fix(playbook §10): resolve all 12 diagnostic warnings W-001..W-012\n\n W-001 CRITICAL: Add scripts/generate_stubs.sh + Makefile to generate\n openclaude_grpc/openclaude_pb2*.py locally without a full Docker build.\n W-002 HIGH: Delete dead Rhodawk_AI_Pitch_Deck_2026.pptx (operator request).\n W-003 HIGH: Rename mcp_config.json -> mcp_config.ARCHIVE.json with archive notice.\n W-004 HIGH: formal_verifier.py — RHODAWK_Z3_ENABLED defaults to true; loud warning if skipped.\n W-005 MEDIUM: Surface RHODAWK_AUTO_MERGE state in System Status banner.\n W-006 MEDIUM: training_store.PgConn.executescript() splits multi-stmt SQL.\n W-007 MEDIUM: webhook_server returns 403 + JSON when secret unset.\n W-008 MEDIUM: hermes_orchestrator — new HERMES_PROVIDER routing flag.\n W-009 MEDIUM: New night_hunt_lock.py shared mutex across both night-hunt loops.\n W-010 MEDIUM: repo_harvester uses dynamic 30-day rolling pushed window.\n W-011 MEDIUM: lora_scheduler emits Telegram/Slack notification on export.\n W-012 MEDIUM: Live Operations tab shows System Status feature-gate banner.

Makefile

@@ -0,0 +1,25 @@
+# Rhodawk AI — Local Developer Makefile
+# Resolves W-001: provides a one-shot target to generate gRPC stubs locally
+# so the Python brain can run without requiring a full Docker build.
+
+.PHONY: help stubs install dev clean
+
+help:
+	@echo "Rhodawk AI — local developer targets"
+	@echo "  make stubs    Generate openclaude_pb2*.py gRPC stubs (W-001)"
+	@echo "  make install  pip install -r requirements.txt + grpcio-tools"
+	@echo "  make dev      Run app.py locally (requires stubs + env vars)"
+	@echo "  make clean    Remove generated gRPC stubs"
+
+stubs:
+	bash scripts/generate_stubs.sh
+
+install:
+	pip install -r requirements.txt
+	pip install grpcio-tools
+
+dev: stubs
+	python -u app.py
+
+clean:
+	rm -f openclaude_grpc/openclaude_pb2.py openclaude_grpc/openclaude_pb2_grpc.py

Rhodawk_AI_Pitch_Deck_2026.pptx

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:952a8e738f0ccbba104c32d018782ac0c2fce30e6833796a5bed5f6588c2d4d4
-size 1639252

app.py

@@ -1969,6 +1969,52 @@ with gr.Blocks(title="Rhodawk AI — Code Review Monster", theme=THEME) as demo:
         # ── TAB 1: LIVE OPERATIONS ──────────────────────────────
         with gr.Tab("⚡ Live Operations"):
 
+            # ── W-005 + W-012 FIX: SYSTEM STATUS BANNER ─────────
+            # Explicitly surface the ENABLED/DISABLED state of every major
+            # opt-in subsystem (Z3, Auto-Merge, Mythos, ARCHITECT, LoRA) so
+            # operators are never misled into thinking a tab implies a live
+            # capability. Renders once at UI build time from env vars.
+            def _flag(name: str, default: str = "false") -> str:
+                v = os.getenv(name, default).lower().strip()
+                on = v in ("1", "true", "yes", "on")
+                return ("✅ ENABLED" if on else "⚠️ DISABLED")
+
+            _z3_state         = _flag("RHODAWK_Z3_ENABLED", "true")  # W-004 default flipped
+            _auto_merge_state = _flag("RHODAWK_AUTO_MERGE", "false")
+            _mythos_state     = _flag("RHODAWK_MYTHOS", "0")
+            _architect_state  = _flag("ARCHITECT_NIGHTMODE", "0")
+            _lora_state       = _flag("RHODAWK_LORA_ENABLED", "false")
+            _hermes_provider  = os.getenv("HERMES_PROVIDER", "auto")  # W-008
+            _night_lock_state = _flag("RHODAWK_NIGHT_HUNT_LOCK", "true")  # W-009
+
+            gr.HTML(f"""
+            <div style="margin:8px 0 16px 0; padding:14px 18px;
+                        background:#0a0f1f; border:1px solid #2d3a5a;
+                        border-left:4px solid #7c3aed; border-radius:10px;
+                        font-family:ui-monospace,Menlo,monospace; font-size:0.82rem;">
+              <div style="font-weight:700; color:#a78bfa; letter-spacing:0.06em;
+                          text-transform:uppercase; margin-bottom:8px;">
+                System Status — Feature Gates
+              </div>
+              <div style="display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr));
+                          gap:6px 18px; color:#cbd5e1;">
+                <div>Z3 Formal Verification: <b>{_z3_state}</b></div>
+                <div>Auto-Merge (Conviction Engine): <b>{_auto_merge_state}</b></div>
+                <div>Mythos Multi-Agent: <b>{_mythos_state}</b></div>
+                <div>ARCHITECT Night-Mode: <b>{_architect_state}</b></div>
+                <div>LoRA Scheduler: <b>{_lora_state}</b></div>
+                <div>Night-Hunt Mutex (W-009): <b>{_night_lock_state}</b></div>
+                <div>Hermes Provider: <b>{_hermes_provider}</b></div>
+              </div>
+              <div style="margin-top:8px; color:#64748b; font-size:0.75rem;">
+                Auto-Merge is OFF by default for safety. Enable with
+                <code style="color:#a78bfa;">RHODAWK_AUTO_MERGE=true</code> only after
+                you trust the conviction engine on your repo. Disabled subsystems
+                show their tab in the UI but do NOT execute at runtime.
+              </div>
+            </div>
+            """)
+
             # ── STATUS BAR ──────────────────────────────────────
             with gr.Row():
                 stat_status = gr.Textbox(label="System Status", interactive=False, scale=3)

architect/nightmode.py

@@ -123,6 +123,35 @@ class NightRun:
 
 
 def run_one_cycle() -> NightRun:
+    # W-009 FIX: coordinate with night_hunt_orchestrator.py so the two
+    # autonomous bug-bounty loops never run overlapping cycles.
+    import sys, os as _os
+    sys.path.insert(0, _os.path.dirname(_os.path.dirname(_os.path.abspath(__file__))))
+    from night_hunt_lock import try_acquire_night_hunt, release_night_hunt, is_locked
+
+    holder = "architect-nightmode"
+    if not try_acquire_night_hunt(holder):
+        _, other, held_for = is_locked()
+        LOG.warning(
+            "ARCHITECT night-mode cycle skipped — another hunt loop (%s) "
+            "holds the lock for %.0fs already. Set RHODAWK_NIGHT_HUNT_LOCK=false "
+            "to disable this guard.", other, held_for,
+        )
+        embodied_bridge.emit_status(
+            f"Night-mode cycle skipped — lock held by {other}", "warn",
+        )
+        skip = NightRun()
+        skip.summary = {"skipped": True, "lock_holder": other}
+        skip.finished_at = _now()
+        return skip
+
+    try:
+        return _run_one_cycle_inner()
+    finally:
+        release_night_hunt(holder)
+
+
+def _run_one_cycle_inner() -> NightRun:
     run = NightRun()
     embodied_bridge.emit_status("Night-mode cycle started", "info")
 

formal_verifier.py

@@ -21,7 +21,11 @@ Enable:  RHODAWK_Z3_ENABLED=true
 import os
 import re
 
-Z3_ENABLED = os.getenv("RHODAWK_Z3_ENABLED", "false").lower() == "true"
+# W-004 FIX: Z3 formal verification gate is now ON by default.
+# z3-solver is already pinned in requirements.txt. Operators may explicitly
+# disable it with RHODAWK_Z3_ENABLED=false. A loud startup warning is emitted
+# whenever Z3 is skipped (either disabled or import failure).
+Z3_ENABLED = os.getenv("RHODAWK_Z3_ENABLED", "true").lower() == "true"
 
 _IMPORT_OK = False
 try:
@@ -30,6 +34,22 @@ try:
 except ImportError:
     pass
 
+import sys as _sys
+if not Z3_ENABLED:
+    print(
+        "[STARTUP WARNING] Z3 formal verification gate is DISABLED "
+        "(RHODAWK_Z3_ENABLED=false). Step 7b of the healing loop will "
+        "be skipped and no UNSAFE diffs will be blocked by Z3.",
+        file=_sys.stderr,
+    )
+elif not _IMPORT_OK:
+    print(
+        "[STARTUP WARNING] Z3 formal verification gate is ENABLED but "
+        "z3-solver is not installed. Run: pip install z3-solver. "
+        "Step 7b of the healing loop will return SKIP.",
+        file=_sys.stderr,
+    )
+
 
 def _extract_added_lines(diff_text: str) -> list[str]:
     return [

hermes_orchestrator.py

@@ -44,6 +44,19 @@ HERMES_MODEL       = os.getenv("HERMES_MODEL", "deepseek/deepseek-r1:free")
 HERMES_FAST_MODEL  = os.getenv("HERMES_FAST_MODEL", "deepseek/deepseek-v3:free")
 OPENROUTER_BASE    = "https://openrouter.ai/api/v1"
 
+# W-008 FIX: explicit provider routing flag so the operator can force Hermes
+# through the OpenClaude gRPC daemon (which itself fails over DO → OpenRouter
+# inside the daemon process). Without this flag, Hermes was bypassing the
+# OpenClaude daemon entirely, breaking cost attribution and rate-limit
+# budgeting.
+#
+# Allowed values:
+#   "auto"            — try DO Inference REST then OpenRouter REST (legacy)
+#   "openclaude_grpc" — route through openclaude_grpc.client (DO daemon :50051)
+#   "do"              — DO Inference REST only
+#   "openrouter"      — OpenRouter REST only
+HERMES_PROVIDER = os.getenv("HERMES_PROVIDER", "auto").lower().strip()
+
 # ── DigitalOcean Serverless Inference (PRIMARY provider) ────────────────
 # OpenAI-compatible REST API. We POST to /chat/completions just like
 # OpenRouter; only the base URL, auth header, and model name differ.
@@ -467,11 +480,38 @@ def _hermes_llm_call(messages: list[dict], model: str = None, timeout: int = 120
       2. On any non-recoverable failure or exhausted rate-limit retries,
          fall back to OpenRouter (OPENROUTER_API_KEY).
       3. If neither is configured, return a graceful no-op.
+
+    W-008 FIX: respect HERMES_PROVIDER env var. When set to
+    "openclaude_grpc" all calls are routed through the OpenClaude gRPC
+    daemon (DigitalOcean primary on :50051, OpenRouter fallback on :50052)
+    instead of bypassing the daemon with direct REST calls.
     """
     requested_model = model or HERMES_MODEL
 
+    # W-008 FIX: openclaude_grpc routing path.
+    if HERMES_PROVIDER == "openclaude_grpc":
+        try:
+            from openclaude_grpc.client import OpenClaudeClient
+            hermes_log("LLM call → openclaude_grpc daemon (:50051)", "HERMES")
+            prompt_text = "\n\n".join(
+                f"[{m.get('role', 'user').upper()}] {m.get('content', '')}"
+                for m in messages
+            )
+            client = OpenClaudeClient(host="127.0.0.1", port=50051)
+            combined, exit_code = client.chat(prompt_text, timeout=timeout)
+            try:
+                return json.loads(combined)
+            except (json.JSONDecodeError, TypeError):
+                return {"done": exit_code == 0, "summary": combined}
+        except Exception as exc:
+            hermes_log(f"openclaude_grpc routing failed: {exc} — falling back to REST",
+                       "WARN")
+            # Fall through to REST providers below.
+
     providers: list[tuple[str, str, str, str, dict]] = []
-    if DO_INFERENCE_API_KEY:
+    do_allowed = HERMES_PROVIDER in ("auto", "do", "openclaude_grpc")
+    or_allowed = HERMES_PROVIDER in ("auto", "openrouter", "openclaude_grpc")
+    if do_allowed and DO_INFERENCE_API_KEY:
         do_model = (
             _strip_provider_prefix(requested_model)
             if requested_model.startswith(("openai/",))
@@ -480,7 +520,7 @@ def _hermes_llm_call(messages: list[dict], model: str = None, timeout: int = 120
         providers.append(
             ("DigitalOcean", DO_INFERENCE_BASE, DO_INFERENCE_API_KEY, do_model, {})
         )
-    if OPENROUTER_API_KEY:
+    if or_allowed and OPENROUTER_API_KEY:
         or_model = _strip_provider_prefix(requested_model) if "/" in requested_model else requested_model
         # OpenRouter expects models in `vendor/name` form — only re-add the
         # prefix when the caller passed an `openai/...` (DO-shaped) string.

lora_scheduler.py

@@ -164,6 +164,29 @@ def run_training_export() -> dict:
         for ex in examples:
             f.write(json.dumps(ex) + "\n")
 
+    # W-011 FIX: notify operators (Telegram + Slack) on every successful
+    # LoRA JSONL export so they know fresh training data is ready, instead of
+    # silently accumulating files in /data/lora_exports/ with no consumer.
+    try:
+        import notifier as _notifier  # type: ignore
+        msg = (
+            f"📦 *Rhodawk LoRA Export*\n"
+            f"• Samples: `{len(examples)}`\n"
+            f"• Path: `{out_path}`\n"
+            f"• Timestamp: `{timestamp}`\n"
+            f"Ready for HF PEFT/TRL/AutoTrain consumption."
+        )
+        if hasattr(_notifier, "notify"):
+            _notifier.notify(msg)  # type: ignore[attr-defined]
+        elif hasattr(_notifier, "send_telegram"):
+            _notifier.send_telegram(msg)  # type: ignore[attr-defined]
+        if hasattr(_notifier, "send_slack"):
+            _notifier.send_slack(msg)  # type: ignore[attr-defined]
+    except Exception as _exc:
+        # Notifications are best-effort; never fail the export over a
+        # missing Telegram/Slack credential.
+        print(f"[lora_scheduler] notification dispatch skipped: {_exc}")
+
     state = _load_state()
     try:
         with sqlite3.connect(DB_PATH) as conn:

mcp_config.json → mcp_config.ARCHIVE.json

@@ -1,10 +1,20 @@
 {
+  "_W003_ARCHIVE_NOTICE": [
+    "This file is ARCHIVED and NOT used at runtime.",
+    "The runtime MCP config is generated by write_mcp_config() in app.py",
+    "and written to /tmp/mcp_runtime.json at the start of every audit.",
+    "Removed entries (kept here for historical reference only):",
+    "  - aider-patcher       (replaced by OpenClaude)",
+    "  - postgres-intelligence (npm package 404)",
+    "  - atheris-fuzzer      (requires Clang+libFuzzer, unavailable on HF Spaces)",
+    "Resolves W-003 (HIGH) from FOUNDER_PLAYBOOK.md section 10."
+  ],
   "_comment": [
-    "TEMPLATE ONLY — contains NO secrets.",
+    "TEMPLATE ONLY \u2014 contains NO secrets.",
     "Actual runtime config is written to /tmp/mcp_runtime.json at startup.",
-    "Secrets injected from HF Space env vars — never committed.",
+    "Secrets injected from HF Space env vars \u2014 never committed.",
     "FETCH_ALLOWED_DOMAINS prevents SSRF against internal services.",
-    "Rhodawk AI v6.0 — 37 cybersecurity MCP server suite (12 new in v6 per Masterplan §8)."
+    "Rhodawk AI v6.0 \u2014 37 cybersecurity MCP server suite (12 new in v6 per Masterplan \u00a78)."
   ],
   "mcpServers": {
     "fetch-docs": {
@@ -45,7 +55,7 @@
         "-y",
         "@modelcontextprotocol/server-memory"
       ],
-      "description": "Persistent knowledge graph — stores exploit chains, CWE patterns, and cross-session vulnerability memory"
+      "description": "Persistent knowledge graph \u2014 stores exploit chains, CWE patterns, and cross-session vulnerability memory"
     },
     "sequential-thinking": {
       "command": "npx",
@@ -91,7 +101,7 @@
         "--db-path",
         "/data/rhodawk_findings.db"
       ],
-      "description": "Local findings store — fast queries on vulnerability metadata, CVSS scores, and bounty estimates"
+      "description": "Local findings store \u2014 fast queries on vulnerability metadata, CVSS scores, and bounty estimates"
     },
     "nuclei-scanner": {
       "command": "uvx",
@@ -100,7 +110,7 @@
         "--allow-commands",
         "nuclei,nuclei-templates"
       ],
-      "description": "Nuclei template-based vulnerability scanner — DAST, CVE detection, misconfig scanning",
+      "description": "Nuclei template-based vulnerability scanner \u2014 DAST, CVE detection, misconfig scanning",
       "env": {
         "NUCLEI_TEMPLATES_PATH": "/data/nuclei-templates",
         "NUCLEI_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
@@ -113,7 +123,7 @@
         "--allow-commands",
         "semgrep"
       ],
-      "description": "Semgrep SAST — taint analysis, CWE pattern matching, secrets detection across 30+ languages",
+      "description": "Semgrep SAST \u2014 taint analysis, CWE pattern matching, secrets detection across 30+ languages",
       "env": {
         "SEMGREP_APP_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__"
       }
@@ -125,7 +135,7 @@
         "--allow-commands",
         "trufflehog"
       ],
-      "description": "TruffleHog v3 — high-signal secret scanning with 700+ detectors across git history"
+      "description": "TruffleHog v3 \u2014 high-signal secret scanning with 700+ detectors across git history"
     },
     "bandit-sast": {
       "command": "uvx",
@@ -134,7 +144,7 @@
         "--allow-commands",
         "bandit"
       ],
-      "description": "Bandit Python SAST — AST-level detection of dangerous patterns, injection sinks, insecure APIs"
+      "description": "Bandit Python SAST \u2014 AST-level detection of dangerous patterns, injection sinks, insecure APIs"
     },
     "pip-audit-sca": {
       "command": "uvx",
@@ -143,7 +153,7 @@
         "--allow-commands",
         "pip-audit,pip"
       ],
-      "description": "pip-audit SCA — known vulnerabilities in Python dependencies via OSV and PyPI Advisory DB"
+      "description": "pip-audit SCA \u2014 known vulnerabilities in Python dependencies via OSV and PyPI Advisory DB"
     },
     "osv-scanner": {
       "command": "uvx",
@@ -152,7 +162,7 @@
         "--allow-commands",
         "osv-scanner"
       ],
-      "description": "OSV Scanner — multi-ecosystem SCA using the Open Source Vulnerability database (Google)"
+      "description": "OSV Scanner \u2014 multi-ecosystem SCA using the Open Source Vulnerability database (Google)"
     },
     "z3-formal-verifier": {
       "command": "uvx",
@@ -161,7 +171,7 @@
         "--allow-commands",
         "python3"
       ],
-      "description": "Z3 SMT solver — formal verification of integer bounds, overflow invariants, protocol properties"
+      "description": "Z3 SMT solver \u2014 formal verification of integer bounds, overflow invariants, protocol properties"
     },
     "hypothesis-fuzzer": {
       "command": "uvx",
@@ -170,7 +180,7 @@
         "--allow-commands",
         "python3,pytest,hypothesis"
       ],
-      "description": "Hypothesis PBT fuzzer — property-based testing for arithmetic overflow, encoding, aliasing bugs"
+      "description": "Hypothesis PBT fuzzer \u2014 property-based testing for arithmetic overflow, encoding, aliasing bugs"
     },
     "atheris-fuzzer": {
       "command": "uvx",
@@ -179,7 +189,7 @@
         "--allow-commands",
         "python3,atheris"
       ],
-      "description": "Atheris coverage-guided fuzzer — libFuzzer-backed Python fuzzing for parser and protocol bugs"
+      "description": "Atheris coverage-guided fuzzer \u2014 libFuzzer-backed Python fuzzing for parser and protocol bugs"
     },
     "angr-symbolic": {
       "command": "uvx",
@@ -188,7 +198,7 @@
         "--allow-commands",
         "python3"
       ],
-      "description": "angr symbolic execution — binary analysis, path exploration, constraint solving for native exploits"
+      "description": "angr symbolic execution \u2014 binary analysis, path exploration, constraint solving for native exploits"
     },
     "radon-complexity": {
       "command": "uvx",
@@ -197,7 +207,7 @@
         "--allow-commands",
         "radon"
       ],
-      "description": "Radon AST complexity analysis — cyclomatic complexity, Halstead metrics, attack surface ranking"
+      "description": "Radon AST complexity analysis \u2014 cyclomatic complexity, Halstead metrics, attack surface ranking"
     },
     "ruff-linter": {
       "command": "uvx",
@@ -206,7 +216,7 @@
         "--allow-commands",
         "ruff"
       ],
-      "description": "Ruff ultra-fast Python linter — detects anti-patterns that correlate with security bugs"
+      "description": "Ruff ultra-fast Python linter \u2014 detects anti-patterns that correlate with security bugs"
     },
     "aider-patcher": {
       "command": "uvx",
@@ -215,7 +225,7 @@
         "--allow-commands",
         "aider"
       ],
-      "description": "Aider AI code editor — applies LLM-generated patches with diff verification and test re-run",
+      "description": "Aider AI code editor \u2014 applies LLM-generated patches with diff verification and test re-run",
       "env": {
         "OPENROUTER_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
       }
@@ -225,7 +235,7 @@
       "args": [
         "mcp-server-fetch"
       ],
-      "description": "NVD/NIST CVE API — fetch full CVE details, CVSS vectors, CWE mappings, affected versions",
+      "description": "NVD/NIST CVE API \u2014 fetch full CVE details, CVSS vectors, CWE mappings, affected versions",
       "env": {
         "FETCH_ALLOWED_DOMAINS": "nvd.nist.gov,cve.org,cve.mitre.org,www.cvedetails.com,vulners.com,osv.dev,opencve.io",
         "NVD_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__"
@@ -236,7 +246,7 @@
       "args": [
         "mcp-server-fetch"
       ],
-      "description": "Bug bounty platform APIs — HackerOne report submission, GitHub Security Advisories, Bugcrowd",
+      "description": "Bug bounty platform APIs \u2014 HackerOne report submission, GitHub Security Advisories, Bugcrowd",
       "env": {
         "FETCH_ALLOWED_DOMAINS": "api.hackerone.com,api.bugcrowd.com,api.intigriti.com,api.yeswehack.com,api.github.com",
         "HACKERONE_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__",
@@ -248,7 +258,7 @@
       "args": [
         "mcp-server-fetch"
       ],
-      "description": "Supply chain security — PyPI typosquatting, dependency confusion, malicious package detection",
+      "description": "Supply chain security \u2014 PyPI typosquatting, dependency confusion, malicious package detection",
       "env": {
         "FETCH_ALLOWED_DOMAINS": "pypi.org,api.pypi.org,registry.npmjs.org,crates.io,deps.dev,socket.dev,api.socket.dev"
       }
@@ -267,7 +277,7 @@
         "-m",
         "mythos.mcp.static_analysis_mcp"
       ],
-      "description": "Mythos: Tree-sitter CPG, Joern, CodeQL, Semgrep — deep semantic static analysis"
+      "description": "Mythos: Tree-sitter CPG, Joern, CodeQL, Semgrep \u2014 deep semantic static analysis"
     },
     "dynamic-analysis-mcp": {
       "command": "python",
@@ -275,7 +285,7 @@
         "-m",
         "mythos.mcp.dynamic_analysis_mcp"
       ],
-      "description": "Mythos: AFL++, KLEE, QEMU, Frida, GDB — coverage-guided + symbolic + instrumented dynamic analysis"
+      "description": "Mythos: AFL++, KLEE, QEMU, Frida, GDB \u2014 coverage-guided + symbolic + instrumented dynamic analysis"
     },
     "exploit-generation-mcp": {
       "command": "python",
@@ -283,7 +293,7 @@
         "-m",
         "mythos.mcp.exploit_generation_mcp"
       ],
-      "description": "Mythos: Pwntools, ROPGadget, heap kit, privesc KB — autonomous PoC synthesis"
+      "description": "Mythos: Pwntools, ROPGadget, heap kit, privesc KB \u2014 autonomous PoC synthesis"
     },
     "vulnerability-database-mcp": {
       "command": "python",
@@ -396,7 +406,7 @@
         "-m",
         "mythos.mcp.skill_selector_mcp"
       ],
-      "description": "Rhodawk: semantic skill selection (MiniLM) — brain extension on demand"
+      "description": "Rhodawk: semantic skill selection (MiniLM) \u2014 brain extension on demand"
     },
     "trufflehog-deep-mcp": {
       "command": "uvx",
@@ -414,7 +424,7 @@
         "--allow-commands",
         "gitleaks,git"
       ],
-      "description": "Gitleaks — complementary secret scanner with custom rules"
+      "description": "Gitleaks \u2014 complementary secret scanner with custom rules"
     },
     "semgrep-pro-patterns-mcp": {
       "command": "uvx",
@@ -496,4 +506,4 @@
       "description": "JS prototype-pollution sink scanner (AST-style grep)"
     }
   }
-}
+}

night_hunt_lock.py

@@ -0,0 +1,95 @@
+"""
+Rhodawk AI — Night Hunt Mutual Exclusion Lock
+==============================================
+Resolves W-009 (MEDIUM): two entirely separate autonomous bug-bounty hunting
+systems exist (`night_hunt_orchestrator.py` and `architect/nightmode.py`). Both
+can be enabled simultaneously and both scan the same bounty platform scope
+(HackerOne, Bugcrowd, Intigriti) with no deduplication or coordination.
+
+This module exposes a single in-process re-entrant lock that BOTH orchestrators
+must acquire before running a hunt cycle. Whichever loop wakes up first holds
+the lock for the duration of its cycle; the other simply skips this round and
+sleeps until its next scheduled wake.
+
+Cross-process protection (multi-container deployments) should layer a
+SQLite/Postgres advisory lock on top of this, but for the single-container HF
+Spaces deployment the in-process lock is sufficient.
+
+Usage:
+
+    from night_hunt_lock import try_acquire_night_hunt, release_night_hunt
+
+    if not try_acquire_night_hunt("architect-nightmode"):
+        LOG.info("another night-hunt loop is already running; skipping cycle")
+        return
+    try:
+        run_one_cycle()
+    finally:
+        release_night_hunt("architect-nightmode")
+
+Or as a context manager:
+
+    from night_hunt_lock import night_hunt_guard
+    with night_hunt_guard("night-hunt-orchestrator") as acquired:
+        if not acquired:
+            return
+        run_night_cycle()
+"""
+
+from __future__ import annotations
+
+import os
+import threading
+import time
+from contextlib import contextmanager
+
+# Operators may opt out of the cross-loop guard if they truly want both
+# loops to run independently (not recommended). Default: enabled.
+_ENABLED = os.getenv("RHODAWK_NIGHT_HUNT_LOCK", "true").lower() == "true"
+
+_LOCK = threading.Lock()
+_HOLDER: str | None = None
+_ACQUIRED_AT: float = 0.0
+
+
+def is_locked() -> tuple[bool, str | None, float]:
+    """Return (locked, holder_name, seconds_held)."""
+    with _LOCK:
+        if _HOLDER is None:
+            return (False, None, 0.0)
+        return (True, _HOLDER, time.time() - _ACQUIRED_AT)
+
+
+def try_acquire_night_hunt(holder: str) -> bool:
+    """Non-blocking acquire. Returns True if this caller now owns the lock."""
+    global _HOLDER, _ACQUIRED_AT
+    if not _ENABLED:
+        return True
+    with _LOCK:
+        if _HOLDER is not None:
+            return False
+        _HOLDER = holder
+        _ACQUIRED_AT = time.time()
+        return True
+
+
+def release_night_hunt(holder: str) -> None:
+    """Release the lock. Only the current holder may release."""
+    global _HOLDER, _ACQUIRED_AT
+    if not _ENABLED:
+        return
+    with _LOCK:
+        if _HOLDER == holder:
+            _HOLDER = None
+            _ACQUIRED_AT = 0.0
+
+
+@contextmanager
+def night_hunt_guard(holder: str):
+    """Context manager that yields True if the lock was acquired."""
+    acquired = try_acquire_night_hunt(holder)
+    try:
+        yield acquired
+    finally:
+        if acquired:
+            release_night_hunt(holder)

night_hunt_orchestrator.py

@@ -452,6 +452,28 @@ def run_night_cycle(
     max_targets: int = MAX_TARGETS,
 ) -> NightCycleReport:
     """Execute one full hunting cycle and return the report."""
+    # W-009 FIX: serialize against architect/nightmode.py so the two
+    # autonomous bug-bounty loops never run overlapping cycles against the
+    # same bounty platform scope.
+    from night_hunt_lock import try_acquire_night_hunt, release_night_hunt, is_locked
+
+    holder = "night-hunt-orchestrator"
+    if not try_acquire_night_hunt(holder):
+        locked, other, held_for = is_locked()
+        LOG.warning(
+            "night cycle skipped — another hunt loop (%s) holds the lock "
+            "for %.0fs already. Set RHODAWK_NIGHT_HUNT_LOCK=false to disable "
+            "this guard.", other, held_for,
+        )
+        skip_report = NightCycleReport(
+            cycle_id=uuid.uuid4().hex[:12],
+            started_at=datetime.now(timezone.utc).isoformat(),
+            platforms=list(platforms or DEFAULT_PLATFORMS),
+        )
+        skip_report.notes.append(f"skipped: night-hunt lock held by {other}")
+        skip_report.finished_at = datetime.now(timezone.utc).isoformat()
+        return skip_report
+
     cycle_id = uuid.uuid4().hex[:12]
     report = NightCycleReport(
         cycle_id=cycle_id,
@@ -471,19 +493,23 @@ def run_night_cycle(
         report.errors.append(f"scope:{exc}")
         return _finalise(report)
 
-    for tgt in report.targets:
-        try:
-            recon = _recon(tgt)
-            findings = _hunt(tgt, recon)
-            findings = _validate(findings)
-            for f in findings:
-                f.draft_submission = _draft_submission(f)
-            report.findings.extend(findings)
-        except Exception as exc:  # noqa: BLE001
-            LOG.exception("target %s crashed: %s", tgt.program, exc)
-            report.errors.append(f"target:{tgt.program}:{exc}")
+    try:
+        for tgt in report.targets:
+            try:
+                recon = _recon(tgt)
+                findings = _hunt(tgt, recon)
+                findings = _validate(findings)
+                for f in findings:
+                    f.draft_submission = _draft_submission(f)
+                report.findings.extend(findings)
+            except Exception as exc:  # noqa: BLE001
+                LOG.exception("target %s crashed: %s", tgt.program, exc)
+                report.errors.append(f"target:{tgt.program}:{exc}")
 
-    return _finalise(report)
+        return _finalise(report)
+    finally:
+        # W-009 FIX: always release the lock so subsequent cycles can run.
+        release_night_hunt(holder)
 
 
 def _finalise(report: NightCycleReport) -> NightCycleReport:

repo_harvester.py

@@ -22,10 +22,14 @@ import os
 import threading
 import time
 from dataclasses import dataclass, field, asdict
+from datetime import datetime, timedelta, timezone
 from typing import Optional
 
 import requests
 
+# W-010 FIX: rolling 30-day window instead of a hardcoded 2025-01-01 floor.
+HARVESTER_PUSHED_WINDOW_DAYS = int(os.getenv("RHODAWK_HARVESTER_PUSHED_WINDOW_DAYS", "30"))
+
 GITHUB_TOKEN       = os.getenv("GITHUB_TOKEN", "")
 HARVESTER_ENABLED  = os.getenv("RHODAWK_HARVESTER_ENABLED", "false").lower() == "true"
 HARVESTER_POLL_S   = int(os.getenv("RHODAWK_HARVESTER_POLL_SECONDS", "21600"))
@@ -67,10 +71,14 @@ def _gh_headers() -> dict:
 
 def _search_repos_with_failing_ci(language: str, page: int = 1) -> list[dict]:
     """Search GitHub for repos in a given language with recent activity."""
+    # W-010 FIX: dynamic rolling window — was hardcoded "pushed:>2025-01-01".
+    pushed_floor = (
+        datetime.now(timezone.utc) - timedelta(days=HARVESTER_PUSHED_WINDOW_DAYS)
+    ).strftime("%Y-%m-%d")
     q = (
         f"language:{language} "
         f"stars:>={HARVESTER_MIN_STARS} "
-        f"pushed:>2025-01-01 "
+        f"pushed:>{pushed_floor} "
         f"fork:false "
         f"is:public"
     )

scripts/generate_stubs.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# ============================================================================
+# Rhodawk AI — Local gRPC Stub Generator
+# ----------------------------------------------------------------------------
+# Resolves W-001 (CRITICAL): the openclaude_grpc/openclaude_pb2.py and
+# openclaude_grpc/openclaude_pb2_grpc.py files are NOT committed to source
+# (they are generated at Docker build time). This script generates them
+# locally so app.py can be imported and run without a full Docker build.
+#
+# Usage:
+#   bash scripts/generate_stubs.sh
+#
+# Requirements:
+#   pip install grpcio-tools
+# ============================================================================
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PROTO_DIR="${REPO_ROOT}/vendor/openclaude/src/proto"
+OUT_DIR="${REPO_ROOT}/openclaude_grpc"
+
+if [ ! -f "${PROTO_DIR}/openclaude.proto" ]; then
+    echo "[generate_stubs] ERROR: ${PROTO_DIR}/openclaude.proto not found." >&2
+    echo "[generate_stubs] The vendor/openclaude submodule may be missing." >&2
+    exit 1
+fi
+
+if ! python -c "import grpc_tools" 2>/dev/null; then
+    echo "[generate_stubs] ERROR: grpcio-tools not installed." >&2
+    echo "[generate_stubs] Run: pip install grpcio-tools" >&2
+    exit 1
+fi
+
+mkdir -p "${OUT_DIR}"
+
+echo "[generate_stubs] Generating Python gRPC stubs..."
+python -m grpc_tools.protoc \
+    -I "${PROTO_DIR}" \
+    --python_out="${OUT_DIR}" \
+    --grpc_python_out="${OUT_DIR}" \
+    "${PROTO_DIR}/openclaude.proto"
+
+# Patch the generated _grpc.py to use a relative import so it works as a
+# package module (the protoc default emits an absolute import).
+GRPC_FILE="${OUT_DIR}/openclaude_pb2_grpc.py"
+if [ -f "${GRPC_FILE}" ]; then
+    sed -i.bak 's/^import openclaude_pb2 as openclaude__pb2$/from . import openclaude_pb2 as openclaude__pb2/' "${GRPC_FILE}"
+    rm -f "${GRPC_FILE}.bak"
+fi
+
+echo "[generate_stubs] Done. Generated:"
+ls -la "${OUT_DIR}"/openclaude_pb2*.py

training_store.py

@@ -44,8 +44,35 @@ def _get_conn():
                 return cur
 
             def executescript(self, script: str):
+                # W-006 FIX: psycopg2's cursor.execute() only processes the
+                # FIRST statement of a multi-statement string. SQLite's
+                # connection.executescript() processes all of them. To match
+                # SQLite semantics, split on `;` and execute statements one at
+                # a time. We respect single/double-quoted string literals so
+                # semicolons inside SQL strings (e.g. defaults) don't break
+                # the split.
                 cur = self.conn.cursor()
-                cur.execute(script)
+                statements: list[str] = []
+                buf: list[str] = []
+                in_squote = False
+                in_dquote = False
+                for ch in script:
+                    if ch == "'" and not in_dquote:
+                        in_squote = not in_squote
+                    elif ch == '"' and not in_squote:
+                        in_dquote = not in_dquote
+                    if ch == ";" and not in_squote and not in_dquote:
+                        stmt = "".join(buf).strip()
+                        if stmt:
+                            statements.append(stmt)
+                        buf = []
+                    else:
+                        buf.append(ch)
+                tail = "".join(buf).strip()
+                if tail:
+                    statements.append(tail)
+                for stmt in statements:
+                    cur.execute(stmt)
                 return cur
 
             def commit(self):

webhook_server.py

@@ -187,6 +187,20 @@ class WebhookHandler(BaseHTTPRequestHandler):
 
         if path == "/webhook/github":
             sig = self.headers.get("X-Hub-Signature-256", "")
+            # W-007 FIX: distinguish missing-secret config from a bad signature.
+            # When RHODAWK_WEBHOOK_SECRET is unset we now return 403 with an
+            # explicit JSON error body so the operator gets an actionable
+            # response instead of a silent rejection.
+            if not WEBHOOK_SECRET:
+                _log_webhook("github", payload, "REJECTED",
+                             "RHODAWK_WEBHOOK_SECRET not configured on server")
+                self._send_json(403, {
+                    "error": "RHODAWK_WEBHOOK_SECRET not configured on server",
+                    "remediation": "Set the RHODAWK_WEBHOOK_SECRET environment variable "
+                                   "to the same shared secret configured on your GitHub "
+                                   "webhook before sending events.",
+                })
+                return
             if not _verify_github_signature(body, sig):
                 _log_webhook("github", payload, "REJECTED", "Invalid HMAC signature")
                 self._send_json(401, {"error": "Invalid signature"})