Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

tasks/reconcile-dashboard-spec/IMPLEMENTATION.md

@@ -0,0 +1,18 @@
+# Implementation: Reconcile Dashboard Spec with Web Implementation
+
+## Summary
+Updated the dashboard specification and documentation to reflect the actual web-based implementation, and removed the vestigial TUI theme module.
+
+## Files Changed
+- `tasks/dashboard-spec.md` — rewritten for web dashboard
+- `automaton/dashboard/README.md` — removed `q` quit shortcut, updated theme description, removed themes.py/pyproject.toml from architecture diagram
+- `automaton/dashboard/html/index.html` — fixed help modal (`t` = cycle themes, removed `q` quit)
+- `automaton/dashboard/themes.py` — deleted
+
+## Verification
+- `grep -i "terminal\|TUI\|ANSI\|arrow key\|resizable" tasks/dashboard-spec.md` returns no inappropriate matches.
+- `python -m automaton.dashboard` still starts and serves `/`.
+
+## Decisions
+- Web dashboard is canonical; TUI-specific acceptance criteria removed.
+- `themes.py` was a stub for ANSI themes and is no longer needed.

tasks/reconcile-dashboard-spec/REVIEW.md

@@ -0,0 +1,4 @@
+# Review
+- **Status**: approved
+- **Timestamp**: 2026-06-14T09:59:37.715348
+- **Comment**: 

tasks/reconcile-dashboard-spec/SPEC.md

@@ -0,0 +1,25 @@
+# SPEC: Reconcile Dashboard Spec with Web Implementation
+
+## Goal
+Eliminate the mismatch between `tasks/dashboard-spec.md` (which describes a terminal TUI) and the actual web-based dashboard implementation.
+
+## Requirements
+1. Rewrite `tasks/dashboard-spec.md` acceptance criteria to describe the implemented web dashboard.
+2. Update `automaton/dashboard/README.md` help table so shortcuts match the web UI:
+   - `t` cycles themes, not waves.
+   - `q` is documented as browser-only (or removed).
+3. Update `automaton/dashboard/html/index.html` help modal to match the README.
+4. Delete `automaton/dashboard/themes.py` (vestigial ANSI theme stub).
+
+## Acceptance Criteria
+- [ ] `tasks/dashboard-spec.md` contains no TUI-only requirements (ANSI, arrow keys, terminal width, resizable panels).
+- [ ] `README.md` and help modal agree on keyboard shortcuts.
+- [ ] `themes.py` is removed.
+- [ ] `python -m automaton.dashboard` still starts and serves `/` and `/api/tasks`.
+
+## Non-Goals
+- Converting the web dashboard to a TUI.
+- Adding new dashboard features.
+
+## Stop Condition
+When all acceptance criteria are met, output "CONTRACT_MET".

tasks/reconcile-dashboard-spec/VERDICT.md

@@ -0,0 +1,18 @@
+# Verdict: Reconcile Dashboard Spec with Web Implementation
+
+## Status: PASS
+**Completion Date**: 2026-06-14
+
+## Summary
+The dashboard specification now matches the implemented web dashboard. Documentation and help modal shortcuts are consistent, and the unused TUI theme module has been removed.
+
+## Findings
+- `tasks/dashboard-spec.md` rewritten for web dashboard.
+- README and help modal agree on keyboard shortcuts.
+- `themes.py` removed.
+
+## Remaining Issues
+None.
+
+## Score
++10 PASS