# Core Components Audit

**Date:** 2026-04-09
**Scope:** engine/, src/, cli/, feeder/, config/, configs/, docs/, scripts/
**Source:** `/Users/jtr/_JTR23_/Home23/` (READ ONLY)

---

## 1. engine/ (786MB on disk)

### Directories That SHOULD Ship

| Directory | Size | Status | Notes |
|-----------|------|--------|-------|
| `src/` | 6.6MB | SHIPS — needs cleaning | Personal data in several files (see below) |
| `tests/` | 452K | SHIPS — clean | No personal refs found |
| `scripts/` | 1.4MB | SHIPS — needs cleaning | Personal refs in merge_runs, LAUNCH_COSMO, UPDATE_RUN_METADATA |
| `lib/` | 60K | SHIPS — clean | No personal refs found |
| `prompts/` | 56K | SHIPS — needs heavy cleaning | Hardcoded "jtr", personal bio, family names throughout |
| `mcp/` | 296K | SHIPS — needs cleaning | Hardcoded path in claude_desktop_config_example.json |
| `tools/` | 16K | SHIPS — clean | No personal refs found |
| `docs/` | 152K | SHIPS — needs cleaning | COSMO_PRODUCT_SPEC.md and BRAIN_PLATFORM_VISION.md have many hardcoded paths |
| `data/` | 40K | SHIPS — clean | No personal refs found |
| `config/` | contains `image.json` | SHIPS — check contents | Single file |
| `prisma/` | 4K | SHIPS | schema.prisma only — generic Prisma schema for SystemConfig table, clean |

### Directories That MUST NOT Ship

| Directory | Size | Why |
|-----------|------|-----|
| `node_modules/` | 324MB | Dependencies — npm install regenerates |
| `runtime/` | 292MB | Brain state — personal agent data |
| `queries-archive/` | 61MB | Old query logs — personal data |
| `brain-studio-new/` | 56MB | Replaced by evobrew |
| `runs/` | 36MB | Run outputs — personal data |
| `backups/` | 1.5MB | State backups |
| `logs/` | 1.3MB | Log files |
| `brain-studio/` | 1.0MB | Old Brain Studio v1 |
| `artifacts/` | 216K | Dream/analysis artifacts |
| `test-frontier/` | 1.9MB | Test results |
| `.backups/` | unknown | Backup directory |
| `.cursor/` | unknown | IDE config |

### Root-Level Files

| File | Ship? | Notes |
|------|-------|-------|
| `package.json` | YES | Clean |
| `package-lock.json` | YES | Clean (regenerated by npm install) |
| `.gitignore` | YES | Comprehensive, covers runtime/logs/env |
| `.mocharc.json` | YES | Test config |
| `Dockerfile` | YES | Clean |
| `docker-compose.yml` | YES | Check for hardcoded paths |
| `.env` | **NO** | **CRITICAL: Contains live API keys** (OpenAI, xAI, Anthropic OAuth) |
| `.env.example` | YES | Clean template with placeholder values |
| `ask`, `ask.backup` | NO | 110K executables — dev artifacts |
| `cosmo` | Check | 1.8K script |
| `start` | Check | 706B script |
| `ship.sh` | NO | 1B — empty |
| `Proposal_*.pdf` | NO | Personal document |
| `` ` support`` | NO | Artifact with unusual filename |
| `showcase-data.json` | NO | Dev artifact |
| `check-strategic-goals.js` | NO | Dev script |
| `external-integrations-starter.yaml` | Check | Config template |
| `filesystem-mcp.log` | NO | Log file |
| `TEST_EXPERIMENTAL_NOW.sh` | NO | Dev script |
| `test-*.js` (7 files) | NO | Root-level test scripts — dev artifacts (actual tests are in tests/) |

### Personal Data Findings in engine/src/

| File | Line | Finding | Severity |
|------|------|---------|----------|
| `src/dashboard/docs-ide.html` | multiple | 17 occurrences of `/Users/jtr/_JTR23_/COSMO` as default browse path | HIGH — hardcoded path |
| `src/dashboard/docs-ide-v2.html` | 1 | `/Users/jtr/_JTR23_/COSMO` as cosmoRoot | HIGH — hardcoded path |
| `src/sleep/notice-pass.js` | 347 | `t.includes('jerry') || t.includes('garcia')` — Grateful Dead reference | LOW — cultural ref, not personal data per se, but reveals owner interests |
| `src/cognition/quantum-reasoner.js` | 245 | Comment mentioning "jtr" | LOW — comment only |
| `src/agents/document-analysis-agent.js` | 1160 | `'jtr'` in hardcoded directory list | MEDIUM — personal workspace name |
| `src/dashboard/server.js` | 870 | Comment `// strip namespace prefix like "jerry__"` | LOW — comment only |

### Personal Data Findings in engine/prompts/

| File | Lines | Finding | Severity |
|------|-------|---------|----------|
| `prompts/system-context.md` | 3-31 | Full personal bio: "Jason Regina (jtr)", family names (Rocco, Vera, Finley, Stella, Melissa), Grateful Dead reference, Terrapin identity | **CRITICAL** — deeply personal |
| `prompts/orchestrator.md` | 18-55 | Multiple "jtr" references, "jtr-brain.db", "jtr-feeder" | HIGH |
| `prompts/consistency-agent.md` | 3-34 | Multiple "jtr" references throughout | HIGH |

### Personal Data Findings in engine/scripts/

| File | Lines | Finding | Severity |
|------|-------|---------|----------|
| `scripts/merge_runs.js` | 2297 | `jerry2 jerryPsych` in usage example | LOW |
| `scripts/merge_runs.js.backup` | 1340 | Same | LOW |
| `scripts/merge_runs.js.backup-pre-v2` | 1660 | Same | LOW |
| `scripts/UPDATE_RUN_METADATA.sh` | 60-61 | `grep -qi "jtr"` with `default_paths="jtr/"` | MEDIUM |
| `scripts/LAUNCH_COSMO.legacy.sh` | 1350-1357 | `jtr)` case with "Personal workspace" label | MEDIUM |
| `scripts/phase2-dashboard.log` | 5 | Hardcoded path `/Users/jtr/` | LOW — log file, shouldn't ship |

### Personal Data Findings in engine/mcp/

| File | Line | Finding | Severity |
|------|------|---------|----------|
| `mcp/claude_desktop_config_example.json` | 6 | `/Users/jtr/_JTR23_/new_Coz/mcp-server/cosmo-mcp.js` | MEDIUM — hardcoded path in example |

### Personal Data Findings in engine/docs/

| File | Lines | Finding | Severity |
|------|-------|---------|----------|
| `docs/COSMO_PRODUCT_SPEC.md` | 267-2093 | Multiple `/Users/jtr/` paths | MEDIUM — doc only |
| `docs/BRAIN_PLATFORM_VISION.md` | 353-911 | `cosmo-jtr-local`, `brain-cloud://jtr/` examples | LOW — example identifiers |

### Required Fixes for engine/

1. **CRITICAL:** Delete `engine/.env` — contains live API keys (OpenAI `sk-proj-...`, xAI `xai-...`, Anthropic OAuth `sk-ant-oat01-...`). Only `.env.example` ships.
2. **HIGH:** Replace all `/Users/jtr/_JTR23_/COSMO` paths in `docs-ide.html` and `docs-ide-v2.html` with config-driven or relative paths.
3. **HIGH:** Rewrite `prompts/system-context.md` to be generic (remove personal bio, family names, Terrapin identity).
4. **HIGH:** Clean `prompts/orchestrator.md` and `prompts/consistency-agent.md` — replace "jtr" with generic owner reference.
5. **MEDIUM:** Remove `'jtr'` from hardcoded directory list in `document-analysis-agent.js:1160`.
6. **MEDIUM:** Clean `mcp/claude_desktop_config_example.json` path.
7. **LOW:** Clean comments in `quantum-reasoner.js:245` and `server.js:870`.

---

## 2. src/ (TS Harness, 432K)

### All .ts Files (40 files)

```
src/acp/bridge.ts
src/agent/codex-auth.ts
src/agent/compaction-hooks.ts
src/agent/compaction.ts
src/agent/context.ts
src/agent/history.ts
src/agent/loop.ts
src/agent/memory.ts
src/agent/tools/brain.ts
src/agent/tools/cron.ts
src/agent/tools/files.ts
src/agent/tools/identity.ts
src/agent/tools/index.ts
src/agent/tools/media.ts
src/agent/tools/research.ts
src/agent/tools/shell.ts
src/agent/tools/subagent.ts
src/agent/tools/web.ts
src/agent/types.ts
src/agents/provider-overlays.ts
src/agents/system-prompt.ts
src/agents/voice.ts
src/browser/cdp.ts
src/channels/discord.ts
src/channels/imessage.ts
src/channels/router.ts
src/channels/telegram.ts
src/channels/webhooks.ts
src/chat/agent.ts
src/commands/handler.ts
src/config.ts
src/engine-events.ts
src/home.ts
src/observability/tts.ts
src/routes/evobrew-bridge.ts
src/scheduler/cron.ts
src/scheduler/delivery.ts
src/sibling/bridge-chat.ts
src/sibling/protocol.ts
src/types.ts
```

### Scan Results

| File | Line | Finding | Severity |
|------|------|---------|----------|
| `src/channels/telegram.ts` | 6 | Comment: `// No webhook — jtr uses polling.` | LOW — comment only |
| `src/agent/loop.ts` | 41, 136-137 | References to `sk-ant-oat*` — OAuth token format detection (code logic, not secrets) | CLEAN — functional code |
| `src/observability/tts.ts` | 58 | `'xi-api-key'` header name — config-driven, not a secret | CLEAN |
| `src/home.ts` | 225 | OAuth token format check — functional code | CLEAN |

**No hardcoded paths.** No hardcoded API keys. No personal references beyond one comment. Telegram IDs are config-driven via `ownerTelegramId` from agent config.yaml.

### Required Fixes for src/

1. **LOW:** Remove "jtr" from comment in `telegram.ts:6`.

### Verdict: CLEAN — minimal fixes needed.

---

## 3. cli/ (96K)

### All Files (16 files)

```
cli/home23.js
cli/lib/agent-create.js
cli/lib/cosmo23-config.js
cli/lib/cosmo23-update.js
cli/lib/evobrew-config.js
cli/lib/evobrew-update.js
cli/lib/generate-ecosystem.js
cli/lib/init.js
cli/lib/pm2-commands.js
cli/lib/prompts.js
cli/templates/BRAIN_INDEX.md
cli/templates/HEARTBEAT.md
cli/templates/LEARNINGS.md
cli/templates/MEMORY.md
cli/templates/MISSION.md
cli/templates/SOUL.md
```

### Scan Results

| File | Line | Finding | Severity |
|------|------|---------|----------|
| `cli/lib/evobrew-update.js` | 10 | `const REPO = 'notforyou23/evobrew';` | EXPECTED — this IS the GitHub repo name, correct for public release |

### Known Issue: Telegram Bot Token Required

`cli/lib/agent-create.js` lines 122-124: Agent creation requires a Telegram bot token and calls `process.exit(1)` if not provided. This blocks users who don't use Telegram.

**Required fix:** Make Telegram bot token optional. Allow agent creation without any messaging channel configured.

### Verdict: CLEAN — one known issue to fix (Telegram requirement).

---

## 4. feeder/ (2.1MB)

### All Files (excluding node_modules)

```
feeder/server.js
feeder/package.json
feeder/package-lock.json
feeder/manifest-jerry.json      <- MUST NOT SHIP
feeder/pending-jerry.json       <- MUST NOT SHIP
feeder/.DS_Store                <- MUST NOT SHIP
```

### Scan Results

| File | Line | Finding | Severity |
|------|------|---------|----------|
| `feeder/server.js` | 18 | `const memberName = config.member \|\| 'jtr';` — default fallback to 'jtr' | MEDIUM — should default to agent name |
| `feeder/server.js` | 20 | `const stateFile = resolvePath(config.state_file \|\| '../runs/jtr/state.json.gz');` — default fallback path | MEDIUM — hardcoded 'jtr' in path |
| `feeder/manifest-jerry.json` | all | Contains full paths `/Users/jtr/_JTR23_/Home23/instances/jerry/workspace/*` | HIGH — personal data, must not ship |
| `feeder/pending-jerry.json` | all | Agent-specific pending queue | HIGH — personal data, must not ship |

### Required Fixes for feeder/

1. **MEDIUM:** Change default member name from `'jtr'` to a generic default (e.g., `'default'` or derive from config).
2. **MEDIUM:** Change default state_file path from `'../runs/jtr/state.json.gz'` to a generic path.
3. **HIGH:** `manifest-jerry.json` and `pending-jerry.json` must be gitignored — they are instance-specific runtime artifacts.

---

## 5. config/ and configs/

### config/home.yaml

| Field | Value | Action |
|-------|-------|--------|
| `home.primaryAgent` | `jerry` | MUST change to empty/placeholder |
| `home.name` | `home23-dev` | Change to `home23` |
| Provider URLs | Generic (ollama.com, api.openai.com, etc.) | CLEAN |
| Model lists | Generic model names | CLEAN |
| Model aliases | Generic | CLEAN |
| Chat defaults | Generic | CLEAN |
| Embedding config | Generic | CLEAN |

**home.yaml ships as a template** — clean except primaryAgent and name.

### config/secrets.yaml

**MUST NOT SHIP.** File exists (531 bytes). Contains API keys. Must be gitignored. A `config/secrets.yaml.example` does NOT currently exist — **must be created**.

### configs/base-engine.yaml

Extremely long (500+ lines). Scan results:

- No hardcoded personal paths
- No API keys
- No personal names
- Model references are generic (`gpt-5.2`, `nemotron-3-super`, etc.)
- Context description is generic ("Home23 agent instance")

**Verdict: CLEAN — ships as-is.**

---

## 6. docs/ (33 files)

### All Files

```
docs/SECURITY-AUDIT.md
docs/design/HOME23-DESIGN.md
docs/design/PUBLIC-RELEASE-DESIGN.md
docs/design/STEP2-AGENT-HARNESS-DESIGN.md
docs/design/STEP3-UNIFIED-PROVIDERS-DESIGN.md
docs/design/STEP4-PROCESS-MANAGER-DESIGN.md
docs/design/STEP5-CLI-INSTALLER-DESIGN.md
docs/design/STEP7-DASHBOARD-DESIGN.md
docs/design/STEP8-EVOBREW-INTEGRATION-DESIGN.md
docs/design/STEP9-COSMO23-INTEGRATION-DESIGN.md
docs/design/STEP9B-DASHBOARD-COSMO-EMBED-DESIGN.md
docs/design/STEP10-INGESTION-COMPILER-DESIGN.md
docs/design/STEP11-INTELLIGENCE-TAB-DESIGN.md
docs/design/STEP12-ONBOARDING-SETTINGS-DESIGN.md
docs/design/STEP13-DASHBOARD-CHAT-DESIGN.md
docs/plans/STEP1-REPO-ENGINE-FEEDER.md
docs/plans/STEP2-AGENT-HARNESS.md
docs/plans/STEP5-CLI-INSTALLER.md
docs/superpowers/plans/2026-04-07-cosmo23-integration.md
docs/superpowers/plans/2026-04-07-evobrew-integration.md
docs/superpowers/plans/2026-04-08-dashboard-chat.md
docs/superpowers/plans/2026-04-08-ingestion-compiler.md
docs/superpowers/plans/2026-04-08-intelligence-tab.md
docs/superpowers/plans/2026-04-08-onboarding-settings.md
docs/superpowers/plans/2026-04-09-public-release.md
docs/vision/HOME23_CANONICAL_VISION.md
docs/vision/HOME23_DRIFT_ANALYSIS_FROM_SESSION_HISTORY.md
docs/vision/HOME23_GAP_MAP.md
docs/vision/HOME23_INHERITANCE_AND_PARITY_CHARTER.md
docs/vision/HOME23_STACK_PYRAMID.md
docs/vision/RECENT_DECISIONS.md
```

### Personal Data Findings

**Design docs (docs/design/):**

| File | Finding | Severity |
|------|---------|----------|
| `STEP2-AGENT-HARNESS-DESIGN.md` | Lines 13, 38-39, 98: `/Users/jtr/` path, `jtr (Telegram ID: REDACTED)`, `name: "jtr"` example | MEDIUM |
| `HOME23-DESIGN.md` | Lines 86, 170, 225: `configs/jtr.yaml`, `jtr-home` example | LOW — design doc examples |
| `PUBLIC-RELEASE-DESIGN.md` | Lines 34, 157, 203-216: Multiple `/Users/jtr/` paths, `jtr` references, `instances/jerry/` | EXPECTED — this doc IS about the release process |
| `STEP9-COSMO23-INTEGRATION-DESIGN.md` | Line 30: `/Users/jtr/_JTR23_/cosmo_2.3` default source path | LOW |
| `STEP10-INGESTION-COMPILER-DESIGN.md` | Line 87: "jtr's sidekick" | LOW |

**Plan docs (docs/plans/):**

| File | Finding | Severity |
|------|---------|----------|
| `STEP1-REPO-ENGINE-FEEDER.md` | Multiple `/Users/jtr/` paths, `configs/jtr.yaml` reference | MEDIUM — build instructions |
| `STEP2-AGENT-HARNESS.md` | Extensive: `/Users/jtr/` paths, Telegram ID `REDACTED`, `jtr` owner references throughout | HIGH — contains real Telegram ID |

**Superpowers plans (docs/superpowers/plans/):**

| File | Finding | Severity |
|------|---------|----------|
| `2026-04-07-evobrew-integration.md` | `/Users/jtr/` paths in rsync commands and test code | MEDIUM |
| `2026-04-07-cosmo23-integration.md` | Multiple `/Users/jtr/` paths, `source: "/Users/jtr/_JTR23_/cosmo_2.3"` | MEDIUM |
| `2026-04-08-ingestion-compiler.md` | `/Users/jtr/_JTR23_/Home23` in cd command | LOW |
| `2026-04-09-public-release.md` | Extensive: `jtr`, `jerry`, `/Users/jtr/` throughout | EXPECTED — release plan doc |

**Vision docs (docs/vision/):** CLEAN — no personal references found.

### Decision Required

Design docs and plan docs are build history. Options:
1. **Ship as-is** — they document the build process, personal refs are incidental
2. **Scrub** — replace personal refs with generic placeholders
3. **Don't ship plans/** — they're build instructions, not user-facing docs

**Recommendation:** Ship design docs with scrubbed examples. Don't ship plans/ or superpowers/ — they're internal build artifacts.

---

## 7. scripts/ (2 files)

### Files

```
scripts/start-agent.sh
scripts/stop-agent.sh
```

### Scan Results

Both scripts are clean — they use `$AGENT_NAME` variable, `$HOME23_ROOT` relative paths, and read config from `config/secrets.yaml` and `config/home.yaml` dynamically. No hardcoded personal data.

**Verdict: CLEAN — ships as-is.**

---

## Summary of Required Fixes

### CRITICAL (must fix before release)

1. **engine/.env** — Contains live API keys. Must NOT ship. Must be in .gitignore.
2. **config/secrets.yaml** — Contains API keys. Must NOT ship. Create `secrets.yaml.example`.
3. **engine/prompts/system-context.md** — Contains full personal bio, family names. Must be rewritten as generic template.

### HIGH (should fix before release)

4. **engine/src/dashboard/docs-ide.html** — 17 hardcoded `/Users/jtr/` paths. Replace with config-driven paths.
5. **engine/src/dashboard/docs-ide-v2.html** — Hardcoded `/Users/jtr/` path.
6. **engine/prompts/orchestrator.md** — Multiple "jtr" references.
7. **engine/prompts/consistency-agent.md** — Multiple "jtr" references.
8. **feeder/manifest-jerry.json, pending-jerry.json** — Must be gitignored (instance-specific runtime).
9. **cli/lib/agent-create.js** — Telegram bot token is required (process.exit). Must be made optional.
10. **config/home.yaml** — `primaryAgent: jerry` must be cleared for template.

### MEDIUM

11. **feeder/server.js** — Default member name 'jtr' and default state path 'runs/jtr/'.
12. **engine/src/agents/document-analysis-agent.js:1160** — 'jtr' in hardcoded directory list.
13. **engine/mcp/claude_desktop_config_example.json** — Hardcoded `/Users/jtr/` path.
14. **docs/plans/STEP2-AGENT-HARNESS.md** — Contains real Telegram ID (REDACTED).

### LOW

15. **src/channels/telegram.ts:6** — Comment mentioning "jtr".
16. **engine/src/cognition/quantum-reasoner.js:245** — Comment mentioning "jtr".
17. **engine/src/dashboard/server.js:870** — Comment mentioning "jerry".
18. Various docs with incidental personal references in examples.

### Artifact Directories to Exclude (.gitignore)

Engine-level: `node_modules/`, `runtime/`, `queries-archive/`, `brain-studio-new/`, `runs/`, `backups/`, `logs/`, `brain-studio/`, `artifacts/`, `test-frontier/`, `.backups/`, `.cursor/`

Feeder-level: `manifest-*.json`, `pending-*.json`, `node_modules/`

Root-level engine files to exclude: `.env`, `ask`, `ask.backup`, `ship.sh`, `Proposal_*.pdf`, `` ` support``, `showcase-data.json`, `check-strategic-goals.js`, `filesystem-mcp.log`, `TEST_EXPERIMENTAL_NOW.sh`, `test-*.js` (root level)

---

## Findings Count

| Component | Files Scanned | Issues Found | Critical | High | Medium | Low |
|-----------|--------------|--------------|----------|------|--------|-----|
| engine/src/ | ~100+ JS/HTML | 6 | 0 | 2 | 1 | 3 |
| engine/prompts/ | 3 MD | 3 | 1 | 2 | 0 | 0 |
| engine/scripts/ | ~10 | 3 | 0 | 0 | 2 | 1 |
| engine/mcp/ | 1 | 1 | 0 | 0 | 1 | 0 |
| engine/docs/ | 2 | 2 | 0 | 0 | 2 | 0 |
| engine/ (root) | 1 | 1 | 1 | 0 | 0 | 0 |
| src/ | 40 TS | 1 | 0 | 0 | 0 | 1 |
| cli/ | 16 | 1 | 0 | 1 | 0 | 0 |
| feeder/ | 3 | 4 | 0 | 1 | 2 | 0 |
| config/ | 3 | 2 | 1 | 1 | 0 | 0 |
| docs/ | 33 | 8 | 0 | 0 | 4 | 4 |
| scripts/ | 2 | 0 | 0 | 0 | 0 | 0 |
| **TOTAL** | ~210+ | **32** | **3** | **7** | **12** | **9** |
