@mindrian_os/install 1.13.0-beta.16 → 1.13.0-beta.17

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mos",
   "description": "MindrianOS -- Your AI innovation co-founder. Larry thinks with you through PWS methodology, builds your Data Room as you explore, and chains frameworks intelligently. Install and go.",
-  "version": "1.13.0-beta.16",
+  "version": "1.13.0-beta.17",
   "author": {
     "name": "Jonathan Sagir",
     "url": "https://mindrian.ai"

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [1.13.0-beta.17] - 2026-05-15
+
+### Fixed
+- **Step 6.6 ordering hole (Bug 1 -- Phase 126.1 hotfix, 2026-05-15).** Phase 126 beta.16 hotfix `3fc008b` moved `verify-release-clean-tree` from `applies_to: ['pre-tag', 'full']` to `['full']` because `release.sh` Step 6.6 calls `--pre-tag` AFTER Steps 3-6 intentionally bump `plugin.json` + `package.json` + `CHANGELOG.md`. That made the cut sail through, but the strict clean-tree gate no longer ran pre-tag AND Test 2 of `tests/test-doctor-acceptance-preflight-checks.cjs` was converted to SKIP rather than re-pointed. Real gap, predicted by `docs/install-cache-family-premortem.md` Section 3. Fix (Option B): added a new `pre-flight` tier to the `applies_to` enum (strict subset of `pre-tag` minus in-flight-incompatible checks); added the `--pre-flight` CLI flag to `scripts/doctor.cjs`; added Step 2.5 to `scripts/release.sh` calling `doctor --acceptance --pre-flight` BEFORE Step 3 mutates the tree (HARD ABORT, no rollback needed because nothing is yet mutated); kept the existing Step 6.6 `--pre-tag` call after Step 6 (still the right tier for post-bump checks). Restored Test 2 from SKIP to PASS under the new tier; added Test 8 asserting tier filter behavior. (`scripts/doctor.cjs`, `scripts/release.sh`, `tests/test-doctor-acceptance-preflight-checks.cjs`.)
+- **Commit B 7-place lockstep gap (Bug 2 -- Phase 126.1 hotfix, 2026-05-15).** `scripts/release.sh` Step 7.5 (Commit B, the next-pre-release advance) bumped `plugin.json` + `package.json` to `NEXT_VERSION` but left `~/mindrian-marketplace/.claude-plugin/marketplace.json` at `vN`. Per `feedback_install_minisite_lockstep.md`, the 7-place lockstep contract requires the marketplace.json `version` field to advance with the plugin repo. The bug recurred in beta.16. Fix: Step 7.5 now writes a second `node -e` block that bumps `MARKETPLACE_DIR/.claude-plugin/marketplace.json` to `NEXT_VERSION` (version field only -- `source.ref` deliberately stays at `vNEW_VERSION` pinning the marketplace commit at Commit A's tag); parallel marketplace-repo `git commit` follows with message `chore: bump marketplace.json to v$NEXT_VERSION (Commit B 7-place lockstep)`. Test H asserts the bump pattern is present in `scripts/release.sh`. (`scripts/release.sh`, `tests/test-release-bump-algebra.cjs`.)
+- **Step 9.7 npx-publish self-test sandbox bug (Bug 3 -- Phase 126.1 hotfix, 2026-05-15).** `scripts/release.sh` Step 9.7 ran `npx --yes @mindrian_os/install@<version>` from an `mktemp -d` temp dir and checked the dir was non-empty after install -- but `@mindrian_os/install` installs into `~/.claude/` (the Claude Code plugin install root), NOT into cwd, so the temp-dir check spuriously failed during the beta.16 cut. Fix (Option A): switched to a HOME-override sandbox at `~/.claude/_test-install-<sha8>/` (subpath under `~/.claude/` per scope; mirrors the Phase 123 `doctor.cjs:2336` sandbox pattern). The npx run sets `HOME=$NPX_TEST_DIR` + `USERPROFILE=$NPX_TEST_DIR` + `npm_config_cache=$NPX_TEST_DIR/.npm` so the install resolves into the sandbox subpath, never touching the operator's real `~/.claude/`. Scaffold marker check now asserts `$NPX_TEST_DIR/.claude/plugins/installed_plugins.json` exists AND is parseable JSON. `trap` cleanup guarantees the sandbox dir + the pre-snapshot file are removed even on abort. Option B (extend `~/mindrianos-install-site` npm-installer with a `--target=<dir>` flag) is the cleaner long-term fix but out of scope for this hotfix (separate repo). Test I asserts the sandbox path + HOME-override are present in `scripts/release.sh` and the legacy `mktemp -d -t mos-npx-selftest` pattern is gone. (`scripts/release.sh`, `tests/test-release-bump-algebra.cjs`.)
+
+### Changed
+- **Phase 122 `teaching:` frontmatter on `/mos:mva-brief` + `/mos:mva-option` verified clean (Phase 126.1 hotfix audit, 2026-05-15).** Per `118/deferred-items.md` lines 5-20 the two MVA helper commands lacked `teaching:` strings as of Plan 118-06. Inspection found the strings were already added between then and now (`commands/mva-brief.md` line 6: 200 chars; `commands/mva-option.md` line 6: 180 chars). All four Phase 122 invariants verified: length 50-300 chars (200 + 180), zero em-dashes (`grep -nP "[—–]"` empty), 1-2 sentences each (terminal `.`), Larry-voice with WHY lede. `node scripts/build-command-registry.cjs --check` exits 0. No edits required; verification-only commit. The pre-existing `118/deferred-items.md` "Pre-existing build-command-registry teaching-field gap" entry can be marked RESOLVED in a follow-up. (`commands/mva-brief.md`, `commands/mva-option.md`.)
+
 ## [1.13.0-beta.16] - 2026-05-14
 
 ### Added

package/commands/file-meeting.md

@@ -4,6 +4,8 @@ description: File a meeting transcript into the Data Room
 argument-hint: [--latest|--paste|<file>]
 serves_jtbd: ["file-meeting"]
 teaching: "When a meeting just happened, /mos:file-meeting captures the transcript and routes the intelligence into the right room sections. Meetings are where institutional knowledge actually lives."
+# Per docs/reward-before-investment-rule.md line 60-62: surface first-paragraph extraction preview before full transcript ask. Remediation tracked as follow-up phase.
+interactive_first_reward: paragraph_preview
 allowed-tools:
   - Read
   - Write

package/commands/grade.md

@@ -3,6 +3,8 @@ name: grade
 description: Grade problem-discovery quality (6 components)
 serves_jtbd: ["audit-room"]
 teaching: "When you want a fast read on problem-discovery quality, /mos:grade scores the room on six components in under a minute. The lightweight cousin of /mos:deep-grade."
+# Per docs/reward-before-investment-rule.md line 64-66: show anonymized calibration distribution before requiring content. Remediation tracked as follow-up phase.
+interactive_first_reward: calibration_distribution_preview
 # --- Phase 122 workflow-layer frontmatter ---
 kind: methodology
 frameworks: ["PWS Triple Validation Compass"]

package/commands/mva-brief.md

@@ -0,0 +1,56 @@
+---
+name: mva-brief
+description: Run the 30-second MVA pipeline for the user's current venture sentence
+argument-hint: (no args -- reads pending state from UserPromptSubmit detection)
+serves_jtbd: ["explore"]
+teaching: "When you have just typed a venture sentence and want a brief in under a minute, /mos:mva-brief runs the 6-agent fan-out and deploys a shareable deck. The reward-before-investment surface of Phase 118."
+allowed-tools: Bash
+interactive_first_reward: instant_brief
+---
+
+# /mos:mva-brief
+
+Run the 30-second MVA pipeline against the pending venture sentence detected by
+the UserPromptSubmit hook (Plan 118-00).
+
+## What this does
+
+1. Reads pending state from `~/.mindrian/mva/<session-id>.json` (written by
+   Plan 118-00 detection hook).
+2. Fires 6 parallel agents (Brain similar + Brain cross-domain + Brain classic
+   traps + Tavily funding + Six-hats red/black + Dashboard graph) under the
+   45-second hard budget.
+3. Streams agent results as they return -- each one rendered in Larry's
+   GUIDED voice (per feedback_larry_pedagogical_guided_first.md).
+4. Closes with the 3-option footer:
+   - [1] Just tell me what's new (stay in "tell me" mode)
+   - [2] Build a room around this (invest)
+   - [3] Challenge me -- Devil's Advocate (go deeper cognitively)
+
+## Instructions for the model
+
+Invoke `node scripts/mva-run.cjs` via Bash with no arguments. The script reads
+the pending state file, runs the orchestrator, and writes the rendered output
+to stdout.
+
+Relay the stdout to the user VERBATIM. Do NOT:
+
+- Add commentary or interpretation before the rendered output
+- Re-summarize the agent findings ("So basically what this means is...")
+- Skip the 3-option footer
+- Autonomously pick option 1, 2, or 3 for the user
+- Add Larry-voice framing ("Here's what I found for you...") -- the renderer
+  already speaks in Larry's voice; double-voicing breaks the GUIDED tone
+
+The 3-option footer IS the user's decision point. Wait for the user to type
+1, 2, or 3 (or their own free-text), then route per the option behavior:
+
+- 1: stay in JUST_TALK mode; keep brief in scrollback; user can ask follow-ups
+- 2: invoke /mos:new-project (stub for v1.13.0; Phase 119 wires fully)
+- 3: invoke /mos:challenge-assumptions against the brief
+
+## Canon parts implemented
+
+- Part 2 (team around navigator -- 6 agents as a parallel team)
+- Part 8 (boundary -- agents send only generic handles to Brain / Tavily)
+- Part 10 sub-claim 3 (room as receipt -- the brief IS the reward)

package/commands/mva-option.md

@@ -0,0 +1,89 @@
+---
+name: mva-option
+description: Route the user's 3-option footer selection after a 30-second MVA brief
+argument-hint: <1|2|3> [<sha8>]
+serves_jtbd: ["explore"]
+teaching: "When the 3-option footer shows after an MVA brief, /mos:mva-option routes your pick (refine / build a room / iterate) into the right next move. The hand-off after the first reward."
+allowed-tools: Bash
+interactive_first_reward: --none (scripting only)
+---
+
+# /mos:mva-option <N> [<sha8>]
+
+Route the user's selection from the 3-option footer that appears after a 30-second MVA brief.
+
+## Why this exists
+
+The 3-option footer renders after every MVA brief (per binding decision B4):
+
+```
+What now?
+  [1] Just tell me what's new         (stay in "tell me" mode)
+  [2] Build a room around this        (invest)
+  [3] Challenge me -- Devil's Advocate (go deeper cognitively)
+```
+
+The user types `1`, `2`, or `3` (or `/mos:mva-option N` directly). This command dispatches the routing.
+
+## Arguments
+
+- `<N>` (required): `1`, `2`, or `3` -- the user's selection
+- `[<sha8>]` (optional): the 8-char prefix identifying the target brief. When OMITTED, the command auto-discovers the most recent brief by calling `resolveCurrentSha8()` which reads `~/.mindrian/mva/state.json` (the manifest atomically written by Plan 118-03's orchestrator after `mva_brief_rendered` fires).
+
+## How to invoke
+
+The model invokes this command via Bash + Node. Two patterns:
+
+**With explicit sha8:**
+
+```bash
+node -e "const r=require('./lib/core/mva-option-router.cjs'); r.routeOption(N, '<sha8>').then(out => console.log(JSON.stringify(out, null, 2)))"
+```
+
+**Without sha8 (auto-resolve via state.json):**
+
+```bash
+node -e "const r=require('./lib/core/mva-option-router.cjs'); const sha=r.resolveCurrentSha8(); if(!sha){console.log(JSON.stringify({ok:false,error:'no_current_brief',message:'No recent brief found. Type your venture sentence to fire the pipeline.'}));process.exit(0);} r.routeOption(N, sha).then(out => console.log(JSON.stringify(out, null, 2)))"
+```
+
+The auto-resolve form is what the `mva-pipeline` skill instructs the model to run when the user types `1`, `2`, or `3` as a plain message immediately after a brief renders. See the "## Routing the 3-option footer" section in `skills/mva-pipeline/SKILL.md` for the full recognition rule.
+
+## What happens per option
+
+- **Option 1** -- operator transitions to `JUST_TALK`; the brief stays in scrollback; the user can ask any follow-up about the 6 cells. The router returns `{ action: 'stay_in_just_talk', next_state: 'JUST_TALK', message: ... }`.
+
+- **Option 2** -- operator unchanged; the router returns `{ action: 'phase_119_stub', next_state: null, message: STUB_MESSAGE_119 }`. The stub message reads:
+
+  > Building a room around this is the next layer; shipping in beta.18 (Phase 119). For now, press option 1 to keep this brief visible, or option 3 to go deeper.
+
+  Per binding decision B6 OPTION A, option 2 is deferred to Phase 119 / v1.13.0-beta.18. The router does NOT invoke `/mos:new-project` in v1.13.0.
+
+- **Option 3** -- operator transitions to `METHODOLOGY`; the router returns `{ action: 'invoke_challenge_assumptions', next_state: 'METHODOLOGY', invoke_command: '/mos:challenge-assumptions --from-brief <sha8>' }`. The model then runs the named slash command against the brief.
+
+## Edge cases
+
+| Situation | Router return | Model surfaces |
+| --------- | ------------- | -------------- |
+| No `state.json` (fresh install / Hebrew refusal) | wrapper short-circuits | "No recent brief found. Type your venture sentence to fire the pipeline." |
+| Side-file `<sha8>.json` missing (brief expired) | `{ ok:false, error:'brief_not_found' }` | "The brief data has expired or was not deployed. Type your sentence again to re-fire the pipeline." |
+| `mva_brief_rendered` event not yet logged (pipeline still streaming) | `{ ok:false, error:'brief_still_rendering' }` | "Brief is still rendering -- options will activate when it completes." |
+| Invalid `N` (0, 4, 99, "1", null) | `{ ok:false, error:'invalid_option' }` | Treat as free-text; route through normal Larry conversation. |
+
+## Telemetry
+
+Each successful invocation emits `mva_option_selected` to `~/.mindrian/telemetry/v1.13/mva.jsonl` with the frozen `ALLOWED_FIELDS` schema:
+
+```
+{ sentence_sha256, option_id, time_to_click_ms }
+```
+
+`time_to_click_ms` is computed from the most recent `mva_brief_rendered` event timestamp for the brief's `sentence_sha256`. Plan 118-06's Dror 2.0 harness reads these events to validate "subject types one sentence and clicks an option within 60 seconds of brief rendering."
+
+Per Canon Part 8: the telemetry payload carries ONLY the sha256 hash + option_id + time delta. Zero user content. Zero URLs.
+
+## Canon parts implemented
+
+- Part 3 (Tri-Context Decision Gate) -- the 3-option footer IS a Decision Gate offering a closed-vocabulary choice (verbs 7 Synthesize / 8 Bank Opportunity / 5 Devil's Advocate)
+- Part 4 (Every Choice Is Graph Data) -- `mva_option_selected` telemetry captures every click; operator transitions write `OPERATOR_TRANSITION` edges to the local room graph (Phase 99 substrate)
+- Part 8 (Graph Boundary) -- zero user content in telemetry; zero raw_sentence reads from the side-file; the router source passes the forbidden-token sweep
+- Part 10 sub-claim 3 (room as receipt) -- the 3-option footer is the user's self-selected commitment level immediately after the reward (the brief itself)

package/commands/new-project.md

@@ -4,6 +4,8 @@ description: Start a new venture project and create its room
 argument-hint: [name]
 serves_jtbd: ["explore"]
 teaching: "When you are starting a new venture, /mos:new-project creates the room scaffolding and registers it in the room registry. The first move of every Mindrian journey."
+# Per docs/reward-before-investment-rule.md line 56-58 remediation: first sentence -> Instant Brief pipeline (this phase's deliverable). Room creation is option 2 of the 3-option footer (Phase 119 wires fully in beta.18).
+interactive_first_reward: instant_brief
 allowed-tools:
   - Read
   - Write

package/commands/onboard.md

@@ -5,6 +5,8 @@ body_shape: B (Semantic Tree)
 body_shape_detail: Steps as conversational flow, context building as nested nodes
 serves_jtbd: ["explore"]
 teaching: "When you just installed MindrianOS, /mos:onboard walks you through the system and builds your first room. Designed so a stranger can self-activate without Larry holding their hand."
+# Per docs/reward-before-investment-rule.md line 68-70: first screen is a question, not a tutorial. Remediation tracked as follow-up phase.
+interactive_first_reward: reframe_question
 ui_reference: skills/ui-system/SKILL.md
 allowed-tools:
   - Read

package/hooks/hooks.json

@@ -292,6 +292,15 @@
           }
         ]
       },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/mva-detect.cjs\"",
+            "timeout": 1500
+          }
+        ]
+      },
       {
         "hooks": [
           {

package/lib/agents/mva/brain-classic-traps.cjs

@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 118-02 Plan 02 Task 1 -- brain-classic-traps agent (Agent 3 of 6 in
+ * B1; agent_id 'brain_classic_traps' in lib/agents/mva/index.cjs).
+ *
+ * Calls Brain via lib/core/brain-client.cjs::query() with a GENERIC Cypher
+ * template from data/mva-agent-prompts.json. Returns top-1 FailureMode pattern
+ * with a "Classic trap:" summary line.
+ *
+ * Graph-native HARD RULES (memory feedback_reverse_salient_agent_graph_native.md):
+ *   1. NEVER require room-db.cjs directly (Phase 109 D-06 chokepoint).
+ *   2. NEVER require any Brain-MCP client module DIRECTLY for raw queries;
+ *      use lib/core/brain-client.cjs which enforces the wire-schema sanitization
+ *      AND only with framework-name/phase-id/enum args, never user content.
+ *   3. NEVER write to stdout / stderr (telemetry side-channel rule).
+ *
+ * Canon Part 8 hard invariant (MVA-118-10):
+ *   The Cypher carries ONLY $-bound parameters with hardcoded stage labels.
+ *   NEVER the user's raw sentence. NEVER the sentence_sha256 as a Cypher
+ *   string interpolation. NEVER any user-content env var (token name elided
+ *   per the Test 6 grep regression).
+ *
+ * Pure CJS, node built-ins only, zero new runtime dependencies.
+ */
+'use strict';
+
+const path = require('node:path');
+const brainClient = require('../../core/brain-client.cjs');
+
+const PROMPTS_PATH = path.resolve(__dirname, '..', '..', '..', 'data', 'mva-agent-prompts.json');
+
+/**
+ * @param {{ sentence_sha256: string, remaining_budget_ms: number }} _context
+ * @param {AbortSignal} signal
+ * @returns {Promise<{ status:'ok'|'empty', payload:any } | null>}
+ */
+async function run(_context, signal) {
+  if (!brainClient.isAvailable()) {
+    return { status: 'empty', payload: { reason: 'brain_unavailable' } };
+  }
+  if (signal && signal.aborted) return null;
+
+  let prompts;
+  try {
+    prompts = require(PROMPTS_PATH).brain_classic_traps;
+  } catch (_e) {
+    return { status: 'empty', payload: { reason: 'prompts_unavailable' } };
+  }
+
+  let result;
+  try {
+    result = await brainClient.query(prompts.cypher, prompts.params);
+  } catch (_e) {
+    return { status: 'empty', payload: { reason: 'brain_error' } };
+  }
+
+  if (signal && signal.aborted) return null;
+
+  const records = (result && Array.isArray(result.records)) ? result.records : [];
+  if (records.length === 0) {
+    return { status: 'empty', payload: { reason: 'no_trap' } };
+  }
+  const trap = records[0];
+  const tail = trap.signature || 'classic failure pattern';
+  const summary = 'Classic trap: ' + (trap.name || 'unnamed') + ' -- ' + tail;
+
+  return {
+    status: 'ok',
+    payload: {
+      summary_line: summary,
+      deck_data: { trap: trap },
+    },
+  };
+}
+
+module.exports = { run };

package/lib/agents/mva/brain-cross-domain.cjs

@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 118-02 Plan 02 Task 1 -- brain-cross-domain agent (Agent 2 of 6 in
+ * B1; agent_id 'brain_cross_domain' in lib/agents/mva/index.cjs).
+ *
+ * Calls Brain via lib/core/brain-client.cjs::search() in cross-domain mode
+ * (GENERIC handle from data/mva-agent-prompts.json) and returns top-1
+ * analogous framework with a one-line "Cross-domain analogy:" summary.
+ *
+ * Graph-native HARD RULES (memory feedback_reverse_salient_agent_graph_native.md):
+ *   1. NEVER require room-db.cjs directly (Phase 109 D-06 chokepoint).
+ *   2. NEVER require any Brain-MCP client module DIRECTLY for raw queries;
+ *      use lib/core/brain-client.cjs which enforces the wire-schema sanitization
+ *      AND only with framework-name/phase-id/enum args, never user content.
+ *   3. NEVER write to stdout / stderr (telemetry side-channel rule).
+ *
+ * Canon Part 8 hard invariant (MVA-118-09):
+ *   The Brain query carries ONLY a hardcoded generic handle. NEVER the user's
+ *   raw sentence. NEVER the sentence_sha256 as a free-text query body. NEVER
+ *   any user-content env var (token name elided per the Test 6 grep regression).
+ *
+ * Pure CJS, node built-ins only, zero new runtime dependencies.
+ */
+'use strict';
+
+const path = require('node:path');
+const brainClient = require('../../core/brain-client.cjs');
+
+const PROMPTS_PATH = path.resolve(__dirname, '..', '..', '..', 'data', 'mva-agent-prompts.json');
+
+/**
+ * @param {{ sentence_sha256: string, remaining_budget_ms: number }} _context
+ * @param {AbortSignal} signal
+ * @returns {Promise<{ status:'ok'|'empty', payload:any } | null>}
+ */
+async function run(_context, signal) {
+  if (!brainClient.isAvailable()) {
+    return { status: 'empty', payload: { reason: 'brain_unavailable' } };
+  }
+  if (signal && signal.aborted) return null;
+
+  let prompts;
+  try {
+    prompts = require(PROMPTS_PATH).brain_cross_domain;
+  } catch (_e) {
+    return { status: 'empty', payload: { reason: 'prompts_unavailable' } };
+  }
+
+  let result;
+  try {
+    result = await brainClient.search(prompts.query, {
+      filters: prompts.filters,
+      limit: prompts.limit,
+    });
+  } catch (_e) {
+    return { status: 'empty', payload: { reason: 'brain_error' } };
+  }
+
+  if (signal && signal.aborted) return null;
+
+  const analogies = (result && Array.isArray(result.results)) ? result.results : [];
+  if (analogies.length === 0) {
+    return { status: 'empty', payload: { reason: 'no_analogy' } };
+  }
+  const analogy = analogies[0];
+  const tail = analogy.signature || 'pattern transfer applicable';
+  const summary = 'Cross-domain analogy: ' + (analogy.name || 'unnamed') + ' -- ' + tail;
+
+  return {
+    status: 'ok',
+    payload: {
+      summary_line: summary,
+      deck_data: { analogy: analogy },
+    },
+  };
+}
+
+module.exports = { run };

package/lib/agents/mva/brain-similar-ventures.cjs

@@ -0,0 +1,93 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 118-02 Plan 02 Task 1 -- brain-similar-ventures agent (Agent 1 of 6
+ * in B1; agent_id 'brain_similar' in lib/agents/mva/index.cjs).
+ *
+ * Calls Brain via lib/core/brain-client.cjs::search() with a GENERIC handle
+ * from data/mva-agent-prompts.json. Returns the top-3 venture matches with a
+ * one-line human-readable summary + structured deck_data.
+ *
+ * Mirrors lib/agents/auto-explore-agent.cjs structure verbatim per the plan.
+ *
+ * Graph-native HARD RULES (memory feedback_reverse_salient_agent_graph_native.md):
+ *   1. NEVER require room-db.cjs directly (Phase 109 D-06 chokepoint).
+ *   2. NEVER require any Brain-MCP client module DIRECTLY for raw queries;
+ *      use lib/core/brain-client.cjs which enforces the wire-schema sanitization
+ *      AND only with framework-name/phase-id/enum args, never user content.
+ *   3. NEVER write to stdout / stderr (telemetry side-channel rule).
+ *
+ * Canon Part 8 hard invariant (MVA-118-08):
+ *   The Brain query carries ONLY generic handles loaded from
+ *   data/mva-agent-prompts.json. NEVER the user's raw sentence. NEVER the
+ *   sentence_sha256 as a free-text query body. NEVER any user-content env
+ *   var (which is never set; see Plan 118-01's AgentContext invariant -- the
+ *   sentence-bearing env var name is elided here so the grep regression in
+ *   test-all-six-agents.cjs Test 6 returns zero matches on this file).
+ *
+ * Pure CJS, node built-ins only, zero new runtime dependencies.
+ */
+'use strict';
+
+const path = require('node:path');
+const brainClient = require('../../core/brain-client.cjs');
+
+const PROMPTS_PATH = path.resolve(__dirname, '..', '..', '..', 'data', 'mva-agent-prompts.json');
+
+/**
+ * Agent run function. Conforms to the Plan 118-01 Agent contract:
+ *   async function agent(context, signal) -> { status:'ok'|'empty', payload } | null
+ *
+ * @param {{ sentence_sha256: string, remaining_budget_ms: number }} _context
+ * @param {AbortSignal} signal
+ * @returns {Promise<{ status:'ok'|'empty', payload:any } | null>}
+ */
+async function run(_context, signal) {
+  // Fast-fail when Brain is unreachable (no key configured). Per the plan's
+  // done-criteria: this must return status='empty' in <100ms.
+  if (!brainClient.isAvailable()) {
+    return { status: 'empty', payload: { reason: 'brain_unavailable' } };
+  }
+  if (signal && signal.aborted) return null;
+
+  // Load the generic prompt template. Per Canon Part 8 this file is the SOLE
+  // source of Brain query bodies for this agent -- audited in one place.
+  let prompts;
+  try {
+    // require() caches; that is desirable here (the JSON is static config).
+    prompts = require(PROMPTS_PATH).brain_similar_ventures;
+  } catch (_e) {
+    return { status: 'empty', payload: { reason: 'prompts_unavailable' } };
+  }
+
+  let result;
+  try {
+    result = await brainClient.search(prompts.query, {
+      filters: prompts.filters,
+      limit: prompts.limit,
+    });
+  } catch (_e) {
+    return { status: 'empty', payload: { reason: 'brain_error' } };
+  }
+
+  if (signal && signal.aborted) return null;
+
+  // brain-client may return { results: [...] } or null on quota-exhaustion + fallback.
+  const ventures = (result && Array.isArray(result.results)) ? result.results.slice(0, 3) : [];
+  if (ventures.length === 0) {
+    return { status: 'empty', payload: { reason: 'no_matches' } };
+  }
+
+  const summary = 'Found ' + ventures.length + ' ventures in this space: ' +
+    ventures.map((v) => (v.name || 'unnamed') + ' (' + (v.status || 'active') + ')').join(', ');
+
+  return {
+    status: 'ok',
+    payload: {
+      summary_line: summary,
+      deck_data: { ventures: ventures },
+    },
+  };
+}
+
+module.exports = { run };

package/lib/agents/mva/dashboard-graph-neighborhood.cjs

@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 118-02 Plan 02 Task 3 -- dashboard-graph-neighborhood agent (Agent 6
+ * of 6 in B1; agent_id 'dashboard_graph' in lib/agents/mva/index.cjs).
+ *
+ * Reads the active room's graph via lib/core/navigation.cjs (the Phase 109
+ * single chokepoint; Canon Part 9 D-06 invariant) and returns a 1-2 hop
+ * neighborhood snapshot of recent decision nodes.
+ *
+ * Graph-native HARD RULES (memory feedback_reverse_salient_agent_graph_native.md):
+ *   1. NEVER require lib/core/room-db.cjs directly (the Phase 109 D-06
+ *      chokepoint allow-list does NOT include MVA agents).
+ *   2. NEVER require better-sqlite3 / node:sqlite directly.
+ *   3. NEVER write to stdout / stderr (telemetry side-channel rule).
+ *   4. NEVER call out over the network (the dashboard is purely LOCAL graph).
+ *
+ * Canon Part 8 hard invariant (MVA-118-12):
+ *   The room graph read is LOCAL only. Zero outbound. The summary line + deck
+ *   data carry only structural identifiers + counts, never raw artifact text.
+ *
+ * Pure CJS, node built-ins only, zero new runtime dependencies.
+ */
+'use strict';
+
+const nav = require('../../core/navigation.cjs');
+
+/**
+ * @param {{ sentence_sha256: string, remaining_budget_ms: number }} _context
+ * @param {AbortSignal} signal
+ * @returns {Promise<{ status:'ok'|'empty', payload:any } | null>}
+ */
+async function run(_context, signal) {
+  if (signal && signal.aborted) return null;
+
+  let active;
+  try {
+    active = nav.detectActiveRoom();
+  } catch (_e) {
+    return { status: 'empty', payload: { reason: 'no_active_room' } };
+  }
+  if (!active || !active.hasRoomDb) {
+    return { status: 'empty', payload: { reason: 'no_active_room' } };
+  }
+  if (signal && signal.aborted) return null;
+
+  let neighborhood;
+  try {
+    neighborhood = nav.getRecentDecisionNeighborhood(active.roomDir, { hops: 1, limit: 5 });
+  } catch (_e) {
+    return { status: 'empty', payload: { reason: 'graph_error' } };
+  }
+  if (signal && signal.aborted) return null;
+
+  const nodes = (neighborhood && Array.isArray(neighborhood.nodes)) ? neighborhood.nodes : [];
+  const edges = (neighborhood && Array.isArray(neighborhood.edges)) ? neighborhood.edges : [];
+  if (nodes.length === 0) {
+    return { status: 'empty', payload: { reason: 'empty_room' } };
+  }
+  const count = nodes.length;
+  const suffix = count === 1 ? '' : 's';
+  const summary = 'Your room already has ' + count + ' related decision node' + suffix + '. Quick preview:';
+  return {
+    status: 'ok',
+    payload: {
+      summary_line: summary,
+      deck_data: { nodes: nodes, edges: edges },
+    },
+  };
+}
+
+module.exports = { run };

package/lib/agents/mva/index.cjs

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 118-02 Plan 02 -- ALL_AGENTS aggregator for the 6 MVA agents (Binding
+ * Decision B1). Consumed by lib/core/mva-dispatcher.cjs which knows nothing
+ * about which agents are which -- it accepts any { id, fn } tuple conforming
+ * to the Agent contract in lib/core/mva-agent-contract.cjs.
+ *
+ * Agent ID -> source-file mapping (short forms per B1; long forms here):
+ *
+ *   brain_similar        <- brain-similar-ventures.cjs           (Agent 1)
+ *   brain_cross_domain   <- brain-cross-domain.cjs               (Agent 2)
+ *   brain_classic_traps  <- brain-classic-traps.cjs              (Agent 3)
+ *   tavily_funding       <- tavily-funding-scan.cjs              (Agent 4)
+ *   six_hats_red_black   <- six-hats-red-black.cjs               (Agent 5)
+ *   dashboard_graph      <- dashboard-graph-neighborhood.cjs     (Agent 6)
+ *
+ * NOTE on filename drift (NIT-2 invariant from plan-checker iteration 2):
+ *   The canonical filenames in this plan's files_modified (e.g.
+ *   brain-cross-domain.cjs, dashboard-graph-neighborhood.cjs) are the
+ *   implementation-time source files. The JSDoc above documents the agent-id
+ *   -> source-file mapping using the B1 short forms so Plan 118-03's renderer
+ *   prefixes ([brain] / [analogy] / [traps] / [funding] / [worth chewing on]
+ *   / [your room]) deterministically resolve from agent_id alone. If an
+ *   executor renames a source file, update both this comment block AND the
+ *   require() path immediately below in the same commit.
+ *
+ * Canon Part 8: this module is a pure aggregator. Zero I/O. Each agent owns
+ * its own boundary; the array shape preserves the dispatcher contract.
+ */
+'use strict';
+
+const ALL_AGENTS = Object.freeze([
+  { id: 'brain_similar',       fn: require('./brain-similar-ventures.cjs').run },
+  { id: 'brain_cross_domain',  fn: require('./brain-cross-domain.cjs').run },
+  { id: 'brain_classic_traps', fn: require('./brain-classic-traps.cjs').run },
+  { id: 'tavily_funding',      fn: require('./tavily-funding-scan.cjs').run },
+  { id: 'six_hats_red_black',  fn: require('./six-hats-red-black.cjs').run },
+  { id: 'dashboard_graph',     fn: require('./dashboard-graph-neighborhood.cjs').run },
+]);
+
+module.exports = { ALL_AGENTS };