Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@rag-agentic-dashboard/gen-ent-agi-gov-master-html.py`:
- Around line 101-107: In main(), the current modules = [data[k] for k in
MODULE_ORDER if k in data] silently ignores missing module keys; instead,
validate that every key in MODULE_ORDER exists in data and fail fast with a
clear error if any are missing. Locate the main function and the MODULE_ORDER
usage, compute the set/list of missing = [k for k in MODULE_ORDER if k not in
data], and if missing is non-empty raise an exception (or call sys.exit) with a
message listing the missing module keys so the build fails immediately rather
than producing a partial dashboard.

In `@rag-agentic-dashboard/gen-ent-agi-gov-master.py`:
- Around line 66-105: The hardcoded metadata counts are inconsistent with the
actual lists/functions: update deliverableInventory.regulatoryAxes to derive its
value from the length of the regulatoryAlignment array and set
deliverableInventory.apiEndpointsPlanned to the number of routes returned by
api_endpoints() (or compute it from the actual api_endpoints() output) so the
dashboard shows self-consistent totals; locate and modify the keys
regulatoryAlignment, deliverableInventory.regulatoryAxes,
deliverableInventory.apiEndpointsPlanned and the api_endpoints() call to replace
static numbers with computed counts.
- Around line 921-945: The S3 WORM example enables object lock and replication
on aws_s3_bucket.worm but never enables versioning, which is required; add an
aws_s3_bucket_versioning resource (e.g., aws_s3_bucket_versioning.worm) that
sets versioning to "Enabled" for the source bucket referenced by
aws_s3_bucket.worm, and ensure the destination replica_bucket_arn is versioned
as well (either document that the target bucket must have an
aws_s3_bucket_versioning resource enabled or add a corresponding resource for
the replica when you control it); update references in
aws_s3_bucket_object_lock_configuration.worm and
aws_s3_bucket_replication_configuration.worm to rely on the bucket after
versioning is enabled.
- Around line 984-999: In daily_audit, ObjectLockRetainUntilDate is incorrectly
set to the current time; compute a UTC timestamp 7 years in the future and pass
that instead: calculate future_date = (datetime.utcnow() +
relativedelta(years=7)) and format it with strftime("%Y-%m-%dT%H:%M:%SZ")
(import datetime and dateutil.relativedelta or use a safe year-add helper) and
use that variable for ObjectLockRetainUntilDate in the s3.put_object call; keep
the existing manifest and other fields unchanged.

In `@rag-agentic-dashboard/public/ent-agi-gov-master.html`:
- Around line 119-121: Update the stale API count in the Deliverable Inventory:
inside the div with id="inventory" (the table with class 'kv'), find the row
where the key td (class='k') equals "apiEndpointsPlanned" and change the
corresponding value td (class='v') from "95" to "56" so it matches the hero KPI
and the API section.
- Line 101: The TOC nav (.toc) contains truncated anchor labels — specifically
the anchors with href '#M5' and '#M7' — so restore their full label text
(replace "M5 · Civilizational-Scale Governance & Compute Over" and "M7 · Kafka
ACL Governance & Continuous Compliance E" with the complete, intended strings)
within the <nav class="toc"> markup, and fix the generator/template that emits
these items so it outputs the full labels for anchors like '#M5' and '#M7'
(update the template or data source that builds the nav entries to use the full
label values).
- Around line 283-286: The paragraph under the section with id
"regulatory-matrix" claims "the headline list of 16 axes" but the <ul> contains
15 <li> items; fix by either adding the missing regulatory axis as a new <li>
(ensuring it matches the M2 — Regulatory Alignment Matrix master list) or change
the paragraph text to say "15 axes" to match the current list; update the <p
class="summary"> text or the <ul> accordingly so the count and list stay
aligned.
- Around line 73-80: The file contains sensitive "CONFIDENTIAL" governance
content exposed in the public static HTML (see header element with class="hero",
the div with class="doc-ref", the H1 title "Enterprise AGI/ASI Governance Master
Framework" and the span.badge elements), so remove or sanitize that content from
the publicly served asset: either move the document out of the public static
assets into an authenticated endpoint or CMS, replace the confidential text in
the public file with a non-sensitive placeholder or summary, and update any
build/deploy scripts to ensure the header/div/doc-ref/h1 content is not bundled
into public/ static assets; also verify the HTTP 200 endpoint is restricted or
removed so the sensitive page is no longer directly fetchable.
- Line 126: The H2 headings are rendering duplicated module prefixes (e.g., "M1
· M1 — Multilayered AI Governance Pillars (G1-G7)") because the template is
concatenating the module id twice; locate the heading generation that outputs
"<h2>…</h2>" for section titles (the string starting "M1 · M1 — Multilayered AI
Governance Pillars (G1-G7)" and similar entries) and remove the redundant module
id concatenation so the heading uses either the moduleId variable OR the
sectionTitle (not both), e.g. change occurrences that build "moduleId + ' · ' +
moduleId + ' — ' + title" to a single prefix like "moduleId + ' — ' + title" or
just use title.
- Around line 614-629: In daily_audit, the S3 listing only handles the first
list_objects_v2 page and the ObjectLockRetainUntilDate is set to now; modify
daily_audit to paginate through all pages by looping on list_objects_v2 with
ContinuationToken (check IsTruncated and use NextContinuationToken) and append
each object's body to leaves until done, then compute the merkle root; also
compute a retention date seven years in the future (e.g., using datetime + 7
years via dateutil.relativedelta or adding 7*365 days carefully) and set
ObjectLockRetainUntilDate to that future ISO8601 UTC timestamp when calling
s3.put_object for the manifest.

In `@rag-agentic-dashboard/server.js`:
- Around line 21269-21277: eagvFindModule currently falls back to any top-level
EAGV property (via EAGV[mid]) which lets non-module entries (e.g., "meta",
"schemas") be treated as modules; remove that fallback and only resolve modules
by whitelisting against EAGV_MODULE_KEYS: iterate EAGV_MODULE_KEYS and match
either the module's id (case-insensitive) or the key itself against the
requested mid, returning the module if found, otherwise return null so
non-module ids yield 404; update eagvFindModule to stop using EAGV[mid] and only
consult EAGV_MODULE_KEYS and EAGV[k].
- Around line 21303-21306: The expressions access sections[0] without guarding
for a missing or empty sections array (e.g., EAGV.M1_pillars.sections[0]),
causing runtime errors; update each occurrence (EAGV.M1_pillars,
EAGV.M2_regulatory, EAGV.M3_architectures, EAGV.M4_safety and the financial-mrm
equivalents) to first check that .sections exists and has length > 0 (or use
optional chaining with .sections?.[0]) before indexing and then safely fall back
to an empty array when computing .length so the API mirrors the generator
behavior.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@rag-agentic-dashboard/gen-wfap-gemini-impl-html.py`:
- Around line 90-101: The rendered <h2> duplicates the module id because
render_module currently uses mid · title; update render_module so the heading
uses only the module title (use esc(title) instead of esc(mid) · esc(title))
while keeping mid for the section id attribute; modify the h2 construction in
the render_module function to remove the prefixed mid to avoid duplicate "M1 —"
labels.

In `@rag-agentic-dashboard/gen-wfap-gemini-impl.py`:
- Around line 1001-1008: The rollback endpoint
(router.post("/api/models/:id/rollback")) updates the current model before
verifying/publishing the target, risking leaving no published model if a
subsequent read/write fails; change the logic to first validate
cur.rollbackTargetId and load both models via db.models.find, then perform the
two updates (set target status "published" and current status "paused") inside a
single transaction primitive provided by your data layer (use db.transaction or
equivalent), ensure you commit on success and rollback on error, call
emitAudit({ type: "model.rollback", from: cur.id, to: tgt.id }) after a
successful commit, and return appropriate error responses if validation or any
transactional operation fails.
- Around line 77-89: The deliverableInventory.apis field is hard-coded to 110
but should be computed from the actual API list; call the api_endpoints()
function where the JSON is assembled and set "apis" to the length of that
returned collection (or to the count of endpoints marked published if
api_endpoints() returns metadata) instead of the literal 110 so the JSON matches
the generated routes (see api_endpoints() and the deliverableInventory object).
- Around line 921-960: The code uses json.dumps(...) in the generate function to
sign the envelope but never imports the json module; add "import json" to the
module imports (near other imports at the top of the file) so json.dumps is
defined when SK.sign(json.dumps(...)) is called and the route handler generate
can return the signed envelope without NameError.

In `@rag-agentic-dashboard/server.js`:
- Around line 21393-21443: The Financial-MRM routes (handlers for
'/api/ent-agi-gov-master/financial-mrm' and
'/api/ent-agi-gov-master/financial-mrm/:id') access
EAGV.M6_financialMrm.sections[0] directly which can throw if sections is
undefined; change both to use a safe-access pattern like: const sec =
((EAGV.M6_financialMrm && EAGV.M6_financialMrm.sections) || [])[0] || {}; and
then use (sec.domains || []) before .find(), mirroring the safe patterns used in
the scenarios and kafka-gac handlers.
- Around line 21559-21561: The three properties (architecturePlanes, dataModels,
dataFlows) use the same unguarded sections[0] pattern; create/ reuse a helper
wfapgFirstSection(source) (modeled after the EAGV fix) that safely returns
source.sections?.[0] or null, then replace the current expressions with guarded
forms using that helper (e.g., (wfapgFirstSection(WFAPG.M1_architecture)?.planes
|| []).length, (wfapgFirstSection(WFAPG.M2_dataModels)?.entities || []).length,
(wfapgFirstSection(WFAPG.M3_dataFlows)?.flows || []).length) so accessing
planes/entities/flows is null-safe and consistent with the EAGV approach.
- Around line 21341-21391: The repeated pattern using unguarded sections[0] in
the routes (pillars, regulatory, architectures, safety) should be replaced by
the eagvFirstSection helper; update each handler that currently does const sec =
(EAGV.M1_pillars && EAGV.M1_pillars.sections[0]) || {} (and the analogous
M2_regulatory, M3_architectures, M4_safety lines) to call
eagvFirstSection(EAGV.M1_pillars) etc., then use the returned sec for
sec.pillars/sec.rows/sec.architectures/sec.protocols and for the find() logic in
the :id/:axis endpoints; ensure eagvFirstSection returns {} when input is falsy
or has no sections to preserve existing behavior and avoid direct indexing of
sections[0].
- Around line 21598-21637: The routes for architecture, data-models and
data-flows currently index WFAPG modules' sections directly (e.g.,
WFAPG.M1_architecture.sections[0], WFAPG.M1_architecture.sections[1],
WFAPG.M1_architecture.sections[2], WFAPG.M2_dataModels.sections[0],
WFAPG.M3_dataFlows.sections[0]) which can throw when sections is missing; add a
small helper function wfapgGetSection(module, index) that returns {} when
module?.sections is not an array or index is out of range, and replace direct
accesses in the handlers (the GET handlers for /api/wfap-gemini/architecture,
/architecture/planes, /architecture/topology, /architecture/tenancy,
/api/wfap-gemini/data-models, /api/wfap-gemini/data-models/:id,
/api/wfap-gemini/data-flows, /api/wfap-gemini/data-flows/:id) to call
wfapgGetSection(WFAPG.M1_architecture,0) etc., then use the returned safe object
(sec) as before.
- Around line 21525-21533: The fallback in wfapgFindModule currently returns
WFAPG[mid] without validating it, which can expose non-module properties; update
the fallback to only return WFAPG[mid] when it is a valid module object (e.g.,
has an id string or other module shape) — modify wfapgFindModule to validate
WFAPG[mid] (check WFAPG[mid] && typeof WFAPG[mid].id === 'string') before
returning, keeping the primary lookup over WFAPG_MODULE_KEYS and the existing
behavior otherwise returning null.

---

Duplicate comments:
In `@rag-agentic-dashboard/server.js`:
- Around line 21303-21306: The code is directly indexing sections[0] on modules
like EAGV.M1_pillars, EAGV.M2_regulatory, EAGV.M3_architectures and
EAGV.M4_safety which can throw if sections is undefined or empty; change those
accesses to safely get the first section (e.g., use a small helper
getFirstSection(module) that returns (module && (module.sections || [])[0]) or
similar) and then use the returned section to compute
.pillars/.rows/.architectures/.protocols lengths so that pillars,
regulatoryAxes, architectures and safetyProtocols never attempt to index
undefined.

---

Nitpick comments:
In `@rag-agentic-dashboard/server.js`:
- Around line 21256-21544: Duplicate module/section lookup logic exists in
eagvFindModule/eagvFindSection and wfapgFindModule/wfapgFindSection; extract a
generic factory to remove duplication. Implement a createModuleFinder(data,
moduleKeys) that encapsulates the uppercase id matching and fallback to
data[mid], and a createSectionFinder(data, moduleKeys) that iterates module
sections and returns { module: m.id, section: s } when matched; then replace
eagvFindModule/wfapgFindModule with createModuleFinder(EAGV,
EAGV_MODULE_KEYS)/createModuleFinder(WFAPG, WFAPG_MODULE_KEYS) and replace
eagvFindSection/wfapgFindSection with the corresponding createSectionFinder
calls, ensuring existing behavior (case-insensitive id matching and same return
shapes) is preserved.