Auth system (off by default, zero friction for localhost):
- New api/auth.py module: password hashing (SHA-256 + STATE_DIR salt),
  signed HMAC session cookies (24h TTL), auth middleware
- Enable via HERMES_WEBUI_PASSWORD env var or Settings panel
- Minimal dark-themed login page at /login (self-contained HTML)
- POST /api/auth/login, /api/auth/logout, GET /api/auth/status
- Settings panel: "Access Password" field + "Sign Out" button
- password_hash added to settings.json (null = auth disabled)

Security hardening:
- Security headers on all responses: X-Content-Type-Options: nosniff,
  X-Frame-Options: DENY, Referrer-Policy: same-origin
- POST body size limit: 20MB cap in read_body() to prevent DoS

Closes NousResearch#23. 9 new tests. Total: 304 passed, 0 regressions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Sprint 19: Password auth, security headers, login page (Issue NousResearch#23)

…settings

Cherry-picked from PR NousResearch#23 (clawjasper56). Adds skipHydration to Zustand
persist, defers initializeSettingsAppearance to useEffect, and adds
mounted guard to ThemeToggleMini.

NousResearch#23)

The inspector panel already uses relative /api/memory paths (fixed in main),
but the parent GET route was missing — requests fell through to the client
router and returned HTML instead of JSON.

This adds a proper TanStack createFileRoute handler that proxies memory
requests through the workspace server with auth, so the inspector works
correctly over Tailscale, LAN, and remote access.

Rebased from PR #4 onto current main.

…missing tools

- Triple DA stub hunt across all C source: found 10 missing Python tools
  (feishu_drive_comment x4, video_analyze, yuanbao x5), 2 agent stubs
  (llm_background_review unwired, api_server mock fallback)
- Vaulted resolved v15 items (NousResearch#21 approval, NousResearch#23 patch, NousResearch#19 homeassistant)
- battleship-v16: 1,915 function gaps across ~373 items
- Updated ALL walkway files with v16 numbers
- Updated README.md and BANNER.md
- Barnacle sweep: all stale references fixed

…ved/rejected legs

The ee014b80 fix covered the reviewer-spawn leg of a review-drain cycle
(`review-required:` block reason → reviewer needs to spawn on a task
with a PR URL in comments). But the cycle has a symmetric second leg:
after the reviewer drains with `review-approved:` (or
`review-rejected:`) and reassigns back to the original assignee, that
assignee must be respawned to squash-merge + complete (or fix + reblock).
The same PR URL still sits in comment history; the same false-positive
fires.

Observed today on jetminds board: t_41626876 (Tower Prefect Child A,
PR NousResearch#23) sat in ready state with the dispatcher firing
respawn_guarded:active_pr every minute since 16:53. Both reviews
APPROVED, PR mergeable + CI-green, but engineering-substrate couldn't
be spawned to merge because the most-recent block reason was
`review-approved:` — not covered by the prior `review-required:`-only
exception.

Fix: extend `_review_required_handoff_active()` to also match
`review-approved:` and `review-rejected:` block-reason prefixes. The
"single most-recent blocked event, narrow scope, doesn't leak past
completion" invariant is preserved unchanged. `review-pending-input:`
and any other non-canonical `review-*` prefix do NOT match — the
predicate enumerates the three drain-cycle prefixes explicitly rather
than substring-matching `review-`.

Tests: 6 new (approved-leg suppresses; rejected-leg suppresses; predicate
matches each prefix individually; predicate rejects unrelated review-*
prefix; approved-leg exception expires post-completion). 27/27 respawn-
guard tests pass; 170/170 test_kanban_db.py file passes. No upstream
behavior changed for non-review-drain workflows.

Refs: substrate task t_b63946f8 (jetminds-main, 2026-05-21)
JetMinds-local; per hermes-fork-patches discipline

Fixes 12 remaining MEDIUM issues from the deep audit (19 total, 7 fixed in Round 12):

design_agent:
- NousResearch#15: add asyncio.wait_for(300s) around LLM API call to prevent infinite hangs
- NousResearch#17: replace 2x hardcoded 'claude-opus-4-8' with shared DEFAULT_MODEL constant

qa_agent / validate_agent:
- NousResearch#20,NousResearch#22,NousResearch#23: already fixed in Round 12 (verified — dynamic timeout/threshold values used)

memory.py:
- NousResearch#24: frontmatter parser uses regex r'^---$' instead of str.split('---',2),
  preventing false splits on content containing '---' (SQL, markdown tables)
- NousResearch#25: parse and preserve 'description' field from frontmatter in metadata,
  fixing write→load roundtrip data loss

profiles.py:
- NousResearch#26: ProfileConfig now frozen=True (immutable dataclass per coding standards)

deploy_agent:
- NousResearch#31: replace 2x sync subprocess.run with asyncio.create_subprocess_exec
- fix 5x .decode() → .decode('utf-8', errors='replace') for Windows CJK safety
- remove unused import subprocess

db.py:
- NousResearch#27: add class docstring explaining RLock + _unlocked pattern
- NousResearch#28: FK constraints already in DDL (verified PRAGMA foreign_keys=ON active)
- NousResearch#29: add _ensure_connection() with PRAGMA integrity_check(1) + auto-reconnect
       on 4 critical methods (create_task, get_task, claim_task, submit_result)
- extract _create_connection() static method for reuse by reconnect

Tests: 79 passed, 0 failed

CRITICAL fixes:
- Remove retracted solve-rate claims (92% failure, 12.5 attempts/solve)
  Per DeepSWE issue NousResearch#21 author: solve-rate findings retracted 2026-06-08
  Replace with honest caveats: no effort tuning, guardrail 404s,
  limited replication. Data is directional, not definitive.
- Remove MiniMax M3 row (never benchmarked on DeepSWE per issue NousResearch#23)
- Expand model table to all 8 published DeepSWE models including
  Claude Opus 4.7, Sonnet 4.6, Gemini 3.5 Flash, Kimi K2.6
- Replace fabricated 'hermes chat' CLI with actual delegate_task() API
- Fix related_skills: model-selection -> subagent-driven-development
- Remove phantom HuggingFace URL (404)

HIGH fixes:
- Description: generic, no disputed model rankings embedded
- Orchestrator: use current model, not hardcoded V4-Pro
- Decision tree: add priority ordering + [route: X] user override
- Strip self-promotion from skill body (frontmatter only)

References file: full table with caveats, valid cost analysis
retained, MiniMax/phamtom-URL removed.