From f78c7f46ca5e98895ce6f6f5b28d7ba6b1812168 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:35:46 -0400
Subject: [PATCH 01/23] Add floating War Room launcher

---
 client/src/components/WarRoomLauncher.tsx | 30 +++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 client/src/components/WarRoomLauncher.tsx

diff --git a/client/src/components/WarRoomLauncher.tsx b/client/src/components/WarRoomLauncher.tsx
new file mode 100644
index 0000000..f707447
--- /dev/null
+++ b/client/src/components/WarRoomLauncher.tsx
@@ -0,0 +1,30 @@
+import { Link, useLocation } from "wouter";
+import { Shield, RadioTower } from "lucide-react";
+
+export default function WarRoomLauncher() {
+  const [location] = useLocation();
+  if (location === "/auth" || location.startsWith("/verify-email") || location.startsWith("/reset-password") || location.startsWith("/accept-invite") || location === "/war-room") {
+    return null;
+  }
+
+  return (
+    <Link href="/war-room">
+      <button
+        data-testid="war-room-launcher"
+        className="fixed bottom-5 right-5 z-50 group rounded-2xl border border-emerald-400/40 bg-black/90 px-4 py-3 text-emerald-300 shadow-[0_0_30px_rgba(16,185,129,0.25)] backdrop-blur-xl transition hover:border-cyan-300/70 hover:text-cyan-200 hover:shadow-[0_0_36px_rgba(34,211,238,0.30)]"
+        aria-label="Open AEGIS War Room"
+      >
+        <span className="flex items-center gap-2">
+          <span className="relative flex h-8 w-8 items-center justify-center rounded-xl border border-emerald-400/30 bg-emerald-500/10">
+            <Shield className="h-4 w-4" />
+            <RadioTower className="absolute -right-1 -top-1 h-3 w-3 animate-pulse text-cyan-300" />
+          </span>
+          <span className="text-left">
+            <span className="block text-[10px] font-mono uppercase tracking-[0.25em] text-emerald-500/80">AEGIS</span>
+            <span className="block text-sm font-semibold">War Room</span>
+          </span>
+        </span>
+      </button>
+    </Link>
+  );
+}

From e8449762502f5eee1f9e9f3dd347743481cc737f Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:36:27 -0400
Subject: [PATCH 02/23] Add cyberpunk AEGIS War Room dashboard

---
 client/src/pages/war-room.tsx | 296 ++++++++++++++++++++++++++++++++++
 1 file changed, 296 insertions(+)
 create mode 100644 client/src/pages/war-room.tsx

diff --git a/client/src/pages/war-room.tsx b/client/src/pages/war-room.tsx
new file mode 100644
index 0000000..a5d1d15
--- /dev/null
+++ b/client/src/pages/war-room.tsx
@@ -0,0 +1,296 @@
+import { useMemo, useState } from "react";
+import {
+  Activity,
+  AlertTriangle,
+  Bot,
+  Cpu,
+  Database,
+  Globe2,
+  MapPinned,
+  Orbit,
+  RadioTower,
+  Satellite,
+  Shield,
+  ShieldCheck,
+  Snowflake,
+  TriangleAlert,
+  Workflow,
+  Zap,
+} from "lucide-react";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { cn } from "@/lib/utils";
+
+const glyphs = "01ZXRYAEGIS<>[]{}//\\*+";
+
+function MatrixBackdrop() {
+  const columns = useMemo(
+    () => Array.from({ length: 34 }, (_, i) => ({
+      id: i,
+      text: Array.from({ length: 24 }, (_, j) => glyphs[(i * 7 + j * 11) % glyphs.length]).join("\n"),
+      delay: `${(i % 9) * 0.17}s`,
+      duration: `${4 + (i % 6) * 0.65}s`,
+      opacity: 0.08 + (i % 5) * 0.025,
+    })),
+    []
+  );
+
+  return (
+    <div className="pointer-events-none absolute inset-0 overflow-hidden" aria-hidden="true">
+      <div className="absolute inset-0 bg-[radial-gradient(circle_at_top,rgba(16,185,129,0.10),transparent_42%),radial-gradient(circle_at_80%_20%,rgba(34,211,238,0.08),transparent_34%)]" />
+      <div className="absolute inset-0 flex justify-between px-2 font-mono text-[10px] leading-4 text-emerald-400">
+        {columns.map((column) => (
+          <pre
+            key={column.id}
+            className="whitespace-pre text-center animate-pulse"
+            style={{ animationDelay: column.delay, animationDuration: column.duration, opacity: column.opacity }}
+          >
+            {column.text}
+          </pre>
+        ))}
+      </div>
+      <div className="absolute inset-0 bg-gradient-to-b from-background/70 via-background/85 to-background" />
+    </div>
+  );
+}
+
+const statusTiles = [
+  { label: "Golden Shield", value: "ENFORCED", icon: ShieldCheck, tone: "text-emerald-300" },
+  { label: "Mission Twin", value: "STANDBY", icon: Workflow, tone: "text-cyan-300" },
+  { label: "ETHER", value: "EVIDENCE READY", icon: Database, tone: "text-violet-300" },
+  { label: "MITO", value: "HUMAN-GATED", icon: Cpu, tone: "text-amber-300" },
+];
+
+const safeFeeds = [
+  {
+    title: "Public Geospatial Scout",
+    icon: MapPinned,
+    status: "SAFE DATA MODE",
+    description: "Public, non-sensitive geospatial overlays for infrastructure resilience, weather, logistics, research facilities, and simulated exercises.",
+  },
+  {
+    title: "Orbital Awareness",
+    icon: Satellite,
+    status: "PUBLIC / SIMULATED",
+    description: "Visualization-ready orbital context for public ephemeris and simulated satellites. No targeting, weapon cueing, or protected mission telemetry.",
+  },
+  {
+    title: "Antarctica Research Watch",
+    icon: Snowflake,
+    status: "RESEARCH MODE",
+    description: "Climate, communications, logistics, and public research-station awareness for continuity planning and scientific operations.",
+  },
+  {
+    title: "Critical Infrastructure",
+    icon: Zap,
+    status: "RESILIENCE ONLY",
+    description: "High-level dependency and continuity modeling for authorized infrastructure data without exposing exploitable operational details.",
+  },
+];
+
+const eventStream = [
+  "[ETHER] War Room interface initialized",
+  "[SHIELD] Execution path requires proof-carrying action",
+  "[SCOUT] Geospatial layer restricted to public/simulated data",
+  "[ORBIT] Orbital view running in awareness-only mode",
+  "[AEGIS] Targeting / weapon-control pathways unavailable",
+  "[MITO] Defensive execution remains human-authorized",
+];
+
+export default function WarRoomPage() {
+  const [mode, setMode] = useState<"LIVE" | "SIMULATION">("SIMULATION");
+
+  return (
+    <div className="relative min-h-full overflow-hidden bg-[#020706] text-foreground">
+      <MatrixBackdrop />
+
+      <div className="relative z-10 mx-auto max-w-[1600px] space-y-5 p-4 md:p-6">
+        <div className="rounded-2xl border border-emerald-400/20 bg-black/55 p-5 shadow-[0_0_50px_rgba(16,185,129,0.10)] backdrop-blur-xl">
+          <div className="flex flex-col gap-4 lg:flex-row lg:items-center lg:justify-between">
+            <div>
+              <div className="mb-2 flex flex-wrap items-center gap-2">
+                <Badge className="border border-emerald-400/30 bg-emerald-500/10 text-emerald-300 hover:bg-emerald-500/10">
+                  AEGIS WAR ROOM
+                </Badge>
+                <Badge variant="outline" className="border-cyan-400/30 text-cyan-300">
+                  DEFENSIVE DECISION SUPPORT
+                </Badge>
+                <Badge variant="outline" className="border-amber-400/30 text-amber-300">
+                  HUMAN AUTHORITY REQUIRED
+                </Badge>
+              </div>
+              <h1 className="font-mono text-2xl font-black tracking-tight text-emerald-100 md:text-4xl">
+                XRAYCLOUD // COMMAND RESILIENCE MATRIX
+              </h1>
+              <p className="mt-2 max-w-4xl text-sm text-emerald-100/65 md:text-base">
+                Cyberpunk command visualization for defensive mission assurance, infrastructure resilience, public geospatial awareness,
+                evidence, continuity planning, and governed AI recommendations.
+              </p>
+            </div>
+
+            <div className="flex items-center gap-2 rounded-xl border border-emerald-400/20 bg-black/70 p-2">
+              <Button
+                size="sm"
+                variant={mode === "SIMULATION" ? "default" : "outline"}
+                onClick={() => setMode("SIMULATION")}
+                className={cn(mode === "SIMULATION" && "bg-emerald-500 text-black hover:bg-emerald-400")}
+              >
+                SIMULATION
+              </Button>
+              <Button
+                size="sm"
+                variant={mode === "LIVE" ? "default" : "outline"}
+                onClick={() => setMode("LIVE")}
+                className={cn(mode === "LIVE" && "bg-cyan-500 text-black hover:bg-cyan-400")}
+              >
+                LIVE VIEW
+              </Button>
+            </div>
+          </div>
+
+          <div className="mt-4 flex items-center gap-2 rounded-xl border border-amber-400/20 bg-amber-500/5 px-3 py-2 text-xs text-amber-200/80">
+            <AlertTriangle className="h-4 w-4 shrink-0" />
+            {mode === "SIMULATION"
+              ? "Simulation mode: visualization uses demonstration state only; no external systems are controlled."
+              : "Live view is display-only until verified authorized data connectors are configured; unknown data remains UNKNOWN."}
+          </div>
+        </div>
+
+        <div className="grid gap-3 sm:grid-cols-2 xl:grid-cols-4">
+          {statusTiles.map(({ label, value, icon: Icon, tone }) => (
+            <Card key={label} className="border-emerald-400/15 bg-black/55 backdrop-blur-xl">
+              <CardContent className="flex items-center justify-between p-4">
+                <div>
+                  <div className="text-[10px] font-mono uppercase tracking-[0.22em] text-muted-foreground">{label}</div>
+                  <div className={cn("mt-1 font-mono text-sm font-bold", tone)}>{value}</div>
+                </div>
+                <div className="rounded-xl border border-emerald-400/15 bg-emerald-500/5 p-2">
+                  <Icon className={cn("h-5 w-5", tone)} />
+                </div>
+              </CardContent>
+            </Card>
+          ))}
+        </div>
+
+        <div className="grid gap-5 xl:grid-cols-[1.35fr_0.65fr]">
+          <Card className="overflow-hidden border-cyan-400/20 bg-black/55 backdrop-blur-xl">
+            <CardHeader className="border-b border-cyan-400/10">
+              <CardTitle className="flex items-center gap-2 font-mono text-cyan-200">
+                <Globe2 className="h-5 w-5" /> Scout // Geospatial + Orbital Awareness
+              </CardTitle>
+            </CardHeader>
+            <CardContent className="p-0">
+              <div className="relative min-h-[430px] overflow-hidden bg-[radial-gradient(circle_at_center,rgba(6,182,212,0.10),transparent_50%),linear-gradient(rgba(16,185,129,0.04)_1px,transparent_1px),linear-gradient(90deg,rgba(16,185,129,0.04)_1px,transparent_1px)] bg-[size:auto,32px_32px,32px_32px]">
+                <div className="absolute inset-6 rounded-full border border-cyan-400/15" />
+                <div className="absolute inset-20 rounded-full border border-emerald-400/10" />
+                <div className="absolute left-[48%] top-[43%] h-28 w-28 rounded-full border border-cyan-300/20 bg-cyan-400/5 shadow-[0_0_60px_rgba(34,211,238,0.12)]" />
+                <div className="absolute left-[51%] top-[46%] h-16 w-16 rounded-full border border-emerald-300/20 bg-emerald-400/5" />
+
+                {[
+                  ["PUBLIC SATCOM", "18%", "24%", Satellite],
+                  ["ANTARCTICA RESEARCH", "70%", "70%", Snowflake],
+                  ["RESILIENCE REGION", "23%", "67%", Shield],
+                  ["SIMULATED AIR NODE", "76%", "30%", RadioTower],
+                ].map(([label, top, left, Icon]: any) => (
+                  <div key={label} className="absolute" style={{ top, left }}>
+                    <div className="group relative flex items-center gap-2 rounded-lg border border-emerald-400/30 bg-black/80 px-2 py-1.5 font-mono text-[10px] text-emerald-200 shadow-[0_0_18px_rgba(16,185,129,0.15)]">
+                      <Icon className="h-3.5 w-3.5 text-cyan-300" />
+                      {label}
+                      <span className="absolute -left-1 -top-1 h-2 w-2 animate-ping rounded-full bg-emerald-400/60" />
+                    </div>
+                  </div>
+                ))}
+
+                <div className="absolute bottom-4 left-4 right-4 rounded-xl border border-cyan-400/15 bg-black/70 p-3 font-mono text-[10px] text-cyan-100/65 backdrop-blur">
+                  DATA POLICY: PUBLIC / SIMULATED / NON-SENSITIVE ONLY • NO TARGETING • NO LIVE WEAPON TELEMETRY • NO DRONE CONTROL
+                </div>
+              </div>
+            </CardContent>
+          </Card>
+
+          <Card className="border-emerald-400/20 bg-black/60 backdrop-blur-xl">
+            <CardHeader className="border-b border-emerald-400/10">
+              <CardTitle className="flex items-center gap-2 font-mono text-emerald-200">
+                <Activity className="h-5 w-5" /> ETHER Event Stream
+              </CardTitle>
+            </CardHeader>
+            <CardContent className="space-y-3 p-4">
+              {eventStream.map((event, index) => (
+                <div key={event} className="flex gap-3 font-mono text-xs">
+                  <span className="text-emerald-500/50">{String(index + 1).padStart(2, "0")}</span>
+                  <span className="text-emerald-100/75">{event}</span>
+                </div>
+              ))}
+              <div className="mt-5 rounded-xl border border-violet-400/20 bg-violet-500/5 p-3">
+                <div className="flex items-center gap-2 text-xs font-semibold text-violet-200">
+                  <Bot className="h-4 w-4" /> GPT-DOUG-MAX
+                </div>
+                <p className="mt-2 text-xs leading-relaxed text-violet-100/60">
+                  Recommendations remain advisory until Golden Shield, policy, authority, and human approval requirements are satisfied.
+                </p>
+              </div>
+            </CardContent>
+          </Card>
+        </div>
+
+        <div className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
+          {safeFeeds.map(({ title, icon: Icon, status, description }) => (
+            <Card key={title} className="border-emerald-400/15 bg-black/50 backdrop-blur-xl transition hover:border-cyan-400/30">
+              <CardContent className="p-4">
+                <div className="flex items-start justify-between gap-3">
+                  <div className="rounded-xl border border-cyan-400/15 bg-cyan-500/5 p-2">
+                    <Icon className="h-5 w-5 text-cyan-300" />
+                  </div>
+                  <Badge variant="outline" className="border-emerald-400/20 font-mono text-[9px] text-emerald-300">
+                    {status}
+                  </Badge>
+                </div>
+                <h3 className="mt-4 font-mono text-sm font-bold text-emerald-100">{title}</h3>
+                <p className="mt-2 text-xs leading-relaxed text-muted-foreground">{description}</p>
+              </CardContent>
+            </Card>
+          ))}
+        </div>
+
+        <div className="grid gap-4 lg:grid-cols-3">
+          <Card className="border-red-400/15 bg-black/55 backdrop-blur-xl">
+            <CardHeader>
+              <CardTitle className="flex items-center gap-2 font-mono text-sm text-red-200">
+                <TriangleAlert className="h-4 w-4" /> Weapon / Drone Control Boundary
+              </CardTitle>
+            </CardHeader>
+            <CardContent className="text-xs leading-relaxed text-red-100/60">
+              War Room may visualize authorized readiness and simulation data, but it does not provide target selection, weapon release,
+              firing solutions, strike planning, autonomous lethal decisions, or direct drone flight / payload control.
+            </CardContent>
+          </Card>
+
+          <Card className="border-cyan-400/15 bg-black/55 backdrop-blur-xl">
+            <CardHeader>
+              <CardTitle className="flex items-center gap-2 font-mono text-sm text-cyan-200">
+                <Orbit className="h-4 w-4" /> Orbital / Space Boundary
+              </CardTitle>
+            </CardHeader>
+            <CardContent className="text-xs leading-relaxed text-cyan-100/60">
+              Public orbital data and simulated assets may be visualized for awareness and continuity. Protected telemetry, military cueing,
+              targeting correlations, or unauthorized satellite control are excluded.
+            </CardContent>
+          </Card>
+
+          <Card className="border-emerald-400/15 bg-black/55 backdrop-blur-xl">
+            <CardHeader>
+              <CardTitle className="flex items-center gap-2 font-mono text-sm text-emerald-200">
+                <Shield className="h-4 w-4" /> Infrastructure Boundary
+              </CardTitle>
+            </CardHeader>
+            <CardContent className="text-xs leading-relaxed text-emerald-100/60">
+              Critical-infrastructure analysis is restricted to resilience, continuity, maintenance, and authorized defensive decision support;
+              the interface must not expose actionable vulnerability or exploitation details.
+            </CardContent>
+          </Card>
+        </div>
+      </div>
+    </div>
+  );
+}

From f242e16d7996b368a287c9b9a7222046d94654a8 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:37:02 -0400
Subject: [PATCH 03/23] Wire AEGIS War Room route and launcher

---
 client/src/App.tsx | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/client/src/App.tsx b/client/src/App.tsx
index c44f0fc..b5dc78f 100644
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -60,7 +60,9 @@ import AuditLogsPage from "@/pages/audit-logs";
 import ThreatSimulationPage from "@/pages/threat-simulation";
 import ThreatDetailPage from "@/pages/threat-detail";
 import IncidentDetailPage from "@/pages/incident-detail";
+import WarRoomPage from "@/pages/war-room";
 import Layout from "@/components/Layout";
+import WarRoomLauncher from "@/components/WarRoomLauncher";
 import type { AuthUser } from "@/lib/auth";
 
 function ProtectedRoute({ component: Component }: { component: () => JSX.Element | null }) {
@@ -124,6 +126,7 @@ function Router() {
       <Route path="/reset-password" component={ResetPasswordPage} />
       <Route path="/accept-invite" component={AcceptInvitePage} />
       <Route path="/dashboard">{() => <ProtectedRoute component={Dashboard} />}</Route>
+      <Route path="/war-room">{() => <ProtectedRoute component={WarRoomPage} />}</Route>
       <Route path="/scans/:id">{() => <ProtectedRoute component={ScanDetail} />}</Route>
       <Route path="/scans">{() => <ProtectedRoute component={Scans} />}</Route>
       <Route path="/compliance">{() => <ProtectedRoute component={Compliance} />}</Route>
@@ -190,6 +193,7 @@ function App() {
         <TooltipProvider>
           <Toaster />
           <Router />
+          <WarRoomLauncher />
         </TooltipProvider>
       </ThemeProvider>
     </QueryClientProvider>

From 0a5febd791b2ae7e52c35b60d93832b5651bb60c Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:40:33 -0400
Subject: [PATCH 04/23] Add War Room safety and connector state core

---
 server/war-room-core.ts | 62 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 server/war-room-core.ts

diff --git a/server/war-room-core.ts b/server/war-room-core.ts
new file mode 100644
index 0000000..37ca1c5
--- /dev/null
+++ b/server/war-room-core.ts
@@ -0,0 +1,62 @@
+export type ConnectorState = "CONNECTED" | "DEGRADED" | "UNAVAILABLE" | "UNKNOWN";
+
+export type WarRoomConnector = {
+  id: string;
+  label: string;
+  category: "LOCAL" | "PUBLIC_WEATHER" | "PUBLIC_ORBITAL" | "PUBLIC_RESEARCH";
+  state: ConnectorState;
+  source: string;
+  observedAt: string;
+  detail?: Record<string, string | number | boolean | null>;
+  error?: string;
+};
+
+const blockedPatterns: Array<{ pattern: RegExp; reason: string }> = [
+  { pattern: /\b(target|targeting|target selection|target acquisition)\b/i, reason: "Target selection and targeting are outside the War Room safety boundary." },
+  { pattern: /\b(weapon release|fire control|firing solution|engagement control|strike planning)\b/i, reason: "Weapon employment and fire-control functions are not available." },
+  { pattern: /\b(drone control|flight control|payload control|autonomous strike|autonomous lethal)\b/i, reason: "Direct drone flight/payload control and autonomous lethal functions are not available." },
+  { pattern: /\b(offensive cyber|exploit deployment|malware deployment|intrusion execution)\b/i, reason: "Offensive cyber execution is outside the defensive mission-assurance boundary." },
+];
+
+export function checkWarRoomCapability(request: string): { allowed: boolean; reason: string } {
+  const text = request.trim();
+  if (!text) return { allowed: false, reason: "A capability description is required." };
+
+  for (const rule of blockedPatterns) {
+    if (rule.pattern.test(text)) return { allowed: false, reason: rule.reason };
+  }
+
+  return {
+    allowed: true,
+    reason: "Permitted for defensive decision support, readiness, maintenance, resilience, public awareness, or simulation subject to normal authorization.",
+  };
+}
+
+export function connectorFailure(
+  id: string,
+  label: string,
+  category: WarRoomConnector["category"],
+  source: string,
+  error: unknown,
+): WarRoomConnector {
+  return {
+    id,
+    label,
+    category,
+    state: "UNAVAILABLE",
+    source,
+    observedAt: new Date().toISOString(),
+    error: error instanceof Error ? error.message.slice(0, 240) : "Connector request failed",
+  };
+}
+
+export function summarizeConnectorStates(connectors: WarRoomConnector[]) {
+  return connectors.reduce(
+    (acc, connector) => {
+      acc.total += 1;
+      acc[connector.state.toLowerCase() as "connected" | "degraded" | "unavailable" | "unknown"] += 1;
+      return acc;
+    },
+    { total: 0, connected: 0, degraded: 0, unavailable: 0, unknown: 0 },
+  );
+}

From e9257b22d0df30e2994dbd34870ce99d51151a52 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:40:40 -0400
Subject: [PATCH 05/23] Add War Room boundary tests

---
 server/war-room.test.ts | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 server/war-room.test.ts

diff --git a/server/war-room.test.ts b/server/war-room.test.ts
new file mode 100644
index 0000000..d3c6de9
--- /dev/null
+++ b/server/war-room.test.ts
@@ -0,0 +1,33 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { checkWarRoomCapability, summarizeConnectorStates, type WarRoomConnector } from "./war-room-core";
+
+test("blocks targeting and weapon-control requests", () => {
+  assert.equal(checkWarRoomCapability("target selection for a strike").allowed, false);
+  assert.equal(checkWarRoomCapability("weapon release workflow").allowed, false);
+  assert.equal(checkWarRoomCapability("direct drone control").allowed, false);
+  assert.equal(checkWarRoomCapability("offensive cyber intrusion execution").allowed, false);
+});
+
+test("allows defensive readiness and public-awareness use cases", () => {
+  assert.equal(checkWarRoomCapability("drone maintenance readiness telemetry").allowed, true);
+  assert.equal(checkWarRoomCapability("public orbital awareness dashboard").allowed, true);
+  assert.equal(checkWarRoomCapability("critical infrastructure continuity planning").allowed, true);
+  assert.equal(checkWarRoomCapability("weapon system maintenance readiness status").allowed, true);
+});
+
+test("summarizes connector states without converting unavailable into healthy", () => {
+  const connectors: WarRoomConnector[] = [
+    { id: "a", label: "A", category: "LOCAL", state: "CONNECTED", source: "local", observedAt: new Date(0).toISOString() },
+    { id: "b", label: "B", category: "PUBLIC_WEATHER", state: "UNAVAILABLE", source: "public", observedAt: new Date(0).toISOString() },
+    { id: "c", label: "C", category: "PUBLIC_ORBITAL", state: "UNKNOWN", source: "public", observedAt: new Date(0).toISOString() },
+  ];
+
+  assert.deepEqual(summarizeConnectorStates(connectors), {
+    total: 3,
+    connected: 1,
+    degraded: 0,
+    unavailable: 1,
+    unknown: 1,
+  });
+});

From a07f99aa9491a19bc7bcb5be3894d00549a17153 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:40:57 -0400
Subject: [PATCH 06/23] Add safe live War Room connector API

---
 server/war-room.ts | 164 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 164 insertions(+)
 create mode 100644 server/war-room.ts

diff --git a/server/war-room.ts b/server/war-room.ts
new file mode 100644
index 0000000..f4c8d1c
--- /dev/null
+++ b/server/war-room.ts
@@ -0,0 +1,164 @@
+import type { Express, Request, Response } from "express";
+import { z } from "zod";
+import { requireAuth } from "./auth";
+import {
+  checkWarRoomCapability,
+  connectorFailure,
+  summarizeConnectorStates,
+  type WarRoomConnector,
+} from "./war-room-core";
+
+const capabilitySchema = z.object({ request: z.string().min(1).max(500) }).strict();
+
+async function fetchJson(url: string, timeoutMs = 3500): Promise<unknown> {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, {
+      signal: controller.signal,
+      headers: { "User-Agent": "XRAYCLOUD-AEGIS/1.0 (defensive decision support)" },
+    });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    return await response.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function weatherConnector(): Promise<WarRoomConnector> {
+  const source = "https://api.weather.gov/alerts/active";
+  try {
+    const payload = await fetchJson(source) as { features?: unknown[]; updated?: string };
+    return {
+      id: "public-weather",
+      label: "National Weather Service public alerts",
+      category: "PUBLIC_WEATHER",
+      state: "CONNECTED",
+      source,
+      observedAt: new Date().toISOString(),
+      detail: {
+        activeAlerts: Array.isArray(payload.features) ? payload.features.length : 0,
+        sourceUpdatedAt: typeof payload.updated === "string" ? payload.updated : null,
+      },
+    };
+  } catch (error) {
+    return connectorFailure("public-weather", "National Weather Service public alerts", "PUBLIC_WEATHER", source, error);
+  }
+}
+
+async function orbitalConnector(): Promise<WarRoomConnector> {
+  const source = "https://celestrak.org/NORAD/elements/gp.php?GROUP=stations&FORMAT=json";
+  try {
+    const payload = await fetchJson(source) as unknown[];
+    return {
+      id: "public-orbital",
+      label: "CelesTrak public orbital catalog (stations group)",
+      category: "PUBLIC_ORBITAL",
+      state: "CONNECTED",
+      source,
+      observedAt: new Date().toISOString(),
+      detail: {
+        publicObjects: Array.isArray(payload) ? payload.length : 0,
+        mode: "AGGREGATE_ONLY",
+      },
+    };
+  } catch (error) {
+    return connectorFailure("public-orbital", "CelesTrak public orbital catalog (stations group)", "PUBLIC_ORBITAL", source, error);
+  }
+}
+
+async function antarcticaConnector(): Promise<WarRoomConnector> {
+  const source = "https://api.open-meteo.com/v1/forecast?latitude=-77.8419&longitude=166.6863&current=temperature_2m,wind_speed_10m&timezone=UTC";
+  try {
+    const payload = await fetchJson(source) as {
+      current?: { temperature_2m?: number; wind_speed_10m?: number; time?: string };
+    };
+    return {
+      id: "antarctica-public-weather",
+      label: "Antarctica public weather context (McMurdo region)",
+      category: "PUBLIC_RESEARCH",
+      state: "CONNECTED",
+      source,
+      observedAt: new Date().toISOString(),
+      detail: {
+        temperatureC: typeof payload.current?.temperature_2m === "number" ? payload.current.temperature_2m : null,
+        windKph: typeof payload.current?.wind_speed_10m === "number" ? payload.current.wind_speed_10m : null,
+        sourceTime: typeof payload.current?.time === "string" ? payload.current.time : null,
+      },
+    };
+  } catch (error) {
+    return connectorFailure("antarctica-public-weather", "Antarctica public weather context (McMurdo region)", "PUBLIC_RESEARCH", source, error);
+  }
+}
+
+function localConnector(): WarRoomConnector {
+  return {
+    id: "zyra-local",
+    label: "Zyra local control-plane heartbeat",
+    category: "LOCAL",
+    state: "CONNECTED",
+    source: "local://zyra",
+    observedAt: new Date().toISOString(),
+    detail: { authenticatedApi: true, executionPath: "DISPLAY_ONLY" },
+  };
+}
+
+export function registerWarRoomRoutes(app: Express) {
+  app.get("/api/war-room/status", requireAuth, async (_req: Request, res: Response) => {
+    const connectors = await Promise.all([
+      Promise.resolve(localConnector()),
+      weatherConnector(),
+      orbitalConnector(),
+      antarcticaConnector(),
+    ]);
+
+    return res.json({
+      mode: "DEFENSIVE_DECISION_SUPPORT",
+      execution: "DISPLAY_ONLY",
+      observedAt: new Date().toISOString(),
+      connectors,
+      summary: summarizeConnectorStates(connectors),
+      components: {
+        warRoomUi: "CONNECTED",
+        livePublicData: connectors.some(c => c.category !== "LOCAL" && c.state === "CONNECTED") ? "CONNECTED" : "DEGRADED",
+        goldenShieldExecution: "NOT_CONNECTED",
+        missionTwinExecution: "NOT_CONNECTED",
+        mitoExecution: "DISABLED",
+        etherPersistence: "NOT_CONNECTED",
+      },
+      allowedDecisionSupport: [
+        "defensive readiness",
+        "maintenance readiness",
+        "public geospatial awareness",
+        "public orbital awareness",
+        "continuity planning",
+        "critical-infrastructure resilience",
+        "drone maintenance/readiness telemetry",
+        "weapon-system maintenance/readiness telemetry",
+      ],
+      blockedControlFunctions: [
+        "target selection",
+        "weapon release",
+        "fire control",
+        "strike planning",
+        "direct drone flight control",
+        "drone payload control",
+        "autonomous lethal action",
+        "offensive cyber execution",
+      ],
+    });
+  });
+
+  app.post("/api/war-room/capability-check", requireAuth, (req: Request, res: Response) => {
+    const parsed = capabilitySchema.safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ message: "Invalid capability request" });
+
+    const result = checkWarRoomCapability(parsed.data.request);
+    return res.status(result.allowed ? 200 : 403).json({
+      ...result,
+      request: parsed.data.request,
+      mode: "POLICY_CHECK_ONLY",
+      executesAnything: false,
+    });
+  });
+}

From 6b304c9f1c1e3de566b3cffa7dcc2493220fe3d9 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:41:20 -0400
Subject: [PATCH 07/23] Register War Room live data routes

---
 server/index.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server/index.ts b/server/index.ts
index bf21683..6dea4c4 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -2,6 +2,7 @@ import express, { type Request, Response, NextFunction } from "express";
 import helmet from "helmet";
 import rateLimit from "express-rate-limit";
 import { registerRoutes } from "./routes";
+import { registerWarRoomRoutes } from "./war-room";
 import { serveStatic } from "./static";
 import { createServer } from "http";
 
@@ -157,6 +158,7 @@ app.use((req, res, next) => {
 
 (async () => {
   await registerRoutes(httpServer, app);
+  registerWarRoomRoutes(app);
 
   app.use((err: any, _req: Request, res: Response, next: NextFunction) => {
     if (res.headersSent) {
@@ -194,6 +196,7 @@ app.use((req, res, next) => {
         process.env.STRIPE_SECRET_KEY ? "stripe" : null,
         process.env.BOOTSTRAP_SECRET ? "bootstrap" : null,
         process.env.HF_TOKEN ? "vision-ai" : null,
+        "aegis-war-room",
       ].filter(Boolean);
       console.log(`\n  ╔═══════════════════════════════════════╗`);
       console.log(`  ║  ZYRA Cybersecurity Platform          ║`);

From e54db08a22b558e7a50af2ee5675ff7bb1bffe38 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:42:00 -0400
Subject: [PATCH 08/23] Connect War Room UI to live public data fabric

---
 client/src/pages/war-room.tsx | 275 +++++++++++++++-------------------
 1 file changed, 118 insertions(+), 157 deletions(-)

diff --git a/client/src/pages/war-room.tsx b/client/src/pages/war-room.tsx
index a5d1d15..c21ac4a 100644
--- a/client/src/pages/war-room.tsx
+++ b/client/src/pages/war-room.tsx
@@ -1,4 +1,5 @@
 import { useMemo, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
 import {
   Activity,
   AlertTriangle,
@@ -24,6 +25,30 @@ import { cn } from "@/lib/utils";
 
 const glyphs = "01ZXRYAEGIS<>[]{}//\\*+";
 
+type ConnectorState = "CONNECTED" | "DEGRADED" | "UNAVAILABLE" | "UNKNOWN";
+
+type WarRoomConnector = {
+  id: string;
+  label: string;
+  category: "LOCAL" | "PUBLIC_WEATHER" | "PUBLIC_ORBITAL" | "PUBLIC_RESEARCH";
+  state: ConnectorState;
+  source: string;
+  observedAt: string;
+  detail?: Record<string, string | number | boolean | null>;
+  error?: string;
+};
+
+type WarRoomStatus = {
+  mode: string;
+  execution: string;
+  observedAt: string;
+  connectors: WarRoomConnector[];
+  summary: { total: number; connected: number; degraded: number; unavailable: number; unknown: number };
+  components: Record<string, string>;
+  allowedDecisionSupport: string[];
+  blockedControlFunctions: string[];
+};
+
 function MatrixBackdrop() {
   const columns = useMemo(
     () => Array.from({ length: 34 }, (_, i) => ({
@@ -33,14 +58,14 @@ function MatrixBackdrop() {
       duration: `${4 + (i % 6) * 0.65}s`,
       opacity: 0.08 + (i % 5) * 0.025,
     })),
-    []
+    [],
   );
 
   return (
     <div className="pointer-events-none absolute inset-0 overflow-hidden" aria-hidden="true">
       <div className="absolute inset-0 bg-[radial-gradient(circle_at_top,rgba(16,185,129,0.10),transparent_42%),radial-gradient(circle_at_80%_20%,rgba(34,211,238,0.08),transparent_34%)]" />
       <div className="absolute inset-0 flex justify-between px-2 font-mono text-[10px] leading-4 text-emerald-400">
-        {columns.map((column) => (
+        {columns.map(column => (
           <pre
             key={column.id}
             className="whitespace-pre text-center animate-pulse"
@@ -55,155 +80,112 @@ function MatrixBackdrop() {
   );
 }
 
-const statusTiles = [
-  { label: "Golden Shield", value: "ENFORCED", icon: ShieldCheck, tone: "text-emerald-300" },
-  { label: "Mission Twin", value: "STANDBY", icon: Workflow, tone: "text-cyan-300" },
-  { label: "ETHER", value: "EVIDENCE READY", icon: Database, tone: "text-violet-300" },
-  { label: "MITO", value: "HUMAN-GATED", icon: Cpu, tone: "text-amber-300" },
-];
-
-const safeFeeds = [
-  {
-    title: "Public Geospatial Scout",
-    icon: MapPinned,
-    status: "SAFE DATA MODE",
-    description: "Public, non-sensitive geospatial overlays for infrastructure resilience, weather, logistics, research facilities, and simulated exercises.",
-  },
-  {
-    title: "Orbital Awareness",
-    icon: Satellite,
-    status: "PUBLIC / SIMULATED",
-    description: "Visualization-ready orbital context for public ephemeris and simulated satellites. No targeting, weapon cueing, or protected mission telemetry.",
-  },
-  {
-    title: "Antarctica Research Watch",
-    icon: Snowflake,
-    status: "RESEARCH MODE",
-    description: "Climate, communications, logistics, and public research-station awareness for continuity planning and scientific operations.",
-  },
-  {
-    title: "Critical Infrastructure",
-    icon: Zap,
-    status: "RESILIENCE ONLY",
-    description: "High-level dependency and continuity modeling for authorized infrastructure data without exposing exploitable operational details.",
-  },
-];
+function stateClass(state: string) {
+  if (state === "CONNECTED") return "text-emerald-300 border-emerald-400/30 bg-emerald-500/10";
+  if (state === "DEGRADED") return "text-amber-300 border-amber-400/30 bg-amber-500/10";
+  if (state === "UNAVAILABLE") return "text-red-300 border-red-400/30 bg-red-500/10";
+  return "text-slate-300 border-slate-400/30 bg-slate-500/10";
+}
 
-const eventStream = [
-  "[ETHER] War Room interface initialized",
-  "[SHIELD] Execution path requires proof-carrying action",
-  "[SCOUT] Geospatial layer restricted to public/simulated data",
-  "[ORBIT] Orbital view running in awareness-only mode",
-  "[AEGIS] Targeting / weapon-control pathways unavailable",
-  "[MITO] Defensive execution remains human-authorized",
-];
+function detailLine(connector: WarRoomConnector) {
+  if (connector.error) return connector.error;
+  if (!connector.detail) return "No additional detail";
+  return Object.entries(connector.detail)
+    .map(([key, value]) => `${key}: ${value ?? "UNKNOWN"}`)
+    .join(" • ");
+}
 
 export default function WarRoomPage() {
-  const [mode, setMode] = useState<"LIVE" | "SIMULATION">("SIMULATION");
+  const [mode, setMode] = useState<"LIVE" | "SIMULATION">("LIVE");
+  const { data, isLoading, isError, refetch, dataUpdatedAt } = useQuery<WarRoomStatus>({
+    queryKey: ["/api/war-room/status"],
+    refetchInterval: mode === "LIVE" ? 30_000 : false,
+    retry: 1,
+  });
+
+  const connectorMap = new Map(data?.connectors.map(connector => [connector.id, connector]) ?? []);
+  const weather = connectorMap.get("public-weather");
+  const orbit = connectorMap.get("public-orbital");
+  const antarctica = connectorMap.get("antarctica-public-weather");
+  const local = connectorMap.get("zyra-local");
+
+  const statusTiles = [
+    { label: "War Room API", value: local?.state ?? (isLoading ? "CONNECTING" : "UNKNOWN"), icon: ShieldCheck },
+    { label: "Public Data", value: data?.components.livePublicData ?? "UNKNOWN", icon: Globe2 },
+    { label: "Golden Shield", value: data?.components.goldenShieldExecution ?? "UNKNOWN", icon: Shield },
+    { label: "MITO", value: data?.components.mitoExecution ?? "UNKNOWN", icon: Cpu },
+  ];
 
   return (
     <div className="relative min-h-full overflow-hidden bg-[#020706] text-foreground">
       <MatrixBackdrop />
-
       <div className="relative z-10 mx-auto max-w-[1600px] space-y-5 p-4 md:p-6">
-        <div className="rounded-2xl border border-emerald-400/20 bg-black/55 p-5 shadow-[0_0_50px_rgba(16,185,129,0.10)] backdrop-blur-xl">
+        <section className="rounded-2xl border border-emerald-400/20 bg-black/60 p-5 shadow-[0_0_50px_rgba(16,185,129,0.10)] backdrop-blur-xl">
           <div className="flex flex-col gap-4 lg:flex-row lg:items-center lg:justify-between">
             <div>
               <div className="mb-2 flex flex-wrap items-center gap-2">
-                <Badge className="border border-emerald-400/30 bg-emerald-500/10 text-emerald-300 hover:bg-emerald-500/10">
-                  AEGIS WAR ROOM
-                </Badge>
-                <Badge variant="outline" className="border-cyan-400/30 text-cyan-300">
-                  DEFENSIVE DECISION SUPPORT
-                </Badge>
-                <Badge variant="outline" className="border-amber-400/30 text-amber-300">
-                  HUMAN AUTHORITY REQUIRED
-                </Badge>
+                <Badge className="border border-emerald-400/30 bg-emerald-500/10 text-emerald-300">AEGIS WAR ROOM</Badge>
+                <Badge variant="outline" className="border-cyan-400/30 text-cyan-300">DEFENSIVE DECISION SUPPORT</Badge>
+                <Badge variant="outline" className="border-amber-400/30 text-amber-300">NO WEAPON / DRONE CONTROL</Badge>
               </div>
-              <h1 className="font-mono text-2xl font-black tracking-tight text-emerald-100 md:text-4xl">
-                XRAYCLOUD // COMMAND RESILIENCE MATRIX
-              </h1>
+              <h1 className="font-mono text-2xl font-black tracking-tight text-emerald-100 md:text-4xl">XRAYCLOUD // LIVE RESILIENCE MATRIX</h1>
               <p className="mt-2 max-w-4xl text-sm text-emerald-100/65 md:text-base">
-                Cyberpunk command visualization for defensive mission assurance, infrastructure resilience, public geospatial awareness,
-                evidence, continuity planning, and governed AI recommendations.
+                Evidence-aware defensive command visualization using authenticated local status plus public weather, orbital, and research context.
+                Missing feeds remain UNKNOWN or UNAVAILABLE instead of being fabricated.
               </p>
             </div>
-
-            <div className="flex items-center gap-2 rounded-xl border border-emerald-400/20 bg-black/70 p-2">
-              <Button
-                size="sm"
-                variant={mode === "SIMULATION" ? "default" : "outline"}
-                onClick={() => setMode("SIMULATION")}
-                className={cn(mode === "SIMULATION" && "bg-emerald-500 text-black hover:bg-emerald-400")}
-              >
-                SIMULATION
-              </Button>
-              <Button
-                size="sm"
-                variant={mode === "LIVE" ? "default" : "outline"}
-                onClick={() => setMode("LIVE")}
-                className={cn(mode === "LIVE" && "bg-cyan-500 text-black hover:bg-cyan-400")}
-              >
-                LIVE VIEW
-              </Button>
+            <div className="flex flex-wrap items-center gap-2 rounded-xl border border-emerald-400/20 bg-black/70 p-2">
+              <Button size="sm" variant={mode === "LIVE" ? "default" : "outline"} onClick={() => setMode("LIVE")} className={cn(mode === "LIVE" && "bg-cyan-500 text-black hover:bg-cyan-400")}>LIVE VIEW</Button>
+              <Button size="sm" variant={mode === "SIMULATION" ? "default" : "outline"} onClick={() => setMode("SIMULATION")} className={cn(mode === "SIMULATION" && "bg-emerald-500 text-black hover:bg-emerald-400")}>SIMULATION</Button>
+              <Button size="sm" variant="outline" onClick={() => refetch()}>REFRESH</Button>
             </div>
           </div>
-
           <div className="mt-4 flex items-center gap-2 rounded-xl border border-amber-400/20 bg-amber-500/5 px-3 py-2 text-xs text-amber-200/80">
             <AlertTriangle className="h-4 w-4 shrink-0" />
-            {mode === "SIMULATION"
-              ? "Simulation mode: visualization uses demonstration state only; no external systems are controlled."
-              : "Live view is display-only until verified authorized data connectors are configured; unknown data remains UNKNOWN."}
+            {mode === "LIVE"
+              ? `Live display-only mode • last UI refresh ${dataUpdatedAt ? new Date(dataUpdatedAt).toLocaleTimeString() : "UNKNOWN"} • no external system control path exists.`
+              : "Simulation mode is visualization-only and does not control external systems."}
           </div>
-        </div>
+        </section>
 
         <div className="grid gap-3 sm:grid-cols-2 xl:grid-cols-4">
-          {statusTiles.map(({ label, value, icon: Icon, tone }) => (
+          {statusTiles.map(({ label, value, icon: Icon }) => (
             <Card key={label} className="border-emerald-400/15 bg-black/55 backdrop-blur-xl">
               <CardContent className="flex items-center justify-between p-4">
                 <div>
                   <div className="text-[10px] font-mono uppercase tracking-[0.22em] text-muted-foreground">{label}</div>
-                  <div className={cn("mt-1 font-mono text-sm font-bold", tone)}>{value}</div>
-                </div>
-                <div className="rounded-xl border border-emerald-400/15 bg-emerald-500/5 p-2">
-                  <Icon className={cn("h-5 w-5", tone)} />
+                  <div className="mt-1 font-mono text-sm font-bold text-emerald-200">{value}</div>
                 </div>
+                <Icon className="h-5 w-5 text-cyan-300" />
               </CardContent>
             </Card>
           ))}
         </div>
 
-        <div className="grid gap-5 xl:grid-cols-[1.35fr_0.65fr]">
+        <div className="grid gap-5 xl:grid-cols-[1.25fr_0.75fr]">
           <Card className="overflow-hidden border-cyan-400/20 bg-black/55 backdrop-blur-xl">
             <CardHeader className="border-b border-cyan-400/10">
-              <CardTitle className="flex items-center gap-2 font-mono text-cyan-200">
-                <Globe2 className="h-5 w-5" /> Scout // Geospatial + Orbital Awareness
-              </CardTitle>
+              <CardTitle className="flex items-center gap-2 font-mono text-cyan-200"><Globe2 className="h-5 w-5" /> Scout // Public Awareness</CardTitle>
             </CardHeader>
             <CardContent className="p-0">
               <div className="relative min-h-[430px] overflow-hidden bg-[radial-gradient(circle_at_center,rgba(6,182,212,0.10),transparent_50%),linear-gradient(rgba(16,185,129,0.04)_1px,transparent_1px),linear-gradient(90deg,rgba(16,185,129,0.04)_1px,transparent_1px)] bg-[size:auto,32px_32px,32px_32px]">
                 <div className="absolute inset-6 rounded-full border border-cyan-400/15" />
                 <div className="absolute inset-20 rounded-full border border-emerald-400/10" />
                 <div className="absolute left-[48%] top-[43%] h-28 w-28 rounded-full border border-cyan-300/20 bg-cyan-400/5 shadow-[0_0_60px_rgba(34,211,238,0.12)]" />
-                <div className="absolute left-[51%] top-[46%] h-16 w-16 rounded-full border border-emerald-300/20 bg-emerald-400/5" />
-
                 {[
-                  ["PUBLIC SATCOM", "18%", "24%", Satellite],
-                  ["ANTARCTICA RESEARCH", "70%", "70%", Snowflake],
-                  ["RESILIENCE REGION", "23%", "67%", Shield],
-                  ["SIMULATED AIR NODE", "76%", "30%", RadioTower],
-                ].map(([label, top, left, Icon]: any) => (
+                  ["PUBLIC ORBIT", "18%", "24%", Satellite, orbit?.state ?? "UNKNOWN"],
+                  ["ANTARCTICA RESEARCH", "70%", "70%", Snowflake, antarctica?.state ?? "UNKNOWN"],
+                  ["PUBLIC WEATHER", "23%", "67%", Zap, weather?.state ?? "UNKNOWN"],
+                  ["LOCAL CONTROL PLANE", "76%", "30%", RadioTower, local?.state ?? "UNKNOWN"],
+                ].map(([label, top, left, Icon, state]: any) => (
                   <div key={label} className="absolute" style={{ top, left }}>
-                    <div className="group relative flex items-center gap-2 rounded-lg border border-emerald-400/30 bg-black/80 px-2 py-1.5 font-mono text-[10px] text-emerald-200 shadow-[0_0_18px_rgba(16,185,129,0.15)]">
-                      <Icon className="h-3.5 w-3.5 text-cyan-300" />
-                      {label}
-                      <span className="absolute -left-1 -top-1 h-2 w-2 animate-ping rounded-full bg-emerald-400/60" />
+                    <div className="relative flex items-center gap-2 rounded-lg border border-emerald-400/30 bg-black/85 px-2 py-1.5 font-mono text-[10px] text-emerald-200 shadow-[0_0_18px_rgba(16,185,129,0.15)]">
+                      <Icon className="h-3.5 w-3.5 text-cyan-300" />{label}<span className="text-[8px] text-cyan-300">{state}</span>
                     </div>
                   </div>
                 ))}
-
-                <div className="absolute bottom-4 left-4 right-4 rounded-xl border border-cyan-400/15 bg-black/70 p-3 font-mono text-[10px] text-cyan-100/65 backdrop-blur">
-                  DATA POLICY: PUBLIC / SIMULATED / NON-SENSITIVE ONLY • NO TARGETING • NO LIVE WEAPON TELEMETRY • NO DRONE CONTROL
+                <div className="absolute bottom-4 left-4 right-4 rounded-xl border border-cyan-400/15 bg-black/75 p-3 font-mono text-[10px] text-cyan-100/65 backdrop-blur">
+                  PUBLIC / AGGREGATE / NON-SENSITIVE DISPLAY ONLY • NO TARGETING • NO WEAPON RELEASE • NO DIRECT DRONE CONTROL
                 </div>
               </div>
             </CardContent>
@@ -211,40 +193,42 @@ export default function WarRoomPage() {
 
           <Card className="border-emerald-400/20 bg-black/60 backdrop-blur-xl">
             <CardHeader className="border-b border-emerald-400/10">
-              <CardTitle className="flex items-center gap-2 font-mono text-emerald-200">
-                <Activity className="h-5 w-5" /> ETHER Event Stream
-              </CardTitle>
+              <CardTitle className="flex items-center gap-2 font-mono text-emerald-200"><Activity className="h-5 w-5" /> Live Connector Fabric</CardTitle>
             </CardHeader>
             <CardContent className="space-y-3 p-4">
-              {eventStream.map((event, index) => (
-                <div key={event} className="flex gap-3 font-mono text-xs">
-                  <span className="text-emerald-500/50">{String(index + 1).padStart(2, "0")}</span>
-                  <span className="text-emerald-100/75">{event}</span>
+              {isLoading && <div className="font-mono text-xs text-cyan-200">CONNECTING...</div>}
+              {isError && <div className="font-mono text-xs text-red-300">WAR ROOM API UNAVAILABLE</div>}
+              {data?.connectors.map(connector => (
+                <div key={connector.id} className="rounded-xl border border-emerald-400/15 bg-black/50 p-3">
+                  <div className="flex items-start justify-between gap-3">
+                    <div>
+                      <div className="font-mono text-xs font-semibold text-emerald-100">{connector.label}</div>
+                      <div className="mt-1 text-[10px] text-muted-foreground">{detailLine(connector)}</div>
+                    </div>
+                    <Badge variant="outline" className={cn("font-mono text-[9px]", stateClass(connector.state))}>{connector.state}</Badge>
+                  </div>
                 </div>
               ))}
-              <div className="mt-5 rounded-xl border border-violet-400/20 bg-violet-500/5 p-3">
-                <div className="flex items-center gap-2 text-xs font-semibold text-violet-200">
-                  <Bot className="h-4 w-4" /> GPT-DOUG-MAX
-                </div>
-                <p className="mt-2 text-xs leading-relaxed text-violet-100/60">
-                  Recommendations remain advisory until Golden Shield, policy, authority, and human approval requirements are satisfied.
-                </p>
+              <div className="rounded-xl border border-violet-400/20 bg-violet-500/5 p-3">
+                <div className="flex items-center gap-2 text-xs font-semibold text-violet-200"><Bot className="h-4 w-4" /> GPT-DOUG-MAX</div>
+                <p className="mt-2 text-xs leading-relaxed text-violet-100/60">Decision support remains advisory. This Zyra branch currently has no Golden Shield / MITO execution integration, so those states are shown truthfully as NOT_CONNECTED / DISABLED.</p>
               </div>
             </CardContent>
           </Card>
         </div>
 
         <div className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
-          {safeFeeds.map(({ title, icon: Icon, status, description }) => (
-            <Card key={title} className="border-emerald-400/15 bg-black/50 backdrop-blur-xl transition hover:border-cyan-400/30">
+          {[
+            { title: "Public Geospatial Scout", icon: MapPinned, status: weather?.state ?? "UNKNOWN", description: "Public weather and resilience context only; no sensitive live operational locations." },
+            { title: "Orbital Awareness", icon: Satellite, status: orbit?.state ?? "UNKNOWN", description: "Aggregate public orbital catalog awareness only; no cueing, protected telemetry, or satellite control." },
+            { title: "Antarctica Research Watch", icon: Snowflake, status: antarctica?.state ?? "UNKNOWN", description: "Public research-region weather context for continuity and logistics planning." },
+            { title: "Readiness Data Boundary", icon: Workflow, status: "SAFE", description: "Drone and weapon-system maintenance/readiness data may be displayed when authorized; control and engagement pathways remain excluded." },
+          ].map(({ title, icon: Icon, status, description }) => (
+            <Card key={title} className="border-emerald-400/15 bg-black/50 backdrop-blur-xl">
               <CardContent className="p-4">
                 <div className="flex items-start justify-between gap-3">
-                  <div className="rounded-xl border border-cyan-400/15 bg-cyan-500/5 p-2">
-                    <Icon className="h-5 w-5 text-cyan-300" />
-                  </div>
-                  <Badge variant="outline" className="border-emerald-400/20 font-mono text-[9px] text-emerald-300">
-                    {status}
-                  </Badge>
+                  <div className="rounded-xl border border-cyan-400/15 bg-cyan-500/5 p-2"><Icon className="h-5 w-5 text-cyan-300" /></div>
+                  <Badge variant="outline" className="border-emerald-400/20 font-mono text-[9px] text-emerald-300">{status}</Badge>
                 </div>
                 <h3 className="mt-4 font-mono text-sm font-bold text-emerald-100">{title}</h3>
                 <p className="mt-2 text-xs leading-relaxed text-muted-foreground">{description}</p>
@@ -255,39 +239,16 @@ export default function WarRoomPage() {
 
         <div className="grid gap-4 lg:grid-cols-3">
           <Card className="border-red-400/15 bg-black/55 backdrop-blur-xl">
-            <CardHeader>
-              <CardTitle className="flex items-center gap-2 font-mono text-sm text-red-200">
-                <TriangleAlert className="h-4 w-4" /> Weapon / Drone Control Boundary
-              </CardTitle>
-            </CardHeader>
-            <CardContent className="text-xs leading-relaxed text-red-100/60">
-              War Room may visualize authorized readiness and simulation data, but it does not provide target selection, weapon release,
-              firing solutions, strike planning, autonomous lethal decisions, or direct drone flight / payload control.
-            </CardContent>
+            <CardHeader><CardTitle className="flex items-center gap-2 font-mono text-sm text-red-200"><TriangleAlert className="h-4 w-4" /> Control Boundary</CardTitle></CardHeader>
+            <CardContent className="text-xs leading-relaxed text-red-100/60">Target selection, weapon release, fire control, strike planning, direct drone flight/payload control, autonomous lethal action, and offensive cyber execution remain unavailable.</CardContent>
           </Card>
-
           <Card className="border-cyan-400/15 bg-black/55 backdrop-blur-xl">
-            <CardHeader>
-              <CardTitle className="flex items-center gap-2 font-mono text-sm text-cyan-200">
-                <Orbit className="h-4 w-4" /> Orbital / Space Boundary
-              </CardTitle>
-            </CardHeader>
-            <CardContent className="text-xs leading-relaxed text-cyan-100/60">
-              Public orbital data and simulated assets may be visualized for awareness and continuity. Protected telemetry, military cueing,
-              targeting correlations, or unauthorized satellite control are excluded.
-            </CardContent>
+            <CardHeader><CardTitle className="flex items-center gap-2 font-mono text-sm text-cyan-200"><Orbit className="h-4 w-4" /> Space Boundary</CardTitle></CardHeader>
+            <CardContent className="text-xs leading-relaxed text-cyan-100/60">Public aggregate orbital data may be visualized for awareness. Protected telemetry, military cueing, targeting correlations, and satellite control are excluded.</CardContent>
           </Card>
-
           <Card className="border-emerald-400/15 bg-black/55 backdrop-blur-xl">
-            <CardHeader>
-              <CardTitle className="flex items-center gap-2 font-mono text-sm text-emerald-200">
-                <Shield className="h-4 w-4" /> Infrastructure Boundary
-              </CardTitle>
-            </CardHeader>
-            <CardContent className="text-xs leading-relaxed text-emerald-100/60">
-              Critical-infrastructure analysis is restricted to resilience, continuity, maintenance, and authorized defensive decision support;
-              the interface must not expose actionable vulnerability or exploitation details.
-            </CardContent>
+            <CardHeader><CardTitle className="flex items-center gap-2 font-mono text-sm text-emerald-200"><Database className="h-4 w-4" /> Data Honesty</CardTitle></CardHeader>
+            <CardContent className="text-xs leading-relaxed text-emerald-100/60">External connector failure is surfaced as UNAVAILABLE. Missing integration is NOT_CONNECTED. No visual state is promoted to verified execution capability.</CardContent>
           </Card>
         </div>
       </div>

From 9314a39572316eed0c0fb1256cd8988ae0064bbd Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 00:42:05 -0400
Subject: [PATCH 09/23] Add War Room CI proof gate

---
 .github/workflows/war-room-ci.yml | 42 +++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 .github/workflows/war-room-ci.yml

diff --git a/.github/workflows/war-room-ci.yml b/.github/workflows/war-room-ci.yml
new file mode 100644
index 0000000..a4ea394
--- /dev/null
+++ b/.github/workflows/war-room-ci.yml
@@ -0,0 +1,42 @@
+name: War Room CI
+
+on:
+  push:
+    branches:
+      - feature/cyberpunk-war-room
+  pull_request:
+    paths:
+      - "client/src/pages/war-room.tsx"
+      - "client/src/components/WarRoomLauncher.tsx"
+      - "server/war-room*.ts"
+      - "server/index.ts"
+      - ".github/workflows/war-room-ci.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: War Room boundary tests
+        run: npx tsx --test server/war-room.test.ts
+
+      - name: TypeScript check
+        run: npm run check
+
+      - name: Production build
+        run: npm run build

From 12e2f21cb87bb815c5157f74678565bc179553b4 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:37:18 -0400
Subject: [PATCH 10/23] fix: set explicit ES2022 TypeScript target

---
 tsconfig.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tsconfig.json b/tsconfig.json
index a0203ee..f549e2c 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -5,6 +5,7 @@
     "incremental": true,
     "tsBuildInfoFile": "./node_modules/typescript/tsbuildinfo",
     "noEmit": true,
+    "target": "ES2022",
     "module": "ESNext",
     "strict": true,
     "lib": ["esnext", "dom", "dom.iterable"],

From 5b770061b5ad834c2823d1e2f3f152270a6a3d28 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:44:42 -0400
Subject: [PATCH 11/23] ci: repair Express type compatibility lockfile

---
 .../workflows/typescript-types-pin-repair.yml | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 .github/workflows/typescript-types-pin-repair.yml

diff --git a/.github/workflows/typescript-types-pin-repair.yml b/.github/workflows/typescript-types-pin-repair.yml
new file mode 100644
index 0000000..689be14
--- /dev/null
+++ b/.github/workflows/typescript-types-pin-repair.yml
@@ -0,0 +1,42 @@
+name: TypeScript Types Pin Repair
+
+on:
+  push:
+    branches:
+      - feature/cyberpunk-war-room
+    paths:
+      - .github/workflows/typescript-types-pin-repair.yml
+
+permissions:
+  contents: write
+
+jobs:
+  repair-lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout branch
+        uses: actions/checkout@v4
+        with:
+          ref: feature/cyberpunk-war-room
+          fetch-depth: 0
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - name: Pin compatible Express route parameter types
+        run: npm install --package-lock-only --save-dev --save-exact @types/express-serve-static-core@5.0.7
+      - name: Validate lockfile
+        run: npm ci
+      - name: Commit deterministic lockfile repair
+        run: |
+          git diff --check
+          if git diff --quiet -- package.json package-lock.json; then
+            echo "No lockfile change required"
+            exit 0
+          fi
+          git config user.name "zyra-ci-repair"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add package.json package-lock.json
+          git commit -m "fix: pin compatible Express parameter types"
+          git push origin HEAD:feature/cyberpunk-war-room

From 9249a7f50f42d7d52b18bacd2fee842a553f0bd6 Mon Sep 17 00:00:00 2001
From: zyra-ci-repair <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 06:45:04 +0000
Subject: [PATCH 12/23] fix: pin compatible Express parameter types

---
 package-lock.json | 67 ++++++++++++++++++++++++++++++++++++++++++++---
 package.json      |  1 +
 2 files changed, 65 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e60f66f..48635cb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -89,6 +89,7 @@
         "@tailwindcss/vite": "^4.1.18",
         "@types/connect-pg-simple": "^7.0.3",
         "@types/express": "^5.0.0",
+        "@types/express-serve-static-core": "5.0.7",
         "@types/express-session": "^1.18.0",
         "@types/node": "20.19.27",
         "@types/passport": "^1.0.16",
@@ -3045,6 +3046,66 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.7.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.1.0",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.7.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.1.0",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.0",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1",
+        "@tybys/wasm-util": "^0.10.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
       "version": "4.1.18",
       "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.1.18.tgz",
@@ -3324,9 +3385,9 @@
       }
     },
     "node_modules/@types/express-serve-static-core": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.1.tgz",
-      "integrity": "sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.0.7.tgz",
+      "integrity": "sha512-R+33OsgWw7rOhD1emjU7dzCDHucJrgJXMA5PYCzJxVil0dsyx5iBEPHqpPfiKNJQb7lZ1vxwoLR4Z87bBUpeGQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index b63c6ef..5eab45e 100644
--- a/package.json
+++ b/package.json
@@ -91,6 +91,7 @@
     "@tailwindcss/vite": "^4.1.18",
     "@types/connect-pg-simple": "^7.0.3",
     "@types/express": "^5.0.0",
+    "@types/express-serve-static-core": "5.0.7",
     "@types/express-session": "^1.18.0",
     "@types/node": "20.19.27",
     "@types/passport": "^1.0.16",

From d204f6e2176583980c225f159650a051adee27a5 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:46:03 -0400
Subject: [PATCH 13/23] ci: remove one-shot TypeScript lockfile repair

---
 .../workflows/typescript-types-pin-repair.yml | 42 -------------------
 1 file changed, 42 deletions(-)
 delete mode 100644 .github/workflows/typescript-types-pin-repair.yml

diff --git a/.github/workflows/typescript-types-pin-repair.yml b/.github/workflows/typescript-types-pin-repair.yml
deleted file mode 100644
index 689be14..0000000
--- a/.github/workflows/typescript-types-pin-repair.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: TypeScript Types Pin Repair
-
-on:
-  push:
-    branches:
-      - feature/cyberpunk-war-room
-    paths:
-      - .github/workflows/typescript-types-pin-repair.yml
-
-permissions:
-  contents: write
-
-jobs:
-  repair-lockfile:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout branch
-        uses: actions/checkout@v4
-        with:
-          ref: feature/cyberpunk-war-room
-          fetch-depth: 0
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-      - name: Pin compatible Express route parameter types
-        run: npm install --package-lock-only --save-dev --save-exact @types/express-serve-static-core@5.0.7
-      - name: Validate lockfile
-        run: npm ci
-      - name: Commit deterministic lockfile repair
-        run: |
-          git diff --check
-          if git diff --quiet -- package.json package-lock.json; then
-            echo "No lockfile change required"
-            exit 0
-          fi
-          git config user.name "zyra-ci-repair"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add package.json package-lock.json
-          git commit -m "fix: pin compatible Express parameter types"
-          git push origin HEAD:feature/cyberpunk-war-room

From c25dc254b36d18bd6367a2f9a6842f57342ecd03 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:49:56 -0400
Subject: [PATCH 14/23] ci: add deterministic TypeScript schema repair

---
 script/typescript-schema-repair.mjs | 176 ++++++++++++++++++++++++++++
 1 file changed, 176 insertions(+)
 create mode 100644 script/typescript-schema-repair.mjs

diff --git a/script/typescript-schema-repair.mjs b/script/typescript-schema-repair.mjs
new file mode 100644
index 0000000..978efaa
--- /dev/null
+++ b/script/typescript-schema-repair.mjs
@@ -0,0 +1,176 @@
+import fs from "node:fs";
+
+function read(path) {
+  return fs.readFileSync(path, "utf8");
+}
+
+function write(path, content) {
+  fs.writeFileSync(path, content);
+}
+
+function replaceOnce(source, before, after, label) {
+  const first = source.indexOf(before);
+  if (first === -1) throw new Error(`repair pattern not found: ${label}`);
+  if (source.indexOf(before, first + before.length) !== -1) {
+    throw new Error(`repair pattern is ambiguous: ${label}`);
+  }
+  return source.replace(before, after);
+}
+
+function replaceAllRequired(source, before, after, expectedMinimum, label) {
+  const count = source.split(before).length - 1;
+  if (count < expectedMinimum) throw new Error(`repair pattern count too low for ${label}: ${count}`);
+  return source.split(before).join(after);
+}
+
+// Frontend typing repairs.
+{
+  const path = "client/src/pages/enterprise.tsx";
+  let source = read(path);
+  source = replaceOnce(
+    source,
+    'function MultiRegionTab({ isLoading: _parentLoading }: { settings?: Setting[]; isLoading: boolean }) {',
+    'function MultiRegionTab({ settings, isLoading: _parentLoading }: { settings?: Setting[]; isLoading: boolean }) {',
+    "enterprise settings destructure",
+  );
+  write(path, source);
+}
+
+{
+  const path = "client/src/pages/pentest.tsx";
+  let source = read(path);
+  source = replaceOnce(
+    source,
+    '{session.testTypes.length} test types',
+    '{Array.isArray(session.testTypes) ? session.testTypes.length : 0} test types',
+    "pentest testTypes rendering",
+  );
+  source = replaceOnce(
+    source,
+    '{(finding.testType as React.ReactNode).toString().replace("_", " ")}',
+    '{String(finding.testType ?? "unknown").replace("_", " ")}',
+    "pentest nullable testType",
+  );
+  write(path, source);
+}
+
+{
+  const path = "client/src/pages/threat-detail.tsx";
+  let source = read(path);
+  source = replaceOnce(
+    source,
+    '<Button variant="link" size="sm" className="mt-1" data-testid="link-view-assets">',
+    '<Button variant="ghost" size="sm" className="mt-1 underline" data-testid="link-view-assets">',
+    "supported button variant",
+  );
+  write(path, source);
+}
+
+// Schema-aligned server repairs.
+{
+  const path = "server/caasm.ts";
+  let source = read(path);
+  source = replaceOnce(
+    source,
+    '    const linkedVulns = vulnerabilities.filter(v =>\n      v.assetId === asset.id ||\n      (v.title?.toLowerCase().includes(asset.hostname.toLowerCase()))\n    );',
+    '    const linkedVulns = vulnerabilities.filter(v =>\n      v.affectedComponent?.toLowerCase().includes(asset.hostname.toLowerCase()) ||\n      (v.title?.toLowerCase().includes(asset.hostname.toLowerCase()))\n    );',
+    "CAASM vulnerability correlation",
+  );
+  source = replaceAllRequired(source, "i.affectedAssets", "i.affectedSystems", 2, "CAASM incident systems");
+  write(path, source);
+}
+
+{
+  const path = "server/exposure.ts";
+  let source = read(path);
+  source = replaceOnce(
+    source,
+    '    exposed: level !== "internal" && level !== "none",',
+    '    exposed: level !== "internal",',
+    "exposure union comparison",
+  );
+  write(path, source);
+}
+
+{
+  const path = "server/intelligence.ts";
+  let source = read(path);
+  source = replaceAllRequired(source, "v.remediation ||", "v.remediationSteps ||", 1, "vulnerability remediation field");
+  source = replaceAllRequired(source, "a.isPublicFacing", 'a.tags.includes("public-facing")', 3, "public-facing asset label");
+  source = replaceAllRequired(source, "a.operatingSystem", "a.os", 1, "asset OS field");
+  write(path, source);
+}
+
+{
+  const path = "server/metrics.ts";
+  let source = read(path);
+  source = replaceAllRequired(source, "item.name", "item.packageName", 1, "SBOM package name filter");
+  source = replaceAllRequired(source, "a.name", "a.packageName", 2, "SBOM package name output");
+  source = replaceAllRequired(source, "a.version", "a.packageVersion", 1, "SBOM package version output");
+  write(path, source);
+}
+
+{
+  const path = "server/routes.ts";
+  let source = read(path);
+  source = replaceOnce(
+    source,
+    '          const updated = f.updatedAt ? new Date(f.updatedAt).getTime() : Date.now();',
+    '          const updated = f.resolvedAt ? new Date(f.resolvedAt).getTime() : Date.now();',
+    "resolved finding timestamp",
+  );
+  source = replaceOnce(
+    source,
+    '      const scannedRepoCount = new Set(allScans.map(s => s.repositoryId).filter(Boolean)).size;',
+    '      const scannedRepoCount = new Set(allScans.filter(s => s.targetType === "repository").map(s => s.targetId).filter((id): id is string => Boolean(id))).size;',
+    "scan target repository coverage",
+  );
+  source = replaceAllRequired(source, "resource: \"", "resourceType: \"", 3, "audit resource type field");
+  source = replaceOnce(
+    source,
+    '    const r = await storage.updateTrainingRecord(req.params.id, parsed.data);',
+    '    const trainingUpdate = {\n      completed: parsed.data.completed,\n      completedAt: parsed.data.completedAt === undefined ? undefined : parsed.data.completedAt === null ? null : new Date(parsed.data.completedAt),\n      course: parsed.data.courseName,\n      phishingScore: parsed.data.score,\n    };\n    const r = await storage.updateTrainingRecord(req.params.id, trainingUpdate);',
+    "training schema transform",
+  );
+  source = replaceOnce(
+    source,
+    '      avgCvss: parseFloat((cves.reduce((s, c) => s + c.cvssScore, 0) / cves.length).toFixed(1)),',
+    '      avgCvss: cves.length > 0 ? parseFloat((cves.reduce((s, c) => s + (c.cvssScore ?? 0), 0) / cves.length).toFixed(1)) : 0,',
+    "nullable CVSS average",
+  );
+  source = replaceOnce(
+    source,
+    '      const criticalRisks = risks.filter(r => r.severity === "critical" && r.status !== "accepted").length;',
+    '      const criticalRisks = risks.filter(r => r.riskScore >= 15 && r.status !== "accepted").length;',
+    "risk severity derivation",
+  );
+  write(path, source);
+}
+
+{
+  const path = "server/seed-demo.ts";
+  let source = read(path);
+  source = replaceOnce(source, ', resolvedAt: ago(3), verifiedAt: ago(2)', ', verifiedAt: ago(2)', "resolved vulnerability fixture one");
+  source = replaceOnce(source, ', resolvedAt: ago(10), verifiedAt: ago(9)', ', verifiedAt: ago(9)', "resolved vulnerability fixture two");
+  write(path, source);
+}
+
+{
+  const path = "server/task-runner.ts";
+  let source = read(path);
+  source = replaceOnce(
+    source,
+    '    const scan = await storage.createScan({\n      organizationId: task.organizationId,\n      repositoryId: repo.id,\n      type: "full",\n      status: "running",\n      branch: repo.defaultBranch || "main",\n      commitHash: null,\n      triggeredBy: task.createdById || "system",\n      totalFindings: 0,\n      criticalCount: 0,\n      highCount: 0,\n      mediumCount: 0,\n      lowCount: 0,\n    });',
+    '    const scan = await storage.createScan({\n      organizationId: task.organizationId,\n      name: `Task scan: ${repo.name}`,\n      scanType: "semgrep",\n      status: "running",\n      targetType: "repository",\n      targetId: repo.id,\n      targetName: repo.name,\n      initiatedById: task.createdById || null,\n    });',
+    "task scan schema",
+  );
+  source = replaceOnce(
+    source,
+    '    playbookId: playbook.id,\n    status: "running",',
+    '    playbookId: playbook.id,\n    playbookName: playbook.name,\n    status: "running",',
+    "SOAR playbook name",
+  );
+  write(path, source);
+}
+
+console.log("TypeScript schema repair applied");

From ecd4693bbdf9d2744ac154f67cdc5ad19352a736 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:50:05 -0400
Subject: [PATCH 15/23] ci: run verified TypeScript schema repair

---
 .../workflows/typescript-schema-repair.yml    | 49 +++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/typescript-schema-repair.yml

diff --git a/.github/workflows/typescript-schema-repair.yml b/.github/workflows/typescript-schema-repair.yml
new file mode 100644
index 0000000..d6e194f
--- /dev/null
+++ b/.github/workflows/typescript-schema-repair.yml
@@ -0,0 +1,49 @@
+name: TypeScript Schema Repair
+
+on:
+  push:
+    branches:
+      - feature/cyberpunk-war-room
+    paths:
+      - script/typescript-schema-repair.mjs
+      - .github/workflows/typescript-schema-repair.yml
+
+permissions:
+  contents: write
+
+jobs:
+  repair-and-verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout feature branch
+        uses: actions/checkout@v4
+        with:
+          ref: feature/cyberpunk-war-room
+          fetch-depth: 0
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - name: Install
+        run: npm ci
+      - name: Apply deterministic schema repairs
+        run: node script/typescript-schema-repair.mjs
+      - name: Verify War Room boundary
+        run: npx tsx --test server/war-room.test.ts
+      - name: TypeScript check
+        run: npm run check
+      - name: Production build
+        run: npm run build
+      - name: Commit verified source repairs
+        run: |
+          git diff --check
+          if git diff --quiet -- client server; then
+            echo "No source repair required"
+            exit 0
+          fi
+          git config user.name "zyra-ci-repair"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add client server
+          git commit -m "fix: align TypeScript code with current schemas"
+          git push origin HEAD:feature/cyberpunk-war-room

From cec5c678e6c6c223d24670af0e69687d31da9b40 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:52:53 -0400
Subject: [PATCH 16/23] ci: preview deterministic TypeScript repairs

---
 .../workflows/typescript-schema-repair.yml    | 34 +++++--------------
 1 file changed, 9 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/typescript-schema-repair.yml b/.github/workflows/typescript-schema-repair.yml
index d6e194f..58170a3 100644
--- a/.github/workflows/typescript-schema-repair.yml
+++ b/.github/workflows/typescript-schema-repair.yml
@@ -1,25 +1,19 @@
-name: TypeScript Schema Repair
+name: TypeScript Schema Repair Preview
 
 on:
-  push:
+  pull_request:
     branches:
-      - feature/cyberpunk-war-room
-    paths:
-      - script/typescript-schema-repair.mjs
-      - .github/workflows/typescript-schema-repair.yml
+      - main
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
-  repair-and-verify:
+  repair-preview:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout feature branch
+      - name: Checkout PR merge
         uses: actions/checkout@v4
-        with:
-          ref: feature/cyberpunk-war-room
-          fetch-depth: 0
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
@@ -27,7 +21,7 @@ jobs:
           cache: npm
       - name: Install
         run: npm ci
-      - name: Apply deterministic schema repairs
+      - name: Apply deterministic schema repairs in runner
         run: node script/typescript-schema-repair.mjs
       - name: Verify War Room boundary
         run: npx tsx --test server/war-room.test.ts
@@ -35,15 +29,5 @@ jobs:
         run: npm run check
       - name: Production build
         run: npm run build
-      - name: Commit verified source repairs
-        run: |
-          git diff --check
-          if git diff --quiet -- client server; then
-            echo "No source repair required"
-            exit 0
-          fi
-          git config user.name "zyra-ci-repair"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add client server
-          git commit -m "fix: align TypeScript code with current schemas"
-          git push origin HEAD:feature/cyberpunk-war-room
+      - name: Show verified repair diff
+        run: git diff --check && git diff --stat

From 5d29812ca559bcc63c09053f609b3b3b6cf380e5 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:54:17 -0400
Subject: [PATCH 17/23] fix: correct deterministic repair expectations

---
 script/typescript-schema-repair.mjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/script/typescript-schema-repair.mjs b/script/typescript-schema-repair.mjs
index 978efaa..63eff22 100644
--- a/script/typescript-schema-repair.mjs
+++ b/script/typescript-schema-repair.mjs
@@ -96,7 +96,7 @@ function replaceAllRequired(source, before, after, expectedMinimum, label) {
   const path = "server/intelligence.ts";
   let source = read(path);
   source = replaceAllRequired(source, "v.remediation ||", "v.remediationSteps ||", 1, "vulnerability remediation field");
-  source = replaceAllRequired(source, "a.isPublicFacing", 'a.tags.includes("public-facing")', 3, "public-facing asset label");
+  source = replaceAllRequired(source, "a.isPublicFacing", 'a.tags.includes("public-facing")', 2, "public-facing asset label");
   source = replaceAllRequired(source, "a.operatingSystem", "a.os", 1, "asset OS field");
   write(path, source);
 }

From a25d09202b831a4b7ee85c917183ce7d16b3fe35 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:55:55 -0400
Subject: [PATCH 18/23] fix: handle unknown pentest summary rendering

---
 script/typescript-schema-repair.mjs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/script/typescript-schema-repair.mjs b/script/typescript-schema-repair.mjs
index 63eff22..0ceb34c 100644
--- a/script/typescript-schema-repair.mjs
+++ b/script/typescript-schema-repair.mjs
@@ -45,6 +45,12 @@ function replaceAllRequired(source, before, after, expectedMinimum, label) {
     '{Array.isArray(session.testTypes) ? session.testTypes.length : 0} test types',
     "pentest testTypes rendering",
   );
+  source = replaceOnce(
+    source,
+    '{session.summary && ((session.summary as any).findingsCount as number) > 0 && (',
+    '{Boolean(session.summary) && ((session.summary as any).findingsCount as number) > 0 && (',
+    "pentest unknown summary rendering",
+  );
   source = replaceOnce(
     source,
     '{(finding.testType as React.ReactNode).toString().replace("_", " ")}',

From cecc5e985dff2a60637014ce3436631763c03b6a Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:57:17 -0400
Subject: [PATCH 19/23] ci: apply verified TypeScript schema repair

---
 .../apply-typescript-schema-repair.yml        | 48 +++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/workflows/apply-typescript-schema-repair.yml

diff --git a/.github/workflows/apply-typescript-schema-repair.yml b/.github/workflows/apply-typescript-schema-repair.yml
new file mode 100644
index 0000000..9c363bd
--- /dev/null
+++ b/.github/workflows/apply-typescript-schema-repair.yml
@@ -0,0 +1,48 @@
+name: Apply Verified TypeScript Schema Repair
+
+on:
+  push:
+    branches:
+      - feature/cyberpunk-war-room
+    paths:
+      - .github/workflows/apply-typescript-schema-repair.yml
+
+permissions:
+  contents: write
+
+jobs:
+  apply-verified-repair:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout feature branch
+        uses: actions/checkout@v4
+        with:
+          ref: feature/cyberpunk-war-room
+          fetch-depth: 0
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - name: Install
+        run: npm ci
+      - name: Apply deterministic schema repairs
+        run: node script/typescript-schema-repair.mjs
+      - name: Verify War Room boundary
+        run: npx tsx --test server/war-room.test.ts
+      - name: TypeScript check
+        run: npm run check
+      - name: Production build
+        run: npm run build
+      - name: Commit verified source repairs
+        run: |
+          git diff --check
+          if git diff --quiet -- client server; then
+            echo "No source repair required"
+            exit 0
+          fi
+          git config user.name "zyra-ci-repair"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add client server
+          git commit -m "fix: align TypeScript code with current schemas"
+          git push origin HEAD:feature/cyberpunk-war-room

From f3ca1fe0428294f8f26472aca922d5295d8e48e3 Mon Sep 17 00:00:00 2001
From: zyra-ci-repair <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 06:58:10 +0000
Subject: [PATCH 20/23] fix: align TypeScript code with current schemas

---
 client/src/pages/enterprise.tsx    |  2 +-
 client/src/pages/pentest.tsx       |  6 +++---
 client/src/pages/threat-detail.tsx |  2 +-
 server/caasm.ts                    |  6 +++---
 server/exposure.ts                 |  2 +-
 server/intelligence.ts             |  8 ++++----
 server/metrics.ts                  |  6 +++---
 server/routes.ts                   | 22 ++++++++++++++--------
 server/seed-demo.ts                |  4 ++--
 server/task-runner.ts              | 17 +++++++----------
 10 files changed, 39 insertions(+), 36 deletions(-)

diff --git a/client/src/pages/enterprise.tsx b/client/src/pages/enterprise.tsx
index 852efd0..eb288ed 100644
--- a/client/src/pages/enterprise.tsx
+++ b/client/src/pages/enterprise.tsx
@@ -239,7 +239,7 @@ function SsoTab({ isLoading: _parentLoading }: { settings?: Setting[]; isLoading
   );
 }
 
-function MultiRegionTab({ isLoading: _parentLoading }: { settings?: Setting[]; isLoading: boolean }) {
+function MultiRegionTab({ settings, isLoading: _parentLoading }: { settings?: Setting[]; isLoading: boolean }) {
   const { toast } = useToast();
 
   interface RegionInfo { id: string; name: string; status: string; }
diff --git a/client/src/pages/pentest.tsx b/client/src/pages/pentest.tsx
index 5b6332e..fa1fe45 100644
--- a/client/src/pages/pentest.tsx
+++ b/client/src/pages/pentest.tsx
@@ -392,9 +392,9 @@ export default function PentestPage() {
               <CardContent className="pb-2">
                 <div className="flex flex-wrap gap-2 mt-2">
                   <Badge variant="outline" className="text-xs">
-                    {session.testTypes.length} test types
+                    {Array.isArray(session.testTypes) ? session.testTypes.length : 0} test types
                   </Badge>
-                  {session.summary && ((session.summary as any).findingsCount as number) > 0 && (
+                  {Boolean(session.summary) && ((session.summary as any).findingsCount as number) > 0 && (
                     <>
                       {((session.summary as any).criticalCount as number) > 0 && (
                         <Badge variant="destructive" className="text-xs">
@@ -506,7 +506,7 @@ export default function PentestPage() {
                         {sessionDetails.findings.map((finding) => (
                           <TableRow key={finding.id} className="cursor-pointer hover:bg-muted/50 group">
                             <TableCell>{getSeverityBadge(finding.severity)}</TableCell>
-                            <TableCell className="capitalize">{(finding.testType as React.ReactNode).toString().replace("_", " ")}</TableCell>
+                            <TableCell className="capitalize">{String(finding.testType ?? "unknown").replace("_", " ")}</TableCell>
                             <TableCell className="font-medium">
                               <div className="flex flex-col">
                                 <span>{(finding.title as React.ReactNode)}</span>
diff --git a/client/src/pages/threat-detail.tsx b/client/src/pages/threat-detail.tsx
index 31cfeee..16f3352 100644
--- a/client/src/pages/threat-detail.tsx
+++ b/client/src/pages/threat-detail.tsx
@@ -211,7 +211,7 @@ export default function ThreatDetailPage() {
                     <Server className="w-8 h-8 text-muted-foreground/30 mx-auto mb-2" />
                     <p className="text-sm text-muted-foreground">No matching assets found in inventory.</p>
                     <Link href="/assets">
-                      <Button variant="link" size="sm" className="mt-1" data-testid="link-view-assets">View Asset Inventory</Button>
+                      <Button variant="ghost" size="sm" className="mt-1 underline" data-testid="link-view-assets">View Asset Inventory</Button>
                     </Link>
                   </div>
                 );
diff --git a/server/caasm.ts b/server/caasm.ts
index 787cf46..f53be66 100644
--- a/server/caasm.ts
+++ b/server/caasm.ts
@@ -55,12 +55,12 @@ export async function buildCorrelatedAssets(orgId: string) {
   return assets.map(asset => {
     const riskScore = calcAssetRiskScore(asset);
     const linkedVulns = vulnerabilities.filter(v =>
-      v.assetId === asset.id ||
+      v.affectedComponent?.toLowerCase().includes(asset.hostname.toLowerCase()) ||
       (v.title?.toLowerCase().includes(asset.hostname.toLowerCase()))
     );
     const linkedIncidents = incidents.filter(i =>
-      i.affectedAssets?.includes(asset.id) ||
-      i.affectedAssets?.includes(asset.hostname)
+      i.affectedSystems?.includes(asset.id) ||
+      i.affectedSystems?.includes(asset.hostname)
     );
     const linkedRisks = risks.filter(r =>
       r.description?.toLowerCase().includes(asset.hostname.toLowerCase())
diff --git a/server/exposure.ts b/server/exposure.ts
index 7fec056..1f33700 100644
--- a/server/exposure.ts
+++ b/server/exposure.ts
@@ -84,7 +84,7 @@ function isAssetExposed(asset: any): ExposureResult {
   }
 
   return {
-    exposed: level !== "internal" && level !== "none",
+    exposed: level !== "internal",
     exposureLevel: level,
     reasons,
   };
diff --git a/server/intelligence.ts b/server/intelligence.ts
index 1512803..8b5d3ad 100644
--- a/server/intelligence.ts
+++ b/server/intelligence.ts
@@ -269,7 +269,7 @@ export async function runSecurityCopilot(question: string, orgId: string): Promi
   if ((q.includes("vulnerabilit") || q.includes("vuln")) && (q.includes("critical") || q.includes("patch") || q.includes("unpatched") || q.includes("open") || q.includes("top") || q.includes("worst"))) {
     const target = criticalVulns.length > 0 ? criticalVulns : highVulns;
     const label = criticalVulns.length > 0 ? "Critical" : "High";
-    return `**${label} Vulnerability Report (Live)**\n\n**${openVulns.length}** open vulnerabilities total:\n• Critical: **${criticalVulns.length}**\n• High: **${highVulns.length}**\n• Medium: ${openVulns.filter(v => v.severity === "medium").length}\n• Low: ${openVulns.filter(v => v.severity === "low").length}\n\n**Top ${label} Findings:**\n${target.slice(0, 5).map(v => `• **${v.title}** (${v.severity})\n  Component: ${v.affectedComponent || "—"} | Status: ${v.status}\n  → Remediation: ${v.remediation || "Apply vendor patch"}`).join("\n")}\n\n**Remediation strategy:**\n1. Patch critical vulns within 24 hours\n2. Schedule high vulns within 7 days\n3. Automate dependency scanning in CI/CD pipeline\n4. Enable automated SBOM correlation to catch new CVEs`;
+    return `**${label} Vulnerability Report (Live)**\n\n**${openVulns.length}** open vulnerabilities total:\n• Critical: **${criticalVulns.length}**\n• High: **${highVulns.length}**\n• Medium: ${openVulns.filter(v => v.severity === "medium").length}\n• Low: ${openVulns.filter(v => v.severity === "low").length}\n\n**Top ${label} Findings:**\n${target.slice(0, 5).map(v => `• **${v.title}** (${v.severity})\n  Component: ${v.affectedComponent || "—"} | Status: ${v.status}\n  → Remediation: ${v.remediationSteps || "Apply vendor patch"}`).join("\n")}\n\n**Remediation strategy:**\n1. Patch critical vulns within 24 hours\n2. Schedule high vulns within 7 days\n3. Automate dependency scanning in CI/CD pipeline\n4. Enable automated SBOM correlation to catch new CVEs`;
   }
 
   if (q.includes("risk") && (q.includes("highest") || q.includes("top") || q.includes("critical") || q.includes("worst"))) {
@@ -303,8 +303,8 @@ export async function runSecurityCopilot(question: string, orgId: string): Promi
   }
 
   if (q.includes("asset") && (q.includes("exposed") || q.includes("internet") || q.includes("public") || q.includes("external"))) {
-    const publicAssets = assets.filter(a => a.isPublicFacing);
-    return `**Exposed Asset Analysis**\n\n**${publicAssets.length}** public-facing assets detected out of ${assets.length} total:\n\n${publicAssets.slice(0, 5).map(a => `• **${a.hostname}** (${a.assetType})\n  Criticality: ${a.criticality} | Cloud: ${a.cloudProvider || "on-prem"}\n  OS: ${a.operatingSystem || "—"}`).join("\n")}\n\n**Risk factors:**\n• ${activePaths.filter(p => publicAssets.some(a => p.entryPoint?.includes(a.hostname))).length} attack paths originate from public assets\n• ${criticalVulns.filter(v => publicAssets.some(a => v.affectedComponent?.includes(a.hostname))).length} critical vulns affect public assets\n\n**Hardening steps:**\n1. Verify WAF/CDN protection on all public endpoints\n2. Restrict unnecessary open ports\n3. Enable DDoS protection\n4. Schedule quarterly external penetration tests`;
+    const publicAssets = assets.filter(a => a.tags.includes("public-facing"));
+    return `**Exposed Asset Analysis**\n\n**${publicAssets.length}** public-facing assets detected out of ${assets.length} total:\n\n${publicAssets.slice(0, 5).map(a => `• **${a.hostname}** (${a.assetType})\n  Criticality: ${a.criticality} | Cloud: ${a.cloudProvider || "on-prem"}\n  OS: ${a.os || "—"}`).join("\n")}\n\n**Risk factors:**\n• ${activePaths.filter(p => publicAssets.some(a => p.entryPoint?.includes(a.hostname))).length} attack paths originate from public assets\n• ${criticalVulns.filter(v => publicAssets.some(a => v.affectedComponent?.includes(a.hostname))).length} critical vulns affect public assets\n\n**Hardening steps:**\n1. Verify WAF/CDN protection on all public endpoints\n2. Restrict unnecessary open ports\n3. Enable DDoS protection\n4. Schedule quarterly external penetration tests`;
   }
 
   if (q.includes("compliance") || q.includes("audit") || q.includes("framework") || q.includes("regulation") || q.includes("nist") || q.includes("iso") || q.includes("soc")) {
@@ -322,5 +322,5 @@ export async function runSecurityCopilot(question: string, orgId: string): Promi
   const score = computePostureScore();
   const totalOpen = criticalVulns.length + highVulns.length;
   const actions = prioritizedActions();
-  return `**ZyraCopilot — Environment Overview (Live)**\n\n🎯 **Posture Score: ${score}/100**\n\n**Real-Time Metrics:**\n• **Assets:** ${assets.length} tracked (${cloudAssets.length} cloud, ${assets.filter(a => a.isPublicFacing).length} public-facing)\n• **Vulnerabilities:** ${openVulns.length} open (${criticalVulns.length} critical, ${highVulns.length} high)\n• **Incidents:** ${openIncidents.length} open (${openIncidents.filter(i => i.severity === "critical").length} critical)\n• **Attack paths:** ${activePaths.length} unmitigated\n• **Risks:** ${risks.length} registered (${criticalRisks.length} critical)\n• **SBOM:** ${sbom.length} packages (${vulnerablePkgs.length} vulnerable)\n• **MTTR:** ${getMttr()}\n\n${actions.length > 0 ? `**Top Actions:**\n${actions.slice(0, 3).map((a, i) => `${i + 1}. ${a}`).join("\n")}` : "✓ No critical actions needed."}\n\n${totalOpen > 5 ? `⚠️ **Alert:** ${totalOpen} critical/high vulnerabilities require immediate attention.` : totalOpen > 0 ? `${totalOpen} critical/high vulnerabilities to address this sprint.` : "✓ No critical or high vulnerabilities open."}\n\nAsk me about specific areas — vulnerabilities, incidents, risks, attack paths, compliance, or trends.`;
+  return `**ZyraCopilot — Environment Overview (Live)**\n\n🎯 **Posture Score: ${score}/100**\n\n**Real-Time Metrics:**\n• **Assets:** ${assets.length} tracked (${cloudAssets.length} cloud, ${assets.filter(a => a.tags.includes("public-facing")).length} public-facing)\n• **Vulnerabilities:** ${openVulns.length} open (${criticalVulns.length} critical, ${highVulns.length} high)\n• **Incidents:** ${openIncidents.length} open (${openIncidents.filter(i => i.severity === "critical").length} critical)\n• **Attack paths:** ${activePaths.length} unmitigated\n• **Risks:** ${risks.length} registered (${criticalRisks.length} critical)\n• **SBOM:** ${sbom.length} packages (${vulnerablePkgs.length} vulnerable)\n• **MTTR:** ${getMttr()}\n\n${actions.length > 0 ? `**Top Actions:**\n${actions.slice(0, 3).map((a, i) => `${i + 1}. ${a}`).join("\n")}` : "✓ No critical actions needed."}\n\n${totalOpen > 5 ? `⚠️ **Alert:** ${totalOpen} critical/high vulnerabilities require immediate attention.` : totalOpen > 0 ? `${totalOpen} critical/high vulnerabilities to address this sprint.` : "✓ No critical or high vulnerabilities open."}\n\nAsk me about specific areas — vulnerabilities, incidents, risks, attack paths, compliance, or trends.`;
 }
diff --git a/server/metrics.ts b/server/metrics.ts
index c0addc5..e713390 100644
--- a/server/metrics.ts
+++ b/server/metrics.ts
@@ -128,14 +128,14 @@ export async function runThreatCorrelation(orgId: string): Promise<{ correlation
       if (!cve.affectedInEnvironment) continue;
       const affected = sbomItems.filter(item =>
         cve.affectedPackages.some((pkg: string) =>
-          item.name?.toLowerCase().includes(pkg.toLowerCase())
+          item.packageName?.toLowerCase().includes(pkg.toLowerCase())
         )
       );
       if (affected.length > 0) {
         correlations.push({
           cveId: cve.cveId,
           severity: cve.severity,
-          affectedPackages: affected.map(a => `${a.name}@${a.version}`),
+          affectedPackages: affected.map(a => `${a.packageName}@${a.packageVersion}`),
           cvssScore: cve.cvssScore,
         });
 
@@ -144,7 +144,7 @@ export async function runThreatCorrelation(orgId: string): Promise<{ correlation
           source: "threat_correlation_engine",
           severity: cve.severity === "critical" ? "critical" : "high",
           title: `${cve.cveId} affects ${affected.length} SBOM package(s)`,
-          description: `Vulnerability ${cve.cveId} (CVSS ${cve.cvssScore}) detected in: ${affected.map(a => a.name).join(", ")}`,
+          description: `Vulnerability ${cve.cveId} (CVSS ${cve.cvssScore}) detected in: ${affected.map(a => a.packageName).join(", ")}`,
           metadata: { cveId: cve.cveId, affectedCount: affected.length },
         });
         eventsCreated++;
diff --git a/server/routes.ts b/server/routes.ts
index 5506b51..def501f 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -1249,7 +1249,7 @@ export async function registerRoutes(
       if (resolved.length > 0) {
         const totalMs = resolved.reduce((sum, f) => {
           const created = new Date(f.createdAt).getTime();
-          const updated = f.updatedAt ? new Date(f.updatedAt).getTime() : Date.now();
+          const updated = f.resolvedAt ? new Date(f.resolvedAt).getTime() : Date.now();
           return sum + (updated - created);
         }, 0);
         avgRemediationDays = Math.round((totalMs / resolved.length) / (1000 * 60 * 60 * 24) * 10) / 10;
@@ -1257,7 +1257,7 @@ export async function registerRoutes(
 
       const allScans = await storage.getScans(orgId);
       const repos = await storage.getRepositories(orgId);
-      const scannedRepoCount = new Set(allScans.map(s => s.repositoryId).filter(Boolean)).size;
+      const scannedRepoCount = new Set(allScans.filter(s => s.targetType === "repository").map(s => s.targetId).filter((id): id is string => Boolean(id))).size;
       const totalRepoCount = Math.max(repos.length, 1);
       const coveragePct = Math.round((scannedRepoCount / totalRepoCount) * 100);
 
@@ -1500,7 +1500,7 @@ export async function registerRoutes(
     const updated = await storage.updateThreatIntelItem(req.params.id, parsed.data, req.user!.organizationId);
     if (!updated) return res.status(404).json({ message: "Item not found" });
     if (parsed.data.status) {
-      await storage.createAuditLog({ organizationId: req.user!.organizationId, userId: req.user!.userId, action: "threat-intel.status-change", resource: "threat_intel", resourceId: req.params.id, details: { previousStatus: existing?.status, newStatus: parsed.data.status, cveId: updated.cveId } });
+      await storage.createAuditLog({ organizationId: req.user!.organizationId, userId: req.user!.userId, action: "threat-intel.status-change", resourceType: "threat_intel", resourceId: req.params.id, details: { previousStatus: existing?.status, newStatus: parsed.data.status, cveId: updated.cveId } });
       if (parsed.data.status === "acknowledged") {
         try {
           await storage.createNotification({
@@ -1685,7 +1685,7 @@ export async function registerRoutes(
       return res.status(400).json({ message: "Invalid request", errors: parsed.error.flatten().fieldErrors });
     }
     const item = await storage.createIncident({ ...parsed.data, organizationId: orgId });
-    await storage.createAuditLog({ organizationId: orgId, userId: req.user!.userId, action: "incident.create", resource: "incident", resourceId: item.id, details: { title: item.title } });
+    await storage.createAuditLog({ organizationId: orgId, userId: req.user!.userId, action: "incident.create", resourceType: "incident", resourceId: item.id, details: { title: item.title } });
     const isCritical = item.severity === "critical";
     await storage.createNotification({ organizationId: orgId, title: isCritical ? "Critical Incident Created" : "New Incident Created", message: `Incident "${item.title}" has been created with ${item.severity} severity.`, type: "incident", severity: item.severity, resourceType: "incident", resourceId: item.id });
     res.json(item);
@@ -1729,7 +1729,7 @@ export async function registerRoutes(
     const entry = { timestamp: new Date().toISOString(), action: req.body.action, note: req.body.note, user: req.body.user || req.user!.userId };
     const timeline = [...(incident.timeline as any[] || []), entry];
     const updated = await storage.updateIncident(req.params.id, { timeline }, req.user!.organizationId);
-    await storage.createAuditLog({ organizationId: req.user!.organizationId, userId: req.user!.userId, action: "incident.timeline.add", resource: "incident", resourceId: req.params.id, details: { action: entry.action, note: entry.note } });
+    await storage.createAuditLog({ organizationId: req.user!.organizationId, userId: req.user!.userId, action: "incident.timeline.add", resourceType: "incident", resourceId: req.params.id, details: { action: entry.action, note: entry.note } });
     res.json(updated);
   });
 
@@ -2305,7 +2305,13 @@ export async function registerRoutes(
   app.put("/api/security-awareness/training/:id", requireAuth, requireRole("owner", "admin"), async (req: Request, res: Response) => {
     const parsed = trainingUpdateSchema.safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ message: "Invalid input", errors: parsed.error.flatten().fieldErrors });
-    const r = await storage.updateTrainingRecord(req.params.id, parsed.data);
+    const trainingUpdate = {
+      completed: parsed.data.completed,
+      completedAt: parsed.data.completedAt === undefined ? undefined : parsed.data.completedAt === null ? null : new Date(parsed.data.completedAt),
+      course: parsed.data.courseName,
+      phishingScore: parsed.data.score,
+    };
+    const r = await storage.updateTrainingRecord(req.params.id, trainingUpdate);
     if (!r) return res.status(404).json({ message: "Not found" });
     res.json(r);
   });
@@ -2685,7 +2691,7 @@ export async function registerRoutes(
       critical: cves.filter(c => c.severity === "critical").length,
       high: cves.filter(c => c.severity === "high").length,
       affectedInEnvironment: cves.filter(c => c.affectedInEnvironment).length,
-      avgCvss: parseFloat((cves.reduce((s, c) => s + c.cvssScore, 0) / cves.length).toFixed(1)),
+      avgCvss: cves.length > 0 ? parseFloat((cves.reduce((s, c) => s + (c.cvssScore ?? 0), 0) / cves.length).toFixed(1)) : 0,
     });
   });
 
@@ -3025,7 +3031,7 @@ async function registerMetricsRoutes(app: Express) {
 
       const criticalScans = scans.filter(s => s.criticalCount > 0).length;
       const openIncidents = incidents.filter(i => i.status !== "resolved").length;
-      const criticalRisks = risks.filter(r => r.severity === "critical" && r.status !== "accepted").length;
+      const criticalRisks = risks.filter(r => r.riskScore >= 15 && r.status !== "accepted").length;
       const criticalEvents = events.filter((e: any) => e.severity === "critical").length;
 
       const scanScore = Math.max(0, 100 - criticalScans * 8);
diff --git a/server/seed-demo.ts b/server/seed-demo.ts
index d3a95ee..fb8bf57 100644
--- a/server/seed-demo.ts
+++ b/server/seed-demo.ts
@@ -170,8 +170,8 @@ export async function seedDemoData(orgId: string, userId: string): Promise<{ see
     { organizationId: orgId, title: "Prototype Pollution in Lodash", severity: "high" as const, status: "open", source: "scan", cve: "CVE-2023-9876", cvss: 7.4, affectedComponent: "lodash@4.17.19", remediationSteps: "Update lodash to 4.17.21+", dueDate: ago(-14) },
     { organizationId: orgId, title: "Authentication Bypass in JWT Middleware", severity: "high" as const, status: "in_progress", source: "pentest", cvss: 8.5, affectedComponent: "auth-service", remediationSteps: "Enforce RS256 algorithm. Add algorithm whitelist.", assignedTo: "Zyra" },
     { organizationId: orgId, title: "Missing Input Validation on File Upload", severity: "medium" as const, status: "open", source: "scan", cvss: 6.5, affectedComponent: "api-gateway", remediationSteps: "Validate file types and implement size limits" },
-    { organizationId: orgId, title: "Weak Password Policy Configuration", severity: "medium" as const, status: "resolved", source: "audit", cvss: 5.3, affectedComponent: "auth-service", remediationSteps: "Enforce minimum 12 characters with complexity", resolvedAt: ago(3), verifiedAt: ago(2) },
-    { organizationId: orgId, title: "Outdated TLS Configuration on Load Balancer", severity: "medium" as const, status: "resolved", source: "scan", cve: "CVE-2023-5555", cvss: 5.9, affectedComponent: "lb-prod-01", remediationSteps: "Disable TLS 1.0/1.1. Enable TLS 1.3.", resolvedAt: ago(10), verifiedAt: ago(9) },
+    { organizationId: orgId, title: "Weak Password Policy Configuration", severity: "medium" as const, status: "resolved", source: "audit", cvss: 5.3, affectedComponent: "auth-service", remediationSteps: "Enforce minimum 12 characters with complexity", verifiedAt: ago(2) },
+    { organizationId: orgId, title: "Outdated TLS Configuration on Load Balancer", severity: "medium" as const, status: "resolved", source: "scan", cve: "CVE-2023-5555", cvss: 5.9, affectedComponent: "lb-prod-01", remediationSteps: "Disable TLS 1.0/1.1. Enable TLS 1.3.", verifiedAt: ago(9) },
     { organizationId: orgId, title: "Information Disclosure in Error Messages", severity: "low" as const, status: "open", source: "scan", cvss: 3.7, affectedComponent: "web-dashboard", remediationSteps: "Return generic error messages in production" },
   ]);
   seeded.push("vulnerabilities");
diff --git a/server/task-runner.ts b/server/task-runner.ts
index 837823a..9ec2b51 100644
--- a/server/task-runner.ts
+++ b/server/task-runner.ts
@@ -27,17 +27,13 @@ async function runScanTask(task: Task): Promise<TaskResult> {
     const repo = repos[0];
     const scan = await storage.createScan({
       organizationId: task.organizationId,
-      repositoryId: repo.id,
-      type: "full",
+      name: `Task scan: ${repo.name}`,
+      scanType: "semgrep",
       status: "running",
-      branch: repo.defaultBranch || "main",
-      commitHash: null,
-      triggeredBy: task.createdById || "system",
-      totalFindings: 0,
-      criticalCount: 0,
-      highCount: 0,
-      mediumCount: 0,
-      lowCount: 0,
+      targetType: "repository",
+      targetId: repo.id,
+      targetName: repo.name,
+      initiatedById: task.createdById || null,
     });
     await storage.updateScan(scan.id, { status: "completed", totalFindings: 0 });
     await logTaskAudit(task, "scan.completed", "scan", scan.id);
@@ -57,6 +53,7 @@ async function runPlaybookTask(task: Task): Promise<TaskResult> {
   const execution = await storage.createSoarExecution({
     organizationId: task.organizationId,
     playbookId: playbook.id,
+    playbookName: playbook.name,
     status: "running",
     triggeredBy: task.createdById || "agent",
     steps: [],

From ea92f9370f767bedabedcab322b999336cbbc685 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:58:50 -0400
Subject: [PATCH 21/23] ci: remove completed TypeScript repair helper

---
 script/typescript-schema-repair.mjs | 182 ----------------------------
 1 file changed, 182 deletions(-)
 delete mode 100644 script/typescript-schema-repair.mjs

diff --git a/script/typescript-schema-repair.mjs b/script/typescript-schema-repair.mjs
deleted file mode 100644
index 0ceb34c..0000000
--- a/script/typescript-schema-repair.mjs
+++ /dev/null
@@ -1,182 +0,0 @@
-import fs from "node:fs";
-
-function read(path) {
-  return fs.readFileSync(path, "utf8");
-}
-
-function write(path, content) {
-  fs.writeFileSync(path, content);
-}
-
-function replaceOnce(source, before, after, label) {
-  const first = source.indexOf(before);
-  if (first === -1) throw new Error(`repair pattern not found: ${label}`);
-  if (source.indexOf(before, first + before.length) !== -1) {
-    throw new Error(`repair pattern is ambiguous: ${label}`);
-  }
-  return source.replace(before, after);
-}
-
-function replaceAllRequired(source, before, after, expectedMinimum, label) {
-  const count = source.split(before).length - 1;
-  if (count < expectedMinimum) throw new Error(`repair pattern count too low for ${label}: ${count}`);
-  return source.split(before).join(after);
-}
-
-// Frontend typing repairs.
-{
-  const path = "client/src/pages/enterprise.tsx";
-  let source = read(path);
-  source = replaceOnce(
-    source,
-    'function MultiRegionTab({ isLoading: _parentLoading }: { settings?: Setting[]; isLoading: boolean }) {',
-    'function MultiRegionTab({ settings, isLoading: _parentLoading }: { settings?: Setting[]; isLoading: boolean }) {',
-    "enterprise settings destructure",
-  );
-  write(path, source);
-}
-
-{
-  const path = "client/src/pages/pentest.tsx";
-  let source = read(path);
-  source = replaceOnce(
-    source,
-    '{session.testTypes.length} test types',
-    '{Array.isArray(session.testTypes) ? session.testTypes.length : 0} test types',
-    "pentest testTypes rendering",
-  );
-  source = replaceOnce(
-    source,
-    '{session.summary && ((session.summary as any).findingsCount as number) > 0 && (',
-    '{Boolean(session.summary) && ((session.summary as any).findingsCount as number) > 0 && (',
-    "pentest unknown summary rendering",
-  );
-  source = replaceOnce(
-    source,
-    '{(finding.testType as React.ReactNode).toString().replace("_", " ")}',
-    '{String(finding.testType ?? "unknown").replace("_", " ")}',
-    "pentest nullable testType",
-  );
-  write(path, source);
-}
-
-{
-  const path = "client/src/pages/threat-detail.tsx";
-  let source = read(path);
-  source = replaceOnce(
-    source,
-    '<Button variant="link" size="sm" className="mt-1" data-testid="link-view-assets">',
-    '<Button variant="ghost" size="sm" className="mt-1 underline" data-testid="link-view-assets">',
-    "supported button variant",
-  );
-  write(path, source);
-}
-
-// Schema-aligned server repairs.
-{
-  const path = "server/caasm.ts";
-  let source = read(path);
-  source = replaceOnce(
-    source,
-    '    const linkedVulns = vulnerabilities.filter(v =>\n      v.assetId === asset.id ||\n      (v.title?.toLowerCase().includes(asset.hostname.toLowerCase()))\n    );',
-    '    const linkedVulns = vulnerabilities.filter(v =>\n      v.affectedComponent?.toLowerCase().includes(asset.hostname.toLowerCase()) ||\n      (v.title?.toLowerCase().includes(asset.hostname.toLowerCase()))\n    );',
-    "CAASM vulnerability correlation",
-  );
-  source = replaceAllRequired(source, "i.affectedAssets", "i.affectedSystems", 2, "CAASM incident systems");
-  write(path, source);
-}
-
-{
-  const path = "server/exposure.ts";
-  let source = read(path);
-  source = replaceOnce(
-    source,
-    '    exposed: level !== "internal" && level !== "none",',
-    '    exposed: level !== "internal",',
-    "exposure union comparison",
-  );
-  write(path, source);
-}
-
-{
-  const path = "server/intelligence.ts";
-  let source = read(path);
-  source = replaceAllRequired(source, "v.remediation ||", "v.remediationSteps ||", 1, "vulnerability remediation field");
-  source = replaceAllRequired(source, "a.isPublicFacing", 'a.tags.includes("public-facing")', 2, "public-facing asset label");
-  source = replaceAllRequired(source, "a.operatingSystem", "a.os", 1, "asset OS field");
-  write(path, source);
-}
-
-{
-  const path = "server/metrics.ts";
-  let source = read(path);
-  source = replaceAllRequired(source, "item.name", "item.packageName", 1, "SBOM package name filter");
-  source = replaceAllRequired(source, "a.name", "a.packageName", 2, "SBOM package name output");
-  source = replaceAllRequired(source, "a.version", "a.packageVersion", 1, "SBOM package version output");
-  write(path, source);
-}
-
-{
-  const path = "server/routes.ts";
-  let source = read(path);
-  source = replaceOnce(
-    source,
-    '          const updated = f.updatedAt ? new Date(f.updatedAt).getTime() : Date.now();',
-    '          const updated = f.resolvedAt ? new Date(f.resolvedAt).getTime() : Date.now();',
-    "resolved finding timestamp",
-  );
-  source = replaceOnce(
-    source,
-    '      const scannedRepoCount = new Set(allScans.map(s => s.repositoryId).filter(Boolean)).size;',
-    '      const scannedRepoCount = new Set(allScans.filter(s => s.targetType === "repository").map(s => s.targetId).filter((id): id is string => Boolean(id))).size;',
-    "scan target repository coverage",
-  );
-  source = replaceAllRequired(source, "resource: \"", "resourceType: \"", 3, "audit resource type field");
-  source = replaceOnce(
-    source,
-    '    const r = await storage.updateTrainingRecord(req.params.id, parsed.data);',
-    '    const trainingUpdate = {\n      completed: parsed.data.completed,\n      completedAt: parsed.data.completedAt === undefined ? undefined : parsed.data.completedAt === null ? null : new Date(parsed.data.completedAt),\n      course: parsed.data.courseName,\n      phishingScore: parsed.data.score,\n    };\n    const r = await storage.updateTrainingRecord(req.params.id, trainingUpdate);',
-    "training schema transform",
-  );
-  source = replaceOnce(
-    source,
-    '      avgCvss: parseFloat((cves.reduce((s, c) => s + c.cvssScore, 0) / cves.length).toFixed(1)),',
-    '      avgCvss: cves.length > 0 ? parseFloat((cves.reduce((s, c) => s + (c.cvssScore ?? 0), 0) / cves.length).toFixed(1)) : 0,',
-    "nullable CVSS average",
-  );
-  source = replaceOnce(
-    source,
-    '      const criticalRisks = risks.filter(r => r.severity === "critical" && r.status !== "accepted").length;',
-    '      const criticalRisks = risks.filter(r => r.riskScore >= 15 && r.status !== "accepted").length;',
-    "risk severity derivation",
-  );
-  write(path, source);
-}
-
-{
-  const path = "server/seed-demo.ts";
-  let source = read(path);
-  source = replaceOnce(source, ', resolvedAt: ago(3), verifiedAt: ago(2)', ', verifiedAt: ago(2)', "resolved vulnerability fixture one");
-  source = replaceOnce(source, ', resolvedAt: ago(10), verifiedAt: ago(9)', ', verifiedAt: ago(9)', "resolved vulnerability fixture two");
-  write(path, source);
-}
-
-{
-  const path = "server/task-runner.ts";
-  let source = read(path);
-  source = replaceOnce(
-    source,
-    '    const scan = await storage.createScan({\n      organizationId: task.organizationId,\n      repositoryId: repo.id,\n      type: "full",\n      status: "running",\n      branch: repo.defaultBranch || "main",\n      commitHash: null,\n      triggeredBy: task.createdById || "system",\n      totalFindings: 0,\n      criticalCount: 0,\n      highCount: 0,\n      mediumCount: 0,\n      lowCount: 0,\n    });',
-    '    const scan = await storage.createScan({\n      organizationId: task.organizationId,\n      name: `Task scan: ${repo.name}`,\n      scanType: "semgrep",\n      status: "running",\n      targetType: "repository",\n      targetId: repo.id,\n      targetName: repo.name,\n      initiatedById: task.createdById || null,\n    });',
-    "task scan schema",
-  );
-  source = replaceOnce(
-    source,
-    '    playbookId: playbook.id,\n    status: "running",',
-    '    playbookId: playbook.id,\n    playbookName: playbook.name,\n    status: "running",',
-    "SOAR playbook name",
-  );
-  write(path, source);
-}
-
-console.log("TypeScript schema repair applied");

From edde9eefb620c53a98c72cb0831f1d4f399c6dee Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:58:56 -0400
Subject: [PATCH 22/23] ci: remove completed TypeScript repair preview

---
 .../workflows/typescript-schema-repair.yml    | 33 -------------------
 1 file changed, 33 deletions(-)
 delete mode 100644 .github/workflows/typescript-schema-repair.yml

diff --git a/.github/workflows/typescript-schema-repair.yml b/.github/workflows/typescript-schema-repair.yml
deleted file mode 100644
index 58170a3..0000000
--- a/.github/workflows/typescript-schema-repair.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-name: TypeScript Schema Repair Preview
-
-on:
-  pull_request:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-jobs:
-  repair-preview:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout PR merge
-        uses: actions/checkout@v4
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-      - name: Install
-        run: npm ci
-      - name: Apply deterministic schema repairs in runner
-        run: node script/typescript-schema-repair.mjs
-      - name: Verify War Room boundary
-        run: npx tsx --test server/war-room.test.ts
-      - name: TypeScript check
-        run: npm run check
-      - name: Production build
-        run: npm run build
-      - name: Show verified repair diff
-        run: git diff --check && git diff --stat

From f8811242dc04df83757d6afa7dba2a2c870e33d4 Mon Sep 17 00:00:00 2001
From: Agens Nihil <60854716+sonoxo@users.noreply.github.com>
Date: Thu, 20 Aug 2026 02:59:03 -0400
Subject: [PATCH 23/23] ci: remove completed TypeScript repair workflow

---
 .../apply-typescript-schema-repair.yml        | 48 -------------------
 1 file changed, 48 deletions(-)
 delete mode 100644 .github/workflows/apply-typescript-schema-repair.yml

diff --git a/.github/workflows/apply-typescript-schema-repair.yml b/.github/workflows/apply-typescript-schema-repair.yml
deleted file mode 100644
index 9c363bd..0000000
--- a/.github/workflows/apply-typescript-schema-repair.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: Apply Verified TypeScript Schema Repair
-
-on:
-  push:
-    branches:
-      - feature/cyberpunk-war-room
-    paths:
-      - .github/workflows/apply-typescript-schema-repair.yml
-
-permissions:
-  contents: write
-
-jobs:
-  apply-verified-repair:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout feature branch
-        uses: actions/checkout@v4
-        with:
-          ref: feature/cyberpunk-war-room
-          fetch-depth: 0
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-      - name: Install
-        run: npm ci
-      - name: Apply deterministic schema repairs
-        run: node script/typescript-schema-repair.mjs
-      - name: Verify War Room boundary
-        run: npx tsx --test server/war-room.test.ts
-      - name: TypeScript check
-        run: npm run check
-      - name: Production build
-        run: npm run build
-      - name: Commit verified source repairs
-        run: |
-          git diff --check
-          if git diff --quiet -- client server; then
-            echo "No source repair required"
-            exit 0
-          fi
-          git config user.name "zyra-ci-repair"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add client server
-          git commit -m "fix: align TypeScript code with current schemas"
-          git push origin HEAD:feature/cyberpunk-war-room