mindforge-cc 10.7.0 → 11.2.0

package/bin/dashboard/server.js

@@ -42,12 +42,18 @@ const RevOpsAPI   = require('./revops-api');
 const app = express();
 
 // ── Bearer token authentication ──────────────────────────────────────────────
-const DASHBOARD_TOKEN = crypto.randomBytes(32).toString('hex');
+let currentToken = crypto.randomBytes(32).toString('hex');
 const TOKEN_FILE = path.join(process.cwd(), '.mindforge', '.dashboard-token');
+const TOKEN_EXPIRY_MS = 24 * 60 * 60 * 1000; // 24 hours
+let tokenCreatedAt = Date.now();
+
+function isTokenExpired() {
+  return (Date.now() - tokenCreatedAt) > TOKEN_EXPIRY_MS;
+}
 
 // Write token to file with restrictive permissions (owner-only read/write)
 fs.mkdirSync(path.dirname(TOKEN_FILE), { recursive: true });
-fs.writeFileSync(TOKEN_FILE, DASHBOARD_TOKEN, { mode: 0o600 });
+fs.writeFileSync(TOKEN_FILE, currentToken, { mode: 0o600 });
 
 /**
  * requireAuth — Validates Bearer token on mutating requests (POST/PUT/DELETE).
@@ -56,6 +62,11 @@ fs.writeFileSync(TOKEN_FILE, DASHBOARD_TOKEN, { mode: 0o600 });
 function requireAuth(req, res, next) {
   if (req.method === 'GET' || req.method === 'OPTIONS') return next();
 
+  // Check token expiration first
+  if (isTokenExpired()) {
+    return res.status(401).json({ error: 'token_expired' });
+  }
+
   const authHeader = req.headers.authorization;
   if (!authHeader || !authHeader.startsWith('Bearer ')) {
     return res.status(401).json({
@@ -65,7 +76,9 @@ function requireAuth(req, res, next) {
 
   const provided = authHeader.slice(7);
   // Constant-time comparison to prevent timing attacks
-  if (!crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(DASHBOARD_TOKEN))) {
+  const tokenBuf = Buffer.from(currentToken);
+  const providedBuf = Buffer.from(provided);
+  if (tokenBuf.length !== providedBuf.length || !crypto.timingSafeEqual(providedBuf, tokenBuf)) {
     return res.status(401).json({
       error: 'Authentication required. Use the token printed at dashboard startup.'
     });
@@ -74,6 +87,44 @@ function requireAuth(req, res, next) {
   next();
 }
 
+// ── Rate limiting (100 req/min/IP) ───────────────────────────────────────────
+const rateLimitMap = new Map(); // ip -> { count, resetAt }
+const RATE_LIMIT = 100;
+const RATE_WINDOW_MS = 60000;
+
+function rateLimitMiddleware(req, res, next) {
+  const ip = req.ip || req.connection.remoteAddress;
+  const now = Date.now();
+  let entry = rateLimitMap.get(ip);
+
+  if (!entry || now > entry.resetAt) {
+    entry = { count: 0, resetAt: now + RATE_WINDOW_MS };
+    rateLimitMap.set(ip, entry);
+  }
+
+  entry.count++;
+
+  if (entry.count > RATE_LIMIT) {
+    return res.status(429).json({
+      error: 'rate_limit_exceeded',
+      retry_after_ms: entry.resetAt - now
+    });
+  }
+
+  next();
+}
+
+// Periodically clean stale rate-limit entries to prevent memory growth
+const rateLimitCleanupInterval = setInterval(() => {
+  const now = Date.now();
+  for (const [ip, entry] of rateLimitMap.entries()) {
+    if (now > entry.resetAt) {
+      rateLimitMap.delete(ip);
+    }
+  }
+}, 60000);
+if (rateLimitCleanupInterval.unref) rateLimitCleanupInterval.unref();
+
 // Security middleware
 app.use((req, res, next) => {
   const addr = req.socket.remoteAddress;
@@ -84,6 +135,9 @@ app.use((req, res, next) => {
   next();
 });
 
+// ── Rate limiting — applied after localhost check, before auth ────────────────
+app.use(rateLimitMiddleware);
+
 // CORS — restrict to dashboard's own origin only (prevent cross-origin attacks)
 const DASHBOARD_ORIGIN = `http://127.0.0.1:${PORT}`;
 app.use((req, res, next) => {
@@ -107,7 +161,7 @@ app.use((req, res, next) => {
   res.setHeader('X-Content-Type-Options', 'nosniff');
   res.setHeader('X-Frame-Options', 'DENY');
   res.setHeader('Cache-Control', 'no-store'); // Never cache dashboard responses
-  res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'");
+  res.setHeader('Content-Security-Policy', 'default-src \'self\'; script-src \'self\'; style-src \'self\' \'unsafe-inline\'; connect-src \'self\'');
   res.setHeader('X-XSS-Protection', '1; mode=block');
   res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
   next();
@@ -124,6 +178,15 @@ app.get('/', (req, res) => {
   res.sendFile(FRONTEND);
 });
 
+// ── Token refresh endpoint (requires valid existing token) ───────────────────
+app.post('/api/v1/token/refresh', requireAuth, (req, res) => {
+  const newToken = crypto.randomBytes(32).toString('hex');
+  fs.writeFileSync(TOKEN_FILE, newToken, { mode: 0o600 });
+  tokenCreatedAt = Date.now();
+  currentToken = newToken;
+  res.json({ success: true, token: newToken, expires_in_ms: TOKEN_EXPIRY_MS });
+});
+
 // ── Register API routes ───────────────────────────────────────────────────────
 API.register(app);
 app.use('/api/temporal', TemporalAPI);
@@ -143,7 +206,7 @@ server.listen(PORT, '127.0.0.1', () => {
   console.log(`    Status:  http://localhost:${PORT}/api/status`);
   console.log(`    Events:  http://localhost:${PORT}/events`);
   console.log(`    PID:     ${process.pid}`);
-  console.log(`[Dashboard] Auth token: ${DASHBOARD_TOKEN}`);
+  console.log('[Dashboard] Auth token written to token file (not logged for security).');
   console.log(`    Token file: ${TOKEN_FILE}`);
   console.log('\n    Press CTRL+C to stop\n');
 

package/bin/dashboard/sse-bridge.js

@@ -21,7 +21,6 @@ const APPROVAL_DIR    = path.join(process.cwd(), '.planning', 'approvals');
 const clients = new Set(); // Connected SSE response objects
 
 let _lastAuditSize  = 0;
-let _auditInode     = 0; // Track file inode for rotation detection
 let _lastAutoState  = '';
 let _lastApprovals  = '';
 
@@ -78,16 +77,18 @@ function pollAuditLog() {
   try {
     const stat     = fs.statSync(AUDIT_PATH);
     const newSize  = stat.size;
-    const newIno   = stat.ino;
 
-    // File rotation detected: inode changed or new file is smaller
-    if (newIno !== _auditInode && _auditInode !== 0) {
-      process.stderr.write(`[sse-bridge] AUDIT.jsonl rotation detected (old ino: ${_auditInode}, new ino: ${newIno})\n`);
+    // Truncation / recreation recovery (NOT rotation — audit rotation was retired in
+    // UC-04b because it broke the hash chain; AUDIT.jsonl grows unbounded). If the
+    // file ever SHRINKS (manually truncated, .planning wiped, or replaced), reset the
+    // read offset to 0 so the live tail keeps working instead of stalling forever on
+    // the `newSize <= _lastAuditSize` early-return below or reading at a stale offset.
+    if (newSize < _lastAuditSize) {
+      process.stderr.write(`[sse-bridge] AUDIT.jsonl shrank (size: ${_lastAuditSize} -> ${newSize}) — re-tailing from start\n`);
       _lastAuditSize = 0;
     }
-    _auditInode = newIno;
 
-    if (newSize <= _lastAuditSize) return; // No new data
+    if (newSize <= _lastAuditSize) return;
 
     // Read only the new bytes appended since last poll
     const fd   = fs.openSync(AUDIT_PATH, 'r');
@@ -169,9 +170,7 @@ function startPolling() {
 
   // Initialize AUDIT position on first start
   if (!_initialized && fs.existsSync(AUDIT_PATH)) {
-    const stat = fs.statSync(AUDIT_PATH);
-    _lastAuditSize = stat.size;
-    _auditInode    = stat.ino;
+    _lastAuditSize = fs.statSync(AUDIT_PATH).size;
     _initialized   = true;
   }
 
@@ -207,9 +206,7 @@ function stopPolling() {
 function start() {
   // Pre-initialize AUDIT position so first client gets instant data
   if (!_initialized && fs.existsSync(AUDIT_PATH)) {
-    const stat = fs.statSync(AUDIT_PATH);
-    _lastAuditSize = stat.size;
-    _auditInode    = stat.ino;
+    _lastAuditSize = fs.statSync(AUDIT_PATH).size;
     _initialized   = true;
   }
   // Polling starts lazily when addClient() is called

package/bin/engine/council-runtime.js

@@ -0,0 +1,124 @@
+'use strict';
+/**
+ * MindForge — Council Runtime (UC-10). Thin multi-voice decision harness (ADS).
+ *
+ * Activates the Adversarial Decision Loop (ADS) mandated by CLAUDE.md: instead of
+ * a multi-round debate simulator, this is a THIN runtime — parallel position
+ * collection (one per voice) + consensus scoring + dissent capture.
+ *
+ * The model is INJECTABLE (no hard LLM dependency) so callers/tests can supply a
+ * mock. The Semaphore from wave-executor is reused to bound concurrent voice calls.
+ *
+ * Design decision — NO challenge round (kept thin per adversarial review + YAGNI):
+ * A second model call per dissenter that folds a revised confidence back into the
+ * consensus adds ordering/weighting complexity and extra failure modes without
+ * changing the activation goal. Position-collection + consensus fully satisfies the
+ * ADS loop and the verdict contract. Add a challenge round only if a concrete need
+ * arises (an explicit `opts.challengeRound` flag would be the clean extension point).
+ *
+ * Filenames use opts.decisionId (NOT Date.now(), which is unavailable in some
+ * MindForge execution contexts); falls back to "council-latest.json".
+ */
+const fs = require('fs');
+const path = require('path');
+const { Semaphore } = require('../autonomous/wave-executor');
+
+const DEFAULT_VOICES = ['architect', 'skeptic', 'pragmatist', 'critic'];
+const VALID_RECOMMENDATIONS = ['PROCEED', 'REVISE'];
+
+/**
+ * Validates a single voice's position payload. Throws a clear, voice-named error
+ * on a malformed payload rather than letting it degrade into NaN consensus.
+ * @param {string} voice — The voice that produced the position (for the error message).
+ * @param {object} position — The raw position returned by the model.
+ */
+function validatePosition(voice, position) {
+  if (!position || typeof position !== 'object') {
+    throw new Error(`Council voice "${voice}" returned an invalid position: expected an object, got ${position === null ? 'null' : typeof position}`);
+  }
+  if (!VALID_RECOMMENDATIONS.includes(position.recommendation)) {
+    throw new Error(`Council voice "${voice}" returned an invalid position: recommendation must be one of ${VALID_RECOMMENDATIONS.join('/')}, got ${JSON.stringify(position.recommendation)}`);
+  }
+  if (typeof position.confidence !== 'number' || !Number.isFinite(position.confidence) || position.confidence < 0 || position.confidence > 1) {
+    throw new Error(`Council voice "${voice}" returned an invalid position: confidence must be a number in [0,1], got ${position.confidence}`);
+  }
+}
+
+/**
+ * Runs a thin adversarial council over a question.
+ * @param {string} question — The decision/question put to the council.
+ * @param {object} [opts]
+ * @param {string[]} [opts.voices] — Voice personas to consult (default: 4 ADS voices).
+ * @param {number} [opts.consensusThreshold=0.75] — Threshold for PROCEED/REVISE.
+ * @param {function} opts.model — REQUIRED. async ({voice, question}) =>
+ *   { recommendation: 'PROCEED'|'REVISE', confidence: number(0..1), rationale: string }
+ * @param {number} [opts.maxConcurrency] — Bound on parallel voice calls (default: #voices).
+ * @param {boolean} [opts.writeDecision=true] — Persist a decision record to disk.
+ * @param {string} [opts.outputPath] — Directory for the record (default: .planning/decisions).
+ * @param {string} [opts.decisionId] — Stable id used in the filename (no Date.now()).
+ * @returns {Promise<{question,positions,consensus,verdict,dissent}>}
+ */
+async function runCouncil(question, opts = {}) {
+  const voices = Array.isArray(opts.voices) && opts.voices.length > 0
+    ? opts.voices
+    : DEFAULT_VOICES;
+  const consensusThreshold = opts.consensusThreshold ?? 0.75;
+  const model = opts.model;
+  if (typeof model !== 'function') {
+    throw new Error('runCouncil requires an injectable model function (opts.model)');
+  }
+  const maxConcurrency = opts.maxConcurrency || voices.length;
+
+  // Parallel position collection — bounded by the reused Semaphore.
+  const sem = new Semaphore(maxConcurrency);
+  const positions = await Promise.all(voices.map(async (voice) => {
+    await sem.acquire();
+    try {
+      const position = await model({ voice, question });
+      // Validate the payload immediately — never silently swallow a malformed
+      // position into NaN consensus (which would collapse to NO_CONSENSUS and
+      // write NaN to the decision record).
+      validatePosition(voice, position);
+      return { voice, ...position };
+    } finally {
+      sem.release();
+    }
+  }));
+
+  // Consensus = mean approval signal across voices.
+  // A PROCEED contributes its confidence; a REVISE contributes its inverse
+  // (so a high-confidence REVISE pulls consensus down hard).
+  const consensus = positions.reduce((sum, p) => {
+    const approval = p.recommendation === 'PROCEED' ? p.confidence : (1 - p.confidence);
+    return sum + approval;
+  }, 0) / positions.length;
+
+  const verdict = consensus >= consensusThreshold ? 'PROCEED'
+    : consensus <= (1 - consensusThreshold) ? 'REVISE'
+    : 'NO_CONSENSUS';
+
+  // Dissent capture:
+  // - For a decisive verdict (PROCEED/REVISE): the voices opposing that direction.
+  // - For NO_CONSENSUS (the deadlock ADS most needs documented): the FULL split —
+  //   every voice's {voice, recommendation, rationale} — so the decision record
+  //   preserves both camps rather than recording an empty dissent list.
+  const dissent = verdict === 'NO_CONSENSUS'
+    ? positions.map((p) => ({ voice: p.voice, recommendation: p.recommendation, rationale: p.rationale }))
+    : positions.filter((p) =>
+        (verdict === 'PROCEED' && p.recommendation !== 'PROCEED') ||
+        (verdict === 'REVISE' && p.recommendation === 'PROCEED'))
+      .map((d) => ({ voice: d.voice, rationale: d.rationale }));
+
+  const result = { question, positions, consensus, verdict, dissent };
+
+  if (opts.writeDecision !== false) {
+    const dir = opts.outputPath || path.join(process.cwd(), '.planning', 'decisions');
+    fs.mkdirSync(dir, { recursive: true });
+    const name = opts.decisionId ? `council-${opts.decisionId}.json` : 'council-latest.json';
+    fs.writeFileSync(path.join(dir, name), JSON.stringify(result, null, 2));
+  }
+
+  return result;
+}
+
+module.exports = { runCouncil };

package/bin/engine/feedback-loop.js

@@ -98,6 +98,14 @@ class WaveFeedbackLoop {
     return { shouldPause: false };
   }
 
+  recordRemediationOutcome(remediationId, outcome) {
+    this.recordPerformance(
+      outcome.strategy,
+      'remediation',
+      outcome.effective
+    );
+  }
+
   reset() {
     this.waveState = { completed: 0, failed: 0, skipped: 0, total: 0 };
   }

package/bin/engine/intelligence-interlock.js

@@ -15,24 +15,41 @@ class IntelligenceInterlock {
     this.UPGRADE_THRESHOLD = 0.50; // v6.3.0 Threshold (Recalibrated for IDC readiness)
   }
 
-  /**
-   * Evaluates if a model upgrade is required based on reasoning drift.
-   * @param {string} spanId 
-   * @param {string} thought 
-   */
   evaluate(spanId, thought) {
-    const analysis = driftDetector.analyze(spanId, thought);
-    
-    if (analysis.drift_score > this.UPGRADE_THRESHOLD) {
-      console.log(`[IDC] Critical Drift Detected (${analysis.drift_score}). Recommending intelligence upgrade for Span ${spanId}.`);
-      return {
-        action: 'UPGRADE_MIR',
-        new_mir: 99, // Force maximum intelligence (Tier 1+)
-        reason: analysis.markers
-      };
+    const driftReport = driftDetector.analyze(spanId, thought);
+    const driftScore = driftReport.drift_score;
+
+    if (driftScore <= this.UPGRADE_THRESHOLD) {
+      return { action: 'CONTINUE', drift_score: driftScore };
+    }
+
+    let tierIncrease;
+    if (driftScore > 0.80) {
+      tierIncrease = 'MAX';
+    } else if (driftScore > 0.65) {
+      tierIncrease = 2;
+    } else {
+      tierIncrease = 1;
     }
 
-    return { action: 'CONTINUE', drift: analysis.drift_score };
+    let costWarning = false;
+    try {
+      const CostTracker = require('../models/cost-tracker');
+      const dailySpend = CostTracker.getDailySpend ? CostTracker.getDailySpend() : 0;
+      const hardLimit = CostTracker.getHardLimit ? CostTracker.getHardLimit() : Infinity;
+      if (dailySpend / hardLimit > 0.8) {
+        costWarning = true;
+        tierIncrease = Math.min(tierIncrease === 'MAX' ? 3 : tierIncrease, 1);
+      }
+    } catch { /* cost tracker unavailable */ }
+
+    return {
+      action: 'UPGRADE_MIR',
+      tier_increase: tierIncrease,
+      drift_score: driftScore,
+      cost_constrained: costWarning,
+      reason: driftReport.markers
+    };
   }
 }
 

package/bin/engine/logic-drift-detector.js

@@ -8,10 +8,11 @@
 'use strict';
 
 const configManager = require('../governance/config-manager');
+const { LRUMap } = require('../utils/index');
 
 class LogicDriftDetector {
   constructor() {
-    this.sessionDriftHistory = new Map(); // spanId -> [scores]
+    this.sessionDriftHistory = new LRUMap(500);
     this.DRIFT_THRESHOLD = configManager.get('governance.drift_threshold', 0.75);
     this.CRITICAL_DRIFT_THRESHOLD = configManager.get('governance.critical_drift_threshold', 0.50);
   }

package/bin/engine/nexus-tracer.js

@@ -16,6 +16,7 @@ const remediationEngine = require('./remediation-engine'); // v6.1 Pillar X
 const logicValidator = require('./logic-validator'); // v7 Pillar X
 const vectorHub = require('../memory/vector-hub'); // v8 Pillar XV
 const { AuditWriter } = require('../utils/file-io');
+const { LRUMap } = require('../utils/index');
 
 class NexusTracer {
   constructor(config = {}) {
@@ -29,8 +30,8 @@ class NexusTracer {
     this.vhInitialized = false;
 
     // v7: Centralized Thresholds
-    this.RES_THRESHOLD = configManager.get('governance.res_threshold', 0.8); 
-    this.entropyCache = new Map(); 
+    this.RES_THRESHOLD = configManager.get('governance.res_threshold', 0.8);
+    this.entropyCache = new LRUMap(1000);
 
     // v9: Async Audit Writer (replaces sync appendFileSync)
     this._auditWriter = new AuditWriter(this.auditPath);

package/bin/engine/otel-exporter.js

@@ -0,0 +1,123 @@
+'use strict';
+/**
+ * MindForge — OTel GenAI Exporter (UC-18).
+ * Translates NexusTracer spans to OpenTelemetry GenAI semantic conventions.
+ * Active only when OTEL_EXPORTER_OTLP_ENDPOINT is set.
+ *
+ * NexusTracer span shape (from nexus-tracer.js startSpan/endSpan):
+ *   {
+ *     id: 'sp_<hex>',
+ *     trace_id: 'tr_<hex>',
+ *     parent_id: string|null,
+ *     name: string,
+ *     status: 'active'|'success'|'error',
+ *     start_time: ISO-8601,
+ *     end_time: ISO-8601,
+ *     attributes: {
+ *       service: string,
+ *       host: string,
+ *       pid: number,
+ *       model_id?: string,
+ *       skill?: string,
+ *       input_tokens?: number,
+ *       output_tokens?: number,
+ *       ...
+ *     }
+ *   }
+ *
+ * Mapping to OTel GenAI semantic conventions:
+ *   span.name → name
+ *   span.attributes.model_id → gen_ai.request.model, gen_ai.response.model
+ *   span.attributes.input_tokens → gen_ai.usage.input_tokens
+ *   span.attributes.output_tokens → gen_ai.usage.output_tokens
+ *   span.name → gen_ai.operation.name
+ *   'mindforge' → gen_ai.system (or span.attributes.provider if present)
+ */
+
+const crypto = require('crypto');
+
+/**
+ * Check if the OTel exporter is enabled (env var gate).
+ * @returns {boolean}
+ */
+function isEnabled() {
+  return !!process.env.OTEL_EXPORTER_OTLP_ENDPOINT;
+}
+
+/**
+ * Translate a NexusTracer span to OTel GenAI-compatible format.
+ * Produces a valid 16-byte hex traceId and 8-byte hex spanId.
+ *
+ * @param {object} nexusSpan - A span object from NexusTracer
+ * @returns {object} OTel-compatible span object
+ */
+function toOtelSpan(nexusSpan) {
+  const attrs = nexusSpan.attributes || {};
+
+  return {
+    traceId: crypto.randomBytes(16).toString('hex'),
+    spanId: crypto.randomBytes(8).toString('hex'),
+    parentSpanId: nexusSpan.parent_id || '',
+    name: nexusSpan.name || 'unknown',
+    kind: 1, // SPAN_KIND_INTERNAL
+    startTimeUnixNano: nexusSpan.start_time
+      ? BigInt(new Date(nexusSpan.start_time).getTime()) * 1_000_000n
+      : 0n,
+    endTimeUnixNano: nexusSpan.end_time
+      ? BigInt(new Date(nexusSpan.end_time).getTime()) * 1_000_000n
+      : 0n,
+    status: nexusSpan.status === 'success' ? { code: 1 } : { code: 2 },
+    attributes: {
+      'gen_ai.system': attrs.provider || 'mindforge',
+      'gen_ai.request.model': attrs.model_id || '',
+      'gen_ai.response.model': attrs.model_id || '',
+      'gen_ai.usage.input_tokens': attrs.input_tokens || 0,
+      'gen_ai.usage.output_tokens': attrs.output_tokens || 0,
+      'gen_ai.operation.name': nexusSpan.name || '',
+      'service.name': attrs.service || 'mindforge-nexus',
+    },
+  };
+}
+
+/**
+ * Serialize BigInt values to strings for JSON compatibility.
+ * @param {object} otelSpan
+ * @returns {object}
+ */
+function toJsonSafe(otelSpan) {
+  return {
+    ...otelSpan,
+    startTimeUnixNano: String(otelSpan.startTimeUnixNano),
+    endTimeUnixNano: String(otelSpan.endTimeUnixNano),
+  };
+}
+
+/**
+ * Export a NexusTracer span to the OTel-compatible local file.
+ * In production, this would POST to OTEL_EXPORTER_OTLP_ENDPOINT/v1/traces.
+ * For now, appends to .mindforge/metrics/otel-spans.jsonl for verification.
+ *
+ * @param {object} nexusSpan - A span from NexusTracer
+ */
+async function exportSpan(nexusSpan) {
+  if (!isEnabled()) return;
+
+  const otelSpan = toOtelSpan(nexusSpan);
+  const jsonSafe = toJsonSafe(otelSpan);
+
+  const fs = require('fs');
+  const path = require('path');
+  const outPath = path.join(process.cwd(), '.mindforge', 'metrics', 'otel-spans.jsonl');
+
+  try {
+    const dir = path.dirname(outPath);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.appendFileSync(outPath, JSON.stringify(jsonSafe) + '\n');
+  } catch {
+    // Non-fatal: observability export should never break the main flow
+  }
+}
+
+module.exports = { isEnabled, toOtelSpan, toJsonSafe, exportSpan };