mindforge-cc 1.0.0

package/.planning/phases/day3/REVIEW-DAY3.md

@@ -0,0 +1,234 @@
+## Finding 1 — BLOCKING: Cursor pagination uses non-unique created_at only
+
+**File:** .mindforge/skills/database-patterns/SKILL.md
+**Category:** Data correctness
+**Severity:** BLOCKING
+
+**Issue:**
+Cursor pagination example uses `created_at` only. This is ambiguous when multiple
+records share the same timestamp, causing missing or duplicate rows.
+
+**Recommendation:**
+Use compound cursor `(created_at, id)` and document cursor encoding. See review
+prompt for exact SQL replacement.
+
+---
+## Finding 2 — MAJOR: MindForge version not bumped for Day 3 skills
+
+**File:** package.json
+**Category:** Compatibility
+**Severity:** MAJOR
+
+**Issue:**
+`package.json` is still `0.1.0` while Day 3 skills require `min_mindforge_version: 0.3.0`.
+This causes compatibility warnings on every task.
+
+**Recommendation:**
+Bump `package.json` version to `0.3.0`.
+
+---
+## Finding 3 — MAJOR: Skills loader missing file-name matching and word-boundary rules
+
+**File:** .mindforge/engine/skills/loader.md
+**Category:** Skills Loader
+**Severity:** MAJOR
+
+**Issue:**
+File path matching checks directory names only and does not check file names
+(`login.ts`, `auth.ts`). Word-boundary matching for triggers is not explicit.
+
+**Recommendation:**
+Add file NAME matching rules and clarify word-boundary matching.
+
+---
+## Finding 4 — MAJOR: Skills summarisation lacks strict budget and priority rules
+
+**File:** .mindforge/engine/skills/loader.md
+**Category:** Context Budget
+**Severity:** MAJOR
+
+**Issue:**
+Summarisation guidance lacks maximum length and priority ordering.
+
+**Recommendation:**
+Add explicit 150-word cap per summarised skill and priority ordering (tier +
+match count). Never summarise security-review.
+
+---
+## Finding 5 — MAJOR: Conflict resolver can block on user input during wave execution
+
+**File:** .mindforge/engine/skills/conflict-resolver.md
+**Category:** Skills Loader
+**Severity:** MAJOR
+
+**Issue:**
+Type 4 conflicts instruct "ask the user", which is impossible for subagents
+in wave execution.
+
+**Recommendation:**
+If conflict cannot be resolved without user input during execution, load neither
+skill, log to AUDIT, and defer to next interactive session.
+
+---
+## Finding 6 — MAJOR: Registry lacks parsing guidance and missing-manifest behavior
+
+**File:** .mindforge/engine/skills/registry.md
+**Category:** Registry
+**Severity:** MAJOR
+
+**Issue:**
+Registry specifies table contents but does not describe table parsing. It also
+omits a path for when MANIFEST.md does not yet exist.
+
+**Recommendation:**
+Add explicit table parsing rules and an auto-create path for first install.
+
+---
+## Finding 7 — MAJOR: Skills command missing safety and validation steps
+
+**File:** .claude/commands/mindforge/skills.md
+**Category:** Commands
+**Severity:** MAJOR
+
+**Issue:**
+`list` does not show path; `validate` does not enforce self-check section;
+`add` lacks confirmation of manifest entry; `update` does not run tests.
+
+**Recommendation:**
+Add path (or --verbose), enforce self-check, add confirmation preview, and run
+skills-platform tests after update.
+
+---
+## Finding 8 — MAJOR: Security scan patterns and redaction incomplete
+
+**File:** .claude/commands/mindforge/security-scan.md
+**Category:** Security
+**Severity:** MAJOR
+
+**Issue:**
+SSRF detection only covers `req.body.url`; secret patterns miss Azure/GCP; and
+redaction scope is unclear for reports.
+
+**Recommendation:**
+Expand SSRF patterns, add Azure/GCP secret patterns, and explicitly redact in
+console AND report output.
+
+---
+## Finding 9 — MAJOR: Map-codebase scalability and DRAFT convention handling
+
+**File:** .claude/commands/mindforge/map-codebase.md
+**Category:** Commands
+**Severity:** MAJOR
+
+**Issue:**
+Architecture subagent reads all files in large codebases; DRAFT conventions are
+not warned in STATE.md; temp directory cleanup only at end.
+
+**Recommendation:**
+Add sampling for large repos, add DRAFT warning in STATE.md, clean temp at start.
+
+---
+## Finding 10 — MAJOR: Discuss-phase lacks multi-domain support and strong auto warning
+
+**Files:** .claude/commands/mindforge/discuss-phase.md, .claude/commands/mindforge/plan-phase.md
+**Category:** Commands
+**Severity:** MAJOR
+
+**Issue:**
+Discuss-phase only covers primary domain; --auto warning too mild; plan-phase does
+not resolve CONTEXT.md open questions.
+
+**Recommendation:**
+Support multi-domain question sets, strengthen auto warning, and update plan-phase
+ to read CONTEXT.md and resolve open questions before planning.
+
+---
+## Finding 11 — MAJOR: Performance skill missing key guidance and caveats
+
+**File:** .mindforge/skills/performance/SKILL.md
+**Category:** Skill Content
+**Severity:** MAJOR
+
+**Issue:**
+Missing DB result caching, pool sizing, SSR/SSG guidance. Latency targets and
+cache TTLs are presented as universal instead of defaults.
+
+**Recommendation:**
+Add caveats and missing guidance.
+
+---
+## Finding 12 — MAJOR: Accessibility skill missing WCAG 2.2, focus order, reduced motion
+
+**File:** .mindforge/skills/accessibility/SKILL.md
+**Category:** Skill Content
+**Severity:** MAJOR
+
+**Issue:**
+Missing WCAG 2.2 AA criteria, DOM vs visual focus order, ARIA required props
+examples, and reduced-motion guidance.
+
+**Recommendation:**
+Add these sections and notes.
+
+---
+## Finding 13 — MAJOR: Data-privacy skill missing consent withdrawal and retention guidance
+
+**File:** .mindforge/skills/data-privacy/SKILL.md
+**Category:** Skill Content
+**Severity:** MAJOR
+
+**Issue:**
+Missing consent withdrawal requirement, retention examples, erasure vs
+anonymisation distinction, and language-agnostic note.
+
+**Recommendation:**
+Add these clarifications.
+
+---
+## Finding 14 — MAJOR: Incident-response skill missing author ownership and human approval
+
+**File:** .mindforge/skills/incident-response/SKILL.md
+**Category:** Skill Content
+**Severity:** MAJOR
+
+**Issue:**
+Postmortem author ownership is unclear for AI draft; missing explicit human
+approval for automated mitigations; monitoring section lacks instrumentation
+placement.
+
+**Recommendation:**
+Clarify author ownership, require human approval for P0 automation, and
+specify service-boundary instrumentation.
+
+---
+## Finding 15 — MAJOR: Database-patterns missing UUIDv7 guidance and SQL example
+
+**File:** .mindforge/skills/database-patterns/SKILL.md
+**Category:** Skill Content
+**Severity:** MAJOR
+
+**Issue:**
+Missing UUIDv7/ULID guidance, no framework-agnostic SQL N+1 example, and no
+transaction isolation guidance for financial operations.
+
+**Recommendation:**
+Add UUIDv7 guidance, SQL example, and SERIALIZABLE note.
+
+---
+## Finding 16 — MAJOR: Tests missing stronger validations
+
+**File:** tests/skills-platform.test.js
+**Category:** Tests
+**Severity:** MAJOR
+
+**Issue:**
+Trigger minimum too low, missing command content smoke tests, missing manifest
+path validation, and missing loader ordering checks.
+
+**Recommendation:**
+Raise trigger minimum to 10, add content marker checks, add manifest path
+resolution test, and add a loader ordering/priority check.
+
+---
+## Review Status
+**NOT APPROVED** — fix BLOCKING and MAJOR findings above.

package/.planning/slack-threads.json

@@ -0,0 +1,6 @@
+{
+  "schema_version": "1.0.0",
+  "channel_id": null,
+  "threads": {},
+  "_warning": "Do not store tokens in this file."
+}

package/CHANGELOG.md

@@ -0,0 +1,175 @@
+# Changelog
+
+All notable changes to MindForge are documented here.
+Format follows [Keep a Changelog](https://keepachangelog.com).
+
+## [1.0.0] — v1.0.0 First Stable Public Release — 2026-03-22
+
+🎉 **MindForge v1.0.0 — Enterprise Agentic Framework — First Stable Release**
+Release published: v1.0.0 (GitHub Releases).
+
+Built over 7 focused sprints, MindForge transforms Claude Code and Antigravity
+from powerful-but-unstructured AI tools into production-grade engineering
+partners with full governance, observability, and enterprise integration.
+
+### What ships in v1.0.0
+
+**36 commands** across 7 workflow categories  
+**10 core skill packs** with three-tier registry (Core/Org/Project)  
+**8 specialised agent personas** covering all engineering roles  
+**Wave-based parallel execution** with dependency graph and automatic compaction  
+**Enterprise integrations**: Jira, Confluence, Slack, GitHub, GitLab  
+**Three-tier governance**: Tier 1 (auto) / Tier 2 (peer review) / Tier 3 (compliance)  
+**Five non-bypassable compliance gates** (secret detection, CRITICAL findings, tests, CVEs, GDPR)  
+**Intelligence layer**: health engine, difficulty scorer, anti-pattern detector, team profiling  
+**Public skills registry**: npm-based `mindforge-skill-*` ecosystem  
+**CI/CD integration**: GitHub Actions, GitLab CI, Jenkins adapters  
+**@mindforge/sdk**: TypeScript SDK with client, event stream, and command builders  
+**Monorepo support**: npm/pnpm/Nx/Turborepo/Lerna workspace detection  
+**AI PR Review**: Claude API-powered code review with context loading  
+**Self-update mechanism**: version check, changelog diff, scope-preserving apply  
+**Version migration engine**: schema migration from v0.1.0 through v1.0.0  
+**Plugin system**: extensible via `mindforge-plugin-*` npm namespace  
+**Token usage optimiser**: profiling and efficiency strategies  
+**50-point production readiness checklist**: fully verified before this release  
+
+**20 Architecture Decision Records** documenting every major design choice  
+**15 test suites** with 3× consecutive run requirement  
+**Complete reference documentation**: commands, security, ADR index, threat model  
+
+### Stable interface contract
+See ADR-020. All 36 commands, HANDOFF.json schema, AUDIT event types,
+@mindforge/sdk exports, and plugin.json format are stable in 1.x.x.
+
+### Breaking changes from 0.6.0
+- VERIFY_PASS_RATE_WARNING_THRESHOLD in MINDFORGE.md is now 0.0-1.0 (was 0-100)
+  Run `/mindforge:migrate` to auto-convert
+- AUDIT.jsonl session_id field is now required (auto-backfilled by migration)
+- HANDOFF.json plugin_api_version field required for plugin compatibility
+
+### Installation
+```bash
+npx mindforge-cc@latest
+# or
+npx mindforge-cc@1.0.0 --claude --global
+```
+
+## [0.6.0] — Day 6 Distribution Platform
+
+### Added
+- Public skills registry: `npx mindforge-skills install/publish/search` (npm-based)
+- Skill validator: 3-level validation schema (schema, content, quality)
+- MINDFORGE.md JSON Schema: validation with non-overridable field markers
+- MindForge CI mode: GitHub Actions / GitLab CI / Jenkins integration
+- GitHub Actions workflow: health, security, quality, AI review jobs
+- AI PR Review Engine: Claude API-powered code review with context loading
+- Monorepo/workspace support: npm/pnpm/Nx/Turborepo/Lerna detection
+- Cross-package planner: topological execution order for monorepo phases
+- @mindforge/sdk: TypeScript SDK with client, event stream, and command builders
+- SSE event stream: real-time progress events via Server-Sent Events
+- /mindforge:init-org — organisation-wide MindForge setup command
+- /mindforge:install-skill — install skill from public/private registry
+- /mindforge:publish-skill — publish skill to npm registry
+- /mindforge:pr-review — AI code review powered by Claude API
+- /mindforge:workspace — monorepo workspace management
+- /mindforge:benchmark — skill effectiveness benchmarking
+- 3 new ADRs: ADR-015 npm registry, ADR-016 CI timeout, ADR-017 localhost SDK
+
+### Hardened
+- Registry: TOCTOU-safe temp directory (chmod 700), tarball size verification
+- CI: timeout exits with code 0 (soft stop), clear Tier 3 block messages
+- SDK: localhost-only SSE binding, Linux inotify fallback
+- AI review: robust daily limit (parse error tolerant), file-based diff truncation
+- Monorepo: affected package detection uses manifest paths (not depth assumption)
+
+## [0.5.0] — Day 5 Intelligence Layer
+
+### Added
+- framework health engine with 7-category diagnostics and safe auto-repair guidance
+- smart context compaction with Level 1/2/3 protocols and structured handoff extraction
+- phase difficulty scorer with weighted composite and task-granularity feedback
+- anti-pattern detection engine with false-positive controls for C01/B03/D01
+- skill gap analyzer for pre-planning capability coverage checks
+- team profile system and per-developer profile templates
+- metrics schema and quality tracker (`session`, `phase`, `skill usage`, `compaction quality`)
+- project constitution file: `MINDFORGE.md`
+- setup wizard modules: environment detection, idempotent config generation, interactive flow
+- 4 new commands: `/mindforge:health`, `/mindforge:retrospective`,
+  `/mindforge:profile-team`, `/mindforge:metrics`
+- 3 ADRs: ADR-012, ADR-013, ADR-014
+- new Day 5 test suites: `tests/intelligence.test.js`, `tests/metrics.test.js`
+
+### Changed
+- CLAUDE runtime contract now includes Day 5 intelligence behavior and
+  non-overridable MINDFORGE enforcement
+- package entrypoint now points to setup wizard
+
+### Fixed
+- AUDIT corruption handling now quarantines invalid lines instead of deleting entries
+- wizard reliability improvements: stdin TTY fallback, end-of-flow credential guidance,
+  and idempotent config replacement behavior
+
+## [0.4.0] — Day 4 Enterprise Integrations and Governance
+
+### Added
+- enterprise integration specs for Jira, Confluence, Slack, GitHub, and GitLab
+- integration connection manager with credential hygiene and retry guidance
+- governance layer: change classification, approvals, and compliance gates
+- multi-developer handoff and session merger protocols
+- 6 new commands: `/mindforge:audit`, `/mindforge:milestone`,
+  `/mindforge:complete-milestone`, `/mindforge:approve`,
+  `/mindforge:sync-jira`, `/mindforge:sync-confluence`
+- Day 4 test suites: `tests/integrations.test.js`, `tests/governance.test.js`
+- enterprise setup and governance guide docs
+
+### Changed
+- README and CLAUDE entrypoint updated for enterprise governance workflows
+- audit schema expanded for integration and governance events
+
+### Fixed
+- Jira transition handling now documents dynamic transition lookup instead of
+  hardcoded IDs
+- governance tiering now covers code-content matches and audit-history escalation
+
+## [0.3.0] — Day 3 Skills Platform
+
+### Added
+- 5 new core skill packs: performance, accessibility, data-privacy,
+  incident-response, database-patterns
+- Skills distribution engine: registry, loader, versioning, conflict resolver
+- 5 new commands: /mindforge:skills, /mindforge:review, /mindforge:security-scan,
+  /mindforge:map-codebase, /mindforge:discuss-phase
+- Persona customisation override system (project and phase level)
+- Skills Manifest (MANIFEST.md) with tier-based registration
+- Skills Authoring Guide for creating org and project skills
+- Injection guard for Tier 2/3 skill validation
+
+### Changed
+- execute-phase now uses multi-tier skills loading
+- plan-phase now reads CONTEXT.md from discuss-phase if available
+- CLAUDE.md updated with skills platform and new command awareness
+
+### Fixed
+- cursor pagination correctness in database-patterns skill (compound cursor)
+
+## [0.2.0] — Day 2 Wave Engine
+
+### Added
+- Wave-based parallel execution engine
+- Dependency parser and wave grouper
+- Context injector with minimum-context principle
+- Compaction protocol (automated at 70% context)
+- AUDIT.jsonl append-only pipeline with full schema
+- 4 new commands: /mindforge:next, /mindforge:quick, /mindforge:status, /mindforge:debug
+
+## [0.1.0] — Day 1 Foundation
+
+### Added
+- Core directory scaffold
+- CLAUDE.md agent entry point
+- 8 agent persona definitions
+- 5 initial core skill packs
+- 6 slash commands: help, init-project, plan-phase, execute-phase, verify-phase, ship
+- npm installer (npx mindforge-cc)
+- State management: STATE.md, HANDOFF.json
+- Org context templates: ORG.md, CONVENTIONS.md, SECURITY.md, TOOLS.md

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 [Your name]
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/MINDFORGE.md

@@ -0,0 +1,76 @@
+# MINDFORGE.md — Project Constitution
+
+## NON-OVERRIDABLE RULES (read-only — these cannot be changed in MINDFORGE.md)
+
+The following CLAUDE.md behaviors are governance primitives and cannot be
+disabled or overridden by MINDFORGE.md:
+
+- Security auto-trigger for auth/payment/PII changes
+- Plan-first rule (no implementation without a PLAN)
+- Secret detection gate
+- AUDIT writing requirement
+- Critical security and secret-related quality gates
+
+Any attempted override is ignored and logged.
+
+## Parsing rule for multiline values
+Values wrapped in triple quotes are parsed as a verbatim multi-line string from
+the first `"""` to the next `"""`.
+
+## Model validation
+If a configured model is unavailable, fallback to `inherit` and warn.
+
+## Project identity
+NAME=MindForge
+VERSION=1.0.0
+DESCRIPTION=Enterprise agentic framework with intelligence and observability layer
+MINDFORGE_VERSION_REQUIRED=1.0.0
+
+## Model preferences
+PLANNER_MODEL=claude-opus-4-5
+EXECUTOR_MODEL=claude-sonnet-4-5
+REVIEWER_MODEL=claude-sonnet-4-5
+VERIFIER_MODEL=claude-sonnet-4-5
+SECURITY_MODEL=claude-opus-4-5
+DEBUG_MODEL=claude-opus-4-5
+
+## Execution behavior
+TIER1_AUTO_APPROVE=true
+WAVE_CONFIRMATION_REQUIRED=false
+AUTO_DISCUSS_PHASE=false
+VERIFY_PASS_RATE_WARNING_THRESHOLD=0.75
+COMPACTION_THRESHOLD_PCT=70
+MAX_TASKS_PER_PHASE=15
+
+## Quality standards
+MIN_TEST_COVERAGE_PCT=80
+MAX_FUNCTION_LINES=40
+MAX_CYCLOMATIC_COMPLEXITY=10
+REQUIRE_ADR_FOR_ALL_DECISIONS=false
+BLOCK_ON_MEDIUM_SECURITY_FINDINGS=false
+
+## Skills behavior
+ALWAYS_LOAD_SKILLS=security-review
+DISABLED_SKILLS=
+MAX_FULL_SKILL_INJECTIONS=3
+
+## Governance
+DISCUSS_PHASE_REQUIRED_ABOVE_DIFFICULTY=3.5
+ANTIPATTERN_SENSITIVITY=standard
+BLOCK_ON_HIGH_ANTIPATTERNS=false
+
+## Project-specific agent instructions
+ADDITIONAL_AGENT_INSTRUCTIONS="""
+- Check packages/shared before creating utilities.
+- Backend middleware semantics follow Fastify conventions.
+- Keep dependency direction one-way from frontend to backend APIs.
+- Prefer date-fns for date manipulation.
+"""
+
+## Project-specific forbidden patterns
+PROJECT_FORBIDDEN_PATTERNS="""
+- No direct DB access from frontend packages
+- No synchronous I/O in API handlers
+- No console.log in API services
+- No TODO comments in committed code
+"""

package/README.md

@@ -0,0 +1,182 @@
+# MindForge — Enterprise Agentic Framework (v1.0.0)
+
+MindForge turns Claude Code and Antigravity into production-grade engineering
+partners with governance, observability, and a disciplined workflow engine.
+Release published: v1.0.0 (GitHub Releases).
+
+```bash
+npx mindforge-cc@latest
+```
+
+---
+
+## Why MindForge
+AI coding agents degrade over long sessions. Context fills up. Quality drops.
+Decisions get forgotten. MindForge fixes that with:
+
+- **Context engineering** — structured project state, always current
+- **Role personas** — specialised agent modes for each task type
+- **Skills** — just-in-time domain knowledge loaded on demand
+- **Wave execution** — parallelism with dependency safety
+- **Quality gates** — compliance and security are non-bypassable
+- **Audit trail** — append-only history of every action
+
+---
+
+## Install
+
+### Claude Code (global)
+```bash
+npx mindforge-cc@latest --claude --global
+```
+
+### Claude Code (local)
+```bash
+npx mindforge-cc@latest --claude --local
+```
+
+### Antigravity
+```bash
+npx mindforge-cc@latest --antigravity --global
+```
+
+### Both runtimes
+```bash
+npx mindforge-cc@latest --all --global
+```
+
+---
+
+## Verify
+Open Claude Code or Antigravity in your project directory and run:
+```
+/mindforge:health
+```
+If issues are found, run:
+```
+/mindforge:health --repair
+```
+
+---
+
+## Quick start (new project)
+```
+/mindforge:init-project
+/mindforge:plan-phase 1
+/mindforge:execute-phase 1
+/mindforge:verify-phase 1
+/mindforge:ship 1
+```
+
+## Quick start (existing codebase)
+```
+/mindforge:map-codebase
+/mindforge:plan-phase 1
+```
+
+---
+
+## Core workflow
+```
+/ mindforge:init-project
+    → Requirements interview
+    → Creates PROJECT.md, REQUIREMENTS.md, STATE.md
+
+/ mindforge:plan-phase 1
+    → Discuss scope and decisions
+    → Research domain (parallel)
+    → Create atomic XML task plans
+
+/ mindforge:execute-phase 1
+    → Wave-based parallel execution
+    → One commit per task
+    → Automated verification
+
+/ mindforge:verify-phase 1
+    → Human acceptance testing
+    → Debug agent on failures
+    → UAT sign-off
+
+/ mindforge:ship 1
+    → Changelog generation
+    → Final quality gates
+    → PR creation
+```
+
+---
+
+## Updates and migrations
+```
+/mindforge:update
+/mindforge:update --apply
+/mindforge:migrate --from v0.6.0 --to v1.0.0
+```
+
+---
+
+## Plugin system (v1.0.0)
+Plugins extend MindForge via the `mindforge-plugin-*` namespace.
+
+```
+/mindforge:plugins list
+/mindforge:plugins install mindforge-plugin-<name>
+/mindforge:plugins validate
+```
+
+---
+
+## Token usage profiling
+```
+/mindforge:tokens --profile
+```
+See `.mindforge/production/token-optimiser.md`.
+
+---
+
+## Documentation
+- **User Guide:** `docs/user-guide.md`
+- **Troubleshooting:** `docs/troubleshooting.md`
+- **CI Quickstart:** `docs/ci-quickstart.md`
+- **Requirements:** `docs/requirements.md`
+- **Quick verify:** `docs/quick-verify.md`
+- **Upgrade guide:** `docs/upgrade.md`
+- **FAQ:** `docs/faq.md`
+- **Release notes:** `RELEASENOTES.md`
+- **Release checklist guide:** `docs/release-checklist-guide.md`
+- **USPs and features:** `docs/usp-features.md`
+- **Full tutorial:** `docs/tutorial.md`
+- **Commands:** `docs/reference/commands.md`
+- **Config reference:** `docs/reference/config-reference.md`
+- **SDK:** `docs/reference/sdk-api.md`
+- **Skills:** `docs/reference/skills-api.md`
+- **Audit events:** `docs/reference/audit-events.md`
+- **Security:** `docs/security/SECURITY.md`
+- **Threat model:** `docs/security/threat-model.md`
+- **Architecture:** `docs/architecture/README.md`
+- **Contributing:** `docs/contributing/CONTRIBUTING.md`
+
+---
+
+## What ships in v1.0.0
+- 36 commands across 7 workflow categories
+- 10 core skill packs with a three-tier registry (Core/Org/Project)
+- 8 specialised agent personas
+- Wave-based execution with dependency graph and compaction
+- Enterprise integrations: Jira, Confluence, Slack, GitHub, GitLab
+- Three-tier governance with 5 non-bypassable compliance gates
+- Intelligence layer: health engine, difficulty scoring, anti-pattern detection
+- Public skills registry and plugin system
+- @mindforge/sdk with event stream and command builders
+- 15 test suites, production checklist, and threat model
+
+---
+
+## Security
+MindForge never stores credentials in files. Review:
+- `docs/security/SECURITY.md`
+- `docs/security/threat-model.md`
+
+---
+
+## License
+MIT