Trim unused code and harden runtime data

[kat3samsin]

Summary

• Remove unreachable code and obsolete surfaces: structured context, unused Codex JSONL formatting, dead Discord task-thread bookkeeping, inert bootstrap templates/helpers, stale dynamic tool filtering, the orphan TODO API, legacy plaintext session endpoints, and remaining team/subagent dashboard UI.
• Harden runtime storage and observability: owner-only modes for sensitive files/directories, launchd umask 077, dashboard-token-safe status output, and secret redaction across local logs, audit traces, cron output, console previews, tool logs, and Langfuse.
• Keep execution behavior intact: raw tool inputs/results still reach tools and models, encrypted JSONL conversations remain, and user-facing cron notification bodies remain unchanged.
• Update tests and documentation alongside the removals and security changes.

Why

A 30-day runtime-history audit showed that the removed paths were unreachable, obsolete, or unused, while cron, heartbeat, Discord, dashboard, voice, MCP, Fetch, and code agents remain active. This trims 536 production LOC and 647 lines overall while adding focused security regression coverage.

The security pass also addresses concrete local risks: routine status output previously exposed the dashboard token, sensitive runtime files depended on permissive umasks, and tool/cron observability could persist raw credentials.

User and developer impact

• skimpyclaw status still authenticates to the gateway but no longer prints credentials.
• Sensitive config, logs, sessions, memory, scratch output, code-agent state, setup secrets, and temporary voice files are written owner-only.
• Langfuse and local observability retain useful previews without storing secret-shaped values.
• The Coding dashboard now reflects the supported single-agent flow.
• No actively used channel, provider, voice, dashboard, cron, MCP, or coding-agent feature is removed.

Validation

• pnpm lint
• pnpm build
• pnpm test — 81 files, 960 tests
• pnpm dashboard:test — 54 tests
• pnpm test:coverage — 60.43% line coverage
• pnpm dashboard:test:coverage — 9.63% line coverage
• pnpm docs:build
• pnpm security:audit — no known vulnerabilities in root, dashboard, or docs
• scripts/secret-scan.sh and gitleaks on origin/trunk..HEAD — clean
• Added-line personal path/IP scan — clean
• Claude review loop — three passes, no blockers
• git diff --check

Manual testing steps

1. Run skimpyclaw status; confirm the gateway and dashboard URL are shown and no token is printed.
2. Open http://127.0.0.1:18790/dashboard; confirm HTTP 200 and that Coding shows flat agent cards with correct pagination.
3. Inspect config/log/session/memory/scratch paths with stat; expect directories at 0700 and sensitive files at 0600.
4. Run a cron script containing a fake TOKEN=...; confirm local logs, audit events, and console output show [REDACTED_SECRET] while the user notification remains unchanged.
5. Start a Discord coding agent; confirm its thread is created and completion/failure notification reaches the thread.
6. Send a voice note; confirm transcription works, the temporary file uses a sanitized extension at 0600, and cleanup removes it.

Live verification

The daemon was restarted from this checkout under Node 24.15.0. Launchd reported running, the gateway health check passed, the dashboard returned HTTP 200, 18 cron jobs initialized, status omitted credentials, and gateway logs were owner-only.

Additional Codex timeout fix

• Raise the per-request Codex ceiling from 120 seconds to 300 seconds so tool-heavy cron turns can finish within their existing 15-20 minute turn budgets.
• Add a fake-timer regression test that proves requests survive the old 120-second boundary and abort at 300 seconds.
• Live verification: Morning, Chief P2 Reader, and THE DAILY all completed successfully after the change.
• Latest validation: pnpm build, 82 test files / 977 tests, focused Codex fetch tests, git diff --check, staged Claude review with no blockers, project secret scan, and gitleaks.