`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_305":306,"_307":308},"routes/_app.x.$handle.$name",{"_98":97,"_31":43,"_107":88,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":57,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",17,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":20,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","skills/doop-design-workspace/SKILL.md","latestPath","fileId","5e61fdfa-a379-11f1-8d69-1607ee4eb77e","name","SKILL.md","fileType","content","# Doop Design Workspace Skill\n\nVersion: 1.0.0\nSource: kgoedecke/doop\nLicense: AGPL-3.0\nPurpose: governed collaborative design canvas + MCP capability for AG/HANTER/NCA.\n\n## Boundary\n\nDoop is treated as a design workspace and MCP-connected tool. It does not grant execution authority, financial authority, credential authority, publication authority, or security-offensive authority.\n\nIdentity != Authority.\nCapability != Approval.\nIntelligence != Privilege.\n\n## Allowed capabilities\n\n- create and edit design frames/canvases;\n- collaborate with humans in the visual workspace;\n- generate UI concepts and implementation-ready HTML/CSS artifacts;\n- review accessibility, layout, responsive behavior, design-system consistency and visual QA;\n- stream bounded design work through an authenticated MCP connection;\n- preserve attribution/evidence for agent-produced design changes.\n\n## Denied by default\n\n- autonomous publication to production;\n- handling secrets in canvas content;\n- browser-side credentials;\n- financial operations;\n- privilege escalation;\n- unrestricted external network access;\n- autonomous offensive security activity;\n- treating MCP connection as execution approval.\n\n## Preferred integration mode\n\n1. Self-host Doop in a dedicated long-running Node runtime with persistent PostgreSQL and WebSocket support, or use the vendor-hosted service only after explicit account authorization.\n2. Connect agents through Doop's MCP OAuth flow or an equivalent authenticated MCP boundary.\n3. Keep model/API credentials server-side.\n4. Disable unsupported ChatGPT-subscription proxying for production use; prefer direct MCP clients or supported provider/API paths.\n5. Route consequential actions through HANTER governance and Approval Gateway.\n\n## Fleet usage\n\nCreative/UI agents: primary users.\nOther NCA: may request/review artifacts when mission scope requires it.\nORION: advisory coordination only.\nHANTER: command center and policy authority boundary; no provider runtime becomes a competing command authority.\n\n## Evidence states\n\nCONFIGURED != CONNECTED.\nCONNECTED != AUTHORIZED.\nAUTHORED != REVIEWED.\nREVIEWED != APPROVED.\nAPPROVED != DEPLOYED.\n\nDo not report Doop as INSTALLED/LIVE until its runtime endpoint, authentication, persistence and MCP connection have been independently verified.","createdAt",["D",1787987709487],"branchVersion","branchId","24770712-378b-401f-a93f-7fe807c5dda9","id","d711419f-af68-49ff-b31a-45902d9292f1","ag-command-center",["D",1787981826165],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","AG HANTER + 100 NCA + CRM command center","imageUrl","fe39b163-4b50-466e-82d1-8bd01133e4b6","pinnedFileId","01a04c05-88bb-772a-8ca1-918bb0a15986","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a03585-eb44-758d-92a4-77db1a9a243c","tursoName","d711419faf6849ffb31a45902d9292f1","tursoHostname","d711419faf6849ffb31a45902d9292f1-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789456888508],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"isOwned",43,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","oromaskevic23","handle","displayName","Олександр Ромаскевич","avatar","https://lh3.googleusercontent.com/a/ACg8ocIo1MJ3hDjpQrinMIRok3d2YY1vpHgehs8m2u1_vc7pmFovRGI=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":300,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":301,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":302,"_82":303,"_84":304,"_86":24},"tree",[186,193,195,200,201,202],"files",[186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202],"counts",{"_176":61,"_177":149,"_178":61,"_179":180,"_181":182},"contents",[129,130,131,132,133,134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":171,"_31":172,"_29":173,"_137":-5,"_39":40,"_38":149,"_139":57,"_36":174,"_13":61,"_33":163,"_34":-5,"_23":24,"_144":-5,"_26":175},{"_41":165,"_31":166,"_29":167,"_137":-5,"_39":40,"_38":168,"_139":57,"_36":169,"_13":61,"_33":163,"_34":-5,"_23":24,"_144":-5,"_26":170},{"_41":159,"_31":160,"_29":161,"_137":-5,"_39":40,"_38":141,"_139":57,"_36":162,"_13":61,"_33":163,"_34":-5,"_23":24,"_144":-5,"_26":164},{"_41":153,"_31":154,"_29":155,"_137":-5,"_39":40,"_38":149,"_139":57,"_36":156,"_13":61,"_33":20,"_34":157,"_23":24,"_144":-5,"_26":158},{"_41":146,"_31":147,"_29":148,"_137":-5,"_39":40,"_38":149,"_139":57,"_36":150,"_13":61,"_33":20,"_34":151,"_23":24,"_144":-5,"_26":152},{"_41":135,"_31":136,"_29":55,"_137":-5,"_39":40,"_38":138,"_139":24,"_36":140,"_13":141,"_33":142,"_34":143,"_23":24,"_144":43,"_26":145},"a3239665-7d7e-4b7b-8678-8689097dfff5","index.ts","parentId",15,"latest",["D",1787983459720],4,"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Hono } from \"npm:hono@4.9.5\";\nimport { Root } from \"./frontend/root.tsx\";\nimport {\n boundedText,\n githubFailureState,\n isAgentId,\n isRepoAllowed,\n normalizeRepo,\n parseRepoAllowlist,\n providerSemantic,\n safeEqual,\n} from \"./lib/policy.mjs\";\n\nconst app = new Hono();\nconst MISSION_ID = \"IC-AG-GENERAL-AGENT-PLATFORM-001\";\nconst CANONICAL_REPO = \"oromaskevic23-cmd/CYBER-HAK-Public\";\nconst RECOVERY_STATUS_URL = \"https://oromaskevic23--6796d66aa32f11f1bd771607ee4eb77e.web.val.run\";\nconst PROVIDERS = [\n { id: \"provider-1\", name: \"Val Town\", node: \"hanter-bridge-node-1\", endpoint: \"https://oromaskevic23--46761dd0a2bf11f18ae41607ee4eb77e.web.val.run/health\", present: true },\n { id: \"provider-2\", name: \"Netlify\", node: \"hanter-bridge-node-2\", endpoint: \"https://hanter-bridge-node-2.netlify.app/health\", present: true },\n { id: \"provider-3\", name: \"Supabase\", node: \"hanter-bridge-node-3\", endpoint: \"https://flqxwhibxnyujynmopmr.supabase.co/functions/v1/hanter-bridge-node-3\", present: true },\n];\n\nconst DIRECTORS = [\n { id: \"ORCH-KIDS-MEDIA-001\", name: \"Lucas Bennett\", agents: 8, domain: \"Kids Media\" },\n { id: \"ORCH-DROPSHIPPING-001\", name: \"Mason Reed\", agents: 16, domain: \"Dropshipping Commerce\" },\n { id: \"ORCH-AI-AUTOMATION-001\", name: \"Ethan Cole\", agents: 13, domain: \"AI Automation\" },\n { id: \"ORCH-B2B-REVENUE-001\", name: \"Sophia Laurent\", agents: 13, domain: \"B2B Revenue\" },\n { id: \"ORCH-CREATIVE-DIGITAL-001\", name: \"Adrian Wolfe\", agents: 13, domain: \"Creative & Digital\" },\n { id: \"ORCH-EDUCATION-001\", name: \"Amelia Grant\", agents: 13, domain: \"Education\" },\n { id: \"ORCH-DATA-MARKET-001\", name: \"Victor Hayes\", agents: 12, domain: \"Data & Market Intelligence\" },\n { id: \"ORCH-SME-SERVICES-001\", name: \"Olivia Morgan\", agents: 12, domain: \"SME Services\" },\n];\n\nconst ROSTER = (() => {\n let n = 1;\n return DIRECTORS.flatMap((director) => Array.from({ length: director.agents }, () => ({\n agent_id: `NCA-${String(n++).padStart(3, \"0\")}`,\n director_id: director.id,\n director: director.name,\n department: director.domain,\n current_mission: MISSION_ID,\n current_task: null,\n checkpoint: \"AG-M1-GOVERNED-INTEGRATION\",\n runtime_state: \"RECOVERY_RUNTIME_REPORTED\",\n skill_bindings: [\"AG Builder 1.1.0\"],\n evidence_count: 0,\n heartbeat: null,\n orion_state: \"ADVISORY_ONLY\",\n truth_boundary: \"ASSIGNMENT_NOT_EXECUTION_EVIDENCE\",\n })));\n})();\n\nawait sqlite.batch([\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_organizations (id TEXT PRIMARY KEY,name TEXT NOT NULL,website TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_contacts (id TEXT PRIMARY KEY,organization_id TEXT,name TEXT NOT NULL,email TEXT,source TEXT NOT NULL,status TEXT NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_leads (id TEXT PRIMARY KEY,title TEXT NOT NULL,stage TEXT NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_opportunities (id TEXT PRIMARY KEY,title TEXT NOT NULL,stage TEXT NOT NULL,value_usd REAL,probability INTEGER NOT NULL,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_activities (id TEXT PRIMARY KEY,kind TEXT NOT NULL,subject TEXT NOT NULL,related_type TEXT,related_id TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_tasks (id TEXT PRIMARY KEY,title TEXT NOT NULL,status TEXT NOT NULL,due_at TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_crm_notes (id TEXT PRIMARY KEY,body TEXT NOT NULL,related_type TEXT,related_id TEXT,owner_agent_id TEXT,evidence_ref TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_missions (id TEXT PRIMARY KEY,title TEXT NOT NULL,status TEXT NOT NULL,director_id TEXT,task_graph_json TEXT NOT NULL,evidence_ref TEXT,approval_state TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_audit_v2 (id INTEGER PRIMARY KEY AUTOINCREMENT,event_type TEXT NOT NULL,subject_id TEXT,detail_json TEXT NOT NULL,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_idempotency (key TEXT PRIMARY KEY,request_hash TEXT NOT NULL,response_json TEXT,created_at TEXT NOT NULL)\" },\n { sql: \"CREATE TABLE IF NOT EXISTS ag_skill_bindings (agent_id TEXT NOT NULL,skill_id TEXT NOT NULL,skill_version TEXT NOT NULL,state TEXT NOT NULL,PRIMARY KEY(agent_id,skill_id))\" },\n]);\nfor (const agent of ROSTER) await sqlite.execute({ sql: \"INSERT OR IGNORE INTO ag_skill_bindings(agent_id,skill_id,skill_version,state) VALUES(?,?,?,?)\", args: [agent.agent_id, \"ag-builder\", \"1.1.0\", \"ACTIVE_BOUNDED\"] });\n\napp.use(\"*\", async (c, next) => {\n await next();\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=(), payment=()\");\n c.header(\"Content-Security-Policy\", \"default-src 'self'; script-src 'self' https://cdn.twind.style https://esm.town https://esm.sh; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'self'\");\n if (c.req.path.startsWith(\"/api/\")) c.header(\"Cache-Control\", \"no-store\");\n});\n\nfunction requireAdmin(c: any) {\n const configured = Deno.env.get(\"AG_ADMIN_TOKEN\");\n if (!configured) return c.json({ ok: false, status: \"BLOCKED\", error: \"AG_ADMIN_TOKEN_NOT_CONFIGURED\" }, 503);\n const provided = c.req.header(\"authorization\")?.replace(/^Bearer\\s+/i, \"\") ?? \"\";\n if (!safeEqual(provided, configured)) return c.json({ ok: false, status: \"BLOCKED\", error: \"UNAUTHORIZED\" }, 401);\n const origin = c.req.header(\"origin\");\n if (origin && origin !== new URL(c.req.url).origin) return c.json({ ok: false, status: \"BLOCKED\", error: \"ORIGIN_DENIED\" }, 403);\n return null;\n}\n\nasync function parseMutation(c: any) {\n if (!/^application\\/json(?:;|$)/i.test(c.req.header(\"content-type\") ?? \"\")) return { error: c.json({ ok: false, error: \"JSON_CONTENT_TYPE_REQUIRED\" }, 415) };\n const length = Number(c.req.header(\"content-length\") ?? 0);\n if (length > 32768) return { error: c.json({ ok: false, error: \"BODY_TOO_LARGE\" }, 413) };\n const key = c.req.header(\"idempotency-key\");\n if (!key || !/^[A-Za-z0-9._:-]{8,128}$/.test(key)) return { error: c.json({ ok: false, error: \"VALID_IDEMPOTENCY_KEY_REQUIRED\" }, 400) };\n try { return { body: await c.req.json(), key }; } catch { return { error: c.json({ ok: false, error: \"MALFORMED_JSON\" }, 400) }; }\n}\n\nasync function fetchJson(url: string, headers: Record = {}, timeoutMs = 5000) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n try {\n const response = await fetch(url, { headers, redirect: \"error\", signal: controller.signal });\n const text = (await response.text()).slice(0, 1000000);\n let body: any = null;\n try { body = text ? JSON.parse(text) : null; } catch { body = { parse_error: true }; }\n return { ok: response.ok, status: response.status, body };\n } finally { clearTimeout(timer); }\n}\n\nlet providerCache: { at: number; value: any[] } | null = null;\nasync function providerHealth() {\n if (providerCache && Date.now() - providerCache.at < 30000) return providerCache.value;\n const checkedAt = new Date().toISOString();\n const value = await Promise.all(PROVIDERS.map(async (provider) => {\n try {\n const result = await fetchJson(provider.endpoint, {}, 4500);\n return { ...provider, http_status: result.status, response: result.body, checked_at: checkedAt, ...providerSemantic(result.ok, result.body, provider.node), side_effect_boundary: \"DENIED\", evidence_reference: `${provider.endpoint} @ ${checkedAt}` };\n } catch (error) {\n return { ...provider, http_status: null, response: null, checked_at: checkedAt, health_state: \"NOT_VERIFIED\", readiness_state: \"NOT_VERIFIED\", authority_state: \"NONE\", boundary_valid: false, side_effect_boundary: \"DENIED\", error: error instanceof Error ? error.name : \"FETCH_FAILED\", evidence_reference: `${provider.endpoint} @ ${checkedAt}` };\n }\n }));\n providerCache = { at: Date.now(), value };\n return value;\n}\n\nlet githubCache: { at: number; repo: string; value: any } | null = null;\nasync function githubStatus(requestedRepo?: string | null) {\n const token = Deno.env.get(\"GITHUB_TOKEN\");\n const configuredRepo = normalizeRepo(Deno.env.get(\"AG_GITHUB_REPO\") ?? CANONICAL_REPO);\n const allowlist = parseRepoAllowlist(Deno.env.get(\"AG_GITHUB_REPO_ALLOWLIST\") ?? \"\");\n const repo = normalizeRepo(requestedRepo ?? configuredRepo);\n if (!repo) return { state: \"REPO_NOT_FOUND\", connected: false, verified_at: new Date().toISOString() };\n if (!token) return { state: \"NOT_CONNECTED\", connected: false, repo, reason: \"GITHUB_CREDENTIAL_NOT_CONFIGURED\", verified_at: new Date().toISOString() };\n if (!isRepoAllowed(repo, allowlist)) return { state: \"ACCESS_DENIED\", connected: false, repo, reason: \"REPOSITORY_NOT_ALLOWLISTED\", verified_at: new Date().toISOString() };\n if (githubCache && githubCache.repo === repo && Date.now() - githubCache.at < 30000) return githubCache.value;\n const headers = { Authorization: `Bearer ${token}`, Accept: \"application/vnd.github+json\", \"User-Agent\": \"AG-Command-Center\" };\n const base = `https://api.github.com/repos/${repo}`;\n try {\n const metadata = await fetchJson(base, headers, 6500);\n if (!metadata.ok) return { state: githubFailureState(metadata.status), connected: false, repo, http_status: metadata.status, verified_at: new Date().toISOString() };\n const [branches, commits, pulls, issues, runs] = await Promise.all([\n fetchJson(`${base}/branches?per_page=100`, headers), fetchJson(`${base}/commits?per_page=1`, headers),\n fetchJson(`${base}/pulls?state=open&per_page=20`, headers), fetchJson(`${base}/issues?state=open&per_page=20`, headers),\n fetchJson(`${base}/actions/runs?per_page=10`, headers),\n ]);\n const latest = Array.isArray(commits.body) ? commits.body[0] : null;\n const value = {\n state: \"CONNECTED\", connected: true, repo: metadata.body.full_name, private: Boolean(metadata.body.private),\n default_branch: metadata.body.default_branch, latest_commit: latest ? { sha: latest.sha, message: latest.commit?.message, url: latest.html_url } : null,\n branches: Array.isArray(branches.body) ? branches.body.map((x: any) => ({ name: x.name, protected: x.protected })) : [],\n pull_requests: Array.isArray(pulls.body) ? pulls.body.map((x: any) => ({ number: x.number, title: x.title, state: x.state, url: x.html_url })) : [],\n issues: Array.isArray(issues.body) ? issues.body.filter((x: any) => !x.pull_request).map((x: any) => ({ number: x.number, title: x.title, state: x.state, url: x.html_url })) : [],\n actions: runs.ok ? (runs.body.workflow_runs ?? []).map((x: any) => ({ id: x.id, name: x.name, status: x.status, conclusion: x.conclusion, url: x.html_url })) : [],\n capability_status: { metadata: metadata.status, branches: branches.status, commits: commits.status, pull_requests: pulls.status, issues: issues.status, actions: runs.status },\n verified_at: new Date().toISOString(), credential_exposed: false,\n };\n githubCache = { at: Date.now(), repo, value };\n return value;\n } catch (error) {\n if (githubCache && githubCache.repo === repo && Date.now() - githubCache.at < 300000) return { ...githubCache.value, state: \"STALE\", connected: false, stale_since: new Date(githubCache.at).toISOString() };\n return { state: \"STALE\", connected: false, repo, reason: error instanceof Error ? error.name : \"FETCH_FAILED\", verified_at: new Date().toISOString() };\n }\n}\n\nasync function recoveryStatus() {\n try { const value = await fetchJson(RECOVERY_STATUS_URL, {}, 5000); return { status: value.ok ? \"PASS\" : \"NOT_VERIFIED\", http_status: value.status, evidence: value.body, verified_at: new Date().toISOString() }; }\n catch (error) { return { status: \"NOT_VERIFIED\", http_status: null, error: error instanceof Error ? error.name : \"FETCH_FAILED\", verified_at: new Date().toISOString() }; }\n}\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/api/health\", (c) => c.json({ ok: true, status: \"PASS\", product: \"AG\", component: \"ag-command-center\", mission_id: MISSION_ID, checkpoint: \"AG-M1-GOVERNED-INTEGRATION\", production: false, timestamp: new Date().toISOString() }));\n\napp.get(\"/api/providers\", async (c) => c.json({ logical_hanter_instances: 1, canonical_state_authority: \"RECOVERY_RUNTIME_UNTIL_ORIGINAL_RESTORED\", rules: { stale_after_seconds: 90, retry: \"EXPONENTIAL_BACKOFF_WITH_JITTER\", idempotency: \"REQUIRED_FOR_MUTATIONS\", replay_protection: \"SIGNED_ENVELOPE_NONCE_AND_EXPIRY_REQUIRED\", split_brain: \"FAIL_CLOSED\", failover: \"HEALTHY_IS_NOT_AUTHORITY\" }, providers: await providerHealth() }));\napp.get(\"/api/runtime/recovery\", async (c) => c.json(await recoveryStatus()));\napp.get(\"/api/agents\", (c) => c.json({ count: ROSTER.length, directors: DIRECTORS.length, agents: ROSTER }));\napp.get(\"/api/missions\", async (c) => c.json({ missions: (await sqlite.execute(\"SELECT * FROM ag_missions ORDER BY updated_at DESC LIMIT 100\")).rows }));\napp.get(\"/api/orion\", async (c) => { const runtime = await recoveryStatus(); return c.json({ role: \"ADVISORY_COORDINATION_ONLY\", authority: \"NONE\", always_on_required: true, runtime }); });\napp.get(\"/api/skills/ag-builder\", async (c) => { const result = await sqlite.execute(\"SELECT state,COUNT(*) count FROM ag_skill_bindings WHERE skill_id='ag-builder' GROUP BY state\"); return c.json({ file: \"skills/ag-builder/SKILL.md\", version: \"1.1.0\", binding_target: 100, bindings: result.rows, governance: \"SKILL_DOES_NOT_GRANT_AUTHORITY\", discoverability: \"SOURCE_PRESENT_AND_AG_RUNTIME_REGISTRY_BOUND\" }); });\napp.get(\"/api/security\", (c) => c.json({ policy: \"DENY_BY_DEFAULT\", chain: [\"AI Passport\", \"Enterprise IMPERIAL Skills\", \"Guardian Core\", \"Approval Gateway\", \"Runtime Domain\", \"Audit Ledger\"], laws: [\"Identity != Authority\", \"Capability != Approval\", \"Intelligence != Privilege\"], cyber_hak: { repository: CANONICAL_REPO, role: \"DEFENSIVE_GOVERNED_CAPABILITY_LAYER\", autonomous_offensive_activity: \"DENIED\", execution_authority: \"NONE\", credential_authority: \"NONE\", financial_authority: \"NONE\" } }));\napp.get(\"/api/github/status\", async (c) => c.json(await githubStatus(c.req.query(\"repo\"))));\n\napp.get(\"/api/crm\", async (c) => {\n const names = [\"organizations\", \"contacts\", \"leads\", \"opportunities\", \"activities\", \"tasks\", \"notes\"];\n const entries = await Promise.all(names.map(async (name) => [name, (await sqlite.execute(`SELECT * FROM ag_crm_${name} ORDER BY created_at DESC LIMIT 100`)).rows]));\n return c.json({ entities: Object.fromEntries(entries), pipeline_stages: [\"NEW\", \"QUALIFY\", \"DISCOVERY\", \"PROPOSAL\", \"NEGOTIATION\", \"WON_EVIDENCED\", \"LOST\"], revenue_claimed_usd: 0, truth_boundary: \"NO_PAYMENT_EVIDENCE_NO_REVENUE\" });\n});\n\napp.post(\"/api/crm/:entity\", async (c) => {\n const denied = requireAdmin(c); if (denied) return denied;\n const parsed = await parseMutation(c); if (parsed.error) return parsed.error;\n const entity = c.req.param(\"entity\");\n const body: any = parsed.body;\n const owner = body.owner_agent_id == null ? null : (isAgentId(body.owner_agent_id) ? body.owner_agent_id : undefined);\n if (owner === undefined) return c.json({ ok: false, error: \"INVALID_OWNER_AGENT_ID\" }, 400);\n const now = new Date().toISOString(); const id = crypto.randomUUID();\n const title = boundedText(body.title ?? body.name ?? body.subject, 240, true);\n if (!title) return c.json({ ok: false, error: \"TITLE_OR_NAME_REQUIRED\" }, 400);\n const statements: Record = {\n organizations: { sql: \"INSERT INTO ag_crm_organizations VALUES(?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.website, 500), owner, boundedText(body.evidence_ref, 500), now, now] },\n contacts: { sql: \"INSERT INTO ag_crm_contacts VALUES(?,?,?,?,?,?,?,?,?,?,?)\", args: [id, body.organization_id ?? null, title, boundedText(body.email, 320), boundedText(body.source, 80) || \"manual\", boundedText(body.status, 40) || \"NEW\", owner, boundedText(body.evidence_ref, 500), now, now] },\n leads: { sql: \"INSERT INTO ag_crm_leads VALUES(?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.stage, 40) || \"NEW\", owner, boundedText(body.evidence_ref, 500), now, now] },\n opportunities: { sql: \"INSERT INTO ag_crm_opportunities VALUES(?,?,?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.stage, 40) || \"QUALIFY\", Number.isFinite(body.value_usd) ? body.value_usd : null, Number.isInteger(body.probability) && body.probability >= 0 && body.probability <= 100 ? body.probability : 0, owner, boundedText(body.evidence_ref, 500), now, now] },\n activities: { sql: \"INSERT INTO ag_crm_activities VALUES(?,?,?,?,?,?,?,?,?)\", args: [id, boundedText(body.kind, 60) || \"NOTE\", title, boundedText(body.related_type, 60), body.related_id ?? null, owner, boundedText(body.evidence_ref, 500), now] },\n tasks: { sql: \"INSERT INTO ag_crm_tasks VALUES(?,?,?,?,?,?,?,?)\", args: [id, title, boundedText(body.status, 40) || \"OPEN\", body.due_at ?? null, owner, boundedText(body.evidence_ref, 500), now, now] },\n notes: { sql: \"INSERT INTO ag_crm_notes VALUES(?,?,?,?,?,?,?)\", args: [id, boundedText(body.body, 8000, true), boundedText(body.related_type, 60), body.related_id ?? null, owner, boundedText(body.evidence_ref, 500), now] },\n };\n const statement = statements[entity]; if (!statement || statement.args.includes(null) && entity === \"notes\" && !statement.args[1]) return c.json({ ok: false, error: \"ENTITY_OR_INPUT_INVALID\" }, 400);\n const requestHash = Array.from(new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(JSON.stringify(body))))).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n const existing = await sqlite.execute({ sql: \"SELECT request_hash,response_json FROM ag_idempotency WHERE key=?\", args: [parsed.key] });\n if (existing.rows.length) return (existing.rows[0] as any).request_hash === requestHash ? c.json(JSON.parse(String((existing.rows[0] as any).response_json))) : c.json({ ok: false, error: \"IDEMPOTENCY_KEY_CONFLICT\" }, 409);\n const response = { ok: true, entity, id, created_at: now };\n await sqlite.batch([statement, { sql: \"INSERT INTO ag_audit_v2(event_type,subject_id,detail_json,created_at) VALUES(?,?,?,?)\", args: [\"CRM_ENTITY_CREATED\", id, JSON.stringify({ entity, owner, evidence_ref: body.evidence_ref ?? null }), now] }, { sql: \"INSERT INTO ag_idempotency(key,request_hash,response_json,created_at) VALUES(?,?,?,?)\", args: [parsed.key, requestHash, JSON.stringify(response), now] }]);\n return c.json(response, 201);\n});\n\napp.get(\"/api/overview\", async (c) => {\n const crm = await sqlite.execute(\"SELECT (SELECT COUNT(*) FROM ag_crm_contacts) contacts,(SELECT COUNT(*) FROM ag_crm_organizations) organizations,(SELECT COUNT(*) FROM ag_crm_leads) leads,(SELECT COUNT(*) FROM ag_crm_opportunities) opportunities,(SELECT COUNT(*) FROM ag_crm_opportunities WHERE evidence_ref IS NOT NULL AND evidence_ref<>'') evidenced_opportunities\");\n const [providers, github, runtime] = await Promise.all([providerHealth(), githubStatus(), recoveryStatus()]);\n return c.json({ product: \"AG\", mode: \"RIGHT_HAND_MODE\", mission: { id: MISSION_ID, status: \"ACTIVE_BUILD\", checkpoint: \"AG-M1-GOVERNED-INTEGRATION\" }, hanter: { role: \"SINGLE_AI_COMMAND_CENTER_DEPUTY\", global_orchestrator: false, production: false }, fleet: { registered_agents: ROSTER.length, directors: DIRECTORS.length, roster_type: \"CANONICAL_ASSIGNMENT\", live_execution_claimed: false }, directors: DIRECTORS, orion: { role: \"ADVISORY_COORDINATION_ONLY\", always_on_required: true, status: runtime.status }, governance: [\"AI Passport\", \"Enterprise IMPERIAL Skills\", \"Guardian Core\", \"Approval Gateway\", \"Runtime Domain\", \"Audit Ledger\"], providers, crm: { ...(crm.rows[0] as any), revenue_claimed_usd: 0 }, github });\n});\n\napp.notFound((c) => c.json({ ok: false, status: \"BLOCKED\", error: \"ROUTE_NOT_FOUND\" }, 404));\napp.onError((error, c) => { console.error(\"AG_REQUEST_FAILED\", error instanceof Error ? error.name : \"UNKNOWN\"); return c.json({ ok: false, status: \"BLOCKED\", error: \"INTERNAL_ERROR\" }, 500); });\nexport default app.fetch;\n","label",[136],"c248b291-25c7-4a77-ba0b-0b333cbab467","README.md","01a04c05-88bb-772a-8ca1-8d527cb36132",1,["D",1787981826165],"# React + Hono Starter\n\nA minimal starter template for building client-side React apps with a Hono\nbackend on Val Town. Click **Remix** to get your own copy.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| [`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter) | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| **[`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter)** *(you're here)* | Client-side React SPA with a Hono API backend. |\n\n**Want to build UI?** Start writing React components in\n[`frontend/components/`](/frontend/components/). Import them into `App.tsx` and\nyou're good to go. Styling is [Twind](https://twind.style/) — just use Tailwind\nutility classes, zero config.\n\n**Want to add an API?** Add routes in [`index.ts`](/index.ts) (there's a\ncommented-out example). Fetch them from your React components.\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Hono -->|serves| HTML[\"root.tsx\"]\n HTML -->|loads| Entry[\"index.tsx\"]\n Entry -->|renders| App[\"App.tsx\"]\n App -->|renders| Counter[\"Counter.tsx\"]\n```\n\n## File structure\n\n```\nindex.ts ← Hono backend (serves frontend + API routes)\nfrontend/\n root.tsx ← HTML shell (stamps immutable asset URLs)\n index.tsx ← React entrypoint (mounts )\n favicon.svg ← App icon\n components/\n App.tsx ← Root component (layout + view source link)\n Counter.tsx ← Example component with state\n```\n\n## How it works\n\n1. **`index.ts`** is the HTTP entrypoint — a Hono server that serves the\n frontend and any API routes you add.\n2. **`frontend/root.tsx`** is the HTML shell — it loads Twind and stamps\n immutable asset URLs for the favicon and React entrypoint.\n3. **`frontend/index.tsx`** mounts the React app.\n4. **`frontend/components/App.tsx`** is the root layout — add new components\n alongside it.\n5. **`frontend/components/Counter.tsx`** is an example stateful component —\n replace it with your own!\n\n## Next steps\n\n- Add API routes in `index.ts`\n- Add new components in `frontend/components/`\n- Add a SQLite database — see the\n [React Hono Example](https://www.val.town/x/stevekrouse/reactHonoExample) for\n a full-stack example with database, queries, and shared types\n\nTemplate updates and upgrade paths for existing remixes: [CHANGELOG.md](/CHANGELOG.md)\n",[147],"533e079a-a773-4761-bff1-01388a09ecfe","CHANGELOG.md","01a04c05-88bb-772a-8ca1-885b686d698f",["D",1787981826165],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n

Diff · v17