/api/docs/raw`\r\n\r\n### `doctor`\r\n\r\n- `GET` `/api/doctor`\r\n- `POST` `/api/doctor/fix`\r\n\r\n### `drift`\r\n\r\n- `GET, POST` `/api/drift/alerts`\r\n- `DELETE, PATCH` `/api/drift/alerts/[alertId]`\r\n- `GET` `/api/drift/metrics`\r\n- `GET` `/api/drift/snapshots`\r\n- `GET` `/api/drift/stats`\r\n\r\n### `evaluations`\r\n\r\n- `GET, POST` `/api/evaluations`\r\n- `GET, POST` `/api/evaluations/runs`\r\n- `GET, PATCH` `/api/evaluations/runs/[runId]`\r\n- `GET, POST` `/api/evaluations/scorers`\r\n- `DELETE, PATCH` `/api/evaluations/scorers/[scorerId]`\r\n- `POST` `/api/evaluations/scorers/preview`\r\n- `GET` `/api/evaluations/stats`\r\n\r\n### `guard`\r\n\r\n- `GET, POST` `/api/guard`\r\n- `GET` `/api/guard/decisions`\r\n\r\n### `handoffs`\r\n\r\n- `GET, POST` `/api/handoffs`\r\n- `GET` `/api/handoffs/[id]`\r\n- `POST` `/api/handoffs/[id]/consume`\r\n- `GET` `/api/handoffs/latest`\r\n\r\n### `health`\r\n\r\n- `GET` `/api/health`\r\n\r\n### `hosted`\r\n\r\n- `POST` `/api/hosted/cleanup`\r\n- `GET, POST` `/api/hosted/workspaces`\r\n- `DELETE, GET` `/api/hosted/workspaces/[workspaceId]`\r\n\r\n### `identities`\r\n\r\n- `GET, POST` `/api/identities`\r\n- `DELETE` `/api/identities/[agentId]`\r\n\r\n### `integrations`\r\n\r\n- `GET` `/api/integrations/health`\r\n- `POST` `/api/integrations/health/refresh`\r\n\r\n### `integrity`\r\n\r\n- `GET` `/api/integrity/jwks`\r\n- `POST` `/api/integrity/verify`\r\n\r\n### `invite`\r\n\r\n- `GET, POST` `/api/invite/[token]`\r\n\r\n### `keys`\r\n\r\n- `DELETE, GET, POST` `/api/keys`\r\n- `GET` `/api/keys/reveal`\r\n\r\n### `knowledge`\r\n\r\n- `GET, POST` `/api/knowledge/collections`\r\n- `DELETE, GET, PATCH` `/api/knowledge/collections/[collectionId]`\r\n- `GET, POST` `/api/knowledge/collections/[collectionId]/items`\r\n- `POST` `/api/knowledge/collections/[collectionId]/search`\r\n- `POST` `/api/knowledge/collections/[collectionId]/sync`\r\n\r\n### `learning`\r\n\r\n- `GET, POST` `/api/learning`\r\n- `GET, POST` `/api/learning/analytics/curves`\r\n- `GET` `/api/learning/analytics/maturity`\r\n- `GET` `/api/learning/analytics/summary`\r\n- `GET, POST` `/api/learning/analytics/velocity`\r\n- `GET` `/api/learning/code-signals`\r\n- `GET` `/api/learning/lessons`\r\n- `GET, POST` `/api/learning/recommendations`\r\n- `PATCH` `/api/learning/recommendations/[recommendationId]`\r\n- `POST` `/api/learning/recommendations/events`\r\n- `GET` `/api/learning/recommendations/metrics`\r\n- `GET, POST` `/api/learning/suggestions`\r\n\r\n### `marketing`\r\n\r\n- `POST` `/api/marketing/event`\r\n\r\n### `mcp`\r\n\r\n- `POST` `/api/mcp`\r\n\r\n### `messages`\r\n\r\n- `GET, PATCH, POST` `/api/messages`\r\n- `GET` `/api/messages/attachments`\r\n- `GET, PATCH, POST` `/api/messages/threads`\r\n- `GET` `/api/messages/threads/[threadId]`\r\n\r\n### `model-strategies`\r\n\r\n- `GET, POST` `/api/model-strategies`\r\n- `DELETE, GET, PATCH` `/api/model-strategies/[strategyId]`\r\n- `POST` `/api/model-strategies/[strategyId]/complete`\r\n\r\n### `oauth`\r\n\r\n- `GET, POST` `/api/oauth/authorize`\r\n- `GET` `/api/oauth/metadata/authorization-server`\r\n- `GET` `/api/oauth/metadata/protected-resource`\r\n- `POST` `/api/oauth/register`\r\n- `POST` `/api/oauth/token`\r\n\r\n### `operations`\r\n\r\n- `GET` `/api/operations/feed`\r\n- `GET` `/api/operations/summary`\r\n\r\n### `orgs`\r\n\r\n- `GET, POST` `/api/orgs`\r\n- `GET, PATCH` `/api/orgs/[orgId]`\r\n- `DELETE, GET, POST` `/api/orgs/[orgId]/keys`\r\n\r\n### `pairings`\r\n\r\n- `GET, POST` `/api/pairings`\r\n- `GET, PATCH` `/api/pairings/[pairingId]`\r\n- `POST` `/api/pairings/[pairingId]/approve`\r\n\r\n### `policies`\r\n\r\n- `DELETE, GET, PATCH, POST` `/api/policies`\r\n- `POST` `/api/policies/generate`\r\n- `POST` `/api/policies/import`\r\n- `GET` `/api/policies/proof`\r\n- `POST` `/api/policies/simulate`\r\n- `GET` `/api/policies/templates`\r\n- `POST` `/api/policies/test`\r\n\r\n### `prompts`\r\n\r\n- `GET` `/api/prompts/agent-connect/raw`\r\n- `POST` `/api/prompts/render`\r\n- `GET` `/api/prompts/runs`\r\n- `GET` `/api/prompts/sdk-coverage/raw`\r\n- `GET` `/api/prompts/server-setup/raw`\r\n- `GET` `/api/prompts/stats`\r\n- `GET, POST` `/api/prompts/templates`\r\n- `DELETE, GET, PATCH` `/api/prompts/templates/[templateId]`\r\n- `GET, POST` `/api/prompts/templates/[templateId]/versions`\r\n- `GET, POST` `/api/prompts/templates/[templateId]/versions/[versionId]`\r\n\r\n### `scoring`\r\n\r\n- `POST` `/api/scoring/calibrate`\r\n- `GET, POST` `/api/scoring/profiles`\r\n- `DELETE, GET, PATCH` `/api/scoring/profiles/[profileId]`\r\n- `POST` `/api/scoring/profiles/[profileId]/dimensions`\r\n- `DELETE, PATCH` `/api/scoring/profiles/[profileId]/dimensions/[dimensionId]`\r\n- `GET, POST` `/api/scoring/risk-templates`\r\n- `DELETE, PATCH` `/api/scoring/risk-templates/[templateId]`\r\n- `GET, POST` `/api/scoring/score`\r\n\r\n### `secrets`\r\n\r\n- `GET, POST` `/api/secrets`\r\n- `DELETE, PATCH` `/api/secrets/[id]`\r\n- `GET` `/api/secrets/rotation-due`\r\n\r\n### `security`\r\n\r\n- `GET, POST` `/api/security/prompt-injection`\r\n- `POST` `/api/security/scan`\r\n- `GET` `/api/security/status`\r\n\r\n### `session`\r\n\r\n- `GET` `/api/session/effective`\r\n\r\n### `sessions`\r\n\r\n- `GET, POST` `/api/sessions`\r\n- `GET, PATCH` `/api/sessions/[sessionId]`\r\n- `GET` `/api/sessions/[sessionId]/events`\r\n\r\n### `settings`\r\n\r\n- `DELETE, GET, POST` `/api/settings`\r\n- `GET` `/api/settings/llm-status`\r\n- `POST` `/api/settings/test`\r\n\r\n### `setup`\r\n\r\n- `POST` `/api/setup/live-proof`\r\n- `POST` `/api/setup/migrate`\r\n- `POST` `/api/setup/ping`\r\n- `GET` `/api/setup/proof`\r\n- `GET` `/api/setup/status`\r\n\r\n### `signals`\r\n\r\n- `GET` `/api/signals`\r\n\r\n### `skills`\r\n\r\n- `POST` `/api/skills/scan`\r\n- `GET` `/api/skills/scans/[id]`\r\n\r\n### `stream`\r\n\r\n- `GET` `/api/stream`\r\n\r\n### `swarm`\r\n\r\n- `GET` `/api/swarm/graph`\r\n- `GET` `/api/swarm/link`\r\n\r\n### `team`\r\n\r\n- `GET` `/api/team`\r\n- `DELETE, PATCH` `/api/team/[userId]`\r\n- `DELETE, GET, POST` `/api/team/invite`\r\n\r\n### `telegram`\r\n\r\n- `POST` `/api/telegram/webhook`\r\n\r\n### `usage`\r\n\r\n- `GET` `/api/usage`\r\n- `GET` `/api/usage/costs`\r\n\r\n### `webhooks`\r\n\r\n- `DELETE, GET, POST` `/api/webhooks`\r\n- `GET` `/api/webhooks/[webhookId]/deliveries`\r\n- `POST` `/api/webhooks/[webhookId]/test`\r\n- `POST` `/api/webhooks/stripe`\r\n\r\n### `workflows`\r\n\r\n- `POST` `/api/workflows/draft`\r\n- `GET, POST` `/api/workflows/templates`\r\n- `DELETE, GET, PATCH` `/api/workflows/templates/[templateId]`\r\n- `POST` `/api/workflows/templates/[templateId]/duplicate`\r\n- `POST` `/api/workflows/templates/[templateId]/execute`\r\n- `POST` `/api/workflows/templates/[templateId]/launch`\r\n- `GET` `/api/workflows/templates/[templateId]/runs`\r\n- `GET` `/api/workflows/templates/[templateId]/runs/[runActionId]`\r\n- `POST` `/api/workflows/templates/[templateId]/runs/[runActionId]/cancel`\r\n- `POST` `/api/workflows/templates/[templateId]/runs/[runActionId]/resume`\r\n\r\n## Required Environment Variables\r\n\r\nThese must be set — DashClaw will fail to start without them.\r\n\r\n- **`DASHCLAW_API_KEY`** - referenced in 56 file(s)\r\n- **`DATABASE_URL`** - referenced in 87 file(s)\r\n- **`ENCRYPTION_KEY`** - referenced in 4 file(s)\r\n- **`NEXTAUTH_SECRET`** - referenced in 5 file(s)\r\n\r\n## Optional Environment Variables\r\n\r\nThese have fallbacks or only activate specific features.\r\n\r\n- `AGENT_ONLINE_WINDOW_MS` *(undocumented)*\r\n- `AGENT_PRIVATE_KEY` *(undocumented)*\r\n- `AGENT_PRIVATE_KEY_JWK` *(undocumented)*\r\n- `ALERT_FROM_EMAIL` *(undocumented)*\r\n- `ALLOWED_ORIGIN` *(undocumented)*\r\n- `ANTHROPIC_API_KEY` *(undocumented)*\r\n- `ANTHROPIC_MODEL` *(undocumented)*\r\n- `API_INVENTORY_VERIFIED_DATE` *(undocumented)*\r\n- `API_SECRET` *(undocumented)*\r\n- `BASE_URL` *(undocumented)*\r\n- `CI` *(undocumented)*\r\n- `CONVERGENCE_BENCH_CONCURRENCY` *(undocumented)*\r\n- `CONVERGENCE_BENCH_ITERATIONS` *(undocumented)*\r\n- `CONVERGENCE_REPLAY_CONNECT_TIMEOUT_MS` *(undocumented)*\r\n- `CONVERGENCE_RETRY_429_MAX` *(undocumented)*\r\n- `CONVERGENCE_RETRY_429_WAIT_MS` *(undocumented)*\r\n- `CONVERGENCE_SSE_SEND_COUNT` *(undocumented)*\r\n- `CONVERGENCE_VERBOSE` *(undocumented)*\r\n- `CRON_SECRET` *(undocumented)*\r\n- `DASHCLAW_ACT_BINDING` *(undocumented)*\r\n- `DASHCLAW_ACT_BINDING_TYP` *(undocumented)*\r\n- `DASHCLAW_AGENT_ID` *(undocumented)*\r\n- `DASHCLAW_ALERTS_DISCORD` *(undocumented)*\r\n- `DASHCLAW_ALERTS_TELEGRAM` *(undocumented)*\r\n- `DASHCLAW_ALLOWED_ISSUER` *(undocumented)*\r\n- `DASHCLAW_API_KEY_ORG` *(undocumented)*\r\n- `DASHCLAW_BASE_URL` *(undocumented)*\r\n- `DASHCLAW_BEHAVIOR_SAMPLES_DIR` *(undocumented)*\r\n- `DASHCLAW_BEHAVIOR_SAMPLES_ENABLED` *(undocumented)*\r\n- `DASHCLAW_CLOSED_ENROLLMENT` *(undocumented)*\r\n- `DASHCLAW_DB_DRIVER` *(undocumented)*\r\n- `DASHCLAW_DB_POOL_MAX` *(undocumented)*\r\n- `DASHCLAW_DISABLE_RATE_LIMIT` *(undocumented)*\r\n- `DASHCLAW_GUARD_FALLBACK` *(undocumented)*\r\n- `DASHCLAW_GUARD_UNAVAILABLE_POLICY` *(undocumented)*\r\n- `DASHCLAW_HOSTED` *(undocumented)*\r\n- `DASHCLAW_JTI_MAX_TTL_SECONDS` *(undocumented)*\r\n- `DASHCLAW_JTI_REPLAY_PROTECTION` *(undocumented)*\r\n- `DASHCLAW_JWT_AUDIENCE` *(undocumented)*\r\n- `DASHCLAW_LOCAL_ADMIN_PASSWORD` *(undocumented)*\r\n- `DASHCLAW_MAX_ORG_ATTACHMENT_BYTES` *(undocumented)*\r\n- `DASHCLAW_MODE` *(undocumented)*\r\n- `DASHCLAW_NEW_CONNECT_WEBHOOK` *(undocumented)*\r\n- `DASHCLAW_PAIRING_TTL_MINUTES` *(undocumented)*\r\n- `DASHCLAW_RATE_LIMIT_MAX` *(undocumented)*\r\n- `DASHCLAW_RATE_LIMIT_WINDOW_MS` *(undocumented)*\r\n- `DASHCLAW_SIGNING_KEY_JWK` *(undocumented)*\r\n- `DASHCLAW_URL` *(undocumented)*\r\n- `DISABLE_PROMPT_INJECTION_SCAN` *(undocumented)*\r\n- `DISCORD_APPROVER_ORG_ID` *(undocumented)*\r\n- `DISCORD_APPROVER_USER_ID` *(undocumented)*\r\n- `DISCORD_BOT_TOKEN` *(undocumented)*\r\n- `DISCORD_PUBLIC_KEY` *(undocumented)*\r\n- `ENFORCE_AGENT_SIGNATURES` *(undocumented)*\r\n- `GITHUB_CLIENT_ID` *(undocumented)*\r\n- `GITHUB_CLIENT_SECRET` *(undocumented)*\r\n- `GITHUB_ID` *(undocumented)*\r\n- `GITHUB_REPO_NAME` *(undocumented)*\r\n- `GITHUB_REPO_OWNER` *(undocumented)*\r\n- `GITHUB_SECRET` *(undocumented)*\r\n- `GITHUB_TOKEN` *(undocumented)*\r\n- `GOOGLE_AI_API_KEY` *(undocumented)*\r\n- `GOOGLE_CLIENT_ID` *(undocumented)*\r\n- `GOOGLE_CLIENT_SECRET` *(undocumented)*\r\n- `GOOGLE_ID` *(undocumented)*\r\n- `GOOGLE_SECRET` *(undocumented)*\r\n- `GUARD_LLM_BASE_URL` *(undocumented)*\r\n- `GUARD_LLM_KEY` *(undocumented)*\r\n- `GUARD_LLM_MODEL` *(undocumented)*\r\n- `GUARD_WEBHOOK_SECRET` *(undocumented)*\r\n- `HOSTED_CLEANUP_SECRET` *(undocumented)*\r\n- `HOSTED_PROVISION_MAX_PER_IP_PER_DAY` *(undocumented)*\r\n- `HOSTED_SMOKE_BASE_URL` *(undocumented)*\r\n- `HOSTED_TRIAL_ACTION_CAP` *(undocumented)*\r\n- `HOSTED_TRIAL_DAYS` *(undocumented)*\r\n- `INTEGRATION_DATABASE_URL` *(undocumented)*\r\n- `MOONSHOT_API_KEY` *(undocumented)*\r\n- `NEXTAUTH_URL`\r\n- `NEXT_PUBLIC_` *(undocumented)*\r\n- `NEXT_PUBLIC_APP_URL` *(undocumented)*\r\n- `NEXT_PUBLIC_DASHCLAW_MODE` *(undocumented)*\r\n- `NEXT_PUBLIC_DASHCLAW_VERSION` *(undocumented)*\r\n- `NEXT_PUBLIC_ENABLE_VERCEL_ANALYTICS` *(undocumented)*\r\n- `NEXT_PUBLIC_PLUGIN_MANIFEST_VERSION` *(undocumented)*\r\n- `NEXT_PUBLIC_SDK_NODE_VERSION` *(undocumented)*\r\n- `NEXT_PUBLIC_SDK_PYTHON_VERSION` *(undocumented)*\r\n- `NEXT_PUBLIC_TURNSTILE_SITE_KEY` *(undocumented)*\r\n- `NODE_ENV` *(undocumented)*\r\n- `OIDC_AUTHORIZATION_URL` *(undocumented)*\r\n- `OIDC_CLIENT_ID` *(undocumented)*\r\n- `OIDC_CLIENT_SECRET` *(undocumented)*\r\n- `OIDC_DISPLAY_NAME` *(undocumented)*\r\n- `OIDC_ISSUER_URL` *(undocumented)*\r\n- `OIDC_TOKEN_URL` *(undocumented)*\r\n- `OIDC_USERINFO_URL` *(undocumented)*\r\n- `OPENAI_API_KEY` *(undocumented)*\r\n- `ORG_ID` *(undocumented)*\r\n- `PORT` *(undocumented)*\r\n- `PW_BASE_URL` *(undocumented)*\r\n- `PW_SMOKE_PORT` *(undocumented)*\r\n- `PYTHON` *(undocumented)*\r\n- `PYTHONPATH` *(undocumented)*\r\n- `REALTIME_BACKEND` *(undocumented)*\r\n- `REALTIME_ENFORCE_REDIS` *(undocumented)*\r\n- `REALTIME_MAX_LISTENERS` *(undocumented)*\r\n- `REALTIME_MEMORY_MAX_LISTENERS` *(undocumented)*\r\n- `REALTIME_REDIS_URL` *(undocumented)*\r\n- `REALTIME_REPLAY_MAX_EVENTS` *(undocumented)*\r\n- `REALTIME_REPLAY_WINDOW_SECONDS` *(undocumented)*\r\n- `REDIS_URL` *(undocumented)*\r\n- `RESEARCH_API_KEY` *(undocumented)*\r\n- `RESEARCH_API_URL` *(undocumented)*\r\n- `RESEND_API_KEY` *(undocumented)*\r\n- `S` *(undocumented)*\r\n- `SERVICE_NAME` *(undocumented)*\r\n- `STARTUP_SMOKE_BASE_URL` *(undocumented)*\r\n- `STARTUP_SMOKE_INTERVAL_MS` *(undocumented)*\r\n- `STARTUP_SMOKE_TIMEOUT_MS` *(undocumented)*\r\n- `STRIPE_PRICE_BUSINESS` *(undocumented)*\r\n- `STRIPE_PRICE_PRO` *(undocumented)*\r\n- `STRIPE_SECRET_KEY` *(undocumented)*\r\n- `STRIPE_WEBHOOK_SECRET` *(undocumented)*\r\n- `TARGET_ENV` *(undocumented)*\r\n- `TELEGRAM_ADMIN_CHAT_ID` *(undocumented)*\r\n- `TELEGRAM_APPROVER_ORG_ID` *(undocumented)*\r\n- `TELEGRAM_BOT_TOKEN` *(undocumented)*\r\n- `TELEGRAM_WEBHOOK_SECRET` *(undocumented)*\r\n- `TEST_BASE_URL` *(undocumented)*\r\n- `TRUST_PROXY` *(undocumented)*\r\n- `TURNSTILE_SECRET_KEY` *(undocumented)*\r\n- `UPSTASH_REDIS_REST_TOKEN` *(undocumented)*\r\n- `UPSTASH_REDIS_REST_URL` *(undocumented)*\r\n- `VERCEL` *(undocumented)*\r\n- `VERCEL_PROJECT_PRODUCTION_URL` *(undocumented)*\r\n- `VERCEL_URL` *(undocumented)*\r\n- `WEBHOOK_ALLOWED_DOMAINS` *(undocumented)*\r\n- `X` *(undocumented)*\r\n\r\n## Database Tables\r\n\r\nAll 89 tables defined in `schema/schema.js` (Drizzle ORM):\r\n\r\n- `action_embeddings`\r\n- `action_records`\r\n- `activity_logs`\r\n- `agent_connections`\r\n- `agent_identities`\r\n- `agent_messages`\r\n- `agent_pairings`\r\n- `agent_presence`\r\n- `agent_schedules`\r\n- `agent_sessions`\r\n- `api_keys`\r\n- `assumptions`\r\n- `calendar_events`\r\n- `code_optimal_file_manifests`\r\n- `code_projects`\r\n- `code_session_alerts`\r\n- `code_session_handoffs`\r\n- `code_session_memos`\r\n- `code_session_messages`\r\n- `code_session_signals`\r\n- `code_session_tool_uses`\r\n- `code_sessions`\r\n- `compliance_snapshots`\r\n- `contacts`\r\n- `content`\r\n- `context_entries`\r\n- `context_points`\r\n- `daily_totals`\r\n- `decisions`\r\n- `drift_alerts`\r\n- `drift_baselines`\r\n- `drift_snapshots`\r\n- `entities`\r\n- `eval_runs`\r\n- `eval_scores`\r\n- `executions`\r\n- `feedback`\r\n- `goals`\r\n- `governed_secrets`\r\n- `guard_decisions`\r\n- `guard_policies`\r\n- `guardrails_test_runs`\r\n- `health_snapshots`\r\n- `ideas`\r\n- `interactions`\r\n- `jwt_replay_log`\r\n- `learning_curves`\r\n- `learning_episodes`\r\n- `learning_recommendation_events`\r\n- `learning_recommendations`\r\n- `learning_velocity`\r\n- `message_threads`\r\n- `milestones`\r\n- `notification_preferences`\r\n- `oauth_access_tokens`\r\n- `oauth_authorization_codes`\r\n- `oauth_clients`\r\n- `open_loops`\r\n- `organizations`\r\n- `profile_scores`\r\n- `prompt_runs`\r\n- `prompt_templates`\r\n- `prompt_versions`\r\n- `risk_templates`\r\n- `routing_agent_metrics`\r\n- `routing_agents`\r\n- `routing_decisions`\r\n- `routing_tasks`\r\n- `scheduled_jobs`\r\n- `scoring_dimensions`\r\n- `scoring_profiles`\r\n- `server_signing_keys`\r\n- `session_events`\r\n- `shared_docs`\r\n- `skill_scan_results`\r\n- `snippets`\r\n- `token_budgets`\r\n- `token_snapshots`\r\n- `topics`\r\n- `usage_meters`\r\n- `user_approaches`\r\n- `user_moods`\r\n- `user_observations`\r\n- `user_preferences`\r\n- `users`\r\n- `waitlist`\r\n- `webhook_deliveries`\r\n- `webhooks`\r\n- `workflows`\r\n\r\n## Configuration Knobs\r\n\r\nPer-org settings stored in the `settings` table. Set via `PUT /api/settings/:key` or the web Settings/Integrations UI. Keys marked sensitive are auto-encrypted at rest.\r\n\r\n### AI Providers\r\n\r\n- `OPENAI_API_KEY`\r\n- `OPENAI_ORG_ID`\r\n- `ANTHROPIC_API_KEY`\r\n- `GROQ_API_KEY`\r\n- `TOGETHER_API_KEY`\r\n- `REPLICATE_API_TOKEN`\r\n- `HUGGINGFACE_API_KEY`\r\n- `PERPLEXITY_API_KEY`\r\n- `ELEVENLABS_API_KEY`\r\n- `ELEVENLABS_VOICE_ID`\r\n\r\n### Databases\r\n\r\n- `DATABASE_URL`\r\n- `SUPABASE_URL`\r\n- `SUPABASE_ANON_KEY`\r\n- `SUPABASE_SERVICE_KEY`\r\n- `PLANETSCALE_URL`\r\n- `MONGODB_URI`\r\n- `REDIS_URL`\r\n- `PINECONE_API_KEY`\r\n- `PINECONE_ENVIRONMENT`\r\n\r\n### Communication\r\n\r\n- `TELEGRAM_BOT_TOKEN`\r\n- `TELEGRAM_ADMIN_CHAT_ID`\r\n- `DASHCLAW_ALERTS_TELEGRAM`\r\n- `DISCORD_BOT_TOKEN`\r\n- `DISCORD_CLIENT_ID`\r\n- `DISCORD_GUILD_ID`\r\n- `SLACK_BOT_TOKEN`\r\n- `SLACK_SIGNING_SECRET`\r\n- `SLACK_APP_TOKEN`\r\n- `TWILIO_ACCOUNT_SID`\r\n- `TWILIO_AUTH_TOKEN`\r\n- `TWILIO_PHONE_NUMBER`\r\n- `RESEND_API_KEY`\r\n- `SENDGRID_API_KEY`\r\n\r\n### Productivity\r\n\r\n- `GOOGLE_ACCOUNT`\r\n- `GOOGLE_CREDENTIALS_PATH`\r\n- `NOTION_API_KEY`\r\n- `NOTION_PARENT_PAGE_ID`\r\n- `LINEAR_API_KEY`\r\n- `AIRTABLE_API_KEY`\r\n- `AIRTABLE_BASE_ID`\r\n- `CALENDLY_API_KEY`\r\n\r\n### Development\r\n\r\n- `GITHUB_TOKEN`\r\n- `GITHUB_USERNAME`\r\n- `VERCEL_TOKEN`\r\n- `VERCEL_PROJECT_ID`\r\n- `RAILWAY_TOKEN`\r\n- `CLOUDFLARE_API_TOKEN`\r\n- `CLOUDFLARE_ACCOUNT_ID`\r\n- `SENTRY_DSN`\r\n- `SENTRY_AUTH_TOKEN`\r\n\r\n### Social\r\n\r\n- `TWITTER_API_KEY`\r\n- `TWITTER_API_SECRET`\r\n- `TWITTER_ACCESS_TOKEN`\r\n- `TWITTER_ACCESS_SECRET`\r\n- `BRAVE_API_KEY`\r\n- `MOLTBOOK_API_KEY`\r\n\r\n### Payments\r\n\r\n- `STRIPE_SECRET_KEY`\r\n- `STRIPE_PUBLISHABLE_KEY`\r\n- `STRIPE_WEBHOOK_SECRET`\r\n- `LEMONSQUEEZY_API_KEY`\r\n\r\n### Native governance alert settings\r\n\r\n- `DASHCLAW_ALERTS_SLACK`\r\n- `DASHCLAW_ALERTS_DISCORD`\r\n- `DASHCLAW_ALERTS_LINEAR`\r\n- `DASHCLAW_ALERTS_GITHUB`\r\n- `DASHCLAW_ALERTS_EMAIL`\r\n- `DASHCLAW_ALERT_EMAIL`\r\n- `SLACK_CHANNEL_ID`\r\n- `SLACK_WEBHOOK_URL`\r\n- `DISCORD_WEBHOOK_URL`\r\n- `GITHUB_REPO`\r\n- `SENDGRID_DEFAULT_TO`\r\n- `SENDGRID_FROM_EMAIL`\r\n\r\n### webhooks + native adapters deliver a signal. Empty/unset = disabled.\r\n\r\n- `DASHCLAW_ACTION_COST_THRESHOLD`\r\n\r\n### System configuration\r\n\r\n- `MODEL_PRICING`\r\n- `ENFORCE_AGENT_SIGNATURES`\r\n\r\n### Predictive risk scoring\r\n\r\n- `PREDICTIVE_RISK_ENABLED`\r\n- `PREDICTIVE_RISK_THRESHOLD`\r\n\r\n### docs/architecture/durable-execution-finality.md.\r\n\r\n- `DASHCLAW_OUTCOME_TIMEOUT_MINUTES`\r\n\r\n### DASHCLAW_BEHAVIOR_SAMPLES_ENABLED env var still overrides them.\r\n\r\n- `BEHAVIOR_RECORDER_ENABLED`\r\n- `BEHAVIOR_RECORDER_UNTIL`\r\n\r\n### content contains a detected secret/credential. Default (unset) = warn only.\r\n\r\n- `DASHCLAW_AUTOSCAN_BLOCK`\r\n\r\n## Realtime & Webhook Events\r\n\r\nEvery mutation that Mission Control reflects and every webhook delivery is keyed on these event strings. Subscribe via `GET /api/events` (SSE) or register a webhook with the matching `events: [...]` array.\r\n\r\n| Constant | Event |\r\n| --- | --- |\r\n| `ACTION_COST_EXCEEDED` | `action.cost_exceeded` |\r\n| `ACTION_CREATED` | `action.created` |\r\n| `ACTION_UPDATED` | `action.updated` |\r\n| `DECISION_CREATED` | `decision.created` |\r\n| `GOAL_CREATED` | `goal.created` |\r\n| `GOAL_UPDATED` | `goal.updated` |\r\n| `GUARD_DECISION_CREATED` | `guard.decision.created` |\r\n| `LOOP_CREATED` | `loop.created` |\r\n| `LOOP_UPDATED` | `loop.updated` |\r\n| `MESSAGE_CREATED` | `message.created` |\r\n| `POLICY_UPDATED` | `policy.updated` |\r\n| `SIGNAL_DETECTED` | `signal.detected` |\r\n| `TASK_ASSIGNED` | `task.assigned` |\r\n| `TASK_COMPLETED` | `task.completed` |\r\n| `TOKEN_USAGE` | `token.usage` |\r\n\r\n## Signal Types\r\n\r\nThese are the `type` strings emitted through `fireWebhooksForOrg` and `deliverNativeNotifications`. Webhooks can subscribe to any subset by putting the type in their `events: [...]` array (or use `['all']` for everything).\r\n\r\n- `autonomy_spike`\r\n- `branch_stale`\r\n- `cost_exceeded`\r\n- `green_insufficient`\r\n- `integration_health_changed`\r\n- `integration_mismatch`\r\n- `lost_confirmation`\r\n- `mcp_degraded`\r\n- `stale_action`\r\n- `test`\r\n\r\n## Native Notification Adapters\r\n\r\nEach adapter delivers `integration_mismatch`, `integration_health_changed`, and `cost_exceeded` signals when at least one of its required credential keys is configured. Per-channel opt-out via `DASHCLAW_ALERTS_=false`.\r\n\r\n| Adapter | Required credential (any one) |\r\n| --- | --- |\r\n| `org_id` | `DISCORD_WEBHOOK_URL` |\r\n| `email` | `RESEND_API_KEY`, `SENDGRID_API_KEY` |\r\n| `github` | `GITHUB_TOKEN` |\r\n| `linear` | `LINEAR_API_KEY` |\r\n| `slack` | `SLACK_BOT_TOKEN`, `SLACK_WEBHOOK_URL` |\r\n\r\n## Detecting Drift\r\n\r\nTo check whether this snapshot matches the current codebase:\r\n\r\n```bash\r\npython -m livingcode diff\r\n```\r\n\r\nIf the diff shows changes, this skill is stale — regenerate it.\n\nFile v1.1.2:_meta.json\n\n{\n \"ownerId\": \"kn772et58w67n5sn64dtadvgws86nbb1\",\n \"slug\": \"dashclaw-platform-intelligence\",\n \"version\": \"1.1.2\",\n \"publishedAt\": 1780573228853\n}\n\nFile v1.1.2:references/api-surface.md\n\n# DashClaw API Surface\r\n\r\n**259 active routes** (verified 2026-05-15 against `docs/api-inventory.json`). Node SDK uses camelCase, Python SDK uses snake_case.\r\n\r\n> ⚠️ **Authoritative source:** `SKILL.md` (regenerated from the livingcode shape) and `docs/api-inventory.md`. This file is a curated narrative for the most commonly consumed surfaces plus anything new that doesn't yet have an SDK mapping. Some sections below describe legacy v1 endpoints that may not exist in the current build (e.g. `/api/context/*`, `/api/snippets/*`, `/api/decisions`, `/api/feedback/*`) — cross-check against `docs/api-inventory.md` before integrating.\r\n\r\n## Table of Contents\r\n\r\n- [Doctor (self-host diagnostics)](#doctor-self-host-diagnostics)\r\n- [MCP Server](#mcp-server)\r\n- [Analytics](#analytics)\r\n- [Action Recording](#action-recording)\r\n- [Approvals](#approvals)\r\n- [Agent Fleet and Profile](#agent-fleet-and-profile)\r\n- [Loops and Assumptions](#loops-and-assumptions)\r\n- [Signals](#signals)\r\n- [Behavior Guard](#behavior-guard)\r\n- [Guard Decisions Audit Log](#guard-decisions-audit-log)\r\n- [Policies](#policies)\r\n- [Capabilities](#capabilities)\r\n- [Workflows](#workflows)\r\n- [Context Manager](#context-manager)\r\n- [Agent Messaging](#agent-messaging)\r\n- [Automation Snippets](#automation-snippets)\r\n- [Session Handoffs](#session-handoffs)\r\n- [Memory](#memory)\r\n- [User Preferences](#user-preferences)\r\n- [Daily Digest](#daily-digest)\r\n- [Security Scanning](#security-scanning)\r\n- [Webhooks](#webhooks)\r\n- [Agent Pairing](#agent-pairing)\r\n- [Identity Binding](#identity-binding)\r\n- [Organization Management](#organization-management)\r\n- [Activity Logs](#activity-logs)\r\n- [Compliance Engine](#compliance-engine)\r\n- [Compliance Exports](#compliance-exports)\r\n- [Bulk Sync](#bulk-sync)\r\n- [Evaluation Framework](#evaluation-framework)\r\n- [Prompt Management](#prompt-management)\r\n- [Drift Detection](#drift-detection)\r\n- [Learning Analytics](#learning-analytics)\r\n- [Scoring Profiles](#scoring-profiles)\r\n- [Risk Templates](#risk-templates)\r\n- [Session Lifecycle](#session-lifecycle)\r\n- [Guard Policy Types](#guard-policy-types)\r\n- [Dashboard Data and Other Routes](#dashboard-data-and-other-routes)\r\n\r\n## Doctor (self-host diagnostics)\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/doctor` | GET | Run all check modules (database, config, auth, deployment, SDK, governance, drift guard). Returns per-check pass/fail + summary. |\r\n| `/api/doctor/fix` | POST | Apply safe auto-fixes (migrate DB, generate secrets, CORS config, seed default policy). Backs up `.env` before any write. |\r\n\r\nThe CLI (`dashclaw doctor`) invokes these endpoints. Local mode (`npm run doctor`) runs the same engine with filesystem access for env writes. Check modules + constants are emitted from the livingcode shape into `app/lib/doctor/generated/checks-from-shape.mjs`.\r\n\r\n## MCP Server\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/mcp` | POST | Model Context Protocol Streamable HTTP transport. Same 26 tools / 6 resources exposed by the stdio binary (`@dashclaw/mcp-server`). |\r\n\r\n**26 tools across 9 groups.** Core governance (8): `dashclaw_guard`, `dashclaw_record`, `dashclaw_invoke`, `dashclaw_capabilities_list`, `dashclaw_policies_list`, `dashclaw_wait_for_approval`, `dashclaw_session_start`, `dashclaw_session_end`. Optimal files (2): `dashclaw_optimal_files_preview`, `dashclaw_optimal_files_manifest`. Session continuity (3): `dashclaw_handoff_create`, `dashclaw_handoff_latest`, `dashclaw_handoff_consume`. Credential hygiene (3): `dashclaw_secret_list`, `dashclaw_secret_due`, `dashclaw_secret_mark_rotated`. Skill safety (1): `dashclaw_skill_scan`. Open loops (3): `dashclaw_loop_add`, `dashclaw_loop_list`, `dashclaw_loop_close`. Learning + retrospection (3): `dashclaw_learning_log`, `dashclaw_learning_query`, `dashclaw_decisions_recent`. Agent inbox (2): `dashclaw_inbox_list`, `dashclaw_messages_mark_read`. Behavior learning (1): `dashclaw_behavior_suggestions`.\r\n\r\n**Resources:** `dashclaw://policies`, `dashclaw://capabilities`, `dashclaw://agent/{agent_id}/history`, `dashclaw://status`, `dashclaw://code-sessions/projects`, `dashclaw://code-sessions/sessions/{session_id}`.\r\n\r\nTool route mapping lives in `mcp-server/lib/routes-inventory.generated.json` — emitted from shape, not hand-edited.\r\n\r\n## Analytics\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/analytics` | GET | Aggregated cost + action analytics for the `/analytics` dashboard. Returns hero stats with trend comparison, cost trend series, action volume series, breakdowns by agent/action type/model, and token usage. |\r\n\r\n## Approvals\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/approvals/[actionId]` | POST | Approve or deny a pending action (body: `{ decision, reasoning }`). Shared by browser, CLI, `/approve` mobile PWA, and SDK polling. Publishes `action.updated` to the Redis SSE stream. |\r\n\r\n## Agent Fleet and Profile\r\n\r\n| Endpoint | Methods | Node SDK |\r\n|---|---|---|\r\n| `/api/agents` | GET | `getAgents` |\r\n| `/api/agents/[agentId]` | GET | `getAgent` |\r\n| `/api/agents/[agentId]/profile` | GET | Aggregated governance profile: vitals strip, trust posture, assumptions summary, policies, recent decisions, signals. Powers `/agents/[agentId]` page. |\r\n| `/api/agents/connections` | GET, POST | `getAgentConnections`, `reportConnections` |\r\n| `/api/agents/heartbeat` | POST | `heartbeat` — auto-updates `agent_presence` on action submission (`418fc872`) |\r\n\r\n## Guard Decisions Audit Log\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/guard/decisions` | GET | Queryable guard decision audit log (triggering policy, risk score, matched rules, outcome). Powers `/policies` ActivityTab. SQL consolidated into `guardrails.repository.js`. |\r\n\r\n## Capabilities\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/capabilities` | GET, POST | List / register capabilities |\r\n| `/api/capabilities/[capabilityId]` | GET, PATCH, DELETE | Read / edit / delete (DELETE added April 2026 — `36a307ac`) |\r\n| `/api/capabilities/[capabilityId]/access` | GET, POST | Access rules |\r\n| `/api/capabilities/[capabilityId]/access/[ruleId]` | DELETE | Remove access rule |\r\n| `/api/capabilities/[capabilityId]/access/check` | GET | Resolve access for a given caller |\r\n| `/api/capabilities/[capabilityId]/health` | GET | Per-capability health |\r\n| `/api/capabilities/[capabilityId]/history` | GET | Invocation history |\r\n| `/api/capabilities/[capabilityId]/invoke` | POST | Full guard → execute → record loop |\r\n| `/api/capabilities/[capabilityId]/test` | POST | Dry-run test invocation |\r\n| `/api/capabilities/health` | GET | Registry-wide health |\r\n\r\n## Workflows\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/workflows/draft` | POST | Draft a workflow from a natural-language goal |\r\n| `/api/workflows/templates` | GET, POST | List / create templates |\r\n| `/api/workflows/templates/[templateId]` | GET, PATCH, DELETE | CRUD |\r\n| `/api/workflows/templates/[templateId]/duplicate` | POST | Clone a template |\r\n| `/api/workflows/templates/[templateId]/execute` | POST | One-shot execution |\r\n| `/api/workflows/templates/[templateId]/launch` | POST | Long-running launch (returns runActionId) |\r\n| `/api/workflows/templates/[templateId]/runs` | GET | List runs |\r\n| `/api/workflows/templates/[templateId]/runs/[runActionId]` | GET | Run detail |\r\n| `/api/workflows/templates/[templateId]/runs/[runActionId]/cancel` | POST | Cancel |\r\n| `/api/workflows/templates/[templateId]/runs/[runActionId]/resume` | POST | Resume after pause/approval |\r\n\r\nTemplate variables serialize objects and preserve arrays (`c4164311`); `prompt_template` replaces the old `prompt` field in analyze steps (`58bc63e1`).\r\n\r\n## Action Recording\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/actions` | GET, POST, DELETE | `createAction`, `getActions` | `create_action`, `get_actions` |\r\n| `/api/actions/[actionId]` | GET, PATCH | `getAction`, `updateOutcome` | `get_action`, `update_outcome` |\r\n\r\n**PATCH outcome fields (v2.13.1+):** `status`, `output_summary`, `side_effects`, `artifacts_created`, `error_message`, `timestamp_end`, `duration_ms`, `cost_estimate`, `tokens_in`, `tokens_out`, `model`. When `tokens_in` / `tokens_out` are reported without an explicit `cost_estimate`, the server derives cost from the configured pricing table (see `app/lib/billing.js`) using `model` to pick the right pricing row. The `model` column was added to `action_records` on 2026-04-14 — run `node scripts/_run-with-env.mjs scripts/migrate-action-model-column.mjs` against existing instances before deploying the matching server build.\r\n\r\n**Token capture pipeline (Claude Code):** the `Stop` hook (`hooks/dashclaw_stop.py`) reads the session transcript at turn end, sums LLM token usage across that turn's assistant messages (cache_read tokens weighted at 0.1× to match Anthropic billing), and PATCHes the per-turn share onto every action_id the pretool opened during the turn. Same idea for the OpenClaw plugin (v1.2.1+) via the `llm_output` and `agent_end` hooks.\r\n\r\n| `/api/actions/[actionId]/artifacts` | GET | `getActionArtifacts` | `get_action_artifacts` |\r\n| `/api/actions/[actionId]/graph` | GET | `getActionGraph` | `get_action_graph` |\r\n| `/api/actions/[actionId]/messages` | GET | `getActionMessages` | `get_action_messages` |\r\n| `/api/actions/[actionId]/trace` | GET | `getActionTrace` | `get_action_trace` |\r\n| `/api/actions/[actionId]/outcome` | GET, POST | `getActionOutcome`, `reportActionOutcome` (+ `reportActionSuccess` / `reportActionFailure` / `reportActionPartial`) | `get_action_outcome`, `report_action_outcome` (+ `report_action_success` / `report_action_failure` / `report_action_partial`) |\r\n| `/api/actions/costs` | GET | `getActionCosts` | `get_action_costs` |\r\n| `/api/actions/loops` | GET, POST | see Loops and Assumptions | — |\r\n| `/api/actions/stats` | GET | `getActionStats` | `get_action_stats` |\r\n| `/api/cron/outcome-sweep` | GET (Bearer `CRON_SECRET`) | — | — |\r\n\r\n**Durable execution finality (v2.13.3+):** `POST /api/actions/[actionId]/outcome` records a terminal `outcome_status` — one of `completed`, `partial`, `failed` — that is independent from the legacy PATCH lifecycle status. Outcomes are one-shot: the first call wins, every subsequent POST returns `409 { error: \"outcome already set\", current_status }`. `GET /api/actions/[actionId]/outcome` returns the current outcome plus an `elapsed_ms` derived field, so agents can poll before retry to avoid double-execution. The Node + Python SDKs ship matching `deriveIdempotencyKey` / `derive_idempotency_key` helpers; passing `idempotency_key` on `POST /api/actions` short-circuits duplicate creates to `{ idempotent_replay: true }`. Pending outcomes age into `lost_confirmation` via `/api/cron/outcome-sweep` (daily on Vercel Hobby, hourly externally if you wire it up); the sweep emits a `signal.detected` event of type `lost_confirmation` and fires webhooks for orgs subscribed to that event. Per-org timeout via the `DASHCLAW_OUTCOME_TIMEOUT_MINUTES` setting (default 15, clamped `[1, 1440]`). Full spec: `docs/architecture/durable-execution-finality.md`.\r\n\r\n`getPendingApprovals` / `get_pending_approvals` — queries actions with `status=pending_approval`.\r\n\r\n**Action approvals moved** — use `POST /api/approvals/[actionId]` (see [Approvals](#approvals)), not the legacy `/api/actions/[actionId]/approve` path.\r\n\r\n**Validation notes (April 2026):**\r\n- `action_type` is **no longer restricted to an enum** — arbitrary strings from third-party agent frameworks are accepted (`11e0911a`).\r\n- `status=blocked` is a valid action status. The `dashclaw_pretool` hook records blocked actions with `status=blocked` when guard returns `decision=block` (`6f0a57bd`, BUG-02).\r\n- `GET /api/actions/[actionId]` responses include `message_summary` alongside the action record.\r\n\r\n## Loops and Assumptions\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/actions/loops` | GET, POST | v2: `registerOpenLoop`, v1: `reportLoop`, `getLoops` | `register_open_loop`, `report_loop`, `get_loops` |\r\n| `/api/actions/loops/{loopId}` | GET, PATCH | v2: `resolveOpenLoop`, v1: `closeLoop` | `resolve_open_loop`, `close_loop` |\r\n| `/api/actions/assumptions` | GET, POST | v2: `recordAssumption`, v1: `reportAssumption`, `getAssumptions` | `record_assumption`, `report_assumption`, `get_assumptions` |\r\n| `/api/actions/assumptions/{assumptionId}` | GET, PATCH | `getAssumption`, `updateAssumption` | `get_assumption`, `update_assumption` |\r\n\r\n## Signals\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/actions/signals` | GET | `getSignals` | `get_signals` |\r\n\r\n**Signal types:** `guard_block`, `guard_warn`, `approval_timeout`, `loop_stale`, `injection_detected`, `drift_alert`, `feedback_negative`, `session_stalled`, `branch_stale`, `mcp_degraded`, `green_insufficient`\r\n\r\n## Behavior Guard\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/guard` | GET, POST | `guard`, `getGuardDecisions` | `guard`, `get_guard_decisions` |\r\n\r\nPOST sends an action for policy evaluation. Returns `{ decision, reasons, warnings, matched_policies, risk_score }`.\r\nDecisions: `allow`, `block`, `warn`, `require_approval`.\r\n\r\n## Policies\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/policies` | GET, POST, PATCH, DELETE | `importPolicies` | `import_policies` |\r\n| `/api/policies/import` | POST | `importPolicies` | `import_policies` |\r\n| `/api/policies/test` | POST | `testPolicy` | `test_policy` |\r\n| `/api/policies/proof` | GET | `getProofReport` | `get_proof_report` |\r\n\r\n## Context Manager\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/context/points` | GET, POST | `saveContextPoint`, `getContextPoints` | `save_context_point`, `get_context_points` |\r\n| `/api/context/threads` | GET, POST | `createThread`, `getThreads` | `create_thread`, `get_threads` |\r\n| `/api/context/threads/{threadId}` | GET, PATCH | `getThread`, `closeThread` | `get_thread`, `close_thread` |\r\n| `/api/context/threads/{threadId}/entries` | POST | `addThreadEntry` | `add_thread_entry` |\r\n\r\nContext thread IDs use `ct_` prefix.\r\n\r\n## Agent Messaging\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/messages` | GET, POST, PATCH | `sendMessage`, `getMessages`, `markRead`, `archiveMessages`, `broadcast` | `send_message`, `get_messages`, `mark_read`, `archive_messages`, `broadcast` |\r\n| `/api/messages/threads` | GET, POST, PATCH | `createMessageThread`, `getMessageThreads`, `resolveMessageThread` | `create_message_thread`, `get_message_threads`, `resolve_message_thread` |\r\n| `/api/messages/docs` | GET, POST | `getSharedDocs`, `saveSharedDoc` | `get_shared_docs`, `save_shared_doc` |\r\n| `/api/messages/attachments` | GET | `getMessageAttachments` | `get_message_attachments` |\r\n| `/api/actions/{actionId}/messages` | GET | `getActionMessages` | `get_action_messages` |\r\n| `/api/actions/{actionId}/messages?summary=true` | GET | -- | -- |\r\n\r\n`GET /api/actions/{actionId}/messages?summary=true` returns `{ total, participants[], correlation, first_message_at, last_message_at }` instead of full messages. `GET /api/actions/{actionId}` now includes `message_summary` in the response.\r\n\r\nMessage thread IDs use `mt_` prefix.\r\n\r\n## Automation Snippets\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/snippets` | GET, POST, DELETE | `saveSnippet`, `getSnippets`, `deleteSnippet` | `save_snippet`, `get_snippets`, `delete_snippet` |\r\n| `/api/snippets/{snippetId}` | GET | `getSnippet` | `get_snippet` |\r\n| `/api/snippets/{snippetId}/use` | POST | `useSnippet` | `use_snippet` |\r\n\r\nSnippet IDs use `sn_` prefix.\r\n\r\n## Session Handoffs\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/handoffs` | GET, POST | `createHandoff`, `getHandoffs`, `getLatestHandoff` | `create_handoff`, `get_handoffs`, `get_latest_handoff` |\r\n\r\n## Memory\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/memory` | GET, POST | `reportMemoryHealth` | `report_memory_health` |\r\n\r\n## User Preferences\r\n\r\n**Maturity:** Experimental\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/preferences` | GET, POST | `logObservation`, `setPreference`, `logMood`, `trackApproach`, `getPreferenceSummary`, `getApproaches` | `log_observation`, `set_preference`, `log_mood`, `track_approach`, `get_preference_summary`, `get_approaches` |\r\n\r\nGET accepts `?type=summary|observations|preferences|moods|approaches`.\r\n\r\n## Daily Digest\r\n\r\n**Maturity:** Experimental\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/digest` | GET | `getDailyDigest` | `get_daily_digest` |\r\n\r\n## Security Scanning\r\n\r\n**Maturity:** Beta\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/security/scan` | POST | `scanContent` | `scan_content` |\r\n| `/api/security/status` | GET | `reportSecurityFinding` | `report_security_finding` |\r\n| `/api/security/prompt-injection` | GET, POST | `scanPromptInjection` | `scan_prompt_injection` |\r\n\r\nPOST scans text for prompt injection attacks. Returns `{ clean, risk_level, recommendation, findings_count, categories, findings }`. Recommendation: `allow`, `warn`, or `block`. Scan metadata stored with `pi_` prefixed IDs.\r\n\r\n## Webhooks\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/webhooks` | GET, POST, DELETE | `getWebhooks`, `createWebhook`, `deleteWebhook` | `get_webhooks`, `create_webhook`, `delete_webhook` |\r\n| `/api/webhooks/{webhookId}/test` | POST | `testWebhook` | `test_webhook` |\r\n| `/api/webhooks/{webhookId}/deliveries` | GET | `getWebhookDeliveries` | `get_webhook_deliveries` |\r\n\r\n## Agent Pairing\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/pairings` | GET, POST | `createPairing`, `listPairings` | `create_pairing`, `list_pairings` |\r\n| `/api/pairings/{pairingId}` | GET | `getPairing` | `get_pairing` |\r\n| `/api/pairings/{pairingId}/approve` | POST | `approvePairing`, `waitForPairing` | `approve_pairing`, `wait_for_pairing` |\r\n\r\n`POST /api/pairings` — Agent identity pairing enrollment. `GET /api/pairings` — List all pairings. `POST /api/pairings/:id/approve` — Approve a pending pairing.\r\n\r\n`PATCH /api/pairings/{pairingId}` now accepts `permission_level` in the body. Valid values: `readonly`, `workspace_write`, `danger`, `prompt`, `allow`.\r\n\r\nManagement UI: `/settings?tab=identity`\r\n\r\n## Identity Binding\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/identities` | GET, POST | `registerIdentity`, `getIdentities` | `register_identity`, `get_identities` |\r\n| `/api/identities/{agentId}` | DELETE | `revokeIdentity` | `revoke_identity` |\r\n\r\n`POST /api/identities` — Register a new agent identity. `GET /api/identities` — List all registered identities. `DELETE /api/identities/:id` — Revoke an agent identity.\r\n\r\n## Organization Management\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/orgs` | GET, POST | `getOrg`, `createOrg` | `get_org`, `create_org` |\r\n| `/api/orgs/{orgId}` | GET, PATCH | `getOrgById`, `updateOrg` | `get_org_by_id`, `update_org` |\r\n| `/api/orgs/{orgId}/keys` | GET | `getOrgKeys` | `get_org_keys` |\r\n\r\n## Activity Logs\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/activity` | GET | `getActivityLogs` | `get_activity_logs` |\r\n\r\n## Compliance Engine\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/compliance/map` | POST | `mapCompliance` | `map_compliance` |\r\n| `/api/compliance/gaps` | POST | `analyzeGaps` | `analyze_gaps` |\r\n| `/api/compliance/report` | GET | `getComplianceReport` | `get_compliance_report` |\r\n| `/api/compliance/frameworks` | GET | `listFrameworks` | `list_frameworks` |\r\n| `/api/compliance/evidence` | GET | `getComplianceEvidence` | `get_compliance_evidence` |\r\n\r\nSupports frameworks: SOC 2 (`soc2`), NIST AI RMF (`nist-ai-rmf`), EU AI Act (`eu-ai-act`), ISO 42001 (`iso-42001`).\r\n\r\n## Compliance Exports\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/compliance/exports` | GET, POST | `createComplianceExport`, `listComplianceExports` | `create_compliance_export`, `list_compliance_exports` |\r\n| `/api/compliance/exports/{exportId}` | GET, DELETE | `getComplianceExport`, `deleteComplianceExport` | `get_compliance_export`, `delete_compliance_export` |\r\n| `/api/compliance/exports/{exportId}/download` | GET | `downloadComplianceExport` | `download_compliance_export` |\r\n| `/api/compliance/exports/{exportId}/status` | GET | `getComplianceExportStatus` | `get_compliance_export_status` |\r\n| `/api/compliance/schedules` | GET, POST | `createComplianceSchedule`, `listComplianceSchedules` | `create_compliance_schedule`, `list_compliance_schedules` |\r\n| `/api/compliance/schedules/{scheduleId}` | PATCH, DELETE | `toggleComplianceSchedule`, `deleteComplianceSchedule` | `toggle_compliance_schedule`, `delete_compliance_schedule` |\r\n| `/api/compliance/trends` | GET | `getComplianceTrends` | `get_compliance_trends` |\r\n\r\nExport IDs use `ce_` prefix. Schedule IDs use `cs_` prefix.\r\n\r\n## Evaluation Framework\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/evaluations/scorers` | GET, POST | `createScorer`, `listScorers` | `create_scorer`, `list_scorers` |\r\n| `/api/evaluations/scorers/{scorerId}` | GET, PATCH, DELETE | `getScorer`, `updateScorer`, `deleteScorer` | `get_scorer`, `update_scorer`, `delete_scorer` |\r\n| `/api/evaluations/scores` | GET, POST | `scoreOutput`, `listScores` | `score_output`, `list_scores` |\r\n| `/api/evaluations/runs` | GET, POST | `createEvalRun`, `listEvalRuns` | `create_eval_run`, `list_eval_runs` |\r\n| `/api/evaluations/types` | GET | `getScorerTypes` | `get_scorer_types` |\r\n\r\nScorer IDs use `es_` prefix. Score IDs use `sc_` prefix. Run IDs use `er_` prefix.\r\n\r\n**5 scorer types**: `regex`, `contains`, `numeric_range`, `custom_function`, `llm_judge` (optional, requires LLM provider).\r\n\r\n## Prompt Management\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/prompts/templates` | GET, POST | `createTemplate`, `listTemplates` | `create_template`, `list_templates` |\r\n| `/api/prompts/templates/{templateId}` | GET, PATCH, DELETE | `getTemplate`, `updateTemplate`, `deleteTemplate` | `get_template`, `update_template`, `delete_template` |\r\n| `/api/prompts/templates/{templateId}/duplicate` | POST | `duplicateTemplate` | `duplicate_template` |\r\n| `/api/prompts/versions` | GET | `listVersions` | `list_versions` |\r\n| `/api/prompts/versions/{templateId}` | POST | `createVersion` | `create_version` |\r\n| `/api/prompts/versions/{templateId}/activate/{versionId}` | POST | `activateVersion` | `activate_version` |\r\n| `/api/prompts/versions/{templateId}/rollback/{versionId}` | POST | `rollbackVersion` | `rollback_version` |\r\n| `/api/prompts/render` | POST | `renderTemplate` | `render_template` |\r\n| `/api/prompts/runs` | GET | `listPromptRuns` | `list_prompt_runs` |\r\n| `/api/prompts/stats` | GET | `getPromptStats` | `get_prompt_stats` |\r\n| `/api/prompts/variables` | GET | `listPromptVariables` | `list_prompt_variables` |\r\n\r\nTemplate IDs use `pt_` prefix. Version IDs use `pv_` prefix.\r\n\r\n## Drift Detection\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/drift/alerts` | GET, POST | `listDriftAlerts`, `detectDrift`, `computeDriftBaselines`, `recordDriftSnapshots` | `list_drift_alerts`, `detect_drift`, `compute_drift_baselines`, `record_drift_snapshots` |\r\n| `/api/drift/alerts/{alertId}` | PATCH, DELETE | `acknowledgeDriftAlert`, `deleteDriftAlert` | `acknowledge_drift_alert`, `delete_drift_alert` |\r\n| `/api/drift/stats` | GET | `getDriftStats` | `get_drift_stats` |\r\n| `/api/drift/snapshots` | GET | `getDriftSnapshots` | `get_drift_snapshots` |\r\n| `/api/drift/metrics` | GET | `getDriftMetrics` | `get_drift_metrics` |\r\n\r\nAlert IDs use `da_` prefix. Baseline IDs use `db_` prefix. Snapshot IDs use `ds_` prefix.\r\n\r\n**6 tracked metrics**: risk_score, confidence, duration_ms, cost_estimate, tokens_total, learning_score.\r\n**Severity thresholds**: z >= 1.5 (info), z >= 2.0 (warning), z >= 3.0 (critical).\r\n\r\nPOST `/api/drift/alerts` accepts `action` field: `detect` (default), `compute_baselines`, `record_snapshots`.\r\n\r\n## Learning Analytics\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/learning/analytics/velocity` | GET, POST | `computeLearningVelocity`, `getLearningVelocity` | `compute_learning_velocity`, `get_learning_velocity` |\r\n| `/api/learning/analytics/curves` | GET, POST | `computeLearningCurves`, `getLearningCurves` | `compute_learning_curves`, `get_learning_curves` |\r\n| `/api/learning/analytics/summary` | GET | `getLearningAnalyticsSummary` | `get_learning_analytics_summary` |\r\n| `/api/learning/analytics/maturity` | GET | `getMaturityLevels` | `get_maturity_levels` |\r\n\r\nVelocity computed via linear regression slope. Acceleration is the change in velocity. Maturity classification uses 6 levels (novice through master) based on episode count, success rate, and average score.\r\n\r\n## Scoring Profiles\r\n\r\n**Maturity:** New (Phase 7)\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/scoring/profiles` | GET, POST | `createScoringProfile`, `listScoringProfiles` | `create_scoring_profile`, `list_scoring_profiles` |\r\n| `/api/scoring/profiles/{profileId}` | GET, PATCH, DELETE | `getScoringProfile`, `updateScoringProfile`, `deleteScoringProfile` | `get_scoring_profile`, `update_scoring_profile`, `delete_scoring_profile` |\r\n| `/api/scoring/profiles/{profileId}/dimensions` | POST | `addScoringDimension` | `add_scoring_dimension` |\r\n| `/api/scoring/profiles/{profileId}/dimensions/{dimensionId}` | PATCH, DELETE | `updateScoringDimension`, `deleteScoringDimension` | `update_scoring_dimension`, `delete_scoring_dimension` |\r\n| `/api/scoring/score` | GET, POST | `scoreWithProfile`, `batchScoreWithProfile`, `getProfileScores`, `getProfileScoreStats` | `score_with_profile`, `batch_score_with_profile`, `get_profile_scores`, `get_profile_score_stats` |\r\n| `/api/scoring/calibrate` | POST | `autoCalibrate` | `auto_calibrate` |\r\n\r\nPOST `/api/scoring/profiles` supports inline dimension creation (pass `dimensions` array in body).\r\nPOST `/api/scoring/score` accepts either `action` (single) or `actions` (batch array).\r\nGET `/api/scoring/score?view=stats` returns aggregate statistics.\r\n\r\n**Composite methods**: `weighted_average`, `minimum`, `geometric_mean`.\r\n**Data sources**: `duration_ms`, `cost_estimate`, `tokens_total`, `risk_score`, `confidence`, `eval_score`, `metadata_field`, `custom_function`.\r\n**ID prefixes**: `sp_` (profiles), `sd_` (dimensions), `ps_` (scores).\r\n\r\n## Risk Templates\r\n\r\n**Maturity:** New (Phase 7)\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/scoring/risk-templates` | GET, POST | `createRiskTemplate`, `listRiskTemplates` | `create_risk_template`, `list_risk_templates` |\r\n| `/api/scoring/risk-templates/{templateId}` | PATCH, DELETE | `updateRiskTemplate`, `deleteRiskTemplate` | `update_risk_template`, `delete_risk_template` |\r\n\r\nRisk templates define rule-based risk scoring: `base_risk` + conditional `rules` (array of `{ condition, add }`).\r\nCondition operators: `==`, `!=`, `>`, `>=`, `<`, `<=`, `contains`. Supports nested paths.\r\n**ID prefix**: `rt_`.\r\n\r\n## Session Lifecycle\r\n\r\n**Maturity:** New (Phase 8)\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/sessions` | GET, POST | `createSession`, `listSessions` | `create_session`, `list_sessions` |\r\n| `/api/sessions/{sessionId}` | GET, PATCH | `getSession`, `updateSession` | `get_session`, `update_session` |\r\n| `/api/sessions/{sessionId}/events` | GET | `getSessionEvents` | `get_session_events` |\r\n\r\n`POST /api/sessions` — Create a session. Body: `{ agent_id, workspace, branch }`.\r\n`GET /api/sessions` — List sessions. Query: `agent_id`, `status`, `limit`.\r\n`GET /api/sessions/{sessionId}` — Get a single session.\r\n`PATCH /api/sessions/{sessionId}` — Update session. Body: `{ status, green_level, branch_freshness, commits_behind, blocked_reason }`.\r\n`GET /api/sessions/{sessionId}/events` — Get session lifecycle events.\r\n\r\nSession IDs use `sess_` prefix.\r\n\r\n## Guard Policy Types\r\n\r\nGuard policies use a `policy_type` field. All types are evaluated server-side without an LLM.\r\n\r\n| Policy Type | Purpose |\r\n|---|---|\r\n| `risk_threshold` | Block or require approval when risk exceeds a limit |\r\n| `cost_limit` | Cap per-action and daily spend |\r\n| `action_allowlist` | Only allow specific action types |\r\n| `content_filter` | Guard against sensitive data in outputs |\r\n| `permission_escalation` | Block when an agent requests a higher permission level than allowed |\r\n| `green_contract` | Require green (passing) test status before certain actions proceed |\r\n| `branch_freshness` | Block actions when the working branch is stale (N+ commits behind) |\r\n\r\nThe three new types (`permission_escalation`, `green_contract`, `branch_freshness`) integrate with session lifecycle data. The guard evaluator reads `green_level`, `branch_freshness`, and `commits_behind` from the active session when evaluating these policies.\r\n\r\n## Dashboard Data and Other Routes\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/health` | GET | -- | -- |\r\n| `/api/stream` | GET (SSE) | `events()` | -- |\r\n| `/api/tokens` | POST | `reportTokenUsage` | `report_token_usage` |\r\n| `/api/dashboard/data` | GET | -- | -- |\r\n| `/api/decisions` | GET, POST | `recordDecision` | `record_decision` |\r\n| `/api/goals` | GET, POST | `createGoal` | `create_goal` |\r\n| `/api/content` | GET, POST | `recordContent` | `record_content` |\r\n| `/api/interactions` | GET, POST | `recordInteraction` | `record_interaction` |\r\n| `/api/integrations` | GET, POST | `reportConnections` | `report_connections` |\r\n| `/api/calendar` | GET, POST | `createCalendarEvent` | `create_calendar_event` |\r\n| `/api/ideas` | GET, POST | `recordIdea` | `record_idea` |\r\n| `/api/onboarding/api-key` | POST | -- | -- |\r\n| `/api/setup/status` | GET | -- | -- |\r\n| `/api/settings/llm-status` | GET | `getLLMStatus` | `get_llm_status` |\r\n| `/api/cron/*` | POST | -- | -- |\r\n| `/api/schedules` | GET, POST | `listAgentSchedules`, `createAgentSchedule` | `list_agent_schedules`, `create_agent_schedule` |\n\nFile v1.1.2:references/platform-knowledge.md\n\n# DashClaw Platform Knowledge\r\n\r\n## Table of Contents\r\n\r\n- [What DashClaw Is](#what-dashclaw-is)\r\n- [Deployment Modes](#deployment-modes)\r\n- [Tech Stack](#tech-stack)\r\n- [Auth Chain](#auth-chain)\r\n- [ID Prefixes](#id-prefixes)\r\n- [Architectural Guardrails](#architectural-guardrails)\r\n- [Product Surfaces](#product-surfaces)\r\n- [Dashboard Navigation](#dashboard-navigation)\r\n- [CLI and Hooks Layer](#cli-and-hooks-layer)\r\n- [Extension Layer](#extension-layer)\r\n- [Signal Types](#signal-types)\r\n- [Livingcode Shape System](#livingcode-shape-system)\r\n- [Key Reference Files](#key-reference-files)\r\n\r\n## What DashClaw Is\r\n\r\nAI agent decision infrastructure. A control plane for policy enforcement, decision recording,\r\nassumption tracking, compliance mapping, security signals, messaging, evaluation scoring,\r\nprompt management, behavioral drift detection, learning analytics, scoring profiles, and operator\r\nworkflows. The governance layer for AI agent fleets.\r\n\r\n**Zero-dependency philosophy**: All features work without any LLM API key by default. The only\r\noptional LLM feature is the `llm_judge` scorer type in the Evaluation Framework.\r\n\r\n## Deployment Modes\r\n\r\n- **Marketing site** (`DASHCLAW_MODE=demo` + `NEXT_PUBLIC_DASHCLAW_MODE=demo`): dashclaw.io, fake data, no login. All writes return 403.\r\n- **Self-hosted** (`DASHCLAW_MODE=self_host`, the default): real database, GitHub/Google OAuth, API key auth.\r\n\r\nBoth modes serve the same landing page. `/demo` sets a cookie and redirects to `/dashboard` with fixture data. `/dashboard` in self-host requires login.\r\n\r\n## Tech Stack\r\n\r\n- Next.js 16 (App Router), JavaScript, Tailwind CSS 3\r\n- Postgres (TCP via `postgres`, serverless via `@neondatabase/serverless`)\r\n- Auth: NextAuth v4 for UI (GitHub, Google, or OIDC), `x-api-key` header for agents/tools\r\n- **Version:** the platform and both SDKs share one version — currently **4.0.1** (Node + Python; see `CHANGELOG.md`).\r\n- SDKs:\r\n - **Node v2 — governance runtime** (`sdk/dashclaw.js`, 104 methods across Core Governance, Scoring, Execution Studio, Messaging, Sessions, and Capability Runtime). This is the SDK that ships as the `dashclaw` package.\r\n - **Node v1 — full platform legacy** (`sdk/legacy/dashclaw-v1.js`, 187 methods), re-exported as `dashclaw/legacy` for older integrations (see `docs/sdk-parity.md`).\r\n - **Python — full platform** (`sdk-python/dashclaw/client.py`, 203 methods).\r\n- Node SDK naming: camelCase. Python SDK naming: snake_case.\r\n\r\n## Auth Chain\r\n\r\nThis is the full middleware pipeline -- critical for troubleshooting:\r\n\r\n```\r\nClient request hits middleware.js\r\n |\r\n +--> Strip x-org-id, x-org-role, x-user-id from inbound headers (ALWAYS)\r\n |\r\n +--> Rate limit check (local in-memory or Upstash Redis)\r\n | Default: 100 req/min (prod), 1000 req/min (dev)\r\n | Override: DASHCLAW_RATE_LIMIT_MAX, DASHCLAW_RATE_LIMIT_WINDOW_MS\r\n | Dev bypass: DASHCLAW_DISABLE_RATE_LIMIT=true\r\n |\r\n +--> Body size check: 2MB max for POST/PUT/PATCH\r\n |\r\n +--> PUBLIC_ROUTES check:\r\n | /api/health, /api/setup/status, /api/auth, /api/cron, /api/docs/raw, /api/prompts\r\n | These skip auth entirely (but still rate-limited)\r\n |\r\n +--> Protected route auth:\r\n |\r\n +--> x-api-key header present?\r\n | |\r\n | +--> Fast path: timing-safe compare against DASHCLAW_API_KEY env var\r\n | | Success: inject x-org-id from DASHCLAW_API_KEY_ORG (default: org_default)\r\n | |\r\n | +--> Slow path: SHA-256 hash lookup in api_keys table\r\n | Success: inject x-org-id + x-org-role from resolved key\r\n | Failure: 401 Unauthorized\r\n |\r\n +--> No API key?\r\n |\r\n +--> Same-origin request (Sec-Fetch-Site: same-origin)?\r\n | Resolve NextAuth session token --> orgId + role\r\n | Supported: GitHub, Google, OIDC (Authentik, Keycloak, etc.)\r\n | org_default users blocked from all APIs except onboarding\r\n |\r\n +--> Cross-origin without key --> 401 Unauthorized\r\n```\r\n\r\n**First-user-admin rule:** The first user to sign in to a fresh self-hosted instance is auto-promoted to `role=admin` in their org. Subsequent signups land as `role=member` by default. The signIn callback (`app/lib/auth/callbacks.js`) gates this on a settled session — not on bootstrap promotion — so the rule survives OAuth redirect churn. See BUG-03 fix (`707c5636`).\r\n\r\n**Action type validation:** `POST /api/actions` now accepts **arbitrary `action_type` strings** from third-party agent frameworks. Validation was intentionally relaxed in `11e0911a` — don't assume an enum.\r\n\r\n**Plan quotas:** All plan quotas (API keys, actions/day, agents) were removed (`49d7b69c`, `db6ee6b0`). Open-source instances are unlimited by design.\r\n\r\n## ID Prefixes\r\n\r\n| Prefix | Entity |\r\n|---|---|\r\n| `sn_` | Snippets |\r\n| `mt_` | Message threads |\r\n| `ct_` | Context threads |\r\n| `oc_live_` / `oc_test_` | API keys |\r\n| `pi_` | Prompt injection scans |\r\n| `org_` | Organizations |\r\n| `gp_` | Guard policies |\r\n| `es_` | Evaluation scorers |\r\n| `sc_` | Evaluation scores |\r\n| `er_` | Evaluation runs |\r\n| `pt_` | Prompt templates |\r\n| `pv_` | Prompt versions |\r\n| `fb_` | Feedback entries |\r\n| `ce_` | Compliance exports |\r\n| `cs_` | Compliance schedules |\r\n| `da_` | Drift alerts |\r\n| `db_` | Drift baselines |\r\n| `ds_` | Drift snapshots |\r\n| `lv_` | Learning velocity records |\r\n| `lc_` | Learning curve records |\r\n| `sp_` | Scoring profiles |\r\n| `sd_` | Scoring dimensions |\r\n| `ps_` | Profile scores |\r\n| `rt_` | Risk templates |\r\n| `sess_` | Sessions |\r\n\r\n## Architectural Guardrails\r\n\r\n1. **Route SQL guardrail**: No direct SQL in `app/api/**/route.js`. Use repositories in `app/lib/repositories/*.repository.js`. CI enforces via `npm run route-sql:check`.\r\n\r\n2. **Real-time first**: DashClaw uses Server-Sent Events (SSE) via `/api/stream` to push updates instantly. Dashboard components use the `useRealtime` hook instead of polling.\r\n\r\n3. **Default-deny**: All `/api/*` routes require auth unless listed in `PUBLIC_ROUTES` in middleware.js. New endpoints are protected by default.\r\n\r\n4. **Org context injection**: Never accept `x-org-id`, `x-org-role`, `x-user-id` from clients. Middleware strips them and injects trusted values from API key resolution.\r\n\r\n5. **Two separate thread systems**:\r\n - Context threads (`ct_*` via `/api/context/threads`) -- track reasoning and context\r\n - Message threads (`mt_*` via `/api/messages/threads`) -- inter-agent communication\r\n - These are NOT interchangeable.\r\n\r\n6. **Zero-LLM default**: All features must work without any LLM API key. The only exception is the `llm_judge` scorer type, which gracefully degrades when no provider is configured.\r\n\r\n7. **DB patterns**: TEXT primary keys with crypto-random prefixed IDs. `getSql()` for connection, `getOrgId()` for org scoping. Tagged template SQL via Neon's `postgres` driver.\r\n\r\n## Product Surfaces\r\n\r\n| Path | Purpose |\r\n|---|---|\r\n| `/` | Public landing site |\r\n| `/demo` | Demo sandbox (fake data, read-only, no login) |\r\n| `/connect` | 8-minute \"first governed action\" onboarding (MCP + agent bootstrap paths) |\r\n| `/setup` | Readiness verification and instance health |\r\n| `/mission-control` | Strategic fleet overview (reactive timeline + live log) |\r\n| `/dashboard` | Draggable widget dashboard (real-time reactive cards) |\r\n| `/workspace` | Per-agent workspace (digest, context, handoffs, snippets, preferences, memory) |\r\n| `/approve` | Mobile PWA approval surface (optimized for on-call operator on phone) |\r\n| `/approvals` | Desktop approval queue |\r\n| `/decisions` | Visual causal chain ledger with inline message trails in expanded rows |\r\n| `/decisions/{actionId}` | Chronological decision timeline (guard decisions, messages, assumptions, actions, outcomes, open loops) |\r\n| `/agents` | Fleet roster (presence, health, recent actions) |\r\n| `/agents/{agentId}` | Agent governance profile — vitals strip, trust posture, policies, decisions, assumptions, signals |\r\n| `/policies` | Shields-first policy builder (ActivityTab + CustomTab, AI generator inline, agent-scope picker, risk explainer) |\r\n| `/policies/generate` | AI policy generator standalone page |\r\n| `/security` | Security dashboard (signals, guard decisions, findings) |\r\n| `/analytics` | Cost + action analytics (hero stats, cost trend, action volume, breakdowns, token usage) |\r\n| `/activity` | Raw activity log |\r\n| `/compliance` | Compliance mapping (framework controls, gap analysis, evidence, reports) |\r\n| `/compliance/exports` | Compliance export generation, scheduling, downloads |\r\n| `/evaluations` | Evaluation framework (scorers, scores, runs, quality tracking) |\r\n| `/prompts` | Prompt registry (templates, versions, rendering, usage stats) |\r\n| `/drift` | Drift detection (baselines, alerts, severity, trends) |\r\n| `/learning` | Learning loop (episodes, recommendations) |\r\n| `/learning/analytics` | Learning analytics (velocity, maturity, curves, summary) |\r\n| `/scoring` | Scoring profiles and dimensions |\r\n| `/sessions` | Session Lifecycle dashboard (active sessions, stall detection, recovery) |\r\n| `/capabilities` | Capability registry (edit/delete inline, invoke, test, health) |\r\n| `/integrations` | Integrations health |\r\n| `/webhooks` | Outbound webhook configuration and delivery history |\r\n| `/identities` | Agent identity binding with approval confirmation and permission levels |\r\n| `/api-keys` | API key management |\r\n\r\n## Dashboard Navigation\r\n\r\nThe left sidebar is organized into four groups (`app/components/Sidebar.js`). **Labs** starts collapsed by default to keep the sidebar calm; state persists via `sessionStorage`.\r\n\r\n| Group | Items |\r\n|---|---|\r\n| **Govern** | Mission Control, Decisions, Approvals, Policies, Fleet |\r\n| **Observe** | Security, Analytics, Activity, Compliance |\r\n| **Configure** | API Keys, Integrations, Webhooks, Identities, Settings |\r\n| **Labs** *(collapsible)* | Assumptions, Sessions, Drift, Learning, Quality, Prompts, Workflows, Model Strategies, Knowledge, Capabilities |\r\n\r\n## CLI and Hooks Layer\r\n\r\n**CLI (`@dashclaw/cli`)**: Terminal client installed via `npm install -g @dashclaw/cli` (see `cli/`). Commands:\r\n- `dashclaw approvals` — interactive inbox (arrow keys, `A`/`D`/`O`/`Q`)\r\n- `dashclaw approve [--reason ...]`\r\n- `dashclaw deny [--reason ...]`\r\n- `dashclaw doctor [--json] [--no-fix] [--category ...]` — diagnoses instance and auto-fixes safe issues by invoking `/api/doctor` and `/api/doctor/fix`\r\n- `dashclaw logout` — removes saved config\r\n\r\nConfig resolution order:\r\n1. Env vars (`DASHCLAW_BASE_URL`, `DASHCLAW_API_KEY`, optional `DASHCLAW_AGENT_ID`)\r\n2. `~/.dashclaw/config.json` (mode `600`, persisted after interactive prompt)\r\n3. Interactive first-run prompt\r\n\r\nApprovals use `POST /api/actions/:id/approve`; real-time sync via Redis SSE.\r\n\r\n**Claude Code Hooks (`hooks/`)**: Three Python scripts for `PreToolUse`, `PostToolUse`, and `Stop` lifecycle events. Require only stdlib, no pip installs. Governed tools: Bash, Edit, Write, MultiEdit, sub-agent spawns (Agent/Task), and MCP tool calls (`mcp__*`) — so connector sends like Gmail/Stripe/Calendar are governed too. Safe to install even without DashClaw configured (silent no-op when env vars are missing). `dashclaw_pretool` records blocked actions on `handle_block` so the audit trail captures policy denials (BUG-02 fix).\r\n\r\n**SDK terminal output**: The Node SDK's `waitForApproval()` method prints a structured approval block to stdout before blocking. The block includes the action ID, policy name, risk score, declared goal, and the replay URL.\r\n\r\n**Approval sync architecture**: Browser, CLI, mobile `/approve` PWA, and SDK polling all converge at `POST /api/actions/:id/approve`. The API commits to Neon Postgres, publishes `action.updated` to the Redis stream, and every connected SSE listener receives the decision within the SSE heartbeat window (~1 second).\r\n\r\n**DashClaw Doctor (`npm run doctor` + `/api/doctor`)**: Self-host diagnostic and auto-fix engine. Runs check modules for database schema, configuration, auth, deployment, SDK reachability, and governance staleness. Local mode (`npm run doctor`) handles filesystem-level fixes — e.g., writing env vars to `.env` (always backing up), generating secrets, CORS config, seeding a default policy, running DB migrations. API endpoints (`GET /api/doctor`, `POST /api/doctor/fix`) are used by the CLI and by CI pipelines. Check modules and constants are emitted from the livingcode shape (see `app/lib/doctor/generated/checks-from-shape.mjs`).\r\n\r\n## Extension Layer\r\n\r\nThese are optional packages published alongside the core runtime.\r\n\r\n**`@dashclaw/mcp-server`** (`mcp-server/`): Model Context Protocol server exposing governance as MCP tools and resources. Two transports:\r\n- **stdio binary** — `npx @dashclaw/mcp-server --url ... --key ...` (Claude Desktop, Claude Code, MCP Inspector)\r\n- **Streamable HTTP** — `POST /api/mcp` on the DashClaw instance itself\r\n\r\n**26 tools across 9 groups:**\r\n- *Core governance (8):* `dashclaw_guard`, `dashclaw_record`, `dashclaw_invoke`, `dashclaw_capabilities_list`, `dashclaw_policies_list`, `dashclaw_wait_for_approval`, `dashclaw_session_start`, `dashclaw_session_end`.\r\n- *Optimal files (2):* `dashclaw_optimal_files_preview`, `dashclaw_optimal_files_manifest`.\r\n- *Session continuity (3):* `dashclaw_handoff_create`, `dashclaw_handoff_latest`, `dashclaw_handoff_consume`.\r\n- *Credential hygiene (3):* `dashclaw_secret_list`, `dashclaw_secret_due`, `dashclaw_secret_mark_rotated`.\r\n- *Skill safety (1):* `dashclaw_skill_scan`.\r\n- *Open loops (3):* `dashclaw_loop_add`, `dashclaw_loop_list`, `dashclaw_loop_close`.\r\n- *Learning + retrospection (3):* `dashclaw_learning_log`, `dashclaw_learning_query`, `dashclaw_decisions_recent`.\r\n- *Agent inbox (2):* `dashclaw_inbox_list`, `dashclaw_messages_mark_read`.\r\n- *Behavior learning (1):* `dashclaw_behavior_suggestions` — observe-only Policy Coach suggestions from recorded behavior.\r\n\r\n**6 resources:** `dashclaw://policies`, `dashclaw://capabilities`, `dashclaw://agent/{agent_id}/history`, `dashclaw://status`, `dashclaw://code-sessions/projects`, `dashclaw://code-sessions/sessions/{session_id}`.\r\n\r\nRoute inventory for tools is emitted from the shape to `mcp-server/lib/routes-inventory.generated.json` — keep tools and routes in sync.\r\n\r\n**`@dashclaw/openclaw-plugin`** (`packages/openclaw-plugin/`, v1.2.1): Governance plugin for the OpenClaw agent framework. Intercepts lifecycle hooks (`before_tool_call` / `after_tool_call`), calls `guard` / `createAction` / `waitForApproval` / `updateOutcome` automatically, and installs the HOOK.md pack via the openclaw CLI. Tool classification vocabulary aligns with DashClaw's guard action types. Ships with regression tests for `handle_block` audit-trail behavior. As of v1.2.1, the plugin also hooks `llm_output` and `agent_end` to attribute LLM token usage (with cache_read tokens weighted at 0.1×) back to each tool call via PATCH on `tokens_in`/`tokens_out`/`model` — DashClaw derives `cost_estimate` server-side.\r\n\r\n**`@dashclaw/governance` skill** (`public/downloads/dashclaw-governance/`): Companion Anthropic Claude skill that teaches governed agents the protocol (guard-before-act, decision handling, recording rules, session lifecycle). Loads org-specific policies and capabilities from MCP resources at session start. Designed to pair with `@dashclaw/mcp-server` in Managed Agents. See `public/downloads/dashclaw-governance/SKILL.md`.\r\n\r\n**Managed Agents integration**: The `examples/managed-agent-*` scripts show how to register a governed Managed Agent via the Anthropic API with the governance skill attached. The `scripts/setup-agents.ts` pattern creates an environment via the Managed Agents API and writes `ANTHROPIC_ENVIRONMENT_ID` back to `.env`.\r\n\r\n## Signal Types\r\n\r\nDashClaw emits 11 signal types. All are evaluated server-side without an LLM.\r\n\r\n| Signal Type | Trigger |\r\n|---|---|\r\n| `guard_block` | Guard policy returned `block` decision |\r\n| `guard_warn` | Guard policy returned `warn` decision |\r\n| `approval_timeout` | Pending approval expired without response |\r\n| `loop_stale` | Open loop exceeded expected resolution time |\r\n| `injection_detected` | Prompt injection scan flagged content |\r\n| `drift_alert` | Behavioral drift z-score exceeded threshold |\r\n| `feedback_negative` | User submitted negative feedback |\r\n| `session_stalled` | Session had no activity beyond idle threshold |\r\n| `branch_stale` | Working branch fell N+ commits behind main |\r\n| `mcp_degraded` | MCP tool handshake failed or connection dropped |\r\n| `green_insufficient` | Test suite did not meet required green level for action |\r\n\r\nSession lifecycle, signal emission, and recovery workflows all operate without an LLM provider configured. They use rule-based evaluation and threshold checks only.\r\n\r\n## Livingcode Shape System\r\n\r\n`livingcode/` is a Python package that models the DashClaw repo as a **shape** — a structured JSON snapshot of routes, env vars, tables, schema, and other derived facts. It produces drift-free derivative artifacts so docs, skills, MCP inventories, and doctor checks never go stale relative to code.\r\n\r\n**Commands:**\r\n\r\n```bash\r\npython -m livingcode query summary # high-level counts\r\npython -m livingcode query routes # current API surface\r\npython -m livingcode query env # current env vars\r\npython -m livingcode query tables # current schema\r\npython -m livingcode query all --json # full machine-readable shape\r\npython -m livingcode diff # compare snapshot to current repo\r\npython -m livingcode emit shape-json --output ...\r\npython -m livingcode emit skill --output ...\r\npython -m livingcode emit doctor-checks --output ...\r\npython -m livingcode emit mcp-tools --output ...\r\n```\r\n\r\n**Fallback when livingcode/Python/the repo are unavailable** (e.g. OpenClaw or the Claude app): these commands only run where the livingcode package and a repo checkout are present. Otherwise, in order: (1) `GET {baseUrl}/api/doctor` for live route/shape health — requires the workspace API key (`x-api-key: `), returns 401/403 without it; (2) read the committed static shape `app/lib/doctor/generated/shape.json` plus `docs/api-inventory.json` if a checkout is reachable; (3) otherwise treat the snapshot in the generated SKILL.md as authoritative.\r\n\r\n**Refresh orchestrator:** `scripts/livingcode-refresh.mjs` (run via `npm run livingcode:refresh`) re-emits every derivative artifact and is invoked automatically by the pre-commit hook when staged changes touch `app/api/`, `app/lib/`, `schema/schema.js`, `middleware.js`, or `livingcode/`. Outputs:\r\n\r\n- `app/lib/doctor/generated/shape.json` (committed; read at runtime by JS)\r\n- `app/lib/doctor/generated/last-snapshot.json` (drift-check baseline)\r\n- `app/lib/doctor/generated/checks-from-shape.mjs` (generated doctor checks)\r\n- `mcp-server/lib/routes-inventory.generated.json`\r\n- `public/downloads/dashclaw-platform-intelligence/SKILL.md` (website download)\r\n- `public/downloads/dashclaw-platform-intelligence.zip(.manifest)?`\r\n- `~/.claude/skills/dashclaw-platform-intelligence/SKILL.md` (global skill)\r\n\r\n**Idempotence:** The shape-json emitter substitutes a content-hash signature for the wall-clock timestamp, so re-runs produce byte-identical output. The zip is only rebuilt when the manifest hash disagrees with the skill directory contents.\r\n\r\n**Do not hand-edit generated artifacts.** The pre-commit hook will overwrite them. Regenerate instead.\r\n\r\n**Drift guard:** The doctor includes a drift check that compares `last-snapshot.json` with the current shape. If they disagree, `npm run doctor` reports `drift_detected` and suggests `npm run livingcode:refresh`.\r\n\r\n## Key Reference Files\r\n\r\nWhen you need current data from the codebase, read these:\r\n\r\n| What | File |\r\n|---|---|\r\n| Full route inventory | `docs/api-inventory.json` / `docs/api-inventory.md` |\r\n| OpenAPI spec (stable) | `docs/openapi/critical-stable.openapi.json` |\r\n| SDK parity matrix | `docs/sdk-parity.md` |\r\n| SDK README (copy-as-markdown source) | `sdk/README.md` |\r\n| Node v2 SDK source | `sdk/dashclaw.js` |\r\n| Node v1 legacy SDK source | `sdk/legacy/dashclaw-v1.js` |\r\n| Python SDK source | `sdk-python/dashclaw/client.py` |\r\n| Middleware (auth chain) | `middleware.js` |\r\n| Sidebar navigation | `app/components/Sidebar.js` |\r\n| Demo fixtures | `app/lib/demo/demoFixtures.js` |\r\n| Repository modules | `app/lib/repositories/*.repository.js` |\r\n| Client setup guide | `docs/client-setup-guide.md` |\r\n| Agent bootstrap guide | `docs/agent-bootstrap.md` |\r\n| Design context (anti-refs, tiebreakers) | `.impeccable.md` |\r\n| Project architecture | `PROJECT_DETAILS.md` |\r\n| Changelog (platform releases) | `CHANGELOG.md` |\r\n| Cross-SDK test harness | `docs/sdk-critical-contract-harness.json` |\r\n| Eval engine | `app/lib/eval.js` |\r\n| Prompt engine | `app/lib/prompt.js` |\r\n| Feedback engine | `app/lib/feedback.js` |\r\n| Compliance exporter | `app/lib/compliance/exporter.js` |\r\n| Drift engine | `app/lib/drift.js` |\r\n| Learning analytics | `app/lib/learningAnalytics.js` |\r\n| Scoring profiles engine | `app/lib/scoringProfiles.js` |\r\n| LLM abstraction (optional) | `app/lib/llm.js` |\r\n| Doctor engine | `app/lib/doctor/` (+ generated `app/lib/doctor/generated/`) |\r\n| CLI entrypoint | `cli/bin/dashclaw.js` |\r\n| CLI doctor formatter | `cli/lib/doctor.js` |\r\n| MCP server (stdio + HTTP) | `mcp-server/` (README at `mcp-server/README.md`) |\r\n| OpenClaw plugin | `packages/openclaw-plugin/` |\r\n| Governance skill (companion) | `public/downloads/dashclaw-governance/SKILL.md` |\r\n| Livingcode package | `livingcode/` (README at `livingcode/README.md`) |\r\n| Refresh orchestrator | `scripts/livingcode-refresh.mjs` |\r\n| Shape snapshot history | `.organism/shape-snapshots/` |\n\nFile v1.1.2:references/troubleshooting.md\n\n# DashClaw Troubleshooting Guide\r\n\r\n## Table of Contents\r\n\r\n- [Triage: Run Doctor First](#triage-run-doctor-first)\r\n- [Error: 401 Unauthorized](#error-401-unauthorized)\r\n- [Error: 403 Forbidden](#error-403-forbidden)\r\n- [Error: 429 Rate Limited](#error-429-rate-limited)\r\n- [Error: 503 Server Misconfigured](#error-503-server-misconfigured)\r\n- [Error: redirect_uri Not Associated](#error-redirect_uri-not-associated)\r\n- [First User Not Admin](#first-user-not-admin)\r\n- [Actions Not Appearing in Dashboard](#actions-not-appearing-in-dashboard)\r\n- [Hooks Don't Fire (Fresh / Docker / Out-of-Box)](#hooks-dont-fire-fresh--docker--out-of-box)\r\n- [Blocked Actions Not Audited](#blocked-actions-not-audited)\r\n- [Agent Pairing Fails](#agent-pairing-fails)\r\n- [Guard Blocks Unexpectedly](#guard-blocks-unexpectedly)\r\n- [Session Stalled](#session-stalled)\r\n- [Branch Freshness Block](#branch-freshness-block)\r\n- [MCP Degraded](#mcp-degraded)\r\n- [Drift Guard Failed](#drift-guard-failed)\r\n- [Permission Escalation Block](#permission-escalation-block)\r\n- [Stale Running Actions / \"Other\" Bucket Dominates](#stale-running-actions--other-bucket-dominates)\r\n- [Analytics Total Cost / Tokens Show Zero](#analytics-total-cost--tokens-show-zero)\r\n- [Common Gotchas](#common-gotchas)\r\n- [General Diagnostic Approach](#general-diagnostic-approach)\r\n- [Companion Diagnostic Scripts](#companion-diagnostic-scripts)\r\n\r\n## Stale Running Actions / \"Other\" Bucket Dominates\r\n\r\n**Symptom:** Action Volume chart's \"Other\" bucket greatly exceeds Completed/Failed/Blocked. Most rows in `action_records` have `status='running'` and no `timestamp_end`.\r\n\r\n**Cause:** PreToolUse opened the action but PostToolUse never closed it (interrupted tool, agent crash, posttool HTTP failure, or — historically — the pre-2026-04-09 `updated_at` column bug).\r\n\r\n**Fix:**\r\n1. **One-shot bulk repair** — close any running action older than the threshold. Reversible (status update only, no deletion).\r\n ```bash\r\n # Preview\r\n node scripts/_run-with-env.mjs scripts/repair-stale-running-actions.mjs --dry-run --older-than-hours 1\r\n # Apply (status='completed' with auto-close summary; preserves rows with error_message → 'failed')\r\n node scripts/_run-with-env.mjs scripts/repair-stale-running-actions.mjs --older-than-hours 1\r\n ```\r\n2. **Stop re-accumulation** — install the Stop hook (`hooks/dashclaw_stop.py`). It auto-closes any action still in `status='running'` at turn end while preserving terminal statuses written by PostToolUse. Use `node scripts/install-hooks.mjs --target=.` to install all three hooks correctly.\r\n\r\n## Analytics Total Cost / Tokens Show Zero\r\n\r\n**Symptom:** `/analytics` shows `$0.00 Total Cost`, `0 Input Tokens`, `0 Output Tokens` even though Actions and Active Agents are populated.\r\n\r\n**Cause:** Agents aren't reporting `tokens_in` / `tokens_out` / `model` to `/api/actions` (POST or PATCH). Pre-2026-04-14 the PATCH route silently dropped these fields anyway.\r\n\r\n**Fix:**\r\n1. Confirm the deployed server build accepts token fields: `curl -sf $DASHCLAW_BASE_URL/api/health | jq '.version'` should be ≥ 2.13.1.\r\n2. Confirm the `model` column exists: `SELECT column_name FROM information_schema.columns WHERE table_name='action_records' AND column_name='model';` returns one row. If not, run `node scripts/_run-with-env.mjs scripts/migrate-action-model-column.mjs`.\r\n3. Wire token reporting:\r\n - **Claude Code** — install the Stop hook (`node scripts/install-hooks.mjs --target=.`).\r\n - **OpenClaw** — upgrade to `@dashclaw/openclaw-plugin@1.2.1+`.\r\n - **Custom SDK agents** — pass `tokens_in`, `tokens_out`, `model` in your `updateOutcome` calls; cost is derived server-side.\r\n4. See `docs/ANALYTICS-ROLLOUT.md` for the full data flow and verification queries.\r\n\r\n## Triage: Run Doctor First\r\n\r\nFor almost any self-host issue, run Doctor before anything else. It diagnoses database schema, configuration, auth, deployment, SDK reachability, governance staleness, and livingcode shape drift — and auto-fixes safe issues.\r\n\r\n```bash\r\n# As an operator on the host:\r\nnpm run doctor # local mode — can write .env, run migrations\r\n\r\n# From anywhere with an API key:\r\ndashclaw doctor # rich terminal output, invokes /api/doctor[/fix]\r\ndashclaw doctor --no-fix # diagnose only\r\ndashclaw doctor --json # for CI / scripts\r\ndashclaw doctor --category database,config\r\n```\r\n\r\n**Exit codes:** `0` healthy, `1` warnings/failures/unreachable.\r\n\r\nIf Doctor reports `drift_detected`, see [Drift Guard Failed](#drift-guard-failed). If it fails with no config, it will prompt you interactively and offer to save to `~/.dashclaw/config.json` (`600` mode). Use `dashclaw logout` to remove saved credentials.\r\n\r\n## Error: 401 Unauthorized\r\n\r\n**\"Unauthorized - Invalid or missing API key\"**\r\n\r\n1. Check `x-api-key` header is being sent (not query params -- those leak in logs)\r\n2. Check `DASHCLAW_API_KEY` is set in the server's `.env`\r\n3. If using multi-org keys, verify the key hash exists in `api_keys` table and is not revoked\r\n4. If using session auth (dashboard), check `Sec-Fetch-Site` is `same-origin`\r\n5. Cross-origin requests without an API key always get 401\r\n\r\n## Error: 403 Forbidden\r\n\r\nMultiple causes -- check the error message:\r\n\r\n**\"Demo mode: write APIs are disabled\"**\r\n- You are hitting the demo instance (`DASHCLAW_MODE=demo`)\r\n- Writes are blocked in demo mode by design\r\n- Fix: Use your self-hosted instance URL instead\r\n\r\n**\"Forbidden - readonly API key\"**\r\n- The API key has `role=readonly` in the `api_keys` table\r\n- Fix: Use an admin-role API key for write operations\r\n\r\n**\"Forbidden - Complete onboarding to access this resource\"**\r\n- User is on `org_default`, which is blocked from all APIs except onboarding\r\n- Fix: Complete workspace setup at `/setup` on the dashboard\r\n- Response includes `{ needsOnboarding: true }` for programmatic detection\r\n\r\n**\"Guard blocked action\"**\r\n- Behavior guard policy matched and returned `decision: block`\r\n- Check `decision.reasons` and `decision.matched_policies` in the response\r\n- Fix: Adjust the policy, lower the risk score, or change the action type\r\n\r\n## Error: 429 Rate Limited\r\n\r\n**\"Rate limit exceeded. Please slow down.\"**\r\n\r\nDefaults:\r\n- Production: 100 requests per minute\r\n- Development: 1000 requests per minute\r\n\r\nFixes:\r\n- Wait 60 seconds (Retry-After header is set)\r\n- Increase: `DASHCLAW_RATE_LIMIT_MAX=500` in server `.env`\r\n- Adjust window: `DASHCLAW_RATE_LIMIT_WINDOW_MS=120000` (2 minutes)\r\n- Dev bypass: `DASHCLAW_DISABLE_RATE_LIMIT=true`\r\n\r\nFor agents that batch operations, implement client-side rate limiting or increase the server limit.\r\n\r\n## Error: 503 Server Misconfigured\r\n\r\n**\"Server misconfigured: set DASHCLAW_API_KEY to protect /api/* endpoints\"**\r\n- Production mode but no `DASHCLAW_API_KEY` env var set\r\n- Fix: Set `DASHCLAW_API_KEY` in server `.env`\r\n\r\n**\"DASHCLAW_API_KEY_ORG references org that does not exist\"**\r\n- The configured org ID doesn't exist in the `organizations` table\r\n- Fix: Run migrations:\r\n ```bash\r\n node scripts/_run-with-env.mjs scripts/migrate-multi-tenant.mjs\r\n ```\r\n- Or create the org: `POST /api/orgs` with admin key\r\n\r\n## Error: redirect_uri Not Associated\r\n\r\nOAuth callback URL missing from your provider app settings.\r\n\r\nAdd these callback URLs:\r\n- **GitHub:** `http://localhost:3000/api/auth/callback/github`\r\n- **Google:** `http://localhost:3000/api/auth/callback/google`\r\n\r\nFor production, replace `http://localhost:3000` with your deployed URL.\r\n\r\n## First User Not Admin\r\n\r\n**Symptom:** You signed in to a fresh self-hosted instance and landed with `role=member` instead of `role=admin`. You can't access admin-only surfaces.\r\n\r\n**Expected behavior:** The **first user** to sign in to a fresh instance is auto-promoted to `role=admin` in their org (BUG-03 fix, `707c5636`). Subsequent signups default to `role=member`.\r\n\r\n**Diagnosis:**\r\n\r\n1. Confirm you were the first sign-in (another user signing in before OAuth redirect churn completes is a common cause — the signIn callback gates promotion on a settled session, not bootstrap).\r\n2. Check the `users` table for your row and inspect `role` and `organization_id`.\r\n3. If an admin already exists, first-user promotion is skipped by design. Ask the existing admin to promote you via `PATCH /api/team/[userId]`.\r\n\r\n**Fix:** If you were genuinely first and the promotion didn't happen (stale code pre-fix), upgrade past `707c5636` or manually `UPDATE users SET role='admin' WHERE id=...`.\r\n\r\n## Actions Not Appearing in Dashboard\r\n\r\n0. **Hooks never fired** (the most common cause for a Claude Code agent that recorded *nothing*): the governance hooks weren't installed (the plugin doesn't install them) or didn't load (project-settings folder-trust gate in a fresh/Docker session). See [Hooks Don't Fire](#hooks-dont-fire-fresh--docker--out-of-box).\r\n1. **Org mismatch**: The agent's API key must resolve to the same org as the dashboard user. Check which org the key maps to.\r\n2. **Route handler check**: Verify `const orgId = request.headers.get('x-org-id')` is being used to scope queries.\r\n3. **Demo mode confusion**: If `DASHCLAW_MODE=demo`, the dashboard shows fixture data, not real data.\r\n4. Run the diagnostic script:\r\n ```bash\r\n node .claude/skills/dashclaw-platform-intelligence/scripts/diagnose.mjs \\\r\n --base-url http://localhost:3000 --api-key $DASHCLAW_API_KEY\r\n ```\r\n\r\n## Hooks Don't Fire (Fresh / Docker / Out-of-Box)\r\n\r\n**Symptom:** You set up DashClaw, ran an agent, and NOTHING was recorded — no PreToolUse/PostToolUse governance, no actions in the ledger — even though the hook scripts work when invoked manually. Often a global Stop hook DID fire while the project Pre/PostToolUse hooks didn't.\r\n\r\n**Most common causes:**\r\n\r\n1. **Hooks were never installed, or you're on an old setup.** As of plugin bundle **2.14.1** the marketplace plugin **bundles** the Pre/Post/Stop hooks — they fire as soon as the plugin is enabled (no separate step, no folder-trust gate). Older plugin versions shipped MCP + skills only, so if you installed before that — or wired the MCP server manually — run the standalone installer: `node scripts/install-hooks.mjs` (per project) or `--global --governance` (user-level).\r\n\r\n2. **Bundled hooks need Python + creds.** Plugin-bundled hooks run `python \"${CLAUDE_PLUGIN_ROOT}/hooks/dashclaw_pretool.py\"` — they exit silently if Python isn't on PATH, or if `DASHCLAW_BASE_URL` (or `DASHCLAW_URL`) + `DASHCLAW_API_KEY` aren't in the environment Claude Code launched from.\r\n\r\n3. **Folder Trust gates the STANDALONE per-project installer (not the plugin).** If you used `install-hooks.mjs` to write a project `.claude/settings.json`, those hooks only load **after** you accept Claude Code's \"trust this folder?\" prompt — so in a fresh / Docker / headless session they silently never load, while a **user-level** `~/.claude/settings.json` hook still fires (the classic \"Stop ran but Pre/PostToolUse didn't\"). **Plugin-bundled hooks and `--global --governance` (user-level) are NOT gated by folder trust.**\r\n\r\n**Also note:** the `npx dashclaw-demo` Docker image is the web app in demo mode + a *scripted* SDK agent (`scripts/demo-agent.mjs`, agent_id `pipeline-agent`) — NOT a Claude Code harness, so it never exercises hooks regardless of settings.\r\n\r\n**Simplest fix — install/enable the DashClaw plugin** (`claude plugin install dashclaw@dashclaw`): the hooks are bundled and fire on enable with no trust gate. Then just set Python + `DASHCLAW_BASE_URL`/`DASHCLAW_API_KEY` in the env.\r\n\r\n**Fix without the plugin — install at the USER level (no trust gate; fires in every project incl. Docker):**\r\n\r\n```bash\r\n# The repo must be present in the environment (hooks are Python; needs python3 + node).\r\nexport DASHCLAW_BASE_URL=\"https://your-instance\" # the hooks read this (DASHCLAW_URL also works)\r\nexport DASHCLAW_API_KEY=\"oc_live_...\"\r\nnode scripts/install-hooks.mjs --global --governance # full Pre/Post/Stop → ~/.claude/settings.json, NO secret written\r\n# undo with: node scripts/install-hooks.mjs --global --governance --uninstall\r\n```\r\n\r\nThen start a **fresh** Claude Code session (so it reads `~/.claude/settings.json`) and run a tool. Verify at `/decisions`.\r\n\r\n**10-second proof the hook + creds resolve (records one action under your agent_id):**\r\n\r\n```bash\r\necho '{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"echo hi\"}}' | python3 hooks/dashclaw_pretool.py; echo \"exit=$?\"\r\n```\r\n\r\n**Silent-config traps:**\r\n- The hooks read `DASHCLAW_BASE_URL`; the MCP server reads `DASHCLAW_URL`. They now accept **either** name, but if your build predates that, setting only `DASHCLAW_URL` left the hooks silently dead.\r\n- If **exactly one** of base-url / api-key is set, PreToolUse prints `[DashClaw] ⚠ Governance hook is half-configured — is not set…` instead of exiting invisibly. If **both** are unset the hook stays silent by design (non-DashClaw users see nothing).\r\n- Alternative to user-level install: accept the folder-trust prompt for the project (`claude` → \"trust this folder\" → restart) so the project `.claude/settings.json` hooks from `node scripts/install-hooks.mjs` load.\r\n\r\n## Blocked Actions Not Audited\r\n\r\n**Symptom:** Guard blocked an action but no record appears in the Decisions ledger or `action_records`.\r\n\r\n**Cause:** Pre-BUG-02, `dashclaw_pretool`'s `handle_block` returned early without recording. The fix now records blocked actions with `status=blocked`.\r\n\r\n**Fix:**\r\n\r\n1. Verify you're running a hook version that includes the BUG-02 fix (`e9ce9aaa`, `6f0a57bd`).\r\n2. Confirm the server accepts `status=blocked` on `POST /api/actions` (it does post-`6f0a57bd`).\r\n3. Re-run the action to confirm a `blocked` row now lands in the audit trail.\r\n\r\n## Agent Pairing Fails\r\n\r\nThe agent pairing flow has several gotchas:\r\n\r\n1. **Canonical JSON ordering matters** for signature verification. Use `JSON.stringify` with sorted keys.\r\n2. **Middleware strips client-sent org headers.** The pairing request goes through without org context initially; an admin must approve.\r\n3. **Full flow:**\r\n - Generate RSA keypair\r\n - `POST /api/pairings` with public key PEM\r\n - Operator approves at the approval URL (returned in response)\r\n - Agent polls `GET /api/pairings/{id}` or uses `waitForPairing()`\r\n4. If the admin key is wrong, the approval POST will 401.\r\n\r\n## Guard Blocks Unexpectedly\r\n\r\n1. Check which policies matched: look at `decision.matched_policies` in the guard response\r\n2. Test the policy in isolation:\r\n ```javascript\r\n const result = await dc.testPolicy({\r\n policyId: 'pol_xxx',\r\n testInput: { actionType: 'your_type', riskScore: 50 }\r\n });\r\n ```\r\n3. Check guard policies on the server (v1 SDK constructor accepts `guardMode`, v2 uses server-side policy config)\r\n4. If using `DASHCLAW_GUARD_FALLBACK=block`, the guard fails closed when the LLM is unavailable\r\n\r\n## Session Stalled\r\n\r\n**Symptom:** Agent session shows `status: stalled` and no new actions are being recorded.\r\n\r\n**Cause:** The session exceeded the idle threshold without activity. DashClaw emits a `session_stalled` signal when no actions, messages, or heartbeats are received within the configured window.\r\n\r\n**Fix:**\r\n\r\n1. Check the session status and blocked reason:\r\n ```bash\r\n curl -H \"x-api-key: $DASHCLAW_API_KEY\" \\\r\n $DASHCLAW_BASE_URL/api/sessions/$SESSION_ID\r\n ```\r\n2. If the agent is alive but idle, update the session to clear the stall:\r\n ```javascript\r\n await dc.updateSession(sessionId, {\r\n status: 'active',\r\n blocked_reason: null,\r\n });\r\n ```\r\n3. If the agent crashed, mark the session as `ended` and create a new one:\r\n ```javascript\r\n await dc.updateSession(sessionId, { status: 'ended', blocked_reason: 'agent_crash' });\r\n const fresh = await dc.createSession({ agent_id, workspace, branch });\r\n ```\r\n\r\n## Branch Freshness Block\r\n\r\n**Symptom:** Guard returns `block` with `matched_policies` containing a `branch_freshness` policy. Error message says the branch is behind main.\r\n\r\n**Cause:** The working branch has fallen too far behind the base branch. A `branch_freshness` guard policy is configured with a `max_commits_behind` threshold, and the session's `commits_behind` value exceeds it.\r\n\r\n**Fix:**\r\n\r\n1. Rebase or merge the latest changes from the base branch:\r\n ```bash\r\n git fetch origin && git rebase origin/main\r\n ```\r\n2. Update the session to reflect the fresh state:\r\n ```javascript\r\n await dc.updateSession(sessionId, {\r\n branch_freshness: 'fresh',\r\n commits_behind: 0,\r\n });\r\n ```\r\n3. Retry the guarded action.\r\n\r\n## MCP Degraded\r\n\r\n**Symptom:** A `mcp_degraded` signal appears. MCP tools may timeout or return errors. Session may show `blocked_reason: mcp_handshake_failed`.\r\n\r\n**Cause:** The MCP tool connection dropped or the handshake failed. This can happen due to network issues, MCP server restarts, or misconfigured tool endpoints.\r\n\r\n**Fix:**\r\n\r\n1. Check MCP server health and network connectivity.\r\n2. Retry the MCP handshake:\r\n ```javascript\r\n // The hooks layer will automatically retry on the next tool call.\r\n // To force a reconnect, restart the agent or Claude Code session.\r\n ```\r\n3. If the MCP server is down, clear the blocked reason so other work can continue:\r\n ```javascript\r\n await dc.updateSession(sessionId, {\r\n status: 'active',\r\n blocked_reason: null,\r\n });\r\n ```\r\n4. Check the session events for the full error trail:\r\n ```bash\r\n curl -H \"x-api-key: $DASHCLAW_API_KEY\" \\\r\n $DASHCLAW_BASE_URL/api/sessions/$SESSION_ID/events\r\n ```\r\n\r\n## Drift Guard Failed\r\n\r\n**Symptom:** `npm run doctor` (or `dashclaw doctor`) reports `drift_detected`. Pre-commit hook aborts with a livingcode drift warning. Skill/OpenAPI/API inventory artifacts look out of date.\r\n\r\n**Cause:** The livingcode shape snapshot at `app/lib/doctor/generated/last-snapshot.json` disagrees with the current repo shape. Some source under `app/api/`, `app/lib/`, `schema/schema.js`, `middleware.js`, or `livingcode/` changed without regenerating derivative artifacts.\r\n\r\n**Fix:**\r\n\r\n```bash\r\nnpm run livingcode:refresh\r\n```\r\n\r\nThat re-emits `shape.json`, `last-snapshot.json`, doctor check modules, the MCP route inventory, `public/downloads/dashclaw-platform-intelligence/SKILL.md`, the zip + manifest, and the global `~/.claude/skills/dashclaw-platform-intelligence/SKILL.md` (if writable). Outputs are idempotent — re-runs produce byte-identical content when source is unchanged.\r\n\r\n**Never hand-edit generated artifacts.** Pre-commit will overwrite them and you'll lose your changes. Edit the source (code / `livingcode/emitters/*.py` / `references/*.md`) and regenerate.\r\n\r\n## Permission Escalation Block\r\n\r\n**Symptom:** Guard returns `block` with `matched_policies` containing a `permission_escalation` policy. The agent attempted an action requiring a higher permission level than its pairing allows.\r\n\r\n**Cause:** The agent's pairing has a `permission_level` (e.g., `readonly` or `workspace_write`) that is insufficient for the requested operation. A `permission_escalation` policy prevents the agent from self-elevating.\r\n\r\n**Fix:**\r\n\r\n1. Check the agent's current permission level:\r\n ```bash\r\n curl -H \"x-api-key: $DASHCLAW_API_KEY\" \\\r\n $DASHCLAW_BASE_URL/api/pairings/$PAIRING_ID\r\n ```\r\n2. If the agent legitimately needs higher permissions, an operator must update the pairing:\r\n ```javascript\r\n // PATCH /api/pairings/{pairingId} with the new permission level\r\n // Valid levels: readonly, workspace_write, danger, prompt, allow\r\n await fetch(`${baseUrl}/api/pairings/${pairingId}`, {\r\n method: 'PATCH',\r\n headers: { 'x-api-key': operatorKey, 'Content-Type': 'application/json' },\r\n body: JSON.stringify({ permission_level: 'workspace_write' }),\r\n });\r\n ```\r\n3. Retry the guarded action after the pairing is updated.\r\n\r\n## Common Gotchas\r\n\r\n1. **Client-sent org headers are stripped.** Middleware always removes `x-org-id`, `x-org-role`, `x-user-id` from inbound requests. Org context comes from API key resolution only.\r\n\r\n2. **Two thread systems exist.** Context threads (`ct_*` via `/api/context/threads`) track reasoning. Message threads (`mt_*` via `/api/messages/threads`) are for communication. Not interchangeable.\r\n\r\n3. **org_default trap.** New users land on `org_default` which is blocked from all APIs except onboarding. Must complete workspace setup first.\r\n\r\n4. **API key shown once.** The onboarding key is displayed exactly once. If lost, generate a new one via `POST /api/keys` or the dashboard.\r\n\r\n5. **Body size limit.** 2MB max for POST/PUT/PATCH. Large sync payloads should be chunked.\r\n\r\n6. **HTTPS in production.** SDK warns if `baseUrl` is not HTTPS. API keys sent over HTTP are visible to network observers.\r\n\r\n7. **Repository pattern enforced.** Never put SQL in route files. CI catches it via `npm run route-sql:check`.\r\n\r\n8. **Demo writes always 403.** Even if you have a valid API key, `DASHCLAW_MODE=demo` blocks all writes.\r\n\r\n9. **Agent signatures need canonical JSON.** Key ordering matters when signing payloads.\r\n\r\n10. **Rate limiting is per-IP.** Multiple agents on the same machine share a rate limit bucket.\r\n\r\n11. **Plugin ≠ hooks, and project hooks need folder-trust.** `claude plugin install dashclaw` ships MCP + skills only; governance hooks are a separate `node scripts/install-hooks.mjs` step. Project `.claude/settings.json` hooks won't load in a fresh/Docker session until you accept Claude Code's folder-trust prompt — use `--global --governance` to install at the user level and skip the gate. See [Hooks Don't Fire](#hooks-dont-fire-fresh--docker--out-of-box).\r\n\r\n## General Diagnostic Approach\r\n\r\n```\r\n1. Check the HTTP status code and full error message\r\n2. Map it to a section above\r\n3. Check middleware.js for the exact condition producing that error\r\n4. Check the route handler: app/api//route.js\r\n5. Check the repository: app/lib/repositories/.repository.js\r\n6. Check if migrations are needed (missing tables/columns)\r\n7. Run the diagnose script for automated checks\r\n```\r\n\r\n## Companion Diagnostic Scripts\r\n\r\n**Full validation:**\r\n```bash\r\nnode .claude/skills/dashclaw-platform-intelligence/scripts/validate-integration.mjs \\\r\n --base-url http://localhost:3000 --api-key $DASHCLAW_API_KEY --full\r\n```\r\n\r\n**Targeted diagnosis:**\r\n```bash\r\nnode .claude/skills/dashclaw-platform-intelligence/scripts/diagnose.mjs \\\r\n --base-url http://localhost:3000 --api-key $DASHCLAW_API_KEY \\\r\n --error \"403 Forbidden\" --endpoint \"/api/actions\"\r\n```\r\n\r\nBoth scripts support `--json` for machine-readable output.\n\nFile v1.1.2:skill-card.md\n\n## Description:\n\nDashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based - prefer live queries via `python -m livingcode query`, or `GET {baseUrl}/api/doctor` when Python/livingcode/the repo are unavailable.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[dashclaw](https://clawhub.ai/user/dashclaw)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers, operators, and agent integrators use this skill to understand DashClaw's platform shape, troubleshoot integrations, and run diagnostics or validation against a configured DashClaw instance.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: API keys may be sent to a user-supplied DashClaw server or exposed through command-line arguments and diagnostic output.\n\nMitigation: Verify the DashClaw host before running scripts, prefer environment variables over command-line key arguments, use short-lived or least-privileged keys, and avoid sharing diagnostic logs.\n\nRisk: Bootstrap and hook workflows can persist across projects or affect future agent sessions.\n\nMitigation: Prefer project-scoped installation, review any global hook install before use, and run diagnostics or bootstrap commands in dry-run or read-only mode first when available.\n\nRisk: Full integration validation can create test data on the configured DashClaw instance.\n\nMitigation: Run read-only validation by default and use full validation only against an intended environment with an appropriate test agent ID.\n\n## Reference(s):\n\n- [DashClaw Platform Intelligence](https://clawhub.ai/dashclaw/skills/dashclaw-platform-intelligence)\n- [DashClaw Publisher Profile](https://clawhub.ai/user/dashclaw)\n- [DashClaw API Surface](references/api-surface.md)\n- [DashClaw Platform Knowledge](references/platform-knowledge.md)\n- [DashClaw Troubleshooting Guide](references/troubleshooting.md)\n\n## Skill Output:\n\n**Output Type(s):** [guidance, markdown, shell commands, code, configuration]\n\n**Output Format:** [Markdown with inline shell commands and optional JSON diagnostic output]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [May query a live DashClaw API or run bundled Node.js scripts when the user provides a base URL, API key, and target agent workspace.]\n\n## Skill Version(s):\n\n1.1.2 (source: server-resolved release metadata)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nArchive v1.1.1: 9 files, 43502 bytes\n\nFiles: references/api-surface.md (31204b), references/platform-knowledge.md (21969b), references/troubleshooting.md (18021b), scripts/bootstrap-agent-quick.mjs (4623b), scripts/diagnose.mjs (9179b), scripts/validate-integration.mjs (9830b), skill-card.md (2923b), SKILL.md (25351b), _meta.json (149b)\n\nFile v1.1.1:SKILL.md\n\n---\r\nname: dashclaw-platform-intelligence\r\ndescription: DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via `python -m livingcode query`, or `GET {baseUrl}/api/doctor` when Python/livingcode/the repo are unavailable.\r\n---\r\n\r\n# DashClaw Platform Intelligence\r\n\r\n**Shape snapshot:** `sha1:4d9403adcde2aaab2e4b7b0b032a441d3acce3bb`\r\n**This file is auto-generated.** Do not edit by hand — regenerate with:\r\n\r\n```bash\r\npython -m livingcode emit skill --output \r\n```\r\n\r\n## Prefer Live Queries\r\n\r\nThe facts below are a snapshot. Before answering any question about DashClaw's current\r\nstructure, routes, env vars, or schema — run a live query:\r\n\r\n```bash\r\npython -m livingcode query summary # High-level shape\r\npython -m livingcode query routes # Current API surface\r\npython -m livingcode query env # Current env vars\r\npython -m livingcode query tables # Current schema\r\npython -m livingcode query all --json # Full machine-readable shape\r\n```\r\n\r\nIf the snapshot below disagrees with a live query, **trust the live query**.\r\n\r\n### Fallback: no Python, livingcode, or repo checkout\r\n\r\n`python -m livingcode` only works where the livingcode package and the repo\r\ncheckout are present (e.g. a developer machine). In OpenClaw / the Claude app\r\nneither exists. When you cannot run the queries above, fall back **in this order**:\r\n\r\n1. **`GET {baseUrl}/api/doctor`** — live route/shape health straight from the running\r\n instance. Requires the workspace API key (`x-api-key: `); returns 401/403\r\n without it. This is the authoritative live source when the CLI is unavailable.\r\n2. **Read the committed static shape** if a repo checkout is reachable:\r\n `app/lib/doctor/generated/shape.json` (full machine-readable shape) and\r\n `docs/api-inventory.json` (route inventory). These are regenerated on every\r\n `npm run livingcode:refresh`, so they track the same facts the queries return.\r\n3. **Otherwise, treat the snapshot in this SKILL.md as authoritative** — it is the\r\n best available source when neither the API nor the repo can be reached.\r\n\r\n## At a Glance\r\n\r\n- **224** active API routes across **56** categories\r\n- **4** required + **137** optional environment variables\r\n- **89** database tables\r\n\r\n## API Surface\r\n\r\n### `actions`\r\n\r\n- `DELETE, GET, POST` `/api/actions`\r\n- `GET, PATCH` `/api/actions/[actionId]`\r\n- `GET` `/api/actions/[actionId]/artifacts`\r\n- `GET` `/api/actions/[actionId]/graph`\r\n- `GET` `/api/actions/[actionId]/messages`\r\n- `GET, POST` `/api/actions/[actionId]/outcome`\r\n- `GET` `/api/actions/[actionId]/trace`\r\n- `GET` `/api/actions/costs`\r\n- `GET, POST` `/api/actions/loops`\r\n- `GET, PATCH` `/api/actions/loops/[loopId]`\r\n- `GET` `/api/actions/stats`\r\n\r\n### `activity`\r\n\r\n- `GET` `/api/activity`\r\n\r\n### `admin`\r\n\r\n- `POST` `/api/admin/trigger-outcome-sweep`\r\n\r\n### `agents`\r\n\r\n- `GET` `/api/agents`\r\n- `GET` `/api/agents/[agentId]`\r\n- `GET` `/api/agents/[agentId]/profile`\r\n- `GET, POST` `/api/agents/connections`\r\n- `POST` `/api/agents/heartbeat`\r\n\r\n### `analytics`\r\n\r\n- `GET` `/api/analytics`\r\n\r\n### `approvals`\r\n\r\n- `POST` `/api/approvals/[actionId]`\r\n\r\n### `artifacts`\r\n\r\n- `GET, POST` `/api/artifacts`\r\n- `DELETE, GET` `/api/artifacts/[artifactId]`\r\n- `POST` `/api/artifacts/evidence-bundle`\r\n\r\n### `assumptions`\r\n\r\n- `GET, POST` `/api/assumptions`\r\n- `GET, PATCH` `/api/assumptions/[assumptionId]`\r\n\r\n### `auth`\r\n\r\n- `-` `/api/auth/[...nextauth]`\r\n- `GET` `/api/auth/config`\r\n- `DELETE, POST` `/api/auth/local`\r\n\r\n### `behavior`\r\n\r\n- `GET` `/api/behavior/samples`\r\n- `POST` `/api/behavior/simulate`\r\n- `GET, POST` `/api/behavior/suggestions`\r\n\r\n### `billing`\r\n\r\n- `POST` `/api/billing/checkout`\r\n- `GET` `/api/billing/portal`\r\n\r\n### `capabilities`\r\n\r\n- `GET, POST` `/api/capabilities`\r\n- `DELETE, GET, PATCH` `/api/capabilities/[capabilityId]`\r\n- `GET, POST` `/api/capabilities/[capabilityId]/access`\r\n- `DELETE` `/api/capabilities/[capabilityId]/access/[ruleId]`\r\n- `GET` `/api/capabilities/[capabilityId]/access/check`\r\n- `GET` `/api/capabilities/[capabilityId]/health`\r\n- `GET` `/api/capabilities/[capabilityId]/history`\r\n- `POST` `/api/capabilities/[capabilityId]/invoke`\r\n- `POST` `/api/capabilities/[capabilityId]/test`\r\n- `GET` `/api/capabilities/health`\r\n\r\n### `code-sessions`\r\n\r\n- `GET` `/api/code-sessions/alerts`\r\n- `POST` `/api/code-sessions/alerts/read-all`\r\n- `POST` `/api/code-sessions/ingest-jsonl`\r\n- `POST` `/api/code-sessions/ingest-live`\r\n- `GET` `/api/code-sessions/manifests/[manifestId]`\r\n- `GET` `/api/code-sessions/memos`\r\n- `POST` `/api/code-sessions/memos/regenerate`\r\n- `GET` `/api/code-sessions/projects`\r\n- `GET` `/api/code-sessions/projects/[projectId]/sessions`\r\n- `GET` `/api/code-sessions/sessions/[sessionId]`\r\n- `GET` `/api/code-sessions/sessions/[sessionId]/autopsy`\r\n- `GET` `/api/code-sessions/sessions/[sessionId]/insights`\r\n- `POST` `/api/code-sessions/sessions/[sessionId]/optimal-files/manifest`\r\n- `POST` `/api/code-sessions/sessions/[sessionId]/optimal-files/merge-preview`\r\n- `POST` `/api/code-sessions/sessions/[sessionId]/optimal-files/preview`\r\n- `GET` `/api/code-sessions/subagent-roi`\r\n\r\n### `compliance`\r\n\r\n- `GET` `/api/compliance/evidence`\r\n- `GET, POST` `/api/compliance/exports`\r\n- `DELETE, GET` `/api/compliance/exports/[exportId]`\r\n- `GET` `/api/compliance/exports/[exportId]/download`\r\n- `GET` `/api/compliance/frameworks`\r\n- `GET` `/api/compliance/gaps`\r\n- `GET` `/api/compliance/map`\r\n- `GET` `/api/compliance/report`\r\n- `GET, POST` `/api/compliance/schedules`\r\n- `DELETE, PATCH` `/api/compliance/schedules/[scheduleId]`\r\n- `GET` `/api/compliance/trends`\r\n\r\n### `cron`\r\n\r\n- `GET` `/api/cron/code-session-cache-crater`\r\n- `GET` `/api/cron/code-session-weekly-memo`\r\n- `GET` `/api/cron/integration-health`\r\n- `GET` `/api/cron/jti-sweep`\r\n- `GET` `/api/cron/learning-episodes-backfill`\r\n- `GET` `/api/cron/learning-recommendations`\r\n- `GET` `/api/cron/memory-maintenance`\r\n- `GET` `/api/cron/outcome-sweep`\r\n- `GET` `/api/cron/policy-suggestions`\r\n- `GET` `/api/cron/reset-meters`\r\n- `POST` `/api/cron/routing-maintenance`\r\n- `GET` `/api/cron/signals`\r\n\r\n### `discord`\r\n\r\n- `POST` `/api/discord/interactions`\r\n\r\n### `docs`\r\n\r\n- `GET` `/api/docs/raw`\r\n\r\n### `doctor`\r\n\r\n- `GET` `/api/doctor`\r\n- `POST` `/api/doctor/fix`\r\n\r\n### `drift`\r\n\r\n- `GET, POST` `/api/drift/alerts`\r\n- `DELETE, PATCH` `/api/drift/alerts/[alertId]`\r\n- `GET` `/api/drift/metrics`\r\n- `GET` `/api/drift/snapshots`\r\n- `GET` `/api/drift/stats`\r\n\r\n### `evaluations`\r\n\r\n- `GET, POST` `/api/evaluations`\r\n- `GET, POST` `/api/evaluations/runs`\r\n- `GET, PATCH` `/api/evaluations/runs/[runId]`\r\n- `GET, POST` `/api/evaluations/scorers`\r\n- `DELETE, PATCH` `/api/evaluations/scorers/[scorerId]`\r\n- `POST` `/api/evaluations/scorers/preview`\r\n- `GET` `/api/evaluations/stats`\r\n\r\n### `guard`\r\n\r\n- `GET, POST` `/api/guard`\r\n- `GET` `/api/guard/decisions`\r\n\r\n### `handoffs`\r\n\r\n- `GET, POST` `/api/handoffs`\r\n- `GET` `/api/handoffs/[id]`\r\n- `POST` `/api/handoffs/[id]/consume`\r\n- `GET` `/api/handoffs/latest`\r\n\r\n### `health`\r\n\r\n- `GET` `/api/health`\r\n\r\n### `hosted`\r\n\r\n- `POST` `/api/hosted/cleanup`\r\n- `GET, POST` `/api/hosted/workspaces`\r\n- `DELETE, GET` `/api/hosted/workspaces/[workspaceId]`\r\n\r\n### `identities`\r\n\r\n- `GET, POST` `/api/identities`\r\n- `DELETE` `/api/identities/[agentId]`\r\n\r\n### `integrations`\r\n\r\n- `GET` `/api/integrations/health`\r\n- `POST` `/api/integrations/health/refresh`\r\n\r\n### `integrity`\r\n\r\n- `GET` `/api/integrity/jwks`\r\n- `POST` `/api/integrity/verify`\r\n\r\n### `keys`\r\n\r\n- `DELETE, GET, POST` `/api/keys`\r\n- `GET` `/api/keys/reveal`\r\n\r\n### `knowledge`\r\n\r\n- `GET, POST` `/api/knowledge/collections`\r\n- `DELETE, GET, PATCH` `/api/knowledge/collections/[collectionId]`\r\n- `GET, POST` `/api/knowledge/collections/[collectionId]/items`\r\n- `POST` `/api/knowledge/collections/[collectionId]/search`\r\n- `POST` `/api/knowledge/collections/[collectionId]/sync`\r\n\r\n### `learning`\r\n\r\n- `GET, POST` `/api/learning`\r\n- `GET, POST` `/api/learning/analytics/curves`\r\n- `GET` `/api/learning/analytics/maturity`\r\n- `GET` `/api/learning/analytics/summary`\r\n- `GET, POST` `/api/learning/analytics/velocity`\r\n- `GET` `/api/learning/code-signals`\r\n- `GET` `/api/learning/lessons`\r\n- `GET, POST` `/api/learning/recommendations`\r\n- `PATCH` `/api/learning/recommendations/[recommendationId]`\r\n- `POST` `/api/learning/recommendations/events`\r\n- `GET` `/api/learning/recommendations/metrics`\r\n- `GET, POST` `/api/learning/suggestions`\r\n\r\n### `marketing`\r\n\r\n- `POST` `/api/marketing/event`\r\n\r\n### `mcp`\r\n\r\n- `POST` `/api/mcp`\r\n\r\n### `messages`\r\n\r\n- `GET, PATCH, POST` `/api/messages`\r\n- `GET` `/api/messages/attachments`\r\n- `GET, PATCH, POST` `/api/messages/threads`\r\n- `GET` `/api/messages/threads/[threadId]`\r\n\r\n### `model-strategies`\r\n\r\n- `GET, POST` `/api/model-strategies`\r\n- `DELETE, GET, PATCH` `/api/model-strategies/[strategyId]`\r\n- `POST` `/api/model-strategies/[strategyId]/complete`\r\n\r\n### `oauth`\r\n\r\n- `GET, POST` `/api/oauth/authorize`\r\n- `GET` `/api/oauth/metadata/authorization-server`\r\n- `GET` `/api/oauth/metadata/protected-resource`\r\n- `POST` `/api/oauth/register`\r\n- `POST` `/api/oauth/token`\r\n\r\n### `operations`\r\n\r\n- `GET` `/api/operations/feed`\r\n- `GET` `/api/operations/summary`\r\n\r\n### `orgs`\r\n\r\n- `GET, POST` `/api/orgs`\r\n- `GET, PATCH` `/api/orgs/[orgId]`\r\n- `DELETE, GET, POST` `/api/orgs/[orgId]/keys`\r\n\r\n### `pairings`\r\n\r\n- `GET, POST` `/api/pairings`\r\n- `GET, PATCH` `/api/pairings/[pairingId]`\r\n- `POST` `/api/pairings/[pairingId]/approve`\r\n\r\n### `policies`\r\n\r\n- `DELETE, GET, PATCH, POST` `/api/policies`\r\n- `POST` `/api/policies/generate`\r\n- `POST` `/api/policies/import`\r\n- `GET` `/api/policies/proof`\r\n- `POST` `/api/policies/simulate`\r\n- `GET` `/api/policies/templates`\r\n- `POST` `/api/policies/test`\r\n\r\n### `prompts`\r\n\r\n- `GET` `/api/prompts/agent-connect/raw`\r\n- `POST` `/api/prompts/render`\r\n- `GET` `/api/prompts/runs`\r\n- `GET` `/api/prompts/sdk-coverage/raw`\r\n- `GET` `/api/prompts/server-setup/raw`\r\n- `GET` `/api/prompts/stats`\r\n- `GET, POST` `/api/prompts/templates`\r\n- `DELETE, GET, PATCH` `/api/prompts/templates/[templateId]`\r\n- `GET, POST` `/api/prompts/templates/[templateId]/versions`\r\n- `GET, POST` `/api/prompts/templates/[templateId]/versions/[versionId]`\r\n\r\n### `scoring`\r\n\r\n- `POST` `/api/scoring/calibrate`\r\n- `GET, POST` `/api/scoring/profiles`\r\n- `DELETE, GET, PATCH` `/api/scoring/profiles/[profileId]`\r\n- `POST` `/api/scoring/profiles/[profileId]/dimensions`\r\n- `DELETE, PATCH` `/api/scoring/profiles/[profileId]/dimensions/[dimensionId]`\r\n- `GET, POST` `/api/scoring/risk-templates`\r\n- `DELETE, PATCH` `/api/scoring/risk-templates/[templateId]`\r\n- `GET, POST` `/api/scoring/score`\r\n\r\n### `secrets`\r\n\r\n- `GET, POST` `/api/secrets`\r\n- `DELETE, PATCH` `/api/secrets/[id]`\r\n- `GET` `/api/secrets/rotation-due`\r\n\r\n### `security`\r\n\r\n- `GET, POST` `/api/security/prompt-injection`\r\n- `POST` `/api/security/scan`\r\n- `GET` `/api/security/status`\r\n\r\n### `session`\r\n\r\n- `GET` `/api/session/effective`\r\n\r\n### `sessions`\r\n\r\n- `GET, POST` `/api/sessions`\r\n- `GET, PATCH` `/api/sessions/[sessionId]`\r\n- `GET` `/api/sessions/[sessionId]/events`\r\n\r\n### `settings`\r\n\r\n- `DELETE, GET, POST` `/api/settings`\r\n- `GET` `/api/settings/llm-status`\r\n- `POST` `/api/settings/test`\r\n\r\n### `setup`\r\n\r\n- `POST` `/api/setup/live-proof`\r\n- `POST` `/api/setup/migrate`\r\n- `POST` `/api/setup/ping`\r\n- `GET` `/api/setup/proof`\r\n- `GET` `/api/setup/status`\r\n\r\n### `signals`\r\n\r\n- `GET` `/api/signals`\r\n\r\n### `skills`\r\n\r\n- `POST` `/api/skills/scan`\r\n- `GET` `/api/skills/scans/[id]`\r\n\r\n### `stream`\r\n\r\n- `GET` `/api/stream`\r\n\r\n### `swarm`\r\n\r\n- `GET` `/api/swarm/graph`\r\n- `GET` `/api/swarm/link`\r\n\r\n### `team`\r\n\r\n- `GET` `/api/team`\r\n- `DELETE, PATCH` `/api/team/[userId]`\r\n- `DELETE, GET, POST` `/api/team/invite`\r\n\r\n### `telegram`\r\n\r\n- `POST` `/api/telegram/webhook`\r\n\r\n### `usage`\r\n\r\n- `GET` `/api/usage`\r\n- `GET` `/api/usage/costs`\r\n\r\n### `webhooks`\r\n\r\n- `DELETE, GET, POST` `/api/webhooks`\r\n- `GET` `/api/webhooks/[webhookId]/deliveries`\r\n- `POST` `/api/webhooks/[webhookId]/test`\r\n- `POST` `/api/webhooks/stripe`\r\n\r\n### `workflows`\r\n\r\n- `POST` `/api/workflows/draft`\r\n- `GET, POST` `/api/workflows/templates`\r\n- `DELETE, GET, PATCH` `/api/workflows/templates/[templateId]`\r\n- `POST` `/api/workflows/templates/[templateId]/duplicate`\r\n- `POST` `/api/workflows/templates/[templateId]/execute`\r\n- `POST` `/api/workflows/templates/[templateId]/launch`\r\n- `GET` `/api/workflows/templates/[templateId]/runs`\r\n- `GET` `/api/workflows/templates/[templateId]/runs/[runActionId]`\r\n- `POST` `/api/workflows/templates/[templateId]/runs/[runActionId]/cancel`\r\n- `POST` `/api/workflows/templates/[templateId]/runs/[runActionId]/resume`\r\n\r\n## Required Environment Variables\r\n\r\nThese must be set — DashClaw will fail to start without them.\r\n\r\n- **`DASHCLAW_API_KEY`** - referenced in 56 file(s)\r\n- **`DATABASE_URL`** - referenced in 87 file(s)\r\n- **`ENCRYPTION_KEY`** - referenced in 4 file(s)\r\n- **`NEXTAUTH_SECRET`** - referenced in 5 file(s)\r\n\r\n## Optional Environment Variables\r\n\r\nThese have fallbacks or only activate specific features.\r\n\r\n- `AGENT_ONLINE_WINDOW_MS` *(undocumented)*\r\n- `AGENT_PRIVATE_KEY` *(undocumented)*\r\n- `AGENT_PRIVATE_KEY_JWK` *(undocumented)*\r\n- `ALERT_FROM_EMAIL` *(undocumented)*\r\n- `ALLOWED_ORIGIN` *(undocumented)*\r\n- `ANTHROPIC_API_KEY` *(undocumented)*\r\n- `ANTHROPIC_MODEL` *(undocumented)*\r\n- `API_INVENTORY_VERIFIED_DATE` *(undocumented)*\r\n- `API_SECRET` *(undocumented)*\r\n- `BASE_URL` *(undocumented)*\r\n- `CI` *(undocumented)*\r\n- `CONVERGENCE_BENCH_CONCURRENCY` *(undocumented)*\r\n- `CONVERGENCE_BENCH_ITERATIONS` *(undocumented)*\r\n- `CONVERGENCE_REPLAY_CONNECT_TIMEOUT_MS` *(undocumented)*\r\n- `CONVERGENCE_RETRY_429_MAX` *(undocumented)*\r\n- `CONVERGENCE_RETRY_429_WAIT_MS` *(undocumented)*\r\n- `CONVERGENCE_SSE_SEND_COUNT` *(undocumented)*\r\n- `CONVERGENCE_VERBOSE` *(undocumented)*\r\n- `CRON_SECRET` *(undocumented)*\r\n- `DASHCLAW_ACT_BINDING` *(undocumented)*\r\n- `DASHCLAW_ACT_BINDING_TYP` *(undocumented)*\r\n- `DASHCLAW_AGENT_ID` *(undocumented)*\r\n- `DASHCLAW_ALERTS_DISCORD` *(undocumented)*\r\n- `DASHCLAW_ALERTS_TELEGRAM` *(undocumented)*\r\n- `DASHCLAW_ALLOWED_ISSUER` *(undocumented)*\r\n- `DASHCLAW_API_KEY_ORG` *(undocumented)*\r\n- `DASHCLAW_BASE_URL` *(undocumented)*\r\n- `DASHCLAW_BEHAVIOR_SAMPLES_DIR` *(undocumented)*\r\n- `DASHCLAW_BEHAVIOR_SAMPLES_ENABLED` *(undocumented)*\r\n- `DASHCLAW_CLOSED_ENROLLMENT` *(undocumented)*\r\n- `DASHCLAW_DB_DRIVER` *(undocumented)*\r\n- `DASHCLAW_DB_POOL_MAX` *(undocumented)*\r\n- `DASHCLAW_DISABLE_RATE_LIMIT` *(undocumented)*\r\n- `DASHCLAW_GUARD_FALLBACK` *(undocumented)*\r\n- `DASHCLAW_GUARD_UNAVAILABLE_POLICY` *(undocumented)*\r\n- `DASHCLAW_HOSTED` *(undocumented)*\r\n- `DASHCLAW_JTI_MAX_TTL_SECONDS` *(undocumented)*\r\n- `DASHCLAW_JTI_REPLAY_PROTECTION` *(undocumented)*\r\n- `DASHCLAW_JWT_AUDIENCE` *(undocumented)*\r\n- `DASHCLAW_LOCAL_ADMIN_PASSWORD` *(undocumented)*\r\n- `DASHCLAW_MAX_ORG_ATTACHMENT_BYTES` *(undocumented)*\r\n- `DASHCLAW_MODE` *(undocumented)*\r\n- `DASHCLAW_NEW_CONNECT_WEBHOOK` *(undocumented)*\r\n- `DASHCLAW_PAIRING_TTL_MINUTES` *(undocumented)*\r\n- `DASHCLAW_RATE_LIMIT_MAX` *(undocumented)*\r\n- `DASHCLAW_RATE_LIMIT_WINDOW_MS` *(undocumented)*\r\n- `DASHCLAW_SIGNING_KEY_JWK` *(undocumented)*\r\n- `DASHCLAW_URL` *(undocumented)*\r\n- `DISABLE_PROMPT_INJECTION_SCAN` *(undocumented)*\r\n- `DISCORD_APPROVER_ORG_ID` *(undocumented)*\r\n- `DISCORD_APPROVER_USER_ID` *(undocumented)*\r\n- `DISCORD_BOT_TOKEN` *(undocumented)*\r\n- `DISCORD_PUBLIC_KEY` *(undocumented)*\r\n- `ENFORCE_AGENT_SIGNATURES` *(undocumented)*\r\n- `GITHUB_CLIENT_ID` *(undocumented)*\r\n- `GITHUB_CLIENT_SECRET` *(undocumented)*\r\n- `GITHUB_ID` *(undocumented)*\r\n- `GITHUB_REPO_NAME` *(undocumented)*\r\n- `GITHUB_REPO_OWNER` *(undocumented)*\r\n- `GITHUB_SECRET` *(undocumented)*\r\n- `GITHUB_TOKEN` *(undocumented)*\r\n- `GOOGLE_AI_API_KEY` *(undocumented)*\r\n- `GOOGLE_CLIENT_ID` *(undocumented)*\r\n- `GOOGLE_CLIENT_SECRET` *(undocumented)*\r\n- `GOOGLE_ID` *(undocumented)*\r\n- `GOOGLE_SECRET` *(undocumented)*\r\n- `GUARD_LLM_BASE_URL` *(undocumented)*\r\n- `GUARD_LLM_KEY` *(undocumented)*\r\n- `GUARD_LLM_MODEL` *(undocumented)*\r\n- `GUARD_WEBHOOK_SECRET` *(undocumented)*\r\n- `HOSTED_CLEANUP_SECRET` *(undocumented)*\r\n- `HOSTED_PROVISION_MAX_PER_IP_PER_DAY` *(undocumented)*\r\n- `HOSTED_SMOKE_BASE_URL` *(undocumented)*\r\n- `HOSTED_TRIAL_ACTION_CAP` *(undocumented)*\r\n- `HOSTED_TRIAL_DAYS` *(undocumented)*\r\n- `INTEGRATION_DATABASE_URL` *(undocumented)*\r\n- `MOONSHOT_API_KEY` *(undocumented)*\r\n- `NEXTAUTH_URL`\r\n- `NEXT_PUBLIC_` *(undocumented)*\r\n- `NEXT_PUBLIC_APP_URL` *(undocumented)*\r\n- `NEXT_PUBLIC_DASHCLAW_MODE` *(undocumented)*\r\n- `NEXT_PUBLIC_DASHCLAW_VERSION` *(undocumented)*\r\n- `NEXT_PUBLIC_ENABLE_VERCEL_ANALYTICS` *(undocumented)*\r\n- `NEXT_PUBLIC_PLUGIN_MANIFEST_VERSION` *(undocumented)*\r\n- `NEXT_PUBLIC_SDK_NODE_VERSION` *(undocumented)*\r\n- `NEXT_PUBLIC_SDK_PYTHON_VERSION` *(undocumented)*\r\n- `NEXT_PUBLIC_TURNSTILE_SITE_KEY` *(undocumented)*\r\n- `NODE_ENV` *(undocumented)*\r\n- `OIDC_AUTHORIZATION_URL` *(undocumented)*\r\n- `OIDC_CLIENT_ID` *(undocumented)*\r\n- `OIDC_CLIENT_SECRET` *(undocumented)*\r\n- `OIDC_DISPLAY_NAME` *(undocumented)*\r\n- `OIDC_ISSUER_URL` *(undocumented)*\r\n- `OIDC_TOKEN_URL` *(undocumented)*\r\n- `OIDC_USERINFO_URL` *(undocumented)*\r\n- `OPENAI_API_KEY` *(undocumented)*\r\n- `ORG_ID` *(undocumented)*\r\n- `PORT` *(undocumented)*\r\n- `PW_BASE_URL` *(undocumented)*\r\n- `PW_SMOKE_PORT` *(undocumented)*\r\n- `PYTHON` *(undocumented)*\r\n- `PYTHONPATH` *(undocumented)*\r\n- `REALTIME_BACKEND` *(undocumented)*\r\n- `REALTIME_ENFORCE_REDIS` *(undocumented)*\r\n- `REALTIME_MAX_LISTENERS` *(undocumented)*\r\n- `REALTIME_MEMORY_MAX_LISTENERS` *(undocumented)*\r\n- `REALTIME_REDIS_URL` *(undocumented)*\r\n- `REALTIME_REPLAY_MAX_EVENTS` *(undocumented)*\r\n- `REALTIME_REPLAY_WINDOW_SECONDS` *(undocumented)*\r\n- `REDIS_URL` *(undocumented)*\r\n- `RESEARCH_API_KEY` *(undocumented)*\r\n- `RESEARCH_API_URL` *(undocumented)*\r\n- `RESEND_API_KEY` *(undocumented)*\r\n- `S` *(undocumented)*\r\n- `SERVICE_NAME` *(undocumented)*\r\n- `STARTUP_SMOKE_BASE_URL` *(undocumented)*\r\n- `STARTUP_SMOKE_INTERVAL_MS` *(undocumented)*\r\n- `STARTUP_SMOKE_TIMEOUT_MS` *(undocumented)*\r\n- `STRIPE_PRICE_BUSINESS` *(undocumented)*\r\n- `STRIPE_PRICE_PRO` *(undocumented)*\r\n- `STRIPE_SECRET_KEY` *(undocumented)*\r\n- `STRIPE_WEBHOOK_SECRET` *(undocumented)*\r\n- `TARGET_ENV` *(undocumented)*\r\n- `TELEGRAM_ADMIN_CHAT_ID` *(undocumented)*\r\n- `TELEGRAM_APPROVER_ORG_ID` *(undocumented)*\r\n- `TELEGRAM_BOT_TOKEN` *(undocumented)*\r\n- `TELEGRAM_WEBHOOK_SECRET` *(undocumented)*\r\n- `TEST_BASE_URL` *(undocumented)*\r\n- `TRUST_PROXY` *(undocumented)*\r\n- `TURNSTILE_SECRET_KEY` *(undocumented)*\r\n- `UPSTASH_REDIS_REST_TOKEN` *(undocumented)*\r\n- `UPSTASH_REDIS_REST_URL` *(undocumented)*\r\n- `VERCEL` *(undocumented)*\r\n- `VERCEL_PROJECT_PRODUCTION_URL` *(undocumented)*\r\n- `VERCEL_URL` *(undocumented)*\r\n- `WEBHOOK_ALLOWED_DOMAINS` *(undocumented)*\r\n- `X` *(undocumented)*\r\n\r\n## Database Tables\r\n\r\nAll 89 tables defined in `schema/schema.js` (Drizzle ORM):\r\n\r\n- `action_embeddings`\r\n- `action_records`\r\n- `activity_logs`\r\n- `agent_connections`\r\n- `agent_identities`\r\n- `agent_messages`\r\n- `agent_pairings`\r\n- `agent_presence`\r\n- `agent_schedules`\r\n- `agent_sessions`\r\n- `api_keys`\r\n- `assumptions`\r\n- `calendar_events`\r\n- `code_optimal_file_manifests`\r\n- `code_projects`\r\n- `code_session_alerts`\r\n- `code_session_handoffs`\r\n- `code_session_memos`\r\n- `code_session_messages`\r\n- `code_session_signals`\r\n- `code_session_tool_uses`\r\n- `code_sessions`\r\n- `compliance_snapshots`\r\n- `contacts`\r\n- `content`\r\n- `context_entries`\r\n- `context_points`\r\n- `daily_totals`\r\n- `decisions`\r\n- `drift_alerts`\r\n- `drift_baselines`\r\n- `drift_snapshots`\r\n- `entities`\r\n- `eval_runs`\r\n- `eval_scores`\r\n- `executions`\r\n- `feedback`\r\n- `goals`\r\n- `governed_secrets`\r\n- `guard_decisions`\r\n- `guard_policies`\r\n- `guardrails_test_runs`\r\n- `health_snapshots`\r\n- `ideas`\r\n- `interactions`\r\n- `jwt_replay_log`\r\n- `learning_curves`\r\n- `learning_episodes`\r\n- `learning_recommendation_events`\r\n- `learning_recommendations`\r\n- `learning_velocity`\r\n- `message_threads`\r\n- `milestones`\r\n- `notification_preferences`\r\n- `oauth_access_tokens`\r\n- `oauth_authorization_codes`\r\n- `oauth_clients`\r\n- `open_loops`\r\n- `organizations`\r\n- `profile_scores`\r\n- `prompt_runs`\r\n- `prompt_templates`\r\n- `prompt_versions`\r\n- `risk_templates`\r\n- `routing_agent_metrics`\r\n- `routing_agents`\r\n- `routing_decisions`\r\n- `routing_tasks`\r\n- `scheduled_jobs`\r\n- `scoring_dimensions`\r\n- `scoring_profiles`\r\n- `server_signing_keys`\r\n- `session_events`\r\n- `shared_docs`\r\n- `skill_scan_results`\r\n- `snippets`\r\n- `token_budgets`\r\n- `token_snapshots`\r\n- `topics`\r\n- `usage_meters`\r\n- `user_approaches`\r\n- `user_moods`\r\n- `user_observations`\r\n- `user_preferences`\r\n- `users`\r\n- `waitlist`\r\n- `webhook_deliveries`\r\n- `webhooks`\r\n- `workflows`\r\n\r\n## Configuration Knobs\r\n\r\nPer-org settings stored in the `settings` table. Set via `PUT /api/settings/:key` or the web Settings/Integrations UI. Keys marked sensitive are auto-encrypted at rest.\r\n\r\n### AI Providers\r\n\r\n- `OPENAI_API_KEY`\r\n- `OPENAI_ORG_ID`\r\n- `ANTHROPIC_API_KEY`\r\n- `GROQ_API_KEY`\r\n- `TOGETHER_API_KEY`\r\n- `REPLICATE_API_TOKEN`\r\n- `HUGGINGFACE_API_KEY`\r\n- `PERPLEXITY_API_KEY`\r\n- `ELEVENLABS_API_KEY`\r\n- `ELEVENLABS_VOICE_ID`\r\n\r\n### Databases\r\n\r\n- `DATABASE_URL`\r\n- `SUPABASE_URL`\r\n- `SUPABASE_ANON_KEY`\r\n- `SUPABASE_SERVICE_KEY`\r\n- `PLANETSCALE_URL`\r\n- `MONGODB_URI`\r\n- `REDIS_URL`\r\n- `PINECONE_API_KEY`\r\n- `PINECONE_ENVIRONMENT`\r\n\r\n### Communication\r\n\r\n- `TELEGRAM_BOT_TOKEN`\r\n- `TELEGRAM_ADMIN_CHAT_ID`\r\n- `DASHCLAW_ALERTS_TELEGRAM`\r\n- `DISCORD_BOT_TOKEN`\r\n- `DISCORD_CLIENT_ID`\r\n- `DISCORD_GUILD_ID`\r\n- `SLACK_BOT_TOKEN`\r\n- `SLACK_SIGNING_SECRET`\r\n- `SLACK_APP_TOKEN`\r\n- `TWILIO_ACCOUNT_SID`\r\n- `TWILIO_AUTH_TOKEN`\r\n- `TWILIO_PHONE_NUMBER`\r\n- `RESEND_API_KEY`\r\n- `SENDGRID_API_KEY`\r\n\r\n### Productivity\r\n\r\n- `GOOGLE_ACCOUNT`\r\n- `GOOGLE_CREDENTIALS_PATH`\r\n- `NOTION_API_KEY`\r\n- `NOTION_PARENT_PAGE_ID`\r\n- `LINEAR_API_KEY`\r\n- `AIRTABLE_API_KEY`\r\n- `AIRTABLE_BASE_ID`\r\n- `CALENDLY_API_KEY`\r\n\r\n### Development\r\n\r\n- `GITHUB_TOKEN`\r\n- `GITHUB_USERNAME`\r\n- `VERCEL_TOKEN`\r\n- `VERCEL_PROJECT_ID`\r\n- `RAILWAY_TOKEN`\r\n- `CLOUDFLARE_API_TOKEN`\r\n- `CLOUDFLARE_ACCOUNT_ID`\r\n- `SENTRY_DSN`\r\n- `SENTRY_AUTH_TOKEN`\r\n\r\n### Social\r\n\r\n- `TWITTER_API_KEY`\r\n- `TWITTER_API_SECRET`\r\n- `TWITTER_ACCESS_TOKEN`\r\n- `TWITTER_ACCESS_SECRET`\r\n- `BRAVE_API_KEY`\r\n- `MOLTBOOK_API_KEY`\r\n\r\n### Payments\r\n\r\n- `STRIPE_SECRET_KEY`\r\n- `STRIPE_PUBLISHABLE_KEY`\r\n- `STRIPE_WEBHOOK_SECRET`\r\n- `LEMONSQUEEZY_API_KEY`\r\n\r\n### Native governance alert settings\r\n\r\n- `DASHCLAW_ALERTS_SLACK`\r\n- `DASHCLAW_ALERTS_DISCORD`\r\n- `DASHCLAW_ALERTS_LINEAR`\r\n- `DASHCLAW_ALERTS_GITHUB`\r\n- `DASHCLAW_ALERTS_EMAIL`\r\n- `DASHCLAW_ALERT_EMAIL`\r\n- `SLACK_CHANNEL_ID`\r\n- `SLACK_WEBHOOK_URL`\r\n- `DISCORD_WEBHOOK_URL`\r\n- `GITHUB_REPO`\r\n- `SENDGRID_DEFAULT_TO`\r\n- `SENDGRID_FROM_EMAIL`\r\n\r\n### webhooks + native adapters deliver a signal. Empty/unset = disabled.\r\n\r\n- `DASHCLAW_ACTION_COST_THRESHOLD`\r\n\r\n### System configuration\r\n\r\n- `MODEL_PRICING`\r\n- `ENFORCE_AGENT_SIGNATURES`\r\n\r\n### Predictive risk scoring\r\n\r\n- `PREDICTIVE_RISK_ENABLED`\r\n- `PREDICTIVE_RISK_THRESHOLD`\r\n\r\n### docs/architecture/durable-execution-finality.md.\r\n\r\n- `DASHCLAW_OUTCOME_TIMEOUT_MINUTES`\r\n\r\n## Realtime & Webhook Events\r\n\r\nEvery mutation that Mission Control reflects and every webhook delivery is keyed on these event strings. Subscribe via `GET /api/events` (SSE) or register a webhook with the matching `events: [...]` array.\r\n\r\n| Constant | Event |\r\n| --- | --- |\r\n| `ACTION_COST_EXCEEDED` | `action.cost_exceeded` |\r\n| `ACTION_CREATED` | `action.created` |\r\n| `ACTION_UPDATED` | `action.updated` |\r\n| `DECISION_CREATED` | `decision.created` |\r\n| `GOAL_CREATED` | `goal.created` |\r\n| `GOAL_UPDATED` | `goal.updated` |\r\n| `GUARD_DECISION_CREATED` | `guard.decision.created` |\r\n| `LOOP_CREATED` | `loop.created` |\r\n| `LOOP_UPDATED` | `loop.updated` |\r\n| `MESSAGE_CREATED` | `message.created` |\r\n| `POLICY_UPDATED` | `policy.updated` |\r\n| `SIGNAL_DETECTED` | `signal.detected` |\r\n| `TASK_ASSIGNED` | `task.assigned` |\r\n| `TASK_COMPLETED` | `task.completed` |\r\n| `TOKEN_USAGE` | `token.usage` |\r\n\r\n## Signal Types\r\n\r\nThese are the `type` strings emitted through `fireWebhooksForOrg` and `deliverNativeNotifications`. Webhooks can subscribe to any subset by putting the type in their `events: [...]` array (or use `['all']` for everything).\r\n\r\n- `autonomy_spike`\r\n- `branch_stale`\r\n- `cost_exceeded`\r\n- `green_insufficient`\r\n- `integration_health_changed`\r\n- `integration_mismatch`\r\n- `lost_confirmation`\r\n- `mcp_degraded`\r\n- `stale_action`\r\n- `test`\r\n\r\n## Native Notification Adapters\r\n\r\nEach adapter delivers `integration_mismatch`, `integration_health_changed`, and `cost_exceeded` signals when at least one of its required credential keys is configured. Per-channel opt-out via `DASHCLAW_ALERTS_=false`.\r\n\r\n| Adapter | Required credential (any one) |\r\n| --- | --- |\r\n| `org_id` | `DISCORD_WEBHOOK_URL` |\r\n| `email` | `RESEND_API_KEY`, `SENDGRID_API_KEY` |\r\n| `github` | `GITHUB_TOKEN` |\r\n| `linear` | `LINEAR_API_KEY` |\r\n| `slack` | `SLACK_BOT_TOKEN`, `SLACK_WEBHOOK_URL` |\r\n\r\n## Detecting Drift\r\n\r\nTo check whether this snapshot matches the current codebase:\r\n\r\n```bash\r\npython -m livingcode diff\r\n```\r\n\r\nIf the diff shows changes, this skill is stale — regenerate it.\n\nFile v1.1.1:_meta.json\n\n{\n \"ownerId\": \"kn772et58w67n5sn64dtadvgws86nbb1\",\n \"slug\": \"dashclaw-platform-intelligence\",\n \"version\": \"1.1.1\",\n \"publishedAt\": 1780553636783\n}\n\nFile v1.1.1:references/api-surface.md\n\n# DashClaw API Surface\r\n\r\n**259 active routes** (verified 2026-05-15 against `docs/api-inventory.json`). Node SDK uses camelCase, Python SDK uses snake_case.\r\n\r\n> ⚠️ **Authoritative source:** `SKILL.md` (regenerated from the livingcode shape) and `docs/api-inventory.md`. This file is a curated narrative for the most commonly consumed surfaces plus anything new that doesn't yet have an SDK mapping. Some sections below describe legacy v1 endpoints that may not exist in the current build (e.g. `/api/context/*`, `/api/snippets/*`, `/api/decisions`, `/api/feedback/*`) — cross-check against `docs/api-inventory.md` before integrating.\r\n\r\n## Table of Contents\r\n\r\n- [Doctor (self-host diagnostics)](#doctor-self-host-diagnostics)\r\n- [MCP Server](#mcp-server)\r\n- [Analytics](#analytics)\r\n- [Action Recording](#action-recording)\r\n- [Approvals](#approvals)\r\n- [Agent Fleet and Profile](#agent-fleet-and-profile)\r\n- [Loops and Assumptions](#loops-and-assumptions)\r\n- [Signals](#signals)\r\n- [Behavior Guard](#behavior-guard)\r\n- [Guard Decisions Audit Log](#guard-decisions-audit-log)\r\n- [Policies](#policies)\r\n- [Capabilities](#capabilities)\r\n- [Workflows](#workflows)\r\n- [Context Manager](#context-manager)\r\n- [Agent Messaging](#agent-messaging)\r\n- [Automation Snippets](#automation-snippets)\r\n- [Session Handoffs](#session-handoffs)\r\n- [Memory](#memory)\r\n- [User Preferences](#user-preferences)\r\n- [Daily Digest](#daily-digest)\r\n- [Security Scanning](#security-scanning)\r\n- [Webhooks](#webhooks)\r\n- [Agent Pairing](#agent-pairing)\r\n- [Identity Binding](#identity-binding)\r\n- [Organization Management](#organization-management)\r\n- [Activity Logs](#activity-logs)\r\n- [Compliance Engine](#compliance-engine)\r\n- [Compliance Exports](#compliance-exports)\r\n- [Bulk Sync](#bulk-sync)\r\n- [Evaluation Framework](#evaluation-framework)\r\n- [Prompt Management](#prompt-management)\r\n- [Drift Detection](#drift-detection)\r\n- [Learning Analytics](#learning-analytics)\r\n- [Scoring Profiles](#scoring-profiles)\r\n- [Risk Templates](#risk-templates)\r\n- [Session Lifecycle](#session-lifecycle)\r\n- [Guard Policy Types](#guard-policy-types)\r\n- [Dashboard Data and Other Routes](#dashboard-data-and-other-routes)\r\n\r\n## Doctor (self-host diagnostics)\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/doctor` | GET | Run all check modules (database, config, auth, deployment, SDK, governance, drift guard). Returns per-check pass/fail + summary. |\r\n| `/api/doctor/fix` | POST | Apply safe auto-fixes (migrate DB, generate secrets, CORS config, seed default policy). Backs up `.env` before any write. |\r\n\r\nThe CLI (`dashclaw doctor`) invokes these endpoints. Local mode (`npm run doctor`) runs the same engine with filesystem access for env writes. Check modules + constants are emitted from the livingcode shape into `app/lib/doctor/generated/checks-from-shape.mjs`.\r\n\r\n## MCP Server\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/mcp` | POST | Model Context Protocol Streamable HTTP transport. Same 26 tools / 6 resources exposed by the stdio binary (`@dashclaw/mcp-server`). |\r\n\r\n**26 tools across 9 groups.** Core governance (8): `dashclaw_guard`, `dashclaw_record`, `dashclaw_invoke`, `dashclaw_capabilities_list`, `dashclaw_policies_list`, `dashclaw_wait_for_approval`, `dashclaw_session_start`, `dashclaw_session_end`. Optimal files (2): `dashclaw_optimal_files_preview`, `dashclaw_optimal_files_manifest`. Session continuity (3): `dashclaw_handoff_create`, `dashclaw_handoff_latest`, `dashclaw_handoff_consume`. Credential hygiene (3): `dashclaw_secret_list`, `dashclaw_secret_due`, `dashclaw_secret_mark_rotated`. Skill safety (1): `dashclaw_skill_scan`. Open loops (3): `dashclaw_loop_add`, `dashclaw_loop_list`, `dashclaw_loop_close`. Learning + retrospection (3): `dashclaw_learning_log`, `dashclaw_learning_query`, `dashclaw_decisions_recent`. Agent inbox (2): `dashclaw_inbox_list`, `dashclaw_messages_mark_read`. Behavior learning (1): `dashclaw_behavior_suggestions`.\r\n\r\n**Resources:** `dashclaw://policies`, `dashclaw://capabilities`, `dashclaw://agent/{agent_id}/history`, `dashclaw://status`, `dashclaw://code-sessions/projects`, `dashclaw://code-sessions/sessions/{session_id}`.\r\n\r\nTool route mapping lives in `mcp-server/lib/routes-inventory.generated.json` — emitted from shape, not hand-edited.\r\n\r\n## Analytics\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/analytics` | GET | Aggregated cost + action analytics for the `/analytics` dashboard. Returns hero stats with trend comparison, cost trend series, action volume series, breakdowns by agent/action type/model, and token usage. |\r\n\r\n## Approvals\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/approvals/[actionId]` | POST | Approve or deny a pending action (body: `{ decision, reasoning }`). Shared by browser, CLI, `/approve` mobile PWA, and SDK polling. Publishes `action.updated` to the Redis SSE stream. |\r\n\r\n## Agent Fleet and Profile\r\n\r\n| Endpoint | Methods | Node SDK |\r\n|---|---|---|\r\n| `/api/agents` | GET | `getAgents` |\r\n| `/api/agents/[agentId]` | GET | `getAgent` |\r\n| `/api/agents/[agentId]/profile` | GET | Aggregated governance profile: vitals strip, trust posture, assumptions summary, policies, recent decisions, signals. Powers `/agents/[agentId]` page. |\r\n| `/api/agents/connections` | GET, POST | `getAgentConnections`, `reportConnections` |\r\n| `/api/agents/heartbeat` | POST | `heartbeat` — auto-updates `agent_presence` on action submission (`418fc872`) |\r\n\r\n## Guard Decisions Audit Log\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/guard/decisions` | GET | Queryable guard decision audit log (triggering policy, risk score, matched rules, outcome). Powers `/policies` ActivityTab. SQL consolidated into `guardrails.repository.js`. |\r\n\r\n## Capabilities\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/capabilities` | GET, POST | List / register capabilities |\r\n| `/api/capabilities/[capabilityId]` | GET, PATCH, DELETE | Read / edit / delete (DELETE added April 2026 — `36a307ac`) |\r\n| `/api/capabilities/[capabilityId]/access` | GET, POST | Access rules |\r\n| `/api/capabilities/[capabilityId]/access/[ruleId]` | DELETE | Remove access rule |\r\n| `/api/capabilities/[capabilityId]/access/check` | GET | Resolve access for a given caller |\r\n| `/api/capabilities/[capabilityId]/health` | GET | Per-capability health |\r\n| `/api/capabilities/[capabilityId]/history` | GET | Invocation history |\r\n| `/api/capabilities/[capabilityId]/invoke` | POST | Full guard → execute → record loop |\r\n| `/api/capabilities/[capabilityId]/test` | POST | Dry-run test invocation |\r\n| `/api/capabilities/health` | GET | Registry-wide health |\r\n\r\n## Workflows\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/workflows/draft` | POST | Draft a workflow from a natural-language goal |\r\n| `/api/workflows/templates` | GET, POST | List / create templates |\r\n| `/api/workflows/templates/[templateId]` | GET, PATCH, DELETE | CRUD |\r\n| `/api/workflows/templates/[templateId]/duplicate` | POST | Clone a template |\r\n| `/api/workflows/templates/[templateId]/execute` | POST | One-shot execution |\r\n| `/api/workflows/templates/[templateId]/launch` | POST | Long-running launch (returns runActionId) |\r\n| `/api/workflows/templates/[templateId]/runs` | GET | List runs |\r\n| `/api/workflows/templates/[templateId]/runs/[runActionId]` | GET | Run detail |\r\n| `/api/workflows/templates/[templateId]/runs/[runActionId]/cancel` | POST | Cancel |\r\n| `/api/workflows/templates/[templateId]/runs/[runActionId]/resume` | POST | Resume after pause/approval |\r\n\r\nTemplate variables serialize objects and preserve arrays (`c4164311`); `prompt_template` replaces the old `prompt` field in analyze steps (`58bc63e1`).\r\n\r\n## Action Recording\r\n\r\n**Maturity:** Stable\r\n\r\n| Endpoint | Methods | Node SDK | Python SDK |\r\n|---|---|---|---|\r\n| `/api/actions` | GET, POST, DELETE | `createAction`, `getActions` | `create_action`, `get_actions` |\r\n| `/api/actions/[actionId]` | GET, PATCH | `getAction`, `updateOutcome` | `get_action`, `update_outcome` |\r\n\r\n**PATCH outcome fields (v2.13.1+):** `status`, `output_summary`, `side_effects`, `artifacts_created`, `error_message`, `timestamp_end`, `duration_ms`, `cost_estimate`, `tokens_in`, `tokens_out`, `model`. When `tokens_in` / `tokens_out` are reported without an explicit `cost_estimate`, the server derives cost from the configured pricing table (see `app/lib/billing.js`) using `model` to pick the right pricing row. The `model` column was added to `action_records` on 2026-04-14 — run `node scripts/_run-with-env.mjs scripts/migrate-action-model-column.mjs` against existing instances before deploying the matching server build.\r\n\r\n**Token capture pipeline (Claude Code):** the `Stop` hook (`hooks/dashclaw_stop.py`) reads the session transcript at turn end, sums LLM token usage across that turn's assistant messages (cache_read tokens weighted at 0.1× to match Anthropic billing), and PATCHes the per-turn share onto every action_id the pretool opened during the turn. Same idea for the OpenClaw plugin (v1.2.1+) via the `llm_output` and `agent_end` hooks.\r\n\r\n| `/api/actions/[actionId]/artifacts` | GET | `getActionArtifacts` | `get_action_artifacts` |\r\n| `/api/actions/[actionId]/graph` | GET | `getActionGraph` | `get_action_graph` |\r\n| `/api/actions/[actionId]/messages` | GET | `getActionMessages` | `get_action_messages` |\r\n| `/api/actions/[actionId]/trace` | GET | `getActionTrace` | `get_action_trace` |\r\n| `/api/actions/[actionId]/outcome` | GET, POST | `getActionOutcome`, `reportActionOutcome` (+ `reportActionSuccess` / `reportActionFailure` / `reportActionPartial`) | `get_action_outcome`, `report_action_outcome` (+ `report_action_success` / `report_action_failure` / `report_action_partial`) |\r\n| `/api/actions/costs` | GET | `getActionCosts` | `get_action_costs` |\r\n| `/api/actions/loops` | GET, POST | see Loops and Assumptions | — |\r\n| `/api/actions/stats` | GET | `getActionStats` | `get_action_stats` |\r\n| `/api/cron/outcome-sweep` | GET (Bearer `CRON_SECRET`) | — | — |\r\n\r\n**Durable execution finality (v2.13.3+):** `POST /api/actions/[actionId]/outcome` records a terminal `outcome_status` — one of `completed`, `partial`, `f\n\nArchive v1.1.0: 9 files, 42184 bytes\n\nFiles: references/api-surface.md (32253b), references/platform-knowledge.md (20512b), references/troubleshooting.md (18021b), scripts/bootstrap-agent-quick.mjs (4623b), scripts/diagnose.mjs (9179b), scripts/validate-integration.mjs (9830b), skill-card.md (2714b), SKILL.md (22738b), _meta.json (149b)\n\nArchive v1.0.1: 7 files, 38583 bytes\n\nFiles: references/api-surface.md (32253b), references/platform-knowledge.md (20512b), references/troubleshooting.md (18021b), scripts/diagnose.mjs (9179b), scripts/validate-integration.mjs (9830b), SKILL.md (21139b), _meta.json (149b)\n\nArchive v1.0.0: 8 files, 40513 bytes\n\nFiles: references/api-surface.md (32253b), references/platform-knowledge.md (20512b), references/troubleshooting.md (18021b), scripts/bootstrap-agent-quick.mjs (4623b), scripts/diagnose.mjs (9179b), scripts/validate-integration.mjs (9830b), SKILL.md (21139b), _meta.json (149b)","readmeExcerpt":"Skill: DashClaw Platform Intelligence Owner: dashclaw Summary: DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via python -m livingcode query, or GET {ba... Tags: ai-agents:1.0.1, dashclaw:1.0.1, governance:1.0.1, integration:1.0.1, latest:1.1.2, platform-expert:1.0.1, troubleshooting:1.0.1 Version history: v1.1.2 | 2026-06-04T11:40:28.853Z | user - Adde","codeSnippets":[],"executableExamples":[],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\r\nname: dashclaw-platform-intelligence\r\ndescription: DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via `python -m livingcode query`, or `GET {baseUrl}/api/doctor` when Python/livingcode/the repo are unavailable.\r\n---\r\n\r\n# DashClaw Platform Intelligence\r\n\r\n**Shape snapshot:** `sha1:22c84d9f7ccd4188bead232ffdde419e68578ba3`\r\n**This file is auto-generated.** Do not edit by hand — regenerate with:\r\n\r\n```bash\r\npython -m livingcode emit skill --output \r\n```\r\n\r\n## Prefer Live Queries\r\n\r\nThe facts below are a snapshot. Before answering any question about DashClaw's current\r\nstructure, routes, env vars, or schema — run a live query:\r\n\r\n```bash\r\npython -m livingcode query summary # High-level shape\r\npython -m livingcode query routes # Current API surface\r\npython -m livingcode query env # Current env vars\r\npython -m livingcode query tables # Current schema\r\npython -m livingcode query all --json # Full machine-readable shape\r\n```\r\n\r\nIf the snapshot below disagrees with a live query, **trust the live query**.\r\n\r\n### Fallback: no Python, livingcode, or repo checkout\r\n\r\n`python -m livingcode` only works where the livingcode package and the repo\r\ncheckout are present (e.g. a developer machine). In OpenClaw / the Claude app\r\nneither exists. When you cannot run the queries above, fall back **in this order**:\r\n\r\n1. **`GET {baseUrl}/api/doctor`** — live route/shape health straight from the running\r\n instance. Requires the workspace API key (`x-api-key: `); returns 401/403\r\n without it. This is the authoritative live source when the CLI is unavailable.\r\n2. **Read the committed static shape** if a repo checkout is reachable:\r\n `app/lib/doctor/generated/shape.json` (full machine-readable shape) and\r\n `docs/api-inventory.json` (route inventory). These are regenerated on every\r\n `npm run livingcode:refresh`, so they track the same facts the queries return.\r\n3. **Otherwise, treat the snapshot in this SKILL.md as authoritative** — it is the\r\n best available source when neither the API nor the repo can be reached.\r\n\r\n## At a Glance\r\n\r\n- **226** active API routes across **57** categories\r\n- **4** required + **137** optional environment variables\r\n- **89** database tables\r\n\r\n## API Surface\r\n\r\n### `actions`\r\n\r\n- `DELETE, GET, POST` `/api/actions`\r\n- `GET, PATCH` `/api/actions/[actionId]`\r\n- `GET` `/api/actions/[actionId]/artifacts`\r\n- `GET` `/api/actions/[actionId]/graph`\r\n- `GET` `/api/actions/[actionId]/messages`\r\n- `GET, POST` `/api/actions/[actionId]/outcome`\r\n- `GET` `/api/actions/[actionId]/trace`\r\n- `GET` `/api/actions/costs`\r\n- `GET, POST` `/api/actions/loops`\r\n- `GET, PATCH` `/api/actions/loops/[loopId]`\r\n- `GET` `/api/actions/stats`\r\n\r\n### `activity`\r\n\r\n- `GET` `/api/activity`\r\n\r\n### `admin`\r\n\r\n- `POST` `/api/admin/trigger-outcome-sweep`\r\n\r\n### `agents`\r\n\r\n- `GET` `/api/agents`\r\n- `GET` `/api/agents/[agentId]`\r\n- `GET` `/api/agents/[agentId]/"},{"path":"_meta.json","content":"{\n \"ownerId\": \"kn772et58w67n5sn64dtadvgws86nbb1\",\n \"slug\": \"dashclaw-platform-intelligence\",\n \"version\": \"1.1.2\",\n \"publishedAt\": 1780573228853\n}"},{"path":"references/api-surface.md","content":"# DashClaw API Surface\r\n\r\n**259 active routes** (verified 2026-05-15 against `docs/api-inventory.json`). Node SDK uses camelCase, Python SDK uses snake_case.\r\n\r\n> ⚠️ **Authoritative source:** `SKILL.md` (regenerated from the livingcode shape) and `docs/api-inventory.md`. This file is a curated narrative for the most commonly consumed surfaces plus anything new that doesn't yet have an SDK mapping. Some sections below describe legacy v1 endpoints that may not exist in the current build (e.g. `/api/context/*`, `/api/snippets/*`, `/api/decisions`, `/api/feedback/*`) — cross-check against `docs/api-inventory.md` before integrating.\r\n\r\n## Table of Contents\r\n\r\n- [Doctor (self-host diagnostics)](#doctor-self-host-diagnostics)\r\n- [MCP Server](#mcp-server)\r\n- [Analytics](#analytics)\r\n- [Action Recording](#action-recording)\r\n- [Approvals](#approvals)\r\n- [Agent Fleet and Profile](#agent-fleet-and-profile)\r\n- [Loops and Assumptions](#loops-and-assumptions)\r\n- [Signals](#signals)\r\n- [Behavior Guard](#behavior-guard)\r\n- [Guard Decisions Audit Log](#guard-decisions-audit-log)\r\n- [Policies](#policies)\r\n- [Capabilities](#capabilities)\r\n- [Workflows](#workflows)\r\n- [Context Manager](#context-manager)\r\n- [Agent Messaging](#agent-messaging)\r\n- [Automation Snippets](#automation-snippets)\r\n- [Session Handoffs](#session-handoffs)\r\n- [Memory](#memory)\r\n- [User Preferences](#user-preferences)\r\n- [Daily Digest](#daily-digest)\r\n- [Security Scanning](#security-scanning)\r\n- [Webhooks](#webhooks)\r\n- [Agent Pairing](#agent-pairing)\r\n- [Identity Binding](#identity-binding)\r\n- [Organization Management](#organization-management)\r\n- [Activity Logs](#activity-logs)\r\n- [Compliance Engine](#compliance-engine)\r\n- [Compliance Exports](#compliance-exports)\r\n- [Bulk Sync](#bulk-sync)\r\n- [Evaluation Framework](#evaluation-framework)\r\n- [Prompt Management](#prompt-management)\r\n- [Drift Detection](#drift-detection)\r\n- [Learning Analytics](#learning-analytics)\r\n- [Scoring Profiles](#scoring-profiles)\r\n- [Risk Templates](#risk-templates)\r\n- [Session Lifecycle](#session-lifecycle)\r\n- [Guard Policy Types](#guard-policy-types)\r\n- [Dashboard Data and Other Routes](#dashboard-data-and-other-routes)\r\n\r\n## Doctor (self-host diagnostics)\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/doctor` | GET | Run all check modules (database, config, auth, deployment, SDK, governance, drift guard). Returns per-check pass/fail + summary. |\r\n| `/api/doctor/fix` | POST | Apply safe auto-fixes (migrate DB, generate secrets, CORS config, seed default policy). Backs up `.env` before any write. |\r\n\r\nThe CLI (`dashclaw doctor`) invokes these endpoints. Local mode (`npm run doctor`) runs the same engine with filesystem access for env writes. Check modules + constants are emitted from the livingcode shape into `app/lib/doctor/generated/checks-from-shape.mjs`.\r\n\r\n## MCP Server\r\n\r\n**Maturity:** New (April 2026)\r\n\r\n| Endpoint | Methods | Purpose |\r\n|---|---|---|\r\n| `/api/mcp` |"},{"path":"references/platform-knowledge.md","content":"# DashClaw Platform Knowledge\r\n\r\n## Table of Contents\r\n\r\n- [What DashClaw Is](#what-dashclaw-is)\r\n- [Deployment Modes](#deployment-modes)\r\n- [Tech Stack](#tech-stack)\r\n- [Auth Chain](#auth-chain)\r\n- [ID Prefixes](#id-prefixes)\r\n- [Architectural Guardrails](#architectural-guardrails)\r\n- [Product Surfaces](#product-surfaces)\r\n- [Dashboard Navigation](#dashboard-navigation)\r\n- [CLI and Hooks Layer](#cli-and-hooks-layer)\r\n- [Extension Layer](#extension-layer)\r\n- [Signal Types](#signal-types)\r\n- [Livingcode Shape System](#livingcode-shape-system)\r\n- [Key Reference Files](#key-reference-files)\r\n\r\n## What DashClaw Is\r\n\r\nAI agent decision infrastructure. A control plane for policy enforcement, decision recording,\r\nassumption tracking, compliance mapping, security signals, messaging, evaluation scoring,\r\nprompt management, behavioral drift detection, learning analytics, scoring profiles, and operator\r\nworkflows. The governance layer for AI agent fleets.\r\n\r\n**Zero-dependency philosophy**: All features work without any LLM API key by default. The only\r\noptional LLM feature is the `llm_judge` scorer type in the Evaluation Framework.\r\n\r\n## Deployment Modes\r\n\r\n- **Marketing site** (`DASHCLAW_MODE=demo` + `NEXT_PUBLIC_DASHCLAW_MODE=demo`): dashclaw.io, fake data, no login. All writes return 403.\r\n- **Self-hosted** (`DASHCLAW_MODE=self_host`, the default): real database, GitHub/Google OAuth, API key auth.\r\n\r\nBoth modes serve the same landing page. `/demo` sets a cookie and redirects to `/dashboard` with fixture data. `/dashboard` in self-host requires login.\r\n\r\n## Tech Stack\r\n\r\n- Next.js 16 (App Router), JavaScript, Tailwind CSS 3\r\n- Postgres (TCP via `postgres`, serverless via `@neondatabase/serverless`)\r\n- Auth: NextAuth v4 for UI (GitHub, Google, or OIDC), `x-api-key` header for agents/tools\r\n- **Version:** the platform and both SDKs share one version — currently **4.0.1** (Node + Python; see `CHANGELOG.md`).\r\n- SDKs:\r\n - **Node v2 — governance runtime** (`sdk/dashclaw.js`, 104 methods across Core Governance, Scoring, Execution Studio, Messaging, Sessions, and Capability Runtime). This is the SDK that ships as the `dashclaw` package.\r\n - **Node v1 — full platform legacy** (`sdk/legacy/dashclaw-v1.js`, 187 methods), re-exported as `dashclaw/legacy` for older integrations (see `docs/sdk-parity.md`).\r\n - **Python — full platform** (`sdk-python/dashclaw/client.py`, 203 methods).\r\n- Node SDK naming: camelCase. Python SDK naming: snake_case.\r\n\r\n## Auth Chain\r\n\r\nThis is the full middleware pipeline -- critical for troubleshooting:\r\n\r\n```\r\nClient request hits middleware.js\r\n |\r\n +--> Strip x-org-id, x-org-role, x-user-id from inbound headers (ALWAYS)\r\n |\r\n +--> Rate limit check (local in-memory or Upstash Redis)\r\n | Default: 100 req/min (prod), 1000 req/min (dev)\r\n | Override: DASHCLAW_RATE_LIMIT_MAX, DASHCLAW_RATE_LIMIT_WINDOW_MS\r\n | Dev bypass: DASHCLAW_DISABLE_RATE_LIMIT=true\r\n |\r\n +--> Body size check: 2MB max for POST/PUT/PATCH\r\n |\r\n +-"},{"path":"references/troubleshooting.md","content":"# DashClaw Troubleshooting Guide\r\n\r\n## Table of Contents\r\n\r\n- [Triage: Run Doctor First](#triage-run-doctor-first)\r\n- [Error: 401 Unauthorized](#error-401-unauthorized)\r\n- [Error: 403 Forbidden](#error-403-forbidden)\r\n- [Error: 429 Rate Limited](#error-429-rate-limited)\r\n- [Error: 503 Server Misconfigured](#error-503-server-misconfigured)\r\n- [Error: redirect_uri Not Associated](#error-redirect_uri-not-associated)\r\n- [First User Not Admin](#first-user-not-admin)\r\n- [Actions Not Appearing in Dashboard](#actions-not-appearing-in-dashboard)\r\n- [Hooks Don't Fire (Fresh / Docker / Out-of-Box)](#hooks-dont-fire-fresh--docker--out-of-box)\r\n- [Blocked Actions Not Audited](#blocked-actions-not-audited)\r\n- [Agent Pairing Fails](#agent-pairing-fails)\r\n- [Guard Blocks Unexpectedly](#guard-blocks-unexpectedly)\r\n- [Session Stalled](#session-stalled)\r\n- [Branch Freshness Block](#branch-freshness-block)\r\n- [MCP Degraded](#mcp-degraded)\r\n- [Drift Guard Failed](#drift-guard-failed)\r\n- [Permission Escalation Block](#permission-escalation-block)\r\n- [Stale Running Actions / \"Other\" Bucket Dominates](#stale-running-actions--other-bucket-dominates)\r\n- [Analytics Total Cost / Tokens Show Zero](#analytics-total-cost--tokens-show-zero)\r\n- [Common Gotchas](#common-gotchas)\r\n- [General Diagnostic Approach](#general-diagnostic-approach)\r\n- [Companion Diagnostic Scripts](#companion-diagnostic-scripts)\r\n\r\n## Stale Running Actions / \"Other\" Bucket Dominates\r\n\r\n**Symptom:** Action Volume chart's \"Other\" bucket greatly exceeds Completed/Failed/Blocked. Most rows in `action_records` have `status='running'` and no `timestamp_end`.\r\n\r\n**Cause:** PreToolUse opened the action but PostToolUse never closed it (interrupted tool, agent crash, posttool HTTP failure, or — historically — the pre-2026-04-09 `updated_at` column bug).\r\n\r\n**Fix:**\r\n1. **One-shot bulk repair** — close any running action older than the threshold. Reversible (status update only, no deletion).\r\n ```bash\r\n # Preview\r\n node scripts/_run-with-env.mjs scripts/repair-stale-running-actions.mjs --dry-run --older-than-hours 1\r\n # Apply (status='completed' with auto-close summary; preserves rows with error_message → 'failed')\r\n node scripts/_run-with-env.mjs scripts/repair-stale-running-actions.mjs --older-than-hours 1\r\n ```\r\n2. **Stop re-accumulation** — install the Stop hook (`hooks/dashclaw_stop.py`). It auto-closes any action still in `status='running'` at turn end while preserving terminal statuses written by PostToolUse. Use `node scripts/install-hooks.mjs --target=.` to install all three hooks correctly.\r\n\r\n## Analytics Total Cost / Tokens Show Zero\r\n\r\n**Symptom:** `/analytics` shows `$0.00 Total Cost`, `0 Input Tokens`, `0 Output Tokens` even though Actions and Active Agents are populated.\r\n\r\n**Cause:** Agents aren't reporting `tokens_in` / `tokens_out` / `model` to `/api/actions` (POST or PATCH). Pre-2026-04-14 the PATCH route silently dropped these fields anyway.\r\n\r\n**Fix:**\r\n1. Confirm the deployed serv"}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":"DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via `python -m livingcode query`, or `GET {ba... Skill: DashClaw Platform Intelligence Owner: dashclaw Summary: DashClaw platform expert for integration, troubleshooting, and governance. Snapshot-based — prefer live queries via python -m livingcode query, or GET {ba... Tags: ai-agents:1.0.1, dashclaw:1.0.1, governance:1.0.1, integration:1.0.1, latest:1.1.2, platform-expert:1.0.1, troubleshooting:1.0.1 Version history: v1.1.2 | 2026-06-04T11:40:28.853Z | user - Adde","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":1816,"uniquenessScore":47,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-12T01:29:39.195Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-12T01:29:39.195Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-12T12:54:50.240Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}