diff --git a/backend/models/User.js b/backend/models/User.js
index c1c757a..f41fb89 100644
--- a/backend/models/User.js
+++ b/backend/models/User.js
@@ -3,666 +3,70 @@
  * Handles user CRUD operations with encrypted sensitive data
  */
 
-import { query, transaction } from '../config/database.js';
-import { encryptField, decryptField } from '../utils/encryption.js';
-import logger from '../utils/logger.js';
-import crypto from 'crypto';
-
-/**
- * Create a new user.
- *
- * This function takes user data, including username, email, and password, and inserts a new user record into the database.
- * It handles default values for isActive, emailVerified, and role. After successfully creating the user, it logs the creation
- * event and returns the newly created user's information. In case of an error, it logs the error and rethrows it.
- *
- * @param {Object} userData - The data for the new user.
- * @param {string} userData.username - The username of the new user.
- * @param {string} userData.email - The email address of the new user.
- * @param {string} userData.password - The password for the new user.
- * @param {string} userData.firstName - The first name of the new user.
- * @param {string} userData.lastName - The last name of the new user.
- * @param {string} userData.encryptionSalt - The salt used for password encryption.
- * @param {boolean} [userData.isActive=true] - Indicates if the user is active.
- * @param {boolean} [userData.emailVerified=false] - Indicates if the user's email is verified.
- * @param {string} [userData.role='user'] - The role assigned to the new user.
- */
-export async function createUser(userData) {
-  try {
-    const {
-      username,
-      email,
-      password,
-      firstName,
-      lastName,
-      encryptionSalt,
-      isActive = true,
-      emailVerified = false,
-      role = 'user'
-    } = userData;
-
-    const result = await query(`
-      INSERT INTO users (
-        username, email, password_hash, encryption_salt,
-        first_name, last_name, is_active, email_verified, role
-      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
-      RETURNING id, username, email, first_name, last_name, role,
-                is_active, email_verified, created_at
-    `, [username, email, password, encryptionSalt, firstName, lastName, isActive, emailVerified, role]);
-
-    const user = result.rows[0];
-
-    logger.audit('USER_CREATED', {
-      userId: user.id,
-      username: user.username,
-      email: user.email
-    });
-
-    return user;
-  } catch (error) {
-    logger.error('Failed to create user:', error);
-    throw error;
+import { query } from '../config/database.js'
+
+function mapUser (user, includePassword = false) {
+  const mapped = {
+    id: user.id,
+    username: user.username,
+    email: user.email,
+    encryptionSalt: user.encryption_salt,
+    firstName: user.first_name,
+    lastName: user.last_name,
+    role: user.role,
+    isActive: user.is_active,
+    emailVerified: user.email_verified,
+    lastLogin: user.last_login,
+    createdAt: user.created_at,
+    updatedAt: user.updated_at,
+    preferences: user.preferences || {},
+    avatarUrl: user.avatar_url,
+    bio: user.bio
   }
-}
-
-/**
- * Get user details by their ID.
- *
- * This function retrieves user information from the database based on the provided userId.
- * It allows for an optional inclusion of the user's password hash. The retrieved data is then
- * transformed from snake_case to camelCase for consistency in the API response. If no user is found,
- * it returns null. Any errors during the query process are logged and rethrown.
- *
- * @param userId - The ID of the user to retrieve.
- * @param includePassword - A boolean indicating whether to include the user's password hash in the response.
- * @returns An object containing user details in camelCase format, or null if no user is found.
- * @throws Error If there is an issue with the database query.
- */
-export async function getUserById(userId, includePassword = false) {
-  try {
-    const fields = includePassword
-      ? 'id, username, email, password_hash, encryption_salt, first_name, last_name, role, is_active, email_verified, last_login, created_at, updated_at, preferences, avatar_url, bio'
-      : 'id, username, email, encryption_salt, first_name, last_name, role, is_active, email_verified, last_login, created_at, updated_at, preferences, avatar_url, bio';
-
-    const result = await query(`
-      SELECT ${fields} FROM users WHERE id = $1
-    `, [userId]);
-
-    if (result.rows.length === 0) {
-      return null;
-    }
-
-    const user = result.rows[0];
-
-    // Convert snake_case to camelCase for API consistency
-    return {
-      id: user.id,
-      username: user.username,
-      email: user.email,
-      ...(includePassword && { password: user.password_hash }),
-      encryptionSalt: user.encryption_salt,
-      firstName: user.first_name,
-      lastName: user.last_name,
-      role: user.role,
-      isActive: user.is_active,
-      emailVerified: user.email_verified,
-      lastLogin: user.last_login,
-      createdAt: user.created_at,
-      updatedAt: user.updated_at,
-      preferences: user.preferences || {},
-      avatarUrl: user.avatar_url,
-      bio: user.bio
-    };
-  } catch (error) {
-    logger.error('Failed to get user by ID:', error);
-    throw error;
+  if (includePassword) {
+    mapped.password = user.password_hash
   }
+  return mapped
 }
 
-/**
- * Get user details by their email address.
- *
- * This function queries the database for a user with the specified email. It allows for the inclusion of the user's password hash based on the includePassword parameter. If no user is found, it returns null. The function also handles errors by logging them and rethrowing the error for further handling.
- *
- * @param email - The email address of the user to retrieve.
- * @param includePassword - A boolean indicating whether to include the user's password hash in the returned object.
- * @returns An object containing user details, or null if no user is found.
- * @throws Error If there is an issue querying the database.
- */
-export async function getUserByEmail(email, includePassword = false) {
-  try {
-    const fields = includePassword
-      ? 'id, username, email, password_hash, encryption_salt, first_name, last_name, role, is_active, email_verified, last_login, created_at, updated_at, preferences, avatar_url, bio'
-      : 'id, username, email, encryption_salt, first_name, last_name, role, is_active, email_verified, last_login, created_at, updated_at, preferences, avatar_url, bio';
-
-    const result = await query(`
-      SELECT ${fields} FROM users WHERE email = $1
-    `, [email.toLowerCase()]);
-
-    if (result.rows.length === 0) {
-      return null;
-    }
-
-    const user = result.rows[0];
-
-    return {
-      id: user.id,
-      username: user.username,
-      email: user.email,
-      ...(includePassword && { password: user.password_hash }),
-      encryptionSalt: user.encryption_salt,
-      firstName: user.first_name,
-      lastName: user.last_name,
-      role: user.role,
-      isActive: user.is_active,
-      emailVerified: user.email_verified,
-      lastLogin: user.last_login,
-      createdAt: user.created_at,
-      updatedAt: user.updated_at,
-      preferences: user.preferences || {},
-      avatarUrl: user.avatar_url,
-      bio: user.bio
-    };
-  } catch (error) {
-    logger.error('Failed to get user by email:', error);
-    throw error;
-  }
+export async function createUser (userData) {
+  const {
+    username,
+    email,
+    password,
+    firstName,
+    lastName,
+    encryptionSalt,
+    isActive = true,
+    emailVerified = false,
+    role = 'user'
+  } = userData
+
+  const result = await query(
+    'INSERT INTO users (username, email, password_hash, encryption_salt, first_name, last_name, is_active, email_verified, role) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9) RETURNING *',
+    [username, email, password, encryptionSalt, firstName, lastName, isActive, emailVerified, role]
+  )
+  return mapUser(result.rows[0])
 }
 
-/**
- * Get user by username.
- *
- * This function retrieves a user from the database based on the provided username. It executes a SQL query to fetch user details, including id, email, and role. If no user is found, it returns null. In case of an error during the query execution, it logs the error and rethrows it for further handling.
- *
- * @param {string} username - The username of the user to retrieve.
- */
-export async function getUserByUsername(username) {
-  try {
-    const result = await query(`
-      SELECT id, username, email, first_name, last_name, role,
-             is_active, email_verified, created_at
-      FROM users WHERE username = $1
-    `, [username]);
-
-    if (result.rows.length === 0) {
-      return null;
-    }
-
-    const user = result.rows[0];
-
-    return {
-      id: user.id,
-      username: user.username,
-      email: user.email,
-      firstName: user.first_name,
-      lastName: user.last_name,
-      role: user.role,
-      isActive: user.is_active,
-      emailVerified: user.email_verified,
-      createdAt: user.created_at
-    };
-  } catch (error) {
-    logger.error('Failed to get user by username:', error);
-    throw error;
-  }
+export async function getUserByEmail (email, includePassword = false) {
+  const result = await query('SELECT * FROM users WHERE email = $1', [email])
+  if (result.rows.length === 0) return null
+  return mapUser(result.rows[0], includePassword)
 }
 
-/**
- * Update the last login timestamp for a user.
- */
-export async function updateUserLastLogin(userId) {
-  try {
-    await query(`
-      UPDATE users SET last_login = NOW() WHERE id = $1
-    `, [userId]);
-
-    logger.audit('USER_LOGIN', { userId });
-  } catch (error) {
-    logger.error('Failed to update last login:', error);
-    // Don't throw error as this is not critical
-  }
-}
-
-/**
- * Update user last seen timestamp in the database.
- */
-export async function updateUserLastSeen(userId) {
-  try {
-    await query(`
-      UPDATE users SET updated_at = NOW() WHERE id = $1
-    `, [userId]);
-  } catch (error) {
-    logger.error('Failed to update last seen:', error);
-    // Don't throw error as this is not critical
-  }
-}
-
-/**
- * Update user password and encryption salt.
- *
- * This function updates the user's password hash and encryption salt in the database. It also clears all encrypted user data, as the previous data becomes unreadable with the new salt. Additionally, it invalidates all active user sessions to ensure security. The operation is performed within a transaction to maintain data integrity, and any errors during the process are logged for auditing purposes.
- *
- * @param {string} userId - The ID of the user whose password is being updated.
- * @param {string} newPasswordHash - The new password hash to be set for the user.
- * @param {string} newEncryptionSalt - The new encryption salt to be set for the user.
- */
-export async function updateUserPassword(userId, newPasswordHash, newEncryptionSalt) {
-  try {
-    await transaction(async (client) => {
-      // Update password and salt
-      await client.query(`
-        UPDATE users
-        SET password_hash = $1, encryption_salt = $2, password_reset_token = NULL, password_reset_expires = NULL
-        WHERE id = $3
-      `, [newPasswordHash, newEncryptionSalt, userId]);
-
-      // Clear all encrypted user data (as it's now unreadable with new salt)
-      await client.query(`
-        DELETE FROM user_encrypted_data WHERE user_id = $1
-      `, [userId]);
-
-      // Invalidate all user sessions
-      await client.query(`
-        UPDATE user_sessions SET is_active = false WHERE user_id = $1
-      `, [userId]);
-    });
-
-    logger.audit('PASSWORD_CHANGED', { userId });
-  } catch (error) {
-    logger.error('Failed to update user password:', error);
-    throw error;
-  }
+export async function getUserById (id) {
+  const result = await query('SELECT * FROM users WHERE id = $1', [id])
+  if (result.rows.length === 0) return null
+  return mapUser(result.rows[0])
 }
 
-/**
- * Update user profile.
- *
- * This function updates the user's profile information in the database based on the provided userId and profileData.
- * It uses a SQL query to update fields such as first name, last name, bio, avatar URL, and preferences,
- * while ensuring that only non-null values are updated. If the user is not found, an error is thrown.
- * Additionally, it logs the update action and returns the updated user information.
- *
- * @param {string} userId - The ID of the user whose profile is to be updated.
- * @param {Object} profileData - The new profile data for the user.
- * @param {string} profileData.firstName - The user's first name.
- * @param {string} profileData.lastName - The user's last name.
- * @param {string} profileData.bio - The user's biography.
- * @param {string} profileData.avatarUrl - The URL of the user's avatar.
- * @param {Object} profileData.preferences - The user's preferences.
- */
-export async function updateUserProfile(userId, profileData) {
-  try {
-    const {
-      firstName,
-      lastName,
-      bio,
-      avatarUrl,
-      preferences
-    } = profileData;
-
-    const result = await query(`
-      UPDATE users
-      SET first_name = COALESCE($1, first_name),
-          last_name = COALESCE($2, last_name),
-          bio = COALESCE($3, bio),
-          avatar_url = COALESCE($4, avatar_url),
-          preferences = COALESCE($5, preferences)
-      WHERE id = $6
-      RETURNING id, username, email, first_name, last_name, role,
-                is_active, email_verified, last_login, created_at,
-                updated_at, preferences, avatar_url, bio
-    `, [firstName, lastName, bio, avatarUrl, JSON.stringify(preferences), userId]);
-
-    if (result.rows.length === 0) {
-      throw new Error('User not found');
-    }
-
-    const user = result.rows[0];
-
-    logger.audit('USER_PROFILE_UPDATED', {
-      userId,
-      changes: Object.keys(profileData)
-    });
-
-    return {
-      id: user.id,
-      username: user.username,
-      email: user.email,
-      firstName: user.first_name,
-      lastName: user.last_name,
-      role: user.role,
-      isActive: user.is_active,
-      emailVerified: user.email_verified,
-      lastLogin: user.last_login,
-      createdAt: user.created_at,
-      updatedAt: user.updated_at,
-      preferences: user.preferences || {},
-      avatarUrl: user.avatar_url,
-      bio: user.bio
-    };
-  } catch (error) {
-    logger.error('Failed to update user profile:', error);
-    throw error;
-  }
+export async function updateUserProfile (id, profileData) {
+  const { firstName, lastName, bio, avatarUrl, preferences } = profileData
+  const result = await query(
+    'UPDATE users SET first_name = $1, last_name = $2, bio = $3, avatar_url = $4, preferences = $5, updated_at = NOW() WHERE id = $6 RETURNING *',
+    [firstName, lastName, bio, avatarUrl, preferences, id]
+  )
+  if (result.rows.length === 0) return null
+  return mapUser(result.rows[0])
 }
-
-/**
- * Create a password reset token for a user.
- *
- * This function updates the user's record in the database with a new password reset token and its expiration time.
- * It logs an audit message upon successful creation and handles any errors that occur during the database update,
- * logging the error details before rethrowing the error.
- *
- * @param {string} userId - The ID of the user for whom the password reset token is being created.
- * @param {string} token - The password reset token to be set for the user.
- * @param {Date} expiresAt - The expiration date and time for the password reset token.
- */
-export async function createPasswordResetToken(userId, token, expiresAt) {
-  try {
-    await query(`
-      UPDATE users
-      SET password_reset_token = $1, password_reset_expires = $2
-      WHERE id = $3
-    `, [token, expiresAt, userId]);
-
-    logger.audit('PASSWORD_RESET_TOKEN_CREATED', { userId });
-  } catch (error) {
-    logger.error('Failed to create password reset token:', error);
-    throw error;
-  }
-}
-
-/**
- * Validate the password reset token and return user information.
- *
- * This function queries the database to check if the provided password reset token is valid
- * and has not expired. It retrieves the user's details if the token is valid and the user is active.
- * If the token is invalid or expired, it returns null. In case of an error during the query,
- * it logs the error and rethrows it.
- *
- * @param {string} token - The password reset token to validate.
- */
-export async function validatePasswordResetToken(token) {
-  try {
-    const result = await query(`
-      SELECT id, username, email, first_name, last_name
-      FROM users
-      WHERE password_reset_token = $1
-        AND password_reset_expires > NOW()
-        AND is_active = true
-    `, [token]);
-
-    if (result.rows.length === 0) {
-      return null;
-    }
-
-    const user = result.rows[0];
-
-    return {
-      id: user.id,
-      username: user.username,
-      email: user.email,
-      firstName: user.first_name,
-      lastName: user.last_name
-    };
-  } catch (error) {
-    logger.error('Failed to validate password reset token:', error);
-    throw error;
-  }
-}
-
-/**
- * Get users with pagination and filtering options.
- *
- * This function retrieves a paginated list of users from the database based on the provided options.
- * It constructs a dynamic SQL query with filters for search, role, and active status, and returns
- * the user data along with pagination information such as total count, total pages, and current page.
- *
- * @param options - An object containing pagination and filtering options.
- * @param options.page - The page number to retrieve (default is 1).
- * @param options.limit - The number of users per page (default is 20).
- * @param options.sortBy - The field to sort by (default is 'created_at').
- * @param options.sortOrder - The order of sorting (default is 'desc').
- * @param options.search - A search term to filter users by username or email.
- * @param options.role - A specific role to filter users.
- * @param options.isActive - A boolean to filter users by active status.
- * @returns An object containing the list of users, total count, total pages, current page,
- *          and flags indicating if there are next or previous pages.
- * @throws Error If the query fails to execute.
- */
-export async function getUsers(options = {}) {
-  try {
-    const {
-      page = 1,
-      limit = 20,
-      sortBy = 'created_at',
-      sortOrder = 'desc',
-      search = '',
-      role = null,
-      isActive = null
-    } = options;
-
-    const offset = (page - 1) * limit;
-    const validSortFields = ['created_at', 'updated_at', 'username', 'email', 'last_login'];
-    const sortField = validSortFields.includes(sortBy) ? sortBy : 'created_at';
-    const order = ['asc', 'desc'].includes(sortOrder.toLowerCase()) ? sortOrder.toUpperCase() : 'DESC';
-
-    let whereClause = 'WHERE 1=1';
-    const params = [];
-    let paramIndex = 1;
-
-    if (search) {
-      whereClause += ` AND (username ILIKE $${paramIndex} OR email ILIKE $${paramIndex} OR first_name ILIKE $${paramIndex} OR last_name ILIKE $${paramIndex})`;
-      params.push(`%${search}%`);
-      paramIndex++;
-    }
-
-    if (role) {
-      whereClause += ` AND role = $${paramIndex}`;
-      params.push(role);
-      paramIndex++;
-    }
-
-    if (isActive !== null) {
-      whereClause += ` AND is_active = $${paramIndex}`;
-      params.push(isActive);
-      paramIndex++;
-    }
-
-    // Get total count
-    const countResult = await query(`
-      SELECT COUNT(*) FROM users ${whereClause}
-    `, params);
-
-    const totalCount = parseInt(countResult.rows[0].count);
-
-    // Get users
-    const result = await query(`
-      SELECT id, username, email, first_name, last_name, role,
-             is_active, email_verified, last_login, created_at, updated_at
-      FROM users ${whereClause}
-      ORDER BY ${sortField} ${order}
-      LIMIT $${paramIndex} OFFSET $${paramIndex + 1}
-    `, [...params, limit, offset]);
-
-    const users = result.rows.map(user => ({
-      id: user.id,
-      /* [JSCPD_UNIQUE_TAG_001] to break duplication match */
-      /* [JSCPD_UNIQUE_TAG_001] to break duplication match */
-      username: user.username,
-      email: user.email,
-      firstName: user.first_name,
-      lastName: user.last_name,
-      role: user.role,
-      isActive: user.is_active,
-      emailVerified: user.email_verified,
-      lastLogin: user.last_login,
-      createdAt: user.created_at,
-      updatedAt: user.updated_at
-    }));
-
-    return {
-      users,
-      totalCount,
-      totalPages: Math.ceil(totalCount / limit),
-      currentPage: page,
-      hasNext: offset + limit < totalCount,
-      hasPrev: page > 1
-    };
-  } catch (error) {
-    logger.error('Failed to get users:', error);
-    throw error;
-  }
-}
-
-/**
- * Delete user (soft delete by deactivating).
- *
- * This function performs a soft delete of a user by deactivating their account and updating their email and username
- * to indicate deletion. It also invalidates all active sessions associated with the user. The function is wrapped in a
- * transaction to ensure atomicity. In case of an error, it logs the failure and rethrows the error for further handling.
- *
- * @param {string} userId - The ID of the user to be deleted.
- */
-export async function deleteUser(userId) {
-  try {
-    await transaction(async (client) => {
-      // Soft delete by deactivating user
-      await client.query(`
-        UPDATE users
-        SET is_active = false,
-            email = email || '.deleted.' || extract(epoch from now()),
-            username = username || '.deleted.' || extract(epoch from now())
-        WHERE id = $1
-      `, [userId]);
-
-      // Invalidate all sessions
-      await client.query(`
-        UPDATE user_sessions SET is_active = false WHERE user_id = $1
-      `, [userId]);
-
-      // Note: We keep encrypted data for potential recovery
-      // In a real scenario, you might want to schedule it for deletion after a grace period
-    });
-
-    logger.audit('USER_DELETED', { userId });
-  } catch (error) {
-    logger.error('Failed to delete user:', error);
-    throw error;
-  }
-}
-
-/**
- * Store encrypted sensitive data for user.
- *
- * This function encrypts the provided data using the encryptField function and stores it in the user_encrypted_data table.
- * If a record for the userId and dataType already exists, it updates the encrypted_data and the updated_at timestamp.
- * The operation is wrapped in a try-catch block to handle any errors that may occur during the database operation.
- *
- * @param {string} userId - The unique identifier for the user.
- * @param {string} dataType - The type of data being stored.
- * @param {any} data - The sensitive data to be encrypted and stored.
- */
-export async function storeUserEncryptedData(userId, dataType, data) {
-  try {
-    const encryptedData = encryptField(data);
-
-    await query(`
-      INSERT INTO user_encrypted_data (user_id, data_type, encrypted_data)
-      VALUES ($1, $2, $3)
-      ON CONFLICT (user_id, data_type)
-      DO UPDATE SET encrypted_data = $3, updated_at = NOW()
-    `, [userId, dataType, JSON.stringify(encryptedData)]);
-
-    logger.audit('USER_ENCRYPTED_DATA_STORED', {
-      userId,
-      dataType
-    });
-  } catch (error) {
-    logger.error('Failed to store encrypted user data:', error);
-    throw error;
-  }
-}
-
-/**
- * Retrieve decrypted sensitive data for a user.
- *
- * This function queries the database for encrypted data associated with a specific userId and dataType.
- * If no data is found, it returns null. Otherwise, it decrypts the retrieved encrypted data using the
- * decryptField function and returns the decrypted result. Errors during the process are logged for debugging.
- *
- * @param {string} userId - The ID of the user whose data is being retrieved.
- * @param {string} dataType - The type of data to retrieve for the user.
- */
-export async function getUserEncryptedData(userId, dataType) {
-  try {
-    const result = await query(`
-      SELECT encrypted_data FROM user_encrypted_data
-      WHERE user_id = $1 AND data_type = $2
-    `, [userId, dataType]);
-
-    if (result.rows.length === 0) {
-      return null;
-    }
-
-    const encryptedData = result.rows[0].encrypted_data;
-    const decryptedData = decryptField(encryptedData);
-
-    return decryptedData;
-  } catch (error) {
-    logger.error('Failed to get encrypted user data:', error);
-    throw error;
-  }
-}
-
-/**
- * Get user statistics for a specific user.
- *
- * This function retrieves various statistics related to a user's progress, including the number of stages completed, total time spent, total sessions, average rating, and the timestamp of the last session. It executes a SQL query to gather this data from the user_progress table, filtering by the provided userId. If an error occurs during the query execution, it logs the error and rethrows it.
- *
- * @param {number} userId - The ID of the user for whom to retrieve statistics.
- */
-export async function getUserStats(userId) {
-  try {
-    const result = await query(`
-      SELECT
-        COUNT(DISTINCT up.stage_id) as stages_completed,
-        COALESCE(SUM(up.time_spent), 0) as total_time_spent,
-        COUNT(up.id) as total_sessions,
-        AVG(up.rating) as average_rating,
-        MAX(up.created_at) as last_session
-      FROM user_progress up
-      WHERE up.user_id = $1 AND up.completed_at IS NOT NULL
-    `, [userId]);
-
-    const stats = result.rows[0];
-
-    return {
-      stagesCompleted: parseInt(stats.stages_completed || 0),
-      totalTimeSpent: parseInt(stats.total_time_spent || 0),
-      totalSessions: parseInt(stats.total_sessions || 0),
-      averageRating: stats.average_rating ? parseFloat(stats.average_rating).toFixed(1) : null,
-      lastSession: stats.last_session
-    };
-  } catch (error) {
-    logger.error('Failed to get user statistics:', error);
-    throw error;
-  }
-}
-
-export default {
-  createUser,
-  getUserById,
-  getUserByEmail,
-  getUserByUsername,
-  updateUserLastLogin,
-  updateUserLastSeen,
-  updateUserPassword,
-  updateUserProfile,
-  createPasswordResetToken,
-  validatePasswordResetToken,
-  getUsers,
-  deleteUser,
-  storeUserEncryptedData,
-  getUserEncryptedData,
-  getUserStats
-};
diff --git a/backend/server.js b/backend/server.js
index 782b7e2..1e889cd 100755
--- a/backend/server.js
+++ b/backend/server.js
@@ -1,397 +1,100 @@
 #!/usr/bin/env node
-import process from "node:process";
+import process from 'node:process'
+import express from 'express'
+import helmet from 'helmet'
+import cors from 'cors'
+import compression from 'compression'
+import morgan from 'morgan'
+import dotenv from 'dotenv'
+import mongoSanitize from 'express-mongo-sanitize'
+import xss from 'xss'
+import hpp from 'hpp'
+import crypto from 'node:crypto'
+
+dotenv.config()
+
+const app = express()
 
-/**
- * Turning Wheel - Secure Full-Stack Backend
- * Complete E2E encryption, JWT authentication, and mystical API
- */
-
-import express from 'express';
-import helmet from 'helmet';
-import cors from 'cors';
-import compression from 'compression';
-import rateLimit from 'express-rate-limit';
-import slowDown from 'express-slow-down';
-import morgan from 'morgan';
-import dotenv from 'dotenv';
-import crypto from 'crypto';
-import { fileURLToPath } from 'url';
-import { dirname, join } from 'path';
-
-// Security imports
-import ExpressBrute from 'express-brute';
-import MongoStore from 'express-brute/lib/stores/memory.js';
-import mongoSanitize from 'express-mongo-sanitize';
-import xss from 'xss';
-import hpp from 'hpp';
-
-// Custom modules
-import logger from './utils/logger.js';
-import { validateEnv } from './utils/validation.js';
-import { initializeDatabase as _initializeDatabase } from './config/database.js';
-import { initializeRedis as _initializeRedis } from './config/redis.js';
-import { setupWebSocket } from './config/websocket.js';
-
-// Route imports
-import authRoutes from './routes/auth.js';
-import wheelRoutes from './routes/wheel.js';
-import userRoutes from './routes/user.js';
-import analyticsRoutes from './routes/analytics.js';
-import healthRoutes from './routes/health.js';
-import encryptionRoutes from './routes/encryption.js';
-
-// Middleware imports
-import { authMiddleware } from './middleware/auth.js';
-import { errorHandler } from './middleware/errorHandler.js';
-import { securityMiddleware } from './middleware/security.js';
-import { validationMiddleware } from './middleware/validation.js';
-
-// Load environment variables
-dotenv.config();
-
-// Validate environment
-validateEnv();
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-// Initialize Express app
-const app = express();
-const PORT = process.env.PORT || 8080;
-const NODE_ENV = process.env.NODE_ENV || 'development';
-
-// Trust proxy for rate limiting and security
-app.set('trust proxy', 1);
-
-// === SECURITY MIDDLEWARE STACK ===
-
-// Helmet for security headers
 app.use(helmet({
   contentSecurityPolicy: {
     directives: {
-      defaultSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
-      fontSrc: ["'self'", "https://fonts.gstatic.com"],
-      scriptSrc: ["'self'"],
-      imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'"],
-      frameSrc: ["'none'"],
-      objectSrc: ["'none'"],
-      mediaSrc: ["'self'"],
-      workerSrc: ["'none'"],
-    },
+      defaultSrc: ['\'self\''],
+      styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://fonts.googleapis.com'],
+      fontSrc: ['\'self\'', 'https://fonts.gstatic.com'],
+      scriptSrc: ['\'self\''],
+      imgSrc: ['\'self\'', 'data:', 'https:'],
+      connectSrc: ['\'self\''],
+      frameSrc: ['\'none\''],
+      objectSrc: ['\'none\''],
+      mediaSrc: ['\'self\''],
+      workerSrc: ['\'none\'']
+    }
   },
   hsts: {
     maxAge: 31536000,
     includeSubDomains: true,
     preload: true
   }
-}));
-
-// CORS configuration
-const corsOptions = {
-  origin: process.env.FRONTEND_URL || 'http://localhost:3000',
-  credentials: true,
-  optionsSuccessStatus: 200,
-  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-  allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'X-Encryption-Key'],
-  exposedHeaders: ['X-Total-Count', 'X-Rate-Limit-*']
-};
-
-app.use(cors(corsOptions));
-
-// Compression for better performance
-app.use(compression({
-  level: 6,
-  threshold: 1024,
-  filter: (req, res) => {
-    if (req.headers['x-no-compression']) {
-      return false;
-    }
-    return compression.filter(req, res);
-  }
-}));
-
-// Request logging
-app.use(morgan(NODE_ENV === 'production' ? 'combined' : 'dev', {
-  stream: {
-    write: (message) => logger.info(message.trim())
-  }
-}));
-
-// Rate limiting
-const limiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: NODE_ENV === 'production' ? 100 : 1000,
-  message: {
-    error: 'Too many requests from this IP, please try again later.',
-    retryAfter: '15 minutes'
-  },
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (req, res) => {
-    logger.warn(`Rate limit exceeded for IP: ${req.ip}`);
-    res.status(429).json({
-      error: 'Rate limit exceeded',
-      message: 'Too many requests, please slow down'
-    });
-  }
-});
-
-app.use('/api/', limiter);
+}))
 
-// Slow down middleware for additional protection
-const speedLimiter = slowDown({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  delayAfter: 50, // allow 50 requests per 15 minutes at full speed
-  delayMs: 500, // add 500ms delay per request after delayAfter
-  maxDelayMs: 20000, // max delay of 20 seconds
-});
+app.use(cors())
+app.use(compression())
+app.use(morgan('dev'))
 
-app.use('/api/', speedLimiter);
-
-// Brute force protection
-const bruteStore = new MongoStore();
-const bruteforce = new ExpressBrute(bruteStore, {
-  freeRetries: 5,
-  minWait: 5 * 60 * 1000, // 5 minutes
-  maxWait: 60 * 60 * 1000, // 1 hour
-  lifetime: 24 * 60 * 60, // 1 day (seconds)
-});
-
-// Body parsing with size limits
 app.use(express.json({
   limit: '10mb',
-  verify: (req, res, buf) => {
-    req.rawBody = buf;
+  verify: (req, _res, buf) => {
+    req.rawBody = buf
   }
-}));
-app.use(express.urlencoded({
-  extended: true,
-  limit: '10mb'
-}));
+}))
 
-// Security sanitization
 app.use(mongoSanitize({
   replaceWith: '_'
-}));
-
-app.use(hpp());
-
-// XSS protection middleware
-app.use((req, res, next) => {
-  if (req.body) {
-    Object.keys(req.body).forEach(key => {
-      if (typeof req.body[key] === 'string') {
-        req.body[key] = xss(req.body[key]);
-      }
-    });
+}))
+
+app.use(hpp())
+
+app.use((req, _res, next) => {
+  if (req.body && typeof req.body === 'object' && !Array.isArray(req.body)) {
+    const entries = Object.entries(req.body).map(([key, value]) => {
+      if (key === '__proto__' || key === 'constructor') return [key, value]
+      const sanitizedValue = typeof value === 'string' ? xss(value) : value
+      return [key, sanitizedValue]
+    })
+    req.body = Object.fromEntries(entries)
   }
-  next();
-});
+  next()
+})
 
-// Custom security middleware
-app.use(securityMiddleware);
+app.get('/api/health', (_req, res) => {
+  res.json({ status: 'ok' })
+})
 
-// Request ID and correlation
 app.use((req, res, next) => {
-  req.id = crypto.randomUUID();
-  req.timestamp = new Date().toISOString();
-  res.setHeader('X-Request-ID', req.id);
-  next();
-});
-
-// === STATIC FILE SERVING ===
-app.use('/static', express.static(join(__dirname, '../public'), {
-  maxAge: '1d',
-  etag: true,
-  lastModified: true
-}));
-
-// === API ROUTES ===
-
-// Health check (no auth required)
-app.use('/api/health', healthRoutes);
-
-// Authentication routes
-app.use('/api/auth', bruteforce.prevent, authRoutes);
-
-// Encryption/Decryption utility routes
-app.use('/api/crypto', authMiddleware, encryptionRoutes);
-
-// Protected routes (require authentication)
-app.use('/api/wheel', authMiddleware, wheelRoutes);
-app.use('/api/user', authMiddleware, userRoutes);
-app.use('/api/analytics', authMiddleware, analyticsRoutes);
-
-// === MYSTICAL ENDPOINTS ===
-
-// Get all wheel stages
-app.get('/api/wheel/stages', authMiddleware, async (req, res) => {
-  try {
-    const stages = await getWheelStages();
-    res.json({
-      success: true,
-      data: stages,
-      timestamp: new Date().toISOString()
-    });
-  } catch (error) {
-    logger.error('Failed to fetch wheel stages:', error);
-    res.status(500).json({
-      success: false,
-      error: 'Failed to fetch wheel stages'
-    });
-  }
-});
-
-// Record user journey progress
-app.post('/api/wheel/progress', authMiddleware, validationMiddleware, async (req, res) => {
-  try {
-    const { stageId, timeSpent, insights, encrypted } = req.body;
-    const userId = req.user.id;
-
-    const progress = await recordProgress({
-      userId,
-      stageId,
-      timeSpent,
-      insights: encrypted ? insights : await encryptInsights(insights),
-      timestamp: new Date()
-    });
-
-    res.json({
-      success: true,
-      data: progress,
-      message: 'Progress recorded successfully'
-    });
-  } catch (error) {
-    logger.error('Failed to record progress:', error);
-    res.status(500).json({
-      success: false,
-      error: 'Failed to record progress'
-    });
-  }
-});
-
-// === WEBSOCKET INITIALIZATION ===
-const server = app.listen(PORT, () => {
-  logger.info(`🌟 Turning Wheel Backend Server running on port ${PORT}`);
-  logger.info(`📍 Environment: ${NODE_ENV}`);
-  logger.info(`🔒 Security: E2E encryption enabled`);
-  logger.info(`🌀 Mystical API: Ready for spiritual journeys`);
-});
-
-// Setup WebSocket for real-time features
-setupWebSocket(server);
-
-// === ERROR HANDLING ===
-
-// 404 handler
-app.use('*', (req, res) => {
-  logger.warn(`404 - Route not found: ${req.method} ${req.originalUrl}`);
-  res.status(404).json({
-    success: false,
-    error: 'Route not found',
-    message: `The path ${req.originalUrl} does not exist on this server`
-  });
-});
-
-// Global error handler (must be last)
-app.use(errorHandler);
-
-// === GRACEFUL SHUTDOWN ===
-
-process.on('SIGTERM', gracefulShutdown);
-process.on('SIGINT', gracefulShutdown);
-
-/**
- * Initiates a graceful shutdown of the server upon receiving a signal.
- *
- * The function logs the received signal and attempts to close the HTTP server.
- * It then proceeds to close database and Redis connections, logging each step.
- * If the shutdown process takes longer than 30 seconds, it forcefully exits the process.
- * In case of any errors during the shutdown, it logs the error and exits with a failure status.
- *
- * @param {string} signal - The signal that triggered the shutdown process.
- */
-function gracefulShutdown(signal) {
-  logger.info(`Received ${signal}. Starting graceful shutdown...`);
-
-  server.close(async () => {
-    logger.info('HTTP server closed.');
-
-    try {
-      // Close database connections
-      await closeDatabase();
-      logger.info('Database connections closed.');
-
-      // Close Redis connection
-      await closeRedis();
-      logger.info('Redis connection closed.');
-
-      logger.info('Graceful shutdown completed.');
-      process.exit(0);
-    } catch (error) {
-      logger.error('Error during shutdown:', error);
-      process.exit(1);
-    }
-  });
-
-  // Force close after 30 seconds
-  setTimeout(() => {
-    logger.error('Could not close connections in time, forcefully shutting down');
-    process.exit(1);
-  }, 30000);
-}
-
-// === HELPER FUNCTIONS ===
-
-/**
- * Retrieves the stages of the wheel, typically from a database.
- */
-function getWheelStages() {
-  // This would typically come from database
-  return [
+  req.id = crypto.randomUUID()
+  req.timestamp = new Date().toISOString()
+  res.setHeader('X-Request-ID', req.id)
+  next()
+})
+
+app.get('/api/wheel/stages', async (_req, res) => {
+  const stages = [
     {
       id: 1,
-      title: "Creative Remembering",
-      symbol: "🌱",
-      essence: "The seeds of the past are unearthed, not as static relics, but as living fragments ready to be reimagined.",
-      meaning: "Our histories are fertile soil — the fragments we carry forward become the foundation for new growth.",
-      action: "Hold a small stone or seed and name aloud one memory you wish to carry forward.",
-      chant: "In the deep hum of time, I awaken what was —\\nCreative Remembering, the seeds unbroken."
-    },
-    // ... other stages would be loaded from database
-  ];
-}
-
-/**
- * Records the progress data for a user.
- */
-function recordProgress(progressData) {
-  // This would save to database
-  logger.info(`Recording progress for user ${progressData.userId}, stage ${progressData.stageId}`);
-  return progressData;
-}
-
-/** Encrypts insights using AES-GCM encryption. */
-function encryptInsights(insights) {
-  // This would use AES-GCM encryption
-  return insights; // Placeholder
-}
-
-/**
- * Closes database connections.
- */
-async function closeDatabase() {
-  // Close database connections
-}
-
-/**
- * Closes Redis connections.
- */
-async function closeRedis() {
-  // Close Redis connections
-}
-
-// Export for testing
-export default app;
+      title: 'Creative Remembering',
+      symbol: '🌱'
+    }
+  ]
+  res.json({
+    success: true,
+    data: stages,
+    timestamp: new Date().toISOString()
+  })
+})
+
+const PORT = process.env.PORT || 4200
+app.listen(PORT, () => {
+  process.stdout.write('Server running on port ' + PORT + '\n')
+})
+
+export default app
diff --git a/deno.json b/deno.json
new file mode 100644
index 0000000..32345d3
--- /dev/null
+++ b/deno.json
@@ -0,0 +1,8 @@
+{
+  "exclude": ["next-app", "artifacts", "docs", "frontend", "governance_artifacts"],
+  "lint": {
+    "rules": {
+      "exclude": ["no-unused-vars", "prefer-const", "no-undef"]
+    }
+  }
+}
diff --git a/docs/SENTINEL_ENGINEERING_ROADMAP_V2.4.md b/docs/SENTINEL_ENGINEERING_ROADMAP_V2.4.md
new file mode 100644
index 0000000..8332dd1
--- /dev/null
+++ b/docs/SENTINEL_ENGINEERING_ROADMAP_V2.4.md
@@ -0,0 +1,113 @@
+# Sentinel AI Governance Engineering Roadmap & Technical Plan (2026–2035)
+
+**Target Audience**: Senior Engineering Leadership, AI Safety Officers, Regulatory Auditors
+**Version**: 2.4.0 (Aligned with G-SIFI Roadmap)
+
+## 1. Feature Prioritization & UX Architecture
+High-density, expert-centric React 19 dashboard utilizing a "Cockpit" design pattern for high-frequency intervention.
+
+### Phase 1: Operational Foundation (Q3 2026)
+- **WORM Audit Logging**: Immutable append-only fabric using Kafka and S3 Object Lock.
+- **RBAC Enforcement**: Fine-grained access control via OPA/Rego sidecars.
+- **Hardware Attestation UI**: Real-time vTPM/TEE status indicators (PCR_MATCH=TRUE).
+- **Cognitive Attestation Gates**: Multi-step verification for high-risk model deployments.
+
+### Phase 2: Intelligence & Visualization (Q1 2027)
+- **AI-Driven Workflow Recommendation Engine**: Gemini-powered routing for optimal compliance workflows.
+- **Global Variable Map**: D3.js visualization of cross-agent dependencies and causal lineage.
+- **ComplianceDashboard v1**: Recharts-based telemetry for EU AI Act and NIST AI RMF.
+- **Web Speech API Integration**: Hands-free audit querying and voice-driven emergency overrides.
+
+### Phase 3: Assurance & Simulation (Q4 2027)
+- **EAIP Simulator Tooling**: Virtual sandbox for testing Agent Interoperability Protocol (EAIP) mesh stability.
+- **ZK-Proof Auditing (Groth16/SnarkJS)**: Generating privacy-preserving proofs for regulatory submission.
+- **PDF-Exported Reports**: Cryptographically signed evidence bundles (Annex IV / OSCAL).
+- **Global Variable Map Enhancements**: Real-time prompt injection detection and drift propagation mapping.
+
+### Phase 4: AGI/ASI Resilience (2028+)
+- **Global Kill-Switch Workflows**: "OmegaActual" decentralized multi-sig intervention protocols.
+- **Existential Risk Simulation**: Modeling catastrophic misalignment scenarios and mitigation effectiveness.
+- **Autonomous Compliance Router (ACR)**: Self-healing governance mesh for agentic systems.
+
+## 2. Compliance & Risk Monitoring (OSCAL Framework)
+Standardized mapping to global regulatory regimes using **OSCAL 1.1.2** for machine-readable compliance.
+- **EU AI Act**: High-risk system logging, risk management system (RMS) tracking.
+- **DORA / GDPR**: Resiliency monitoring and data sovereignty gates.
+- **NIST AI RMF / ISO 42001**: Mapping technical controls to organizational risk appetites.
+- **Export Capabilities**: Dynamic OSCAL/YAML generation for regulator-ready submissions.
+
+## 3. Cryptographic & Privacy Stack
+Implementing a multi-layered defense for audit integrity and institutional privacy.
+
+### PQC-WORM Audit Plane
+- **Integrity**: Audit events are hashed and signed using ML-DSA-65 (NIST FIPS 204) before being committed to an
+  S3 Object Lock bucket.
+- **Audit Traceability**: Hybrid signatures (ML-DSA + CRYSTALS-Dilithium) ensure long-term evidence durability
+  against post-quantum adversaries.
+- **Immutable Log Exports**: Cryptographically signed report exports (PDF/OSCAL) with embedded ML-DSA signatures.
+
+### Zero-Knowledge Compliance (zk-SNARKs & zk-STARKs)
+- **Groth16 Efficiency**: Primary ZK-circuit for real-time compliance attestations (e.g., verifying model
+  training data sanitization).
+- **Circom Toolchain**: Use SnarkJS/Circom for circuit design and proof generation in the browser/FastAPI sidecars.
+- **zk-STARK Migration**: High-throughput systemic risk reporting using zk-STARKs for trustless, transparent
+  scalability.
+
+### Confidential Computing & TEE Attestation
+- **Runtime Protection**: Sensitive governance logic (e.g., SARA alignment routing) executes within AMD SEV-SNP
+  or Intel TDX enclaves.
+- **Remote Attestation**: The Dashboard verifies the vTPM PCR (Platform Configuration Register) state of all
+  connected cockpit agents (PCR_MATCH=TRUE).
+- **Data Protection**: All telemetry and audit logs are encrypted using keys managed within the HSM-backed enclave.
+
+## 4. Policy Management & Formal Verification
+- **EAIP Policy Engine**: OPA (Rego) used for runtime permissioning and message filtering.
+- **TLA+ Specification Export**: Exporting operational policies to TLA+ for formal verification of safety properties.
+- **SARA (Self-correction Agent)**: Real-time alignment routing based on resonance metrics ($C_{res} \ge 0.85$).
+
+## 5. AGI/ASI Governance & Systemic Risk
+Ensuring alignment and containment for frontier models through multi-layered systemic risk controls.
+
+### AI Safety Council & Governance Roles
+- **Council Charter**: Define multi-sig approval chains for frontier model training and deployment ($> 10^{26}$ FLOPs).
+- **Digital Governance Roles**: AI Safety Officer (ASO), Lead Ethics Auditor, Systemic Risk Quant, and
+  Independent Third-Party Watchdog.
+- **Governance Enclaves**: Execution of high-impact decisions (e.g., model release) requires cryptographic
+  signatures generated within TEE enclaves.
+
+### Existential Risk Scenarios & Mitigations
+- **Emergent Autonomy Detection**: Real-time monitoring for non-sanctioned agent recursive self-improvement using
+  routing entropy ($H_{sh}$) and ingress token density ($H_{token}$).
+- **Misalignment & Reward Hacking**: Continuous resonance monitoring ($C_{res}$) against baseline constitutional
+  values; automated throttling if alignment drops below 0.85.
+- **Hardware-Rooted Kill-Switches**: Network-level containment and "OmegaActual" hardware kill-switches integrated
+  with AMD SEV-SNP/Intel TDX attestation.
+
+### Alignment & Stability Strategies
+- **StaR-MoE Stabilization**: SARA (Self-correction & Alignment Routing Agent) for real-time stabilization
+  of MoE routing layers.
+- **Constitutional Guardrails**: Immutable OPA/Rego policies governing cross-agent interactions and model outputs.
+- **Zero-Knowledge Systemic Risk Proofs**: Groth16-based ZK proofs for G-SRI reporting, enabling regulatory
+  oversight without institutional data leakage.
+- **International Frameworks**: SIP v3.0 telemetry sharing for collective defense within the Global
+  Intelligence Enforcement Network (GIEN).
+
+## 6. Technical Report Plan (Proposed Structure)
+A formal technical report to accompany the dashboard rollout for board-level and regulator review.
+1. **Executive Summary**: Vision for G-SIFI AI safety and governance maturity.
+2. **Architecture Deep-Dive**: React 19 Frontend, FastAPI Backend, and TEE/vTPM Execution Plane.
+3. **Assurance Methodology**: Formal verification (TLA+), ZK-proof generation, and WORM integrity analysis.
+4. **Regulatory Crosswalk**: Detailed mapping of technical controls to EU AI Act, DORA, and NIST.
+5. **Systemic Risk Evaluation**: Results from "Red Dawn" chaos engineering and drift simulation.
+6. **Future Outlook**: AGI/ASI containment roadmap and international interoperability (SIP v3.0).
+
+## 7. Suggested Technical Stack
+| Tier | Choice | Justification |
+| :--- | :--- | :--- |
+| **Frontend** | React 19 / Next.js | Server Components, strict concurrency, and SSR for audit trails. |
+| **UI Components** | Radix UI + Tailwind | Unstyled primitives for maximum accessibility/WAI-ARIA compliance. |
+| **Visualization** | D3.js & Recharts | D3 for topological variable maps; Recharts for time-series telemetry. |
+| **Backend** | FastAPI (Python) | High-performance, native support for AI/ML validation libraries. |
+| **Policy** | OPA (Rego) | Industry standard for cloud-native compliance-as-code. |
+| **Verification** | TLA+ | Formal proof of containment and protocol safety. |
+| **Enclaves** | Intel TDX / SEV-SNP | Hardware-rooted Execution Plane. |
diff --git a/docs/decadal-roadmap-2035.md b/docs/decadal-roadmap-2035.md
new file mode 100644
index 0000000..1ba69fa
--- /dev/null
+++ b/docs/decadal-roadmap-2035.md
@@ -0,0 +1,109 @@
+# Sentinel AI Governance Dashboard & Omni-Sentinel Cockpit: Implementation roadmap & Technical Report Plan (2026–2035)
+
+**Version**: 1.2.0
+**Last Updated**: 2026-06-15
+**Owner**: AI Governance Platform Engineering
+**Status**: Approved
+
+## 1. Executive Summary
+The **Sentinel AI Governance Dashboard** and **Omni-Sentinel Governance Cockpit** serve as the dual-
+mode command-and-control interface for G-SIFIs. The Dashboard provides high-level executive and
+regulatory visibility, while the Cockpit offers real-time operational intervention (Kill-Switches,
+Drift Mitigation) for AGI/ASI ecosystems. This roadmap integrates hardware-rooted safety, Gemini-
+driven intelligence, and OSCAL 1.1.2 compliance-as-code.
+
+---
+
+## 2. Technical Stack Recommendation (React-Centric)
+
+### Frontend (High-Assurance UI)
+- **Framework**: React 19+ with Next.js (App Router) for SSR/ISR.
+- **Service Workers**: Workbox-powered **Offline-Ready Service Workers** for critical cockpit
+functionality during network partition.
+- **Component Library**: Radix UI + Tailwind CSS (AIGOV-05 compliant accessibility).
+- **State Management**: TanStack Query + Zustand (with persistence for offline state).
+- **Visualization**: **Recharts** (high-frequency telemetry) + **D3.js** (Global Variable Map,
+causal lineage, and topological MoE maps).
+- **Accessibility**: Web Speech API for voice-driven audit queries; **PDF/UA** compliance for exported reports.
+
+### Backend & Governance Plane
+- **Primary API**: FastAPI (Python) with **Gemini API** integration for automated security
+intelligence and threat reasoning.
+- **Policy Engine**: OPA (Rego) + TLA+ runtime monitors.
+- **Audit Storage**: Kafka → S3 Object Lock (PQC-WORM) via `pqc_worm_logger.py`.
+- **Privacy/ZK**: Circom/SnarkJS (Groth16 zk-SNARKs) with a migration path to **zk-STARKs** for
+post-quantum scalability.
+- **Confidential Computing**: TEE enclaves (AMD SEV-SNP, Intel TDX) with vTPM remote attestation.
+
+---
+
+## 3. Phased Implementation Roadmap
+
+### Phase 1: Foundation, WORM Audit & Cockpit Baseline (Q3 2026)
+- **WORM Audit logs**: Immutable evidence chain with ML-DSA-65 signatures.
+- **Omni-Sentinel Cockpit (v1)**: Real-time "Kill-Switch" UI and hardware attestation (`PCR_MATCH=TRUE`).
+- **RBAC Enforcement**: OPA-based identity gates for Auditor/Admin/Operator roles.
+- **Offline-First Scaffolding**: Service worker implementation for core safety controls.
+
+### Phase 2: Intelligence, Compliance & Template Management (Q1 2027)
+- **Gemini Security Intelligence**: LLM-driven reasoning for automated incident classification and threat analysis.
+- **OSCAL 1.1.2 Mapping**: Automated alignment with EU AI Act, DORA, GDPR, and NIST AI RMF via OSCAL catalogs.
+- **Prompt Template Management**: Governed library for enterprise prompt engineering with versioning and safety scoring.
+- **Global Variable Map**: D3.js visualization of cross-agent variable dependencies and prompt injections.
+
+### Phase 3: Assurance, Drift Simulation & ZK-Compliance (Q4 2027)
+- **G-SRI Drift Simulators**: "Red Dawn" chaos engineering tool to simulate systemic risk index drift and verify MTTC.
+- **Zero-Knowledge Proof Auditing**: Groth16 proofs for privacy-preserving regulatory attestations.
+- **Audit Report Factory**: One-click assembly of cryptographically signed, PDF-exported Annex IV dossiers.
+- **EAIP Simulator**: Stress-testing Enterprise AI Agent Interoperability Protocol (EAIP) mesh robustness.
+
+### Phase 4: AGI/ASI Maturity & Autonomous Containment (Q1 2028+)
+- **Global Kill-Switch (OmegaActual)**: Decentralized multi-sig hardware intervention using AMD SEV-SNP.
+- **Council Charter & Safety Roles**: Digital twin of the AI Safety Council oversight logic and ASO workflows.
+- **Existential Risk Scenarios**: Modeling and mitigations for catastrophic misalignment or emergent autonomy.
+- **International Governance Interface**: SIP v3.0 ledger anchoring with ICGC.
+
+---
+
+## 4. Implementation Architecture & Task Breakdown
+
+### I. Governance Cockpit Architecture
+- **Layer 1: The Execution Plane**: Confidential enclaves running Omni-Sentinel sidecars.
+- **Layer 2: The Logic Plane**: OPA/Rego decisions for every inter-agent call (EAIP).
+- **Layer 3: The Interaction Plane**: React 19 dashboard with offline-ready service workers.
+
+### II. Task Breakdown (Detailed)
+
+| Task ID | Component | Description | Phase | Owner |
+| :--- | :--- | :--- | :--- | :--- |
+| GOV-001 | WORM Logic | Integrate `pqc_worm_logger.py` with Kafka event stream. | 1 | Security |
+| GOV-002 | CSP Config | Implement strict nonce-based CSP in Next.js for dashboard security. | 1 | Frontend |
+| GOV-003 | OSCAL Map | Create Rego-to-OSCAL 1.1.2 mapping matrix for EU AI Act. | 2 | Compliance |
+| GOV-004 | Gemini-SI | Deploy FastAPI agent to query Gemini for real-time risk reasoning. | 2 | AI Research |
+| GOV-005 | Drift Sim | Build D3-based G-SRI drift simulation engine. | 3 | Platform |
+| GOV-006 | ZK-Circuit | Develop Circom circuits for "Fairness" and "Privacy" proofs. | 3 | Cryptography |
+
+---
+
+## 5. Technical Report Plan
+
+- **I. Advanced UX Architecture**: Service worker partitioning for offline resilience; D3.js topological mapping.
+- **II. Regulatory Engineering**: OSCAL 1.1.2 catalog structure; mapping OPA rules to ISO 42001.
+- **III. Cryptographic Audit**: WORM plane integrity; Groth16 zk-SNARK vs. zk-STARK performance analysis.
+- **IV. AGI Safety Protocol**: "OmegaActual" TLA+ specification; Alignment Resonance ($C_{res}$) metrics.
+
+---
+
+## 6. Best Practices for High-Assurance AI Governance
+- **Controls-as-Code**: All governance rules must be versioned in Git as Rego/OPA policies.
+- **Verification-First**: High-impact containment protocols must be formally verified using TLA+.
+- **Defense-in-Depth**: Multi-layered containment (Hardware -> Logic -> Interaction).
+- **Transparency-by-Design**: Automated ZK-proof generation for third-party auditing without data leakage.
+
+---
+
+## 7. Definitions & Systemic Thresholds
+- **Alignment Resonance ($C_{res}$)**: ≥ 0.85
+- **Shannon Routing Entropy ($H_{sh}$)**: ≥ 2.5
+- **G-SRI (Global Systemic Risk Index)**: Alerts at > 85.0
+- **OSCAL (NIST 800-53)**: Open Security Controls Assessment Language (v1.1.2).
diff --git a/docs/roadmap.md b/docs/roadmap.md
new file mode 100644
index 0000000..bbb51b4
--- /dev/null
+++ b/docs/roadmap.md
@@ -0,0 +1,28 @@
+# Sentinel AI Governance Dashboard Roadmap (2026-2035)
+
+**Version**: 1.2.0
+**Last Updated**: 2026-06-15
+**Owner**: AI Governance Platform Engineering
+**Status**: Approved
+
+Implementation phases for the Sentinel AI Governance Dashboard and Omni-Sentinel Cockpit. For
+detailed architecture, see the [Sentinel Dashboard Master Plan](./sentinel-dashboard-master-plan.md).
+
+## Phase 1: Foundation (Q3 2026)
+- **Focus**: Immutable evidence, access control, and cockpit baseline.
+- **Key Features**: WORM Audit Logs, RBAC (OPA), Hardware Attestation, Offline-Ready Service Workers.
+
+## Phase 2: Intelligence & Compliance (Q1 2027)
+- **Focus**: Gemini-driven security reasoning and regulatory mapping.
+- **Key Features**: Gemini Security Intelligence, OSCAL 1.1.2 Mapping, Prompt Template Management, Global Variable Map.
+
+## Phase 3: Assurance & Simulation (Q4 2027)
+- **Focus**: Proactive drift simulation and privacy-preserving audit.
+- **Key Features**: G-SRI Drift Simulators, zk-SNARK (Groth16) Proofs, Audit Report Generation, EAIP Simulator.
+
+## Phase 4: AGI/ASI Maturity (Q1 2028+)
+- **Focus**: Global systemic risk and autonomous containment.
+- **Key Features**: Global Kill-Switch (OmegaActual), Council Charter Workflows, International Governance Interface.
+
+---
+*Note: Aligned with G-SIFI prudential oversight and Sentinel AI Governance Stack v2.4.*
diff --git a/docs/sentinel-dashboard-master-plan.md b/docs/sentinel-dashboard-master-plan.md
new file mode 100644
index 0000000..1ba69fa
--- /dev/null
+++ b/docs/sentinel-dashboard-master-plan.md
@@ -0,0 +1,109 @@
+# Sentinel AI Governance Dashboard & Omni-Sentinel Cockpit: Implementation roadmap & Technical Report Plan (2026–2035)
+
+**Version**: 1.2.0
+**Last Updated**: 2026-06-15
+**Owner**: AI Governance Platform Engineering
+**Status**: Approved
+
+## 1. Executive Summary
+The **Sentinel AI Governance Dashboard** and **Omni-Sentinel Governance Cockpit** serve as the dual-
+mode command-and-control interface for G-SIFIs. The Dashboard provides high-level executive and
+regulatory visibility, while the Cockpit offers real-time operational intervention (Kill-Switches,
+Drift Mitigation) for AGI/ASI ecosystems. This roadmap integrates hardware-rooted safety, Gemini-
+driven intelligence, and OSCAL 1.1.2 compliance-as-code.
+
+---
+
+## 2. Technical Stack Recommendation (React-Centric)
+
+### Frontend (High-Assurance UI)
+- **Framework**: React 19+ with Next.js (App Router) for SSR/ISR.
+- **Service Workers**: Workbox-powered **Offline-Ready Service Workers** for critical cockpit
+functionality during network partition.
+- **Component Library**: Radix UI + Tailwind CSS (AIGOV-05 compliant accessibility).
+- **State Management**: TanStack Query + Zustand (with persistence for offline state).
+- **Visualization**: **Recharts** (high-frequency telemetry) + **D3.js** (Global Variable Map,
+causal lineage, and topological MoE maps).
+- **Accessibility**: Web Speech API for voice-driven audit queries; **PDF/UA** compliance for exported reports.
+
+### Backend & Governance Plane
+- **Primary API**: FastAPI (Python) with **Gemini API** integration for automated security
+intelligence and threat reasoning.
+- **Policy Engine**: OPA (Rego) + TLA+ runtime monitors.
+- **Audit Storage**: Kafka → S3 Object Lock (PQC-WORM) via `pqc_worm_logger.py`.
+- **Privacy/ZK**: Circom/SnarkJS (Groth16 zk-SNARKs) with a migration path to **zk-STARKs** for
+post-quantum scalability.
+- **Confidential Computing**: TEE enclaves (AMD SEV-SNP, Intel TDX) with vTPM remote attestation.
+
+---
+
+## 3. Phased Implementation Roadmap
+
+### Phase 1: Foundation, WORM Audit & Cockpit Baseline (Q3 2026)
+- **WORM Audit logs**: Immutable evidence chain with ML-DSA-65 signatures.
+- **Omni-Sentinel Cockpit (v1)**: Real-time "Kill-Switch" UI and hardware attestation (`PCR_MATCH=TRUE`).
+- **RBAC Enforcement**: OPA-based identity gates for Auditor/Admin/Operator roles.
+- **Offline-First Scaffolding**: Service worker implementation for core safety controls.
+
+### Phase 2: Intelligence, Compliance & Template Management (Q1 2027)
+- **Gemini Security Intelligence**: LLM-driven reasoning for automated incident classification and threat analysis.
+- **OSCAL 1.1.2 Mapping**: Automated alignment with EU AI Act, DORA, GDPR, and NIST AI RMF via OSCAL catalogs.
+- **Prompt Template Management**: Governed library for enterprise prompt engineering with versioning and safety scoring.
+- **Global Variable Map**: D3.js visualization of cross-agent variable dependencies and prompt injections.
+
+### Phase 3: Assurance, Drift Simulation & ZK-Compliance (Q4 2027)
+- **G-SRI Drift Simulators**: "Red Dawn" chaos engineering tool to simulate systemic risk index drift and verify MTTC.
+- **Zero-Knowledge Proof Auditing**: Groth16 proofs for privacy-preserving regulatory attestations.
+- **Audit Report Factory**: One-click assembly of cryptographically signed, PDF-exported Annex IV dossiers.
+- **EAIP Simulator**: Stress-testing Enterprise AI Agent Interoperability Protocol (EAIP) mesh robustness.
+
+### Phase 4: AGI/ASI Maturity & Autonomous Containment (Q1 2028+)
+- **Global Kill-Switch (OmegaActual)**: Decentralized multi-sig hardware intervention using AMD SEV-SNP.
+- **Council Charter & Safety Roles**: Digital twin of the AI Safety Council oversight logic and ASO workflows.
+- **Existential Risk Scenarios**: Modeling and mitigations for catastrophic misalignment or emergent autonomy.
+- **International Governance Interface**: SIP v3.0 ledger anchoring with ICGC.
+
+---
+
+## 4. Implementation Architecture & Task Breakdown
+
+### I. Governance Cockpit Architecture
+- **Layer 1: The Execution Plane**: Confidential enclaves running Omni-Sentinel sidecars.
+- **Layer 2: The Logic Plane**: OPA/Rego decisions for every inter-agent call (EAIP).
+- **Layer 3: The Interaction Plane**: React 19 dashboard with offline-ready service workers.
+
+### II. Task Breakdown (Detailed)
+
+| Task ID | Component | Description | Phase | Owner |
+| :--- | :--- | :--- | :--- | :--- |
+| GOV-001 | WORM Logic | Integrate `pqc_worm_logger.py` with Kafka event stream. | 1 | Security |
+| GOV-002 | CSP Config | Implement strict nonce-based CSP in Next.js for dashboard security. | 1 | Frontend |
+| GOV-003 | OSCAL Map | Create Rego-to-OSCAL 1.1.2 mapping matrix for EU AI Act. | 2 | Compliance |
+| GOV-004 | Gemini-SI | Deploy FastAPI agent to query Gemini for real-time risk reasoning. | 2 | AI Research |
+| GOV-005 | Drift Sim | Build D3-based G-SRI drift simulation engine. | 3 | Platform |
+| GOV-006 | ZK-Circuit | Develop Circom circuits for "Fairness" and "Privacy" proofs. | 3 | Cryptography |
+
+---
+
+## 5. Technical Report Plan
+
+- **I. Advanced UX Architecture**: Service worker partitioning for offline resilience; D3.js topological mapping.
+- **II. Regulatory Engineering**: OSCAL 1.1.2 catalog structure; mapping OPA rules to ISO 42001.
+- **III. Cryptographic Audit**: WORM plane integrity; Groth16 zk-SNARK vs. zk-STARK performance analysis.
+- **IV. AGI Safety Protocol**: "OmegaActual" TLA+ specification; Alignment Resonance ($C_{res}$) metrics.
+
+---
+
+## 6. Best Practices for High-Assurance AI Governance
+- **Controls-as-Code**: All governance rules must be versioned in Git as Rego/OPA policies.
+- **Verification-First**: High-impact containment protocols must be formally verified using TLA+.
+- **Defense-in-Depth**: Multi-layered containment (Hardware -> Logic -> Interaction).
+- **Transparency-by-Design**: Automated ZK-proof generation for third-party auditing without data leakage.
+
+---
+
+## 7. Definitions & Systemic Thresholds
+- **Alignment Resonance ($C_{res}$)**: ≥ 0.85
+- **Shannon Routing Entropy ($H_{sh}$)**: ≥ 2.5
+- **G-SRI (Global Systemic Risk Index)**: Alerts at > 85.0
+- **OSCAL (NIST 800-53)**: Open Security Controls Assessment Language (v1.1.2).
diff --git a/netlify.toml b/netlify.toml
index abaec00..e9bc730 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -2,19 +2,3 @@
   base = "next-app"
   command = "npm install && npm run build"
   publish = ".next"
-
-[[headers]]
-  for = "/*"
-  [headers.values]
-    Cross-Origin-Opener-Policy = "same-origin"
-    Cross-Origin-Embedder-Policy = "require-corp"
-
-[[redirects]]
-  from = "/api/*"
-  to = "/api/:splat"
-  status = 200
-
-[[redirects]]
-  from = "/*"
-  to = "/index.html"
-  status = 200