[reconciliation] Rebuild HumeStone overlay on upstream OB1 pin

.github/workflows/ob1-gate-v2.yml

@@ -11,16 +11,28 @@ name: OB1 PR Gate
 # This means: automated agent passes → human admin approves → merge allowed
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened]
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
+  event_guard:
+    name: OB1 Gate Event Guard
+    if: github.event_name != 'pull_request_target'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Explain non-review gate run
+        run: |
+          echo "OB1 PR Gate received a ${GITHUB_EVENT_NAME} event."
+          echo "The contribution review only runs for pull_request_target events."
+
   review:
     name: OB1 Review
+    if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout PR head safely
@@ -30,7 +42,9 @@ jobs:
           fetch-depth: 0
 
       - name: Fetch base branch
-        run: git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1
+        run: |
+          git fetch origin "${{ github.event.pull_request.base.ref }}:refs/remotes/origin/${{ github.event.pull_request.base.ref }}" --depth=1
+          git show "origin/${{ github.event.pull_request.base.ref }}:.github/metadata.schema.json" > /tmp/ob1-metadata.schema.json
 
       - name: Install metadata schema validator
         run: python3 -m pip install check-jsonschema
@@ -53,11 +67,11 @@ jobs:
 
       - name: Run review checks
         id: review
+        env:
+          CHANGED_FILES: ${{ steps.changed.outputs.files }}
+          CONTRIB_DIRS: ${{ steps.changed.outputs.contrib_dirs }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
-          CHANGED_FILES="${{ steps.changed.outputs.files }}"
-          CONTRIB_DIRS="${{ steps.changed.outputs.contrib_dirs }}"
-          PR_TITLE="${{ github.event.pull_request.title }}"
-
           pass_count=0
           fail_count=0
           results=""
@@ -144,7 +158,7 @@ jobs:
               continue
             fi
 
-            if ! schema_output=$(check-jsonschema --schemafile .github/metadata.schema.json "$dir/metadata.json" 2>&1); then
+            if ! schema_output=$(check-jsonschema --schemafile /tmp/ob1-metadata.schema.json "$dir/metadata.json" 2>&1); then
               indented_output=$(printf '%s\n' "$schema_output" | sed 's/^/      /')
               rule3_detail="${rule3_detail}  - \`$dir/metadata.json\` failed schema validation\n${indented_output}\n"
               rule3_pass=false
@@ -628,24 +642,33 @@ jobs:
           REVIEW_COMMENT: ${{ steps.review.outputs.comment }}
           REVIEW_FAILED: ${{ steps.review.outputs.failed }}
           SECRET_BLOCKED: ${{ steps.review.outputs.secret_blocked }}
+          CHANGED_FILES: ${{ steps.changed.outputs.files }}
+          CONTRIB_DIRS: ${{ steps.changed.outputs.contrib_dirs }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
+          PR_AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          PR_DRAFT: ${{ github.event.pull_request.draft }}
         run: |
           set -euo pipefail
 
           mkdir -p gate-artifact
 
           printf '%s\n' "$REVIEW_COMMENT" > gate-artifact/ob1-review-summary.md
           printf '%s\n' "$REVIEW_COMMENT" >> "$GITHUB_STEP_SUMMARY"
-          printf '%s\n' "${{ steps.changed.outputs.files }}" > gate-artifact/changed-files.txt
-          printf '%s\n' "${{ steps.changed.outputs.contrib_dirs }}" > gate-artifact/contribution-dirs.txt
+          printf '%s\n' "$CHANGED_FILES" > gate-artifact/changed-files.txt
+          printf '%s\n' "$CONTRIB_DIRS" > gate-artifact/contribution-dirs.txt
 
           jq -n \
-            --argjson pr_number "${{ github.event.pull_request.number }}" \
-            --arg pr_url "${{ github.event.pull_request.html_url }}" \
-            --arg title "${{ github.event.pull_request.title }}" \
-            --arg head_sha "${{ github.event.pull_request.head.sha }}" \
-            --arg author_login "${{ github.event.pull_request.user.login }}" \
-            --arg author_association "${{ github.event.pull_request.author_association }}" \
-            --arg is_draft "${{ github.event.pull_request.draft }}" \
+            --argjson pr_number "$PR_NUMBER" \
+            --arg pr_url "$PR_URL" \
+            --arg title "$PR_TITLE" \
+            --arg head_sha "$PR_HEAD_SHA" \
+            --arg author_login "$PR_AUTHOR_LOGIN" \
+            --arg author_association "$PR_AUTHOR_ASSOCIATION" \
+            --arg is_draft "$PR_DRAFT" \
             --arg failed "$REVIEW_FAILED" \
             --arg secret_blocked "$SECRET_BLOCKED" \
             '{

.github/workflows/ob1-pr-followups.yml

@@ -16,8 +16,18 @@ permissions:
   id-token: write
 
 jobs:
+  ignore_non_pr_gate:
+    name: Ignore Non-PR Gate Run
+    if: github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.event != 'pull_request_target'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Explain skipped follow-up
+        run: |
+          echo "OB1 PR Follow-Ups only acts on pull_request or pull_request_target gate runs."
+          echo "Received upstream event: ${{ github.event.workflow_run.event }}"
+
   followups:
-    if: github.event.workflow_run.event == 'pull_request'
+    if: github.event.workflow_run.event == 'pull_request' || github.event.workflow_run.event == 'pull_request_target'
     runs-on: ubuntu-latest
     concurrency:
       group: ob1-pr-followups-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.id }}

dashboards/open-brain-dashboard-next/.env.example

@@ -1,6 +1,14 @@
 # Required: URL of your Open Brain REST API
 NEXT_PUBLIC_API_URL=https://YOUR-PROJECT-REF.supabase.co/functions/v1/open-brain-rest
 
+# Required: password entered at the dashboard login screen.
+DASHBOARD_PASSWORD=
+
+# Required: server-side Company Memory access key. It is never entered at
+# login or stored in the browser session. MCP_ACCESS_KEY remains a legacy fallback.
+OPEN_BRAIN_KEY=
+# MCP_ACCESS_KEY=
+
 # Optional: URL of your OB1 Agent Memory API.
 # If omitted, the dashboard derives it from NEXT_PUBLIC_API_URL by replacing open-brain-rest with agent-memory-api.
 # AGENT_MEMORY_API_URL=https://YOUR-PROJECT-REF.supabase.co/functions/v1/agent-memory-api
@@ -9,6 +17,10 @@ NEXT_PUBLIC_API_URL=https://YOUR-PROJECT-REF.supabase.co/functions/v1/open-brain
 # AGENT_MEMORY_WORKSPACE_ID=ob1-staging
 # AGENT_MEMORY_PROJECT_ID=
 
+# Optional: use a dedicated Agent Memory access key when its API is deployed.
+# If omitted, the dashboard intentionally falls back to MCP_ACCESS_KEY.
+# AGENT_MEMORY_ACCESS_KEY=
+
 # Required: 32+ character secret for iron-session cookie encryption
 # Generate with: openssl rand -hex 32
 SESSION_SECRET=
@@ -23,6 +35,12 @@ SESSION_SECRET=
 # OB1_DEMO_AUTH_BYPASS=false
 # OB1_DASHBOARD_DEMO_KEY=local-screenshot-key
 
+# Optional: allow Mission Control to send retrieved Company Memory snippets to
+# OpenRouter for answer synthesis. Default is off; enabling requires privacy review.
+# MISSION_CONTROL_AI_ANSWERS_ENABLED=false
+# OPENROUTER_API_KEY=
+# OPENROUTER_MODEL=anthropic/claude-3.5-haiku
+
 # Optional: SHA-256 hash of passphrase to unlock restricted/sensitive content
 # Requires the sensitivity-tiers primitive (sensitivity_tier column on thoughts)
 # Generate with: echo -n "your-passphrase" | shasum -a 256

dashboards/open-brain-dashboard-next/EXTENSIONS.md

@@ -0,0 +1,84 @@
+# Dashboard Extensions
+
+The Open Brain dashboard supports drop-in extensions that add a new route
+and a sidebar entry **without modifying any core dashboard file**.
+
+## Anatomy
+
+An extension is:
+
+1. A folder under `app/<route>/` containing one or more `page.tsx` files
+   (Next.js App Router conventions apply). The folder name becomes the URL.
+2. One entry in `extensions.config.ts` adding a sidebar nav item.
+
+That's it. Extensions own their own API helpers (live in the extension
+folder, not `lib/api.ts`) and their own types.
+
+## Minimal example
+
+```
+app/
+  hello/
+    page.tsx          ← extension page
+    api.ts            ← extension's own data layer (optional)
+```
+
+```ts
+// extensions.config.ts
+export const EXTENSIONS: ExtensionNavEntry[] = [
+  { href: "/hello", label: "Hello", icon: "sparkles" },
+];
+```
+
+`page.tsx` imports its own helpers from `./api` (or wherever), and the
+extension is live after `npm run build && vercel deploy --prod`.
+
+## Auth
+
+Extension pages use the same session helpers as core pages:
+
+```tsx
+import { requireSessionOrRedirect } from "@/lib/auth";
+
+export default async function Page() {
+  const { apiKey } = await requireSessionOrRedirect();
+  // ...
+}
+```
+
+`apiKey` is the OB1 access key the user logged in with — pass it as the
+`x-brain-key` header when calling Edge Functions.
+
+## Backend routes
+
+Extensions that need their own REST endpoints have two clean options:
+
+- **Sidecar Edge Function.** Deploy a separate function (e.g.
+  `my-extension-api`). Derive its URL on the dashboard side by string-
+  replacing `open-brain-rest` in `NEXT_PUBLIC_API_URL` (`agent-memory-api`
+  does this — see `lib/agent-memory.ts`).
+- **Add routes to `open-brain-rest`.** Acceptable when the data lives in a
+  table that's tightly coupled to OB1's core surface area.
+
+## Icon registry
+
+Extensions reference icons by string name because `extensions.config.ts`
+is plain TypeScript (no JSX). Supported keys are declared in
+`extensions.config.ts` as `ExtensionIcon`. To add a new icon:
+
+1. Add the key to the `ExtensionIcon` union.
+2. Implement the SVG component in `components/Sidebar.tsx`.
+3. Map the key in `EXTENSION_ICONS`.
+
+## Position in the sidebar
+
+Extensions render in declaration order, between the core nav items
+(Dashboard, Thoughts, Workflow, Agent Memory, Search, Audit, Duplicates)
+and the trailing "Add" entry.
+
+## Versioning
+
+The extension contract is small (one config file, one folder layout
+convention) so it's intentionally not versioned. Breaking changes — if
+ever — would surface as TypeScript errors in `extensions.config.ts`,
+which is the right place to catch them.

dashboards/open-brain-dashboard-next/README.md

@@ -255,6 +255,16 @@ AGENT_MEMORY_API_URL=http://127.0.0.1:3022
 
 Do not enable `OB1_DEMO_AUTH_BYPASS` in shared previews or production. It exists so repeatable screenshot and video generation can run without putting real API keys in browser automation.
 
+### Agent Memory Read-Only Governance Guard
+
+Set `OB1_GOVERNANCE_READ_ONLY=true` for local governance pilots. In this mode, Agent Memory list/detail pages render read-only notices, hide review controls, and server actions return before calling `PATCH /memories/:id/review`.
+
+Verify locally:
+
+```bash
+npm run test:agent-memory
+```
+
 ## Tech Stack
 
 - **Next.js 16** (App Router)

dashboards/open-brain-dashboard-next/app/agent-memory/[id]/page.tsx

@@ -3,6 +3,7 @@ import type { ReactNode } from "react";
 import { notFound } from "next/navigation";
 import { revalidatePath } from "next/cache";
 import {
+  agentMemoryDefaults,
   fetchAgentMemory,
   reviewAgentMemory,
 } from "@/lib/agent-memory";
@@ -14,26 +15,40 @@ import {
 } from "@/components/AgentMemoryBadges";
 import { FormattedDate } from "@/components/FormattedDate";
 import type { AgentMemoryReviewAction } from "@/lib/types";
+import { isGovernanceReadOnly } from "@/lib/governance";
 
 export const dynamic = "force-dynamic";
 
 export default async function AgentMemoryDetailPage({
   params,
+  searchParams,
 }: {
   params: Promise<{ id: string }>;
+  searchParams: Promise<Record<string, string | undefined>>;
 }) {
   const { apiKey } = await requireSessionOrRedirect();
   const { id } = await params;
+  const query = await searchParams;
+  const defaults = agentMemoryDefaults();
+  const workspaceId = query.workspace_id || defaults.workspaceId;
+  const projectId = query.project_id ?? defaults.projectId;
+  const governanceReadOnly = isGovernanceReadOnly();
 
   let memory;
   try {
-    memory = await fetchAgentMemory(apiKey, id);
+    memory = await fetchAgentMemory(apiKey, id, {
+      workspace_id: workspaceId,
+      project_id: projectId,
+    });
   } catch {
     notFound();
   }
 
   async function reviewAction(formData: FormData) {
     "use server";
+    if (isGovernanceReadOnly()) {
+      return;
+    }
     const { apiKey } = await requireSessionOrRedirect();
     const action = String(formData.get("action") || "") as AgentMemoryReviewAction;
     await reviewAgentMemory(apiKey, id, action, {
@@ -59,26 +74,32 @@ export default async function AgentMemoryDetailPage({
             {memory.summary}
           </h1>
         </div>
-        <div className="flex flex-wrap gap-2">
-          <form action={reviewAction}>
-            <input type="hidden" name="action" value="evidence_only" />
-            <button className="ob1-command-button h-9 px-3 text-sm">
-              Evidence only
-            </button>
-          </form>
-          <form action={reviewAction}>
-            <input type="hidden" name="action" value="confirm" />
-            <button className="h-9 border border-success/30 px-3 text-sm text-success hover:bg-success/10">
-              Confirm
-            </button>
-          </form>
-          <form action={reviewAction}>
-            <input type="hidden" name="action" value="reject" />
-            <button className="h-9 border border-danger/30 px-3 text-sm text-danger hover:bg-danger/10">
-              Reject
-            </button>
-          </form>
-        </div>
+        {governanceReadOnly ? (
+          <div className="rounded-md border border-amber-500/40 bg-amber-500/10 px-3 py-2 text-xs text-amber-200">
+            Review actions are unavailable in the read-only governance pilot.
+          </div>
+        ) : (
+          <div className="flex flex-wrap gap-2">
+            <form action={reviewAction}>
+              <input type="hidden" name="action" value="evidence_only" />
+              <button className="ob1-command-button h-9 px-3 text-sm">
+                Evidence only
+              </button>
+            </form>
+            <form action={reviewAction}>
+              <input type="hidden" name="action" value="confirm" />
+              <button className="h-9 border border-success/30 px-3 text-sm text-success hover:bg-success/10">
+                Confirm
+              </button>
+            </form>
+            <form action={reviewAction}>
+              <input type="hidden" name="action" value="reject" />
+              <button className="h-9 border border-danger/30 px-3 text-sm text-danger hover:bg-danger/10">
+                Reject
+              </button>
+            </form>
+          </div>
+        )}
       </div>
 
       <div className="grid gap-4 md:grid-cols-[minmax(0,1fr)_340px]">