Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.archon/config.yaml:
- Around line 3-5: The config currently copies the full local .env (copyFiles: -
.env) into each worktree which duplicates secrets; instead create a
least-privilege file (e.g., scout.env) that contains only the Scout-specific
vars (SCOUT_API_KEY) and replace the .env reference in copyFiles with that
filename, or switch to managed env injection instead of file-copy; also update
the Cursor MCP's envFile setting to point to the same least-privilege scout.env
if file-based injection is still used so both MCPs read the minimal Scout-only
vars rather than the full .env.

In @.archon/scripts/ci-wait.js:
- Around line 43-54: The timeout handler sets timedOut and schedules a 2s grace
timer with .unref(), but because unrefed timers don't keep the process alive the
grace timer may never run and the child 'exit' handler returns early, dropping
the intended exit code; update the timeout logic in the timeout callback to stop
using .unref() on the grace setTimeout and in the child.on('exit', ...) handler
(referencing timedOut, timer, and child) call process.exit(3) directly when
timedOut is true before returning so the process reliably exits with code 3
after a timeout.

In @.archon/scripts/fetch-review-app-url.js:
- Around line 86-95: The current polling loop around pollOnce swallows all
errors and retries, which delays exiting for permanent failures; update the
catch block in the while loop that wraps pollOnce (in
.archon/scripts/fetch-review-app-url.js) to detect non-retryable errors and exit
immediately with code 2: specifically check for err.code === 'ENOENT' (missing
gh binary) and JSON parse failures (err instanceof SyntaxError or err.name ===
'SyntaxError' coming from JSON.parse) and call process.exit(2) with a clear
error log; for other transient errors keep the existing console.error and
continue retrying.

In @.archon/workflows/defaults/archon-scout-perf-roadmap.yaml:
- Around line 27-32: Add a new bash validation node (id:
ensure-routes-discovered) immediately after the discover-routes node that checks
the produced routes.json is not an empty array (e.g., fail if file missing or
content == "[]"), and make all profile nodes (profile-00, profile-01, etc.)
depend on ensure-routes-discovered instead of discover-routes so the DAG fails
early when discovery yields no routes; keep consolidate-plan dependency
unchanged so it can still run when appropriate.

In @.archon/workflows/defaults/archon-slack-feature-to-review-app.yaml:
- Around line 373-381: The bash step passes a POSIX-style character class to
fetch-review-app-url.js which is later used in new RegExp(...) (see new RegExp
usage around line 62 in fetch-review-app-url.js); replace the POSIX `[:space:]`
usage with JavaScript whitespace `\s` in the pattern argument and ensure the
backslash is escaped correctly for the YAML/bash context (so the JS gets `\s` at
runtime and dots are escaped for the domain). Update the `fetch-review-url`
step's pattern string accordingly so the script receives a valid JS regex that
stops at whitespace.

In @.claude/skills/archon/guides/slack.md:
- Line 13: The Bot Token Scopes list currently implies all listed scopes are
required; mark the reactions:write scope as optional (e.g., “reactions:write
(optional — only used for the :eyes: receipt reaction)”) or move it into a
separate “Optional scopes” sentence to keep optional Slack scope wording
consistent; update the “Bot Token Scopes” line that lists app_mentions:read,
chat:write, reactions:write, channels:history, channels:join, im:history,
im:write, im:read to reflect this change.

In @.cursor/hooks/state/continual-learning-index.json:
- Around line 1-11: Remove the committed runtime hook state file
.cursor/hooks/state/continual-learning-index.json from the PR and stop tracking
that directory: run git rm --cached for
.cursor/hooks/state/continual-learning-index.json (and any other files under
.cursor/hooks/state/ like the listed JSONL entries
"280d685f-a48a-46c6-833f-323dd405d054/280d685f-a48a-46c6-833f-323dd405d054.jsonl",
"d2ae91bc-63ac-4028-88d4-97ce68f614a8/...",
"caf60f72-6726-464d-a2cf-d3e482e5d1a9/..."), add .cursor/hooks/state/ to
.gitignore (or at minimum ignore these continual-learning state files), and
amend the commit or create a new commit removing them so runtime metadata is not
tracked.

In @.cursor/hooks/state/continual-learning.json:
- Around line 1-8: This file (.cursor/hooks/state/continual-learning.json)
contains run-specific continual-learning snapshot fields (lastRunAtMs,
lastTranscriptMtimeMs, lastProcessedGenerationId, trialStartedAtMs) and should
not be versioned; remove it from the repo history/PR changes by untracking it
(git rm --cached) and add a pattern to ignore these hook-state artifacts (e.g.,
ignore .cursor/hooks/state/ or continual-learning.json) so future runtime
snapshots are not committed, and revert any accidental modifications in this PR
so only core PR changes remain.

In `@AGENTS.md`:
- Line 6: Update the ambiguous sentence in AGENTS.md so "Web" is explicit and
the two behaviors are separated: change the text around "Settings → Platform
Connections" to say that the Settings → Platform Connections page currently
hardcodes Slack, Telegram, Discord, and GitHub as "not connected", while the
"Web" tab (or "Web adapter status" / "Web UI runtime status") is the one that
reflects live adapter connection state; explicitly name "Web UI" or "Web tab" as
the live-status source so it's clear a working Slack bot may still appear
unconfigured on the Settings page until the UI is wired to the real platform
status.

In `@docs/plans/2026-04-17-slack-archie-feature-to-review-app-plan.md`:
- Around line 7-8: The plan currently claims "No adapter or orchestrator
changes" but the PR actually introduces interactive-gate plumbing in workflow
execution (see packages/workflows/src/dag-executor.ts where interactiveGate
metadata is now passed), so update the plan text to accurately reflect that
workflow execution/adapter behavior is changing: mention the interactiveGate
metadata addition in dag-executor, note that workflow execution now propagates
interactive gating (affecting adapter/executor blast radius), and adjust the
other occurrences (around the referenced blocks at the top and the other
sections called out) so reviewers aren’t misled about scope.
- Around line 18-21: The plan incorrectly references helper script filenames
with a .ts extension (e.g., `.archon/scripts/dispatch-review-app.ts`,
`.archon/scripts/ci-wait.ts`, `.archon/scripts/fetch-review-app-url.ts` and the
workflow file
`.archon/workflows/defaults/archon-slack-feature-to-review-app.yaml` calls)
while the implemented scripts are `.js`; update all occurrences of these script
names in the plan to use the actual `.js` filenames (replace each `.ts`
reference with the corresponding `.js` one) so copy-paste commands, workflow
invocations, and any listed helper script names (dispatch-review-app, ci-wait,
fetch-review-app-url) match the real files throughout the document (also apply
the same replacements at the other line ranges mentioned).

In `@docs/specs/2026-04-17-slack-archie-feature-to-review-app-design.md`:
- Line 181: The fenced code block at the mentioned location is missing a
language tag causing markdown lint errors; update the triple-backtick fence to
include the language identifier "text" (i.e., use ```text) for the plain
progress-message example so the block is explicitly marked as plain text.
- Around line 44-45: References to the workflow location and helper script
extensions are stale: update any occurrences of the old workflow path string
"packages/workflows/src/defaults/workflows/" to the new location
".archon/workflows/defaults/" and change helper script filenames/extensions
referenced as ".ts" to ".js" (e.g., helper script imports or examples), then
scan and fix the other occurrences called out (the additional instances noted in
the comment) so all path and extension references are consistent.

In `@packages/adapters/src/chat/slack/adapter.ts`:
- Around line 492-494: The logs currently pass raw ctx.userId into getLog().info
for the 'slack.gate_approve_clicked' event (and the similar getLog().info call
around lines 550-552); replace the raw userId with the existing Slack user-id
masking utility used by the unauthorized-message logs (i.e., call the same
masking function used elsewhere—e.g., maskUserId(ctx.userId) or the project’s
PII/masking helper) so the getLog().info payload contains the masked user id
instead of ctx.userId for both 'slack.gate_approve_clicked' and the similar gate
log.
- Around line 668-688: In dispatchSyntheticMessage, enforce the Slack whitelist
before invoking messageHandler: check the adapter's allowedUserIds (e.g.,
this.allowedUserIds) for params.userId and if the user is not in the whitelist,
log a warning and return early (silently reject) instead of calling
this.messageHandler; otherwise continue as before. Ensure the check mirrors the
authorization logic used for app_mention/DM paths so button/modal interactions
cannot bypass gate authorization.

In `@packages/cli/src/commands/setup.ts`:
- Line 1033: The setup wizard currently lists "reactions:write" as a required
scope in the concatenated scope string ('   - app_mentions:read, chat:write,
reactions:write, channels:history\n' +); update that string/template so
"reactions:write" is marked as optional (e.g., move it into parentheses or
annotate with "[optional]" and remove it from any required-scopes enforcement
logic), and ensure any validation code that enforces required scopes (the
function or constant that builds/validates the scope list in setup.ts) does not
treat reactions:write as mandatory.

---

Outside diff comments:
In @.claude/skills/archon/guides/setup.md:
- Around line 161-173: The two subsection headings currently labeled "### 5c:
Verify Configuration" and "### 5d: Run Database Migrations (PostgreSQL only)"
are incorrectly numbered and should remain under Step 4; rename those headings
to "### 4c: Verify Configuration" and "### 4d: Run Database Migrations
(PostgreSQL only)" respectively so they follow "4b" and avoid conflict with the
actual "## Step 5" section; ensure any internal references to 5c/5d in nearby
text are updated to 4c/4d as well.

In `@packages/workflows/src/defaults/bundled-defaults.ts`:
- Line 40: The section header comment "// Default Workflows (13 total)" is out
of sync with BUNDLED_WORKFLOWS (which now contains 14 entries); update the
header to reflect the correct count (e.g., "// Default Workflows (14 total)"),
or replace the hardcoded count with a dynamic reference in documentation/tests
by using BUNDLED_WORKFLOWS.length where appropriate so the comment/test stays in
sync with the array.

---

Nitpick comments:
In @.archon/scripts/dispatch-review-app.js:
- Around line 34-38: The script currently prints both gh stdout and stderr to
stdout which corrupts the JSON summary; change the stderr handling so that when
stderr.trim() is truthy it is written to stderr (e.g., use
process.stderr.write(...) or console.error(...)) instead of console.log; keep
the stdout handling and the JSON.stringify line unchanged so the final JSON
summary remains the only thing emitted on stdout by dispatch-review-app.js
(refer to the stdout/stderr variables and the JSON.stringify({ dispatched: true,
workflow: workflowFile, ref }) line).

In @.cursor/mcp.json:
- Line 5: The args entry is using an unpinned image tag
"scoutapp/scout-mcp-local:latest" which makes runs non-reproducible; update the
args array to reference a specific version tag or immutable digest (for example
replace "scoutapp/scout-mcp-local:latest" with "scoutapp/scout-mcp-local:vX.Y.Z"
or "scoutapp/scout-mcp-local@sha256:...") so the invocation in the "args" array
is pinned and stable across runs.

In `@packages/workflows/src/deps.ts`:
- Around line 50-51: Extract the inline interactiveGate object shape into a
named exported interface (e.g., InteractiveGate) and replace the optional
property declaration interactiveGate?: { runId: string; nodeId: string } with
interactiveGate?: InteractiveGate; ensure the new interface is exported from the
same module so it becomes part of the public metadata contract and matches
MessageMetadata.interactiveGate semantics.