Wire LLM failover for the BrainForge Cybersecurity endpoint

- Add HTTP Basic auth support to ImprovedVllmClient via the
Authorization default_header so HANA-style credentials
(guest:HANA_KLATCHAT_PASSWORD) authenticate against the
4090-x1-3 BrainForge/Security vLLM endpoint.
- Have bootstrap load HANA_USERNAME_KLATCHAT / HANA_KLATCHAT_PASSWORD
from ~/.secrets/shared.env when api_username is configured, and opt
cybersecurity_config.yaml in via api_username: "guest".
- Stop provider.py from re-registering personas at module import time
with a raw ImprovedVllmClient, which silently overwrote bootstrap's
ResilientLLMClient wrapping and disabled OpenAI fallback.
switch_provider now reuses bootstrap.create_persona_llm and
create_orchestrator_llm to preserve the wrap.
- Rewrite ResilientLLMClient._race_or_fallback per spec: try primary;
on error run fallback sequentially; on >race_timeout_seconds run
fallback in parallel and return whichever finishes first. Bump
default race_timeout_seconds to 60s.
- Fix OpenAIFallbackClient for gpt-5 / o-series: use
max_completion_tokens and normalize persona-id author roles to
"assistant" so OpenAI accepts the orchestrator context.
- Centralize env loading via app/core/env_loader.py and use it from
main.py + bootstrap so the backend always picks up shared.env.
- Polish header theming + branding (Cybersecurity Advisor), restore
the cybersecurity user-profile UX touches, and drop the chat title
from the floating header.
- Add app/core/_debug_log.py NDJSON logger and runtime probes in
chat / resilient / vLLM / OpenAI clients to keep collecting
evidence until the failover path is verified end-to-end.

Co-authored-by: Cursor <cursoragent@cursor.com>

cybersecurity_config.yaml

@@ -1,5 +1,5 @@
 # ============================================================================
-# Cybersecurity Advisor Canvas — Application Configuration
+# Cybersecurity Advisor — Application Configuration
 # ============================================================================
 
 app:
@@ -25,7 +25,7 @@ homepage:
     Get practical guidance on threats, compliance, incident response, architecture,
     and career growth from a panel of cybersecurity-focused AI advisors — each
     bringing a distinct lens to your questions.
-  features_title: "Why Use Cybersecurity Advisor Canvas?"
+  features_title: "Why Use Cybersecurity Advisor?"
   features:
     - title: "Defense in Depth"
       description: "Receive layered perspectives on risk, controls, detection, and response"
@@ -176,6 +176,7 @@ llm:
   vllm:
     api_url: "https://4090-x1-3.neonaiservices2.com/vllm0"
     api_key: ""
+    api_username: "guest"
     model_id: "BrainForge/Security@2026.03.18"
     neon_persona_orchestrator: "vanilla"
     neon_persona_advisors: "CybersecurityExpert"
@@ -185,7 +186,7 @@ llm:
     orchestrator_reasoning_effort: "low"
     persona_reasoning_effort: "none"
   resilient:
-    race_timeout_seconds: 3
+    race_timeout_seconds: 60
 
 rag:
   embedding_model: "all-MiniLM-L6-v2"

multi_llm_chatbot_backend/app/api/routes/chat.py

@@ -166,15 +166,64 @@ async def chat_stream(
             done_queue: asyncio.Queue = asyncio.Queue()
 
             async def _run(pid: str) -> None:
+                # #region agent log
+                import os as _os
+                from app.core._debug_log import dlog
+                _probe_persona = chat_orchestrator.get_persona(pid)
+                _llm = getattr(_probe_persona, "llm", None) if _probe_persona else None
+                _llm_type = type(_llm).__name__ if _llm is not None else None
+                _primary_type = type(getattr(_llm, "primary", None)).__name__ if _llm is not None else None
+                _fallback_type = type(getattr(_llm, "fallback", None)).__name__ if _llm is not None else None
+                _primary_key = getattr(getattr(_llm, "primary", None), "api_key", None)
+                _primary_username = getattr(getattr(_llm, "primary", None), "api_username", None)
+                _primary_apiurl = getattr(getattr(_llm, "primary", None), "api_url", None)
+                _fallback_key = getattr(getattr(_llm, "fallback", None), "api_key", None)
+                _fallback_model = getattr(getattr(_llm, "fallback", None), "model", None)
+                if not _primary_key and _llm is not None:
+                    _primary_key = getattr(_llm, "api_key", None)
+                _vllm_env = _os.environ.get("VLLM_API_KEY", "")
+                _openai_env = _os.environ.get("OPENAI_API_KEY", "")
+                dlog("chat.py:_run.entry", f"persona task started", {
+                    "pid": pid,
+                    "llm_type": _llm_type,
+                    "primary_type": _primary_type,
+                    "primary_api_url": _primary_apiurl,
+                    "primary_api_username": _primary_username,
+                    "primary_key_prefix": (_primary_key[:8] + "…") if _primary_key else None,
+                    "primary_key_len": len(_primary_key) if _primary_key else 0,
+                    "fallback_type": _fallback_type,
+                    "fallback_model": _fallback_model,
+                    "fallback_key_prefix": (_fallback_key[:8] + "…") if _fallback_key else None,
+                    "fallback_key_len": len(_fallback_key) if _fallback_key else 0,
+                    "env_vllm_prefix": (_vllm_env[:8] + "…") if _vllm_env else None,
+                    "env_vllm_len": len(_vllm_env),
+                    "env_openai_prefix": (_openai_env[:8] + "…") if _openai_env else None,
+                    "env_openai_len": len(_openai_env),
+                }, "F")
+                # #endregion
                 try:
                     persona = chat_orchestrator.get_persona(pid)
                     result = await chat_orchestrator.generate_single_persona_response(
                         session, persona,
                         message.response_length or "medium",
                     )
+                    # #region agent log
+                    dlog("chat.py:_run.result", "persona response", {
+                        "pid": pid,
+                        "response_preview": (result.get("response") or "")[:200],
+                        "used_documents": result.get("used_documents"),
+                    }, "B")
+                    # #endregion
                     session.append_message(pid, result["response"])
                     await done_queue.put(result)
                 except Exception as e:
+                    # #region agent log
+                    dlog("chat.py:_run.exception", "persona task exception", {
+                        "pid": pid,
+                        "exc_type": type(e).__name__,
+                        "exc_msg": str(e)[:500],
+                    }, "B")
+                    # #endregion
                     logger.exception(f"chat-stream _run failed for {pid}: {e}")
                     failed_persona = chat_orchestrator.get_persona(pid)
                     await done_queue.put({

multi_llm_chatbot_backend/app/api/routes/provider.py

@@ -37,11 +37,12 @@ def create_llm_client(provider: str = None):
     else:
         raise ValueError(f"Unknown provider: {provider}")
 
-# Initialize LLM and personas
-llm = create_llm_client(current_provider)
-DEFAULT_PERSONAS = get_default_personas(llm)
-for persona in DEFAULT_PERSONAS:
-    chat_orchestrator.register_persona(persona)
+# NOTE: Personas and `llm` are already created and registered by
+# app/core/bootstrap.py with the correct ResilientLLMClient wrapping
+# (primary vLLM + OpenAI fallback). Re-registering them here at module
+# import time replaces them with a raw vLLM client that lacks the
+# fallback wrapper AND lacks the api_username/api_key wiring, breaking
+# both auth and failover. Bootstrap already handles initial setup.
 
 class ProviderSwitch(BaseModel):
     provider: str
@@ -65,13 +66,19 @@ async def switch_provider(provider_data: ProviderSwitch):
         raise HTTPException(status_code=400, detail=f"Unknown provider: {provider_data.provider}. Available: {available_providers}")
 
     try:
+        from app.core.bootstrap import (
+            create_orchestrator_llm,
+            create_persona_llm,
+        )
+
         current_provider = provider_data.provider
-        new_llm = create_llm_client(current_provider)
+        new_llm = create_orchestrator_llm()
         llm = new_llm
 
         chat_orchestrator.llm_client = new_llm
 
-        new_personas = get_default_personas(new_llm)
+        persona_llm = create_persona_llm()
+        new_personas = get_default_personas(persona_llm)
         chat_orchestrator.personas.clear()
         for persona in new_personas:
             chat_orchestrator.register_persona(persona)

multi_llm_chatbot_backend/app/config.py

@@ -273,6 +273,7 @@ class OllamaConfig(BaseModel):
 class VllmConfig(BaseModel):
     api_url: str = ""
     api_key: str = Field(default=os.getenv("VLLM_API_KEY", ""))
+    api_username: str = Field(default=os.getenv("VLLM_API_USERNAME", ""))
     model_id: str = ""
     neon_persona_orchestrator: str = "vanilla"
     neon_persona_advisors: str = "CybersecurityExpert"

multi_llm_chatbot_backend/app/core/_debug_log.py

@@ -0,0 +1,28 @@
+"""Debug-mode NDJSON logger. Writes to the agent debug log file."""
+from __future__ import annotations
+
+import json
+import time
+from pathlib import Path
+from typing import Any
+
+_LOG_PATH = Path(r"C:\Users\dream\.cursor\projects\Ask-A-Neon-LLM-Demos\debug-1d5c0f.log")
+_SESSION_ID = "1d5c0f"
+
+
+def dlog(location: str, message: str, data: Any = None, hypothesis_id: str = "") -> None:
+    try:
+        entry = {
+            "sessionId": _SESSION_ID,
+            "timestamp": int(time.time() * 1000),
+            "location": location,
+            "message": message,
+            "data": data or {},
+        }
+        if hypothesis_id:
+            entry["hypothesisId"] = hypothesis_id
+        _LOG_PATH.parent.mkdir(parents=True, exist_ok=True)
+        with _LOG_PATH.open("a", encoding="utf-8") as fh:
+            fh.write(json.dumps(entry, default=str) + "\n")
+    except Exception:
+        pass

multi_llm_chatbot_backend/app/core/bootstrap.py

@@ -36,7 +36,35 @@ def _load_shared_env_var(name: str) -> str:
     return ""
 
 
+def _vllm_api_username() -> str:
+    """Optional HTTP Basic auth username for the vLLM endpoint.
+
+    The Neon BrainForge/Security endpoint at 4090-x1-3 requires HTTP Basic
+    auth using HANA_USERNAME_KLATCHAT / HANA_KLATCHAT_PASSWORD from
+    ~/.secrets/shared.env. We allow explicit override via api_username
+    in config or VLLM_API_USERNAME env var, falling back to the shared
+    HANA_USERNAME_KLATCHAT entry.
+    """
+    return (
+        settings.llm.vllm.api_username
+        or os.getenv("VLLM_API_USERNAME", "")
+        or _load_shared_env_var("HANA_USERNAME_KLATCHAT")
+    )
+
+
 def _vllm_api_key() -> str:
+    """vLLM key/password. If api_username is set (HANA Basic auth), prefer
+    HANA_KLATCHAT_PASSWORD; otherwise use the generic VLLM_API_KEY Bearer
+    token. This matches the dual-auth nature of the Neon endpoints.
+    """
+    if _vllm_api_username():
+        return (
+            settings.llm.vllm.api_key
+            or os.getenv("HANA_KLATCHAT_PASSWORD", "")
+            or _load_shared_env_var("HANA_KLATCHAT_PASSWORD")
+            or os.getenv("VLLM_API_KEY", "")
+            or _load_shared_env_var("VLLM_API_KEY")
+        )
     return (
         settings.llm.vllm.api_key
         or os.getenv("VLLM_API_KEY", "")
@@ -62,6 +90,7 @@ def _build_neon_vllm(neon_persona: str | None) -> ImprovedVllmClient:
         api_key=_vllm_api_key(),
         model_name=model_name,
         neon_persona=neon_persona,
+        api_username=_vllm_api_username() or None,
     )
 
 

multi_llm_chatbot_backend/app/llm/improved_vllm_client.py

@@ -1,3 +1,4 @@
+import base64
 import json
 import logging
 from typing import Any, Callable, Dict, List, Optional
@@ -19,17 +20,33 @@ class ImprovedVllmClient(LLMClient):
         model_name: str = None,
         neon_persona: str | None = None,
         model_revision: str | None = None,
+        api_username: str | None = None,
     ):
         self.api_url = api_url
         self.api_key = api_key
+        self.api_username = api_username or None
         self.model_name = model_name
         self.neon_persona = neon_persona
         self.model_revision = model_revision
-        self.client = AsyncOpenAI(
-            base_url=f"{api_url}/v1",
-            api_key=api_key or "not-needed",
-            timeout=90.0,
-        )
+
+        client_kwargs: dict = {
+            "base_url": f"{api_url}/v1",
+            "api_key": api_key or "not-needed",
+            "timeout": 90.0,
+        }
+
+        if self.api_username:
+            # Some Neon endpoints (e.g. BrainForge/Security at 4090-x1-3)
+            # require HTTP Basic auth using HANA-style credentials rather
+            # than the regular Bearer token. The OpenAI SDK injects its own
+            # Authorization: Bearer <api_key> header on every request, so we
+            # override it via default_headers to ensure Basic auth wins.
+            basic = base64.b64encode(
+                f"{self.api_username}:{api_key or ''}".encode("utf-8")
+            ).decode("ascii")
+            client_kwargs["default_headers"] = {"Authorization": f"Basic {basic}"}
+
+        self.client = AsyncOpenAI(**client_kwargs)
         self.context_manager = get_context_manager()
 
     def _resolve_model_revision(self) -> str | None:
@@ -100,16 +117,39 @@ class ImprovedVllmClient(LLMClient):
             text = response.choices[0].message.content.strip()
             return self._clean_response(text)
 
-        except APIConnectionError:
+        except APIConnectionError as e:
+            # #region agent log
+            from app.core._debug_log import dlog
+            dlog("improved_vllm_client.py:generate.conn_err", "vLLM connection error", {
+                "api_url": self.api_url,
+                "exc_msg": str(e)[:300],
+            }, "E")
+            # #endregion
             logger.error(f"Unable to connect to vLLM at {self.api_url}")
             return "I'm unable to connect to the AI service. Please ensure the vLLM endpoint is available."
         except APIStatusError as e:
+            # #region agent log
+            from app.core._debug_log import dlog
+            dlog("improved_vllm_client.py:generate.status_err", "vLLM API status error", {
+                "status_code": getattr(e, "status_code", None),
+                "message": getattr(e, "message", None),
+                "api_url": self.api_url,
+                "model": self.model_name,
+            }, "E")
+            # #endregion
             logger.error(f"vLLM API error: {e.status_code} - {e.message}")
             if e.status_code == 404:
                 logger.info("Model not found, will re-discover on next request")
                 self.model_name = None
             return "The AI service encountered an error. Please try again."
         except Exception as e:
+            # #region agent log
+            from app.core._debug_log import dlog
+            dlog("improved_vllm_client.py:generate.unexpected", "vLLM unexpected error", {
+                "exc_type": type(e).__name__,
+                "exc_msg": str(e)[:500],
+            }, "E")
+            # #endregion
             logger.error(f"Unexpected error in vLLM client: {str(e)}")
             return "I encountered an unexpected error. Please try again."
 

multi_llm_chatbot_backend/app/llm/openai_fallback_client.py

@@ -34,11 +34,36 @@ class OpenAIFallbackClient(LLMClient):
         self.client = AsyncOpenAI(api_key=api_key, timeout=120.0)
         self.context_manager = get_context_manager()
 
+    _ALLOWED_ROLES = {"system", "assistant", "user", "function", "tool", "developer"}
+
     def _reasoning_kwargs(self) -> Dict[str, Any]:
         if not self.reasoning_effort or self.reasoning_effort == "none":
             return {}
         return {"reasoning_effort": self.reasoning_effort}
 
+    def _uses_completion_tokens_param(self) -> bool:
+        """gpt-5+ requires `max_completion_tokens`; older models use `max_tokens`."""
+        m = (self.model or "").lower()
+        return m.startswith("gpt-5") or m.startswith("o1") or m.startswith("o3")
+
+    def _normalize_messages(self, messages: List[dict]) -> List[dict]:
+        """Map persona-id roles (e.g. 'jerry_huaute') to 'assistant' so OpenAI
+        accepts them. Preserve the persona name via the optional 'name' field
+        when possible.
+        """
+        out: List[dict] = []
+        for msg in messages:
+            role = msg.get("role", "user")
+            if role in self._ALLOWED_ROLES:
+                out.append(msg)
+                continue
+            new_msg = dict(msg)
+            new_msg["role"] = "assistant"
+            if "name" not in new_msg and isinstance(role, str):
+                new_msg["name"] = role[:64]
+            out.append(new_msg)
+        return out
+
     async def generate(
         self,
         system_prompt: str,
@@ -52,13 +77,16 @@ class OpenAIFallbackClient(LLMClient):
             system_prompt=system_prompt,
             llm_provider="openai",
         )
+        normalized_messages = self._normalize_messages(context_window.messages)
+        token_kwarg = "max_completion_tokens" if self._uses_completion_tokens_param() else "max_tokens"
         create_kwargs: Dict[str, Any] = dict(
             model=self.model,
-            messages=context_window.messages,
-            temperature=temperature,
-            max_tokens=max_tokens,
+            messages=normalized_messages,
+            **{token_kwarg: max_tokens},
             **self._reasoning_kwargs(),
         )
+        if not self._uses_completion_tokens_param():
+            create_kwargs["temperature"] = temperature
         if response_mime_type == "application/json":
             create_kwargs["response_format"] = {"type": "json_object"}
 
@@ -69,9 +97,26 @@ class OpenAIFallbackClient(LLMClient):
                 raise ValueError("OpenAI returned empty content")
             return self._clean_response(text)
         except (APIConnectionError, APIStatusError) as exc:
+            # #region agent log
+            from app.core._debug_log import dlog
+            dlog("openai_fallback_client.py:generate.api_err", "OpenAI API error", {
+                "exc_type": type(exc).__name__,
+                "status_code": getattr(exc, "status_code", None),
+                "model": self.model,
+                "exc_msg": str(exc)[:500],
+            }, "B")
+            # #endregion
             logger.error("OpenAI API error: %s", exc)
             raise
         except Exception as exc:
+            # #region agent log
+            from app.core._debug_log import dlog
+            dlog("openai_fallback_client.py:generate.unexpected", "OpenAI generate failed", {
+                "exc_type": type(exc).__name__,
+                "model": self.model,
+                "exc_msg": str(exc)[:500],
+            }, "B")
+            # #endregion
             logger.error("OpenAI generate failed: %s", exc)
             raise
 
@@ -95,14 +140,17 @@ class OpenAIFallbackClient(LLMClient):
 
         try:
             for _round in range(self._MAX_TOOL_ROUNDS):
-                response = await self.client.chat.completions.create(
+                token_kwarg = "max_completion_tokens" if self._uses_completion_tokens_param() else "max_tokens"
+                tool_kwargs: Dict[str, Any] = dict(
                     model=self.model,
-                    messages=messages,
+                    messages=self._normalize_messages(messages),
                     tools=openai_tools or None,
-                    temperature=temperature,
-                    max_tokens=max_tokens,
+                    **{token_kwarg: max_tokens},
                     **self._reasoning_kwargs(),
                 )
+                if not self._uses_completion_tokens_param():
+                    tool_kwargs["temperature"] = temperature
+                response = await self.client.chat.completions.create(**tool_kwargs)
                 choice = response.choices[0].message
                 if not choice.tool_calls:
                     text = choice.content or ""

multi_llm_chatbot_backend/app/llm/resilient_client.py

@@ -41,6 +41,15 @@ class ResilientLLMClient(LLMClient):
 
     async def _run_primary(self, coro_factory):
         result = await coro_factory(self.primary)
+        # #region agent log
+        from app.core._debug_log import dlog
+        preview = (result if isinstance(result, str) else getattr(result, "text", ""))[:200]
+        dlog("resilient_client.py:_run_primary", "primary returned", {
+            "label": self.primary_label,
+            "result_type": type(result).__name__,
+            "preview": preview,
+        }, "E")
+        # #endregion
         if isinstance(result, str) and _looks_like_failed_response(result):
             raise RuntimeError(f"{self.primary_label} returned failure text")
         if isinstance(result, ToolCallResult) and _looks_like_failed_response(result.text):
@@ -49,49 +58,152 @@ class ResilientLLMClient(LLMClient):
 
     async def _run_fallback(self, coro_factory):
         logger.info("Using fallback LLM for %s", self.primary_label)
-        return await coro_factory(self.fallback)
+        # #region agent log
+        from app.core._debug_log import dlog
+        dlog("resilient_client.py:_run_fallback.start", "invoking fallback", {
+            "label": self.primary_label,
+        }, "B")
+        # #endregion
+        try:
+            result = await coro_factory(self.fallback)
+            # #region agent log
+            preview = (result if isinstance(result, str) else getattr(result, "text", ""))[:200]
+            dlog("resilient_client.py:_run_fallback.ok", "fallback returned", {
+                "label": self.primary_label,
+                "preview": preview,
+            }, "B")
+            # #endregion
+            return result
+        except Exception as fe:
+            # #region agent log
+            dlog("resilient_client.py:_run_fallback.error", "fallback raised", {
+                "label": self.primary_label,
+                "exc_type": type(fe).__name__,
+                "exc_msg": str(fe)[:500],
+            }, "B")
+            # #endregion
+            raise
 
     async def _race_or_fallback(self, coro_factory):
+        """Spec:
+        - Start *primary* immediately.
+        - If primary returns successfully → use it.
+        - If primary fails (raises, returns recognised failure text) → run
+          *fallback* sequentially and return its result.
+        - If primary takes longer than ``race_timeout_seconds`` without
+          completing → start *fallback* in parallel and return whichever
+          finishes first (primary or fallback).
+        """
+        # #region agent log
+        from app.core._debug_log import dlog
+        dlog("resilient_client.py:_race_or_fallback.enter", "starting primary", {
+            "label": self.primary_label,
+            "timeout_s": self.race_timeout_seconds,
+        }, "B")
+        # #endregion
+
         primary_task = asyncio.create_task(self._run_primary(coro_factory))
+
         try:
-            return await asyncio.wait_for(
+            result = await asyncio.wait_for(
                 asyncio.shield(primary_task),
                 timeout=self.race_timeout_seconds,
             )
+            # #region agent log
+            preview = (result if isinstance(result, str) else getattr(result, "text", ""))[:200]
+            dlog("resilient_client.py:_race_or_fallback.primary_ok", "primary succeeded", {
+                "label": self.primary_label,
+                "preview": preview,
+            }, "B")
+            # #endregion
+            return result
         except asyncio.TimeoutError:
             logger.info(
-                "%s exceeded %.1fs — racing fallback",
+                "%s slower than %.1fs — racing fallback in parallel",
                 self.primary_label,
                 self.race_timeout_seconds,
             )
+            # #region agent log
+            dlog("resilient_client.py:_race_or_fallback.timeout_race", "racing fallback in parallel", {
+                "label": self.primary_label,
+                "timeout_s": self.race_timeout_seconds,
+            }, "B")
+            # #endregion
+            return await self._race_first_successful(primary_task, coro_factory)
         except Exception as exc:
-            logger.warning("%s failed: %s — using fallback", self.primary_label, exc)
+            logger.warning("%s failed: %s — using fallback sequentially", self.primary_label, exc)
+            # #region agent log
+            dlog("resilient_client.py:_race_or_fallback.primary_fail", "primary raised", {
+                "label": self.primary_label,
+                "exc_type": type(exc).__name__,
+                "exc_msg": str(exc)[:500],
+            }, "B")
+            # #endregion
             if not primary_task.done():
                 primary_task.cancel()
-            return await self._run_fallback(coro_factory)
-
-        if primary_task.done():
-            try:
-                return primary_task.result()
-            except Exception as exc:
-                logger.warning("%s failed after wait: %s", self.primary_label, exc)
-                return await self._run_fallback(coro_factory)
 
+        try:
+            return await self._run_fallback(coro_factory)
+        except Exception as fb_exc:
+            logger.error(
+                "Both primary (%s) and fallback failed for this request: %s",
+                self.primary_label, fb_exc,
+            )
+            raise
+
+    async def _race_first_successful(self, primary_task: asyncio.Task, coro_factory):
+        """Primary is still running past the soft timeout. Start fallback in
+        parallel and return whichever completes successfully first. If the
+        first one to complete failed, await the other; if both fail, raise.
+        """
+        # #region agent log
+        from app.core._debug_log import dlog
+        # #endregion
         fallback_task = asyncio.create_task(self._run_fallback(coro_factory))
-        done, pending = await asyncio.wait(
-            {primary_task, fallback_task},
-            return_when=asyncio.FIRST_COMPLETED,
-        )
-        for task in pending:
-            task.cancel()
-        for task in done:
-            if task.cancelled():
-                continue
-            try:
-                return task.result()
-            except Exception as exc:
-                logger.warning("Race winner failed: %s", exc)
-        return await self._run_fallback(coro_factory)
+        pending = {primary_task, fallback_task}
+
+        winner_text: str | None = None
+        winner_obj: Any = None
+        last_exc: Exception | None = None
+
+        while pending:
+            done, pending = await asyncio.wait(pending, return_when=asyncio.FIRST_COMPLETED)
+            for task in done:
+                which = "primary" if task is primary_task else "fallback"
+                try:
+                    result = task.result()
+                except Exception as exc:
+                    last_exc = exc
+                    # #region agent log
+                    dlog("resilient_client.py:_race_first_successful.loser", "task failed", {
+                        "which": which,
+                        "exc_type": type(exc).__name__,
+                        "exc_msg": str(exc)[:300],
+                    }, "B")
+                    # #endregion
+                    continue
+                # #region agent log
+                preview = (result if isinstance(result, str) else getattr(result, "text", ""))[:200]
+                dlog("resilient_client.py:_race_first_successful.winner", "task succeeded", {
+                    "which": which,
+                    "preview": preview,
+                }, "B")
+                # #endregion
+                winner_obj = result
+                winner_text = preview
+                break
+            if winner_obj is not None:
+                break
+
+        for t in pending:
+            if not t.done():
+                t.cancel()
+
+        if winner_obj is not None:
+            return winner_obj
+        if last_exc is not None:
+            raise last_exc
+        raise RuntimeError("race produced no result and no exception")
 
     async def generate(
         self,

phd-advisor-frontend/public/index.html

@@ -7,7 +7,7 @@
     <meta name="theme-color" content="#000000" />
     <meta
       name="description"
-      content="AI Advisor Panel — AI-Powered Guidance from Multiple Experts"
+      content="Cybersecurity Advisor — AI-powered security guidance from expert advisors"
     />
     <link rel="apple-touch-icon" href="%PUBLIC_URL%/logo192.png" />
     <!--
@@ -24,7 +24,7 @@
       work correctly both with client-side routing and a non-root public URL.
       Learn how to configure a non-root public URL by running `npm run build`.
     -->
-    <title>React App</title>
+    <title>Cybersecurity Advisor</title>
   </head>
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>

phd-advisor-frontend/public/manifest.json

@@ -1,6 +1,6 @@
 {
-  "short_name": "AI Advisor Panel",
-  "name": "Neon AI Panel of Experts",
+  "short_name": "Cybersecurity Advisor",
+  "name": "Cybersecurity Advisor",
   "icons": [
     {
       "src": "favicon.ico",

phd-advisor-frontend/src/data/userGuide.js

@@ -1,4 +1,4 @@
-// User Guide content for Cybersecurity Advisor Canvas.
+// User Guide content for Cybersecurity Advisor.
 // Use {{appName}} as a placeholder — replaced at render time.
 
 export const userGuideTopics = [

phd-advisor-frontend/src/styles/CanvasPage.css

@@ -157,23 +157,19 @@
   position: sticky;
   top: 0;
   z-index: 100;
-  background: rgba(31, 41, 55, 0.95);
+  background: var(--header-bg);
   backdrop-filter: blur(20px);
   -webkit-backdrop-filter: blur(20px);
-  border-bottom: 1px solid var(--canvas-border);
+  border-bottom: 1px solid var(--header-border);
   padding: 12px 24px;
   display: grid;
   grid-template-columns: 1fr auto 1fr;
   align-items: center;
   gap: 16px;
-  box-shadow: 0 4px 20px rgba(0, 0, 0, 0.3);
+  box-shadow: var(--header-shadow);
   flex-shrink: 0;
 }
 .canvas-page-with-sidebar .floating-header .header-right { justify-self: end; }
-.canvas-page-with-sidebar[data-canvas-theme="light"] .floating-header {
-  background: rgba(255, 255, 255, 0.95);
-  box-shadow: 0 4px 20px rgba(0, 0, 0, 0.08);
-}
 
 .canvas-page-with-sidebar .header-left {
   display: flex;

phd-advisor-frontend/src/styles/ChatPage.css

@@ -18,23 +18,18 @@
   position: sticky;
   top: 0;
   z-index: 100;
-  background: rgba(255, 255, 255, 0.95);
+  background: var(--header-bg);
   backdrop-filter: blur(20px);
   -webkit-backdrop-filter: blur(20px);
-  border-bottom: 1px solid var(--border-primary);
+  border-bottom: 1px solid var(--header-border);
   padding: 12px 24px;
   display: flex;
   align-items: center;
   justify-content: space-between;
-  box-shadow: 0 4px 20px rgba(0, 0, 0, 0.08);
+  box-shadow: var(--header-shadow);
   flex-shrink: 0;
 }
 
-[data-theme="dark"] .floating-header {
-  background: rgba(31, 41, 55, 0.95);
-  box-shadow: 0 4px 20px rgba(0, 0, 0, 0.3);
-}
-
 .header-left {
   display: flex;
   align-items: center;

phd-advisor-frontend/src/styles/components.css

@@ -42,6 +42,11 @@
   --input-border: #D1D5DB;
   --input-focus: #6366F1;
   --input-focus-shadow: 0 0 0 3px rgba(99, 102, 241, 0.1);
+
+  /* App header (floating bar) */
+  --header-bg: #EBF5FF;
+  --header-border: rgba(59, 130, 246, 0.2);
+  --header-shadow: 0 4px 20px rgba(37, 99, 235, 0.1);
 }
 
 :root[data-theme="dark"] {
@@ -87,6 +92,11 @@
   --input-border: #4B5563;
   --input-focus: #818CF8;
   --input-focus-shadow: 0 0 0 3px rgba(129, 140, 248, 0.2);
+
+  /* App header (floating bar) */
+  --header-bg: rgba(23, 37, 64, 0.97);
+  --header-border: rgba(96, 165, 250, 0.18);
+  --header-shadow: 0 4px 20px rgba(0, 0, 0, 0.35);
 }
 
 /* Theme Toggle Button */

scripts/patch_canvas_insights.py

@@ -0,0 +1,130 @@
+from pathlib import Path
+
+p = Path(r"C:\Users\dream\CCAI-Demo-Canvas-Upgrades\phd-advisor-frontend\src\components\canvas\canvasData.js")
+c = p.read_text(encoding="utf-8")
+
+start = c.index("export const INSIGHTS = [")
+end = c.index("export const WIDGET_CATALOG")
+
+insights = r'''export const INSIGHTS = [
+  {
+    id: 'i-progress',
+    title: 'Program progress',
+    icon: 'graph',
+    category: 'progress',
+    confidence: 82,
+    summary: 'Zero Trust Phase 2 is 78% complete. MFA enforced for workforce; service accounts and legacy VPN exceptions remain the main gaps before audit sampling.',
+    bullets: [
+      'Identity: <strong>MFA 94%</strong> workforce · service accounts in remediation',
+      'Network: micro-segmentation pilot on <strong>3 app tiers</strong>',
+      '<strong>Risk:</strong> 12 VPN exceptions still lack compensating controls',
+    ],
+    pinned: true,
+    sources: 18,
+    updatedMinutesAgo: 5,
+    quotes: [
+      '"MFA rollout blocked on two legacy HR integrations." — IAM workstream notes',
+      '"Auditors will sample VPN exception register first." — GRC advisor chat',
+    ],
+  },
+  {
+    id: 'i-method',
+    title: 'Controls posture',
+    icon: 'flask',
+    category: 'theory',
+    confidence: 71,
+    summary: 'SOC 2 CC6/CC7 mappings are drafted. Detection use cases cover ransomware and cred theft; log retention and IR tabletop evidence are still thin.',
+    bullets: [
+      'Mapped: <strong>CC6.1–CC6.7</strong> access controls with Okta + AWS',
+      'Open: centralized logging retention proof for <strong>365 days</strong>',
+      'Open: tabletop scenario for <strong>ransomware + exfil</strong> not yet run',
+    ],
+    sources: 14,
+    updatedMinutesAgo: 14,
+    quotes: [
+      '"Need SIEM retention screenshots before fieldwork." — compliance advisor',
+      '"Tabletop scheduled but not executed." — IR lead notes',
+    ],
+  },
+  {
+    id: 'i-lit',
+    title: 'Threat landscape',
+    icon: 'book',
+    category: 'literature',
+    confidence: 76,
+    summary: 'Strong coverage of identity attacks, SaaS misconfigurations, and supply-chain risks for your stack. Weaker on OT exposure and insider threat playbooks.',
+    bullets: [
+      '<strong>Coverage:</strong> MITRE techniques for cloud identity & SaaS',
+      '<strong>Gap:</strong> limited intel on <strong>OAuth consent phishing</strong> variants',
+      '<strong>Gap:</strong> no formal insider-threat escalation path documented',
+    ],
+    sources: 32,
+    updatedMinutesAgo: 28,
+    quotes: [
+      '"OAuth abuse is the fastest-moving thread in your sector." — threat intel advisor',
+      '"Insider playbook is a one-pager — not enough for audit." — GRC advisor',
+    ],
+  },
+  {
+    id: 'i-questions',
+    title: 'Open security questions',
+    icon: 'sparkles',
+    category: 'theory',
+    confidence: 63,
+    summary: 'Three live threads. Q1 (scope of zero trust for contractors) gates architecture sign-off. Q2–Q3 affect detection engineering priorities.',
+    bullets: [
+      '<strong>Q1:</strong> Do contractors get full ZTNA or bastion-only access?',
+      '<strong>Q2:</strong> Which SIEM detections are in-scope for SOC 2 evidence?',
+      '<strong>Q3:</strong> Is customer data in EU regions in scope for DPA addendum?',
+    ],
+    sources: 9,
+    updatedMinutesAgo: 41,
+    quotes: [
+      '"Contractor access model blocks network design." — architect advisor',
+      '"EU data residency may expand audit scope." — privacy advisor',
+    ],
+  },
+  {
+    id: 'i-next',
+    title: 'Next steps',
+    icon: 'arrow',
+    category: 'action',
+    confidence: 85,
+    summary: 'Near-term actions tied to audit date and production cutover. Two items have slipped one sprint.',
+    bullets: [
+      'Close <strong>12 VPN exceptions</strong> or document compensating controls',
+      'Run ransomware tabletop & upload minutes to evidence locker',
+      'Ship <strong>5 high-fidelity detections</strong> to production SIEM',
+      'Finalize vendor SOC 2 bridge letter for subprocessors',
+    ],
+    sources: 7,
+    updatedMinutesAgo: 9,
+    quotes: [
+      '"VPN exceptions are the #1 audit finding risk." — GRC advisor',
+      '"Detections without tuning will false-positive in week one." — SOC advisor',
+    ],
+  },
+  {
+    id: 'i-blockers',
+    title: 'Blockers & risks',
+    icon: 'alert',
+    category: 'risk',
+    confidence: 74,
+    summary: 'One technical blocker (legacy logging), one governance blocker (exception approvals). Governance is the higher audit risk.',
+    bullets: [
+      '<strong>Technical:</strong> legacy app logs not reaching SIEM — 18% of prod traffic',
+      '<strong>Governance:</strong> exception approval SLA &gt; 10 days — auditors will flag',
+    ],
+    sources: 6,
+    updatedMinutesAgo: 20,
+    quotes: [
+      '"Without those logs you cannot prove detective controls." — detection engineer',
+      '"Exception backlog reads as control failure." — devil\'s advocate advisor',
+    ],
+  },
+];
+
+'''
+
+p.write_text(c[:start] + insights + c[end:], encoding="utf-8")
+print("insights updated")

scripts/patch_chatpage_end.py

@@ -0,0 +1,101 @@
+from pathlib import Path
+
+p = Path(r"C:\Users\dream\CCAI-Demo-Canvas-Upgrades\phd-advisor-frontend\src\pages\ChatPage.js")
+c = p.read_text(encoding="utf-8")
+
+close_div = "</" + "div>"
+
+needle = f"""              placeholder={{
+                replyingTo 
+                  ? `Reply to ${{replyingTo.advisorName}}...`
+                  : chatPlaceholder
+              }}
+            />
+          {close_div}
+        {close_div}
+      {close_div}
+    {close_div}
+  );
+}};
+
+export default ChatPage;
+"""
+
+replacement = f"""              placeholder={{
+                replyingTo 
+                  ? `Reply to ${{replyingTo.advisorName}}...`
+                  : chatPlaceholder
+              }}
+              showProfileButtons={{!userProfile || userProfile.completion_pct < 100}}
+              onOpenOnboarding={{() => setShowOnboarding(true)}}
+              onOpenProfileForm={{() => setShowProfileForm(true)}}
+            />
+          {close_div}
+        {close_div}
+      {close_div}
+
+      {{showOnboarding && (
+        <OnboardingChat
+          authToken={{authToken}}
+          userName={{user?.firstName}}
+          onClose={{() => {{ setShowOnboarding(false); loadProfile(); }}}}
+        />
+      )}}
+
+      {{showProfileForm && (
+        <ProfileWalkthrough
+          authToken={{authToken}}
+          existingProfile={{userProfile}}
+          onClose={{() => {{ setShowProfileForm(false); loadProfile(); }}}}
+        />
+      )}}
+
+      {{showClearData && (
+        <ClearDataModal
+          authToken={{authToken}}
+          onClose={{() => setShowClearData(false)}}
+          onDataCleared={{({{ profile: clearedProfile, chats: clearedChats }}) => {{
+            if (clearedProfile) {{
+              setUserProfile(null);
+              loadProfile();
+            }}
+            if (clearedChats) {{
+              setMessages([]);
+              setCurrentSessionId(null);
+              setCurrentSessionTitle('');
+              handleNewChat();
+            }}
+          }}}}
+        />
+      )}}
+
+      {{showAccount && (
+        <AccountModal
+          user={{user}}
+          authToken={{authToken}}
+          onClose={{() => setShowAccount(false)}}
+          onAccountUpdated={{(updated) => {{
+            if (user) {{
+              user.firstName = updated.firstName;
+              user.lastName = updated.lastName;
+              user.email = updated.email;
+            }}
+          }}}}
+          onAccountDeleted={{() => {{
+            setShowAccount(false);
+            onSignOut();
+          }}}}
+        />
+      )}}
+    {close_div}
+  );
+}};
+
+export default ChatPage;
+"""
+
+if needle not in c:
+    raise SystemExit("needle not found in ChatPage.js")
+
+p.write_text(c.replace(needle, replacement, 1), encoding="utf-8")
+print("ok")

scripts/patch_message_bubble_avatar.py

@@ -0,0 +1,47 @@
+from pathlib import Path
+
+p = Path(r"C:\Users\dream\CCAI-Demo-Canvas-Upgrades\phd-advisor-frontend\src\components\MessageBubble.js")
+c = p.read_text(encoding="utf-8")
+
+start = c.index("    const avatarElement = (size = 40)")
+end = c.index("    return (", start)
+new = """    const avatarElement = (size = 44) => {
+      const iconSize = Math.round(size * 0.52);
+      return (
+        <div
+          className="advisor-message-avatar-ring"
+          style={{ width: size, height: size }}
+        >
+          {advisor.avatarUrl ? (
+            <img
+              src={advisor.avatarUrl}
+              alt={advisor.name || 'Advisor'}
+            />
+          ) : Icon ? (
+            <Icon
+              className="advisor-message-avatar-icon"
+              style={{
+                color: colors.color || 'var(--text-secondary)',
+                width: iconSize,
+                height: iconSize,
+              }}
+            />
+          ) : (
+            <span
+              className="advisor-message-avatar-initial"
+              style={{ color: colors.color || 'var(--text-secondary)', fontSize: iconSize }}
+            >
+              {advisor.name ? advisor.name.charAt(0) : 'A'}
+            </span>
+          )}
+        </motion.div>
+      );
+    };
+
+"""
+new = new.replace("</motion.div>", "</" + "div>")
+
+c = c[:start] + new + c[end:]
+c = c.replace("{inlineAvatar && avatarElement(32)}", "{inlineAvatar && avatarElement(44)}", 1)
+p.write_text(c, encoding="utf-8")
+print("ok")

scripts/patch_sidebar.py

@@ -0,0 +1,94 @@
+from pathlib import Path
+
+p = Path(r"C:\Users\dream\CCAI-Demo-Canvas-Upgrades\phd-advisor-frontend\src\components\Sidebar.js")
+c = p.read_text(encoding="utf-8")
+
+avatar_old = (
+    '                  <div className="user-avatar">\n'
+    '                    <User size={20} />\n'
+    '                  </div>'
+)
+avatar_new = (
+    '                  <motion.div\n'
+    '                    className="user-avatar"\n'
+    '                    onClick={() => onAvatarChange && setShowAvatarPicker(true)}\n'
+    '                    style={{\n'
+    "                      cursor: onAvatarChange ? 'pointer' : undefined,\n"
+    '                      backgroundColor: currentAvatar?.bg || undefined,\n'
+    '                      color: currentAvatar?.color || undefined,\n'
+    '                    }}\n'
+    "                    title={onAvatarChange ? 'Change avatar' : undefined}\n"
+    '                  >\n'
+    '                    <AvatarIcon size={20} />\n'
+    '                  </div>'
+)
+avatar_new = avatar_new.replace("<motion.div", "<div").replace("motion.div\n", "div\n")
+
+menu_old = (
+    '                    {showUserMenu && (\n'
+    '                      <div className="user-menu">\n'
+    '                        <button className="user-menu-item">\n'
+    '                          <Settings size={16} />\n'
+    '                          <span>Settings</span>\n'
+    '                        </button>\n'
+    '                        <button className="user-menu-item sign-out" onClick={onSignOut}>\n'
+    '                          <LogOut size={16} />\n'
+    '                          <span>Sign Out</span>\n'
+    '                        </button>\n'
+    '                      </div>\n'
+    '                    )}'
+)
+menu_new = (
+    '                    {showUserMenu && (\n'
+    '                      <div className="user-menu">\n'
+    '                        <button className="user-menu-item" onClick={() => { setShowUserMenu(false); setShowAvatarPicker(true); }}>\n'
+    '                          <User size={16} />\n'
+    '                          <span>Change Avatar</span>\n'
+    '                        </button>\n'
+    '                        <button className="user-menu-item" onClick={() => { setShowUserMenu(false); if (onOpenProfile) onOpenProfile(); }}>\n'
+    '                          <UserCircle size={16} />\n'
+    '                          <span>Profile</span>\n'
+    '                        </button>\n'
+    '                        <button className="user-menu-item" onClick={() => { setShowUserMenu(false); if (onOpenAccount) onOpenAccount(); }}>\n'
+    '                          <KeyRound size={16} />\n'
+    '                          <span>Account</span>\n'
+    '                        </button>\n'
+    '                        <button className="user-menu-item" onClick={() => { setShowUserMenu(false); if (onOpenClearData) onOpenClearData(); }}>\n'
+    '                          <DatabaseZap size={16} />\n'
+    '                          <span>Clear User Data</span>\n'
+    '                        </button>\n'
+    '                        <button className="user-menu-item sign-out" onClick={onSignOut}>\n'
+    '                          <LogOut size={16} />\n'
+    '                          <span>Sign Out</span>\n'
+    '                        </button>\n'
+    '                      </div>\n'
+    '                    )}'
+)
+
+if avatar_old not in c:
+    raise SystemExit("avatar block not found")
+c = c.replace(avatar_old, avatar_new, 1)
+if menu_old not in c:
+    raise SystemExit("menu block not found")
+c = c.replace(menu_old, menu_new, 1)
+
+picker = """
+      {showAvatarPicker && (
+        <UserAvatarPicker
+          options={avatarOptions}
+          currentId={userAvatarId}
+          onSelect={(id) => { onAvatarChange?.(id); setShowAvatarPicker(false); }}
+          onClose={() => setShowAvatarPicker(false)}
+        />
+      )}
+"""
+
+if "UserAvatarPicker" not in c.split("export default")[0].split("return (")[-1]:
+    c = c.replace(
+        "      {isMobileOpen && (",
+        picker + "\n      {isMobileOpen && (",
+        1,
+    )
+
+p.write_text(c, encoding="utf-8")
+print("Sidebar patched")