mindforge-cc 11.0.0 → 11.2.1

package/bin/governance/ztai-manager.js

@@ -5,6 +5,7 @@
 
 const crypto = require('node:crypto');
 const { promisify } = require('node:util');
+const configManager = require('./config-manager');
 
 const generateKeyPair = promisify(crypto.generateKeyPair);
 
@@ -64,7 +65,7 @@ class SecureEnclaveProvider extends KeyProvider {
   }
 
   async generate(did) {
-    console.log(`[ZTAI-HSM] Provisioning protected identity enclave for ${did}...`);
+    console.log(`[ZTAI-HSM-SIM] Provisioning simulated (in-process) identity enclave for ${did}...`);
     const { publicKey, privateKey } = await generateKeyPair('ed25519');
     const pubPEM = publicKey.export({ type: 'spki', format: 'pem' });
     
@@ -81,7 +82,7 @@ class SecureEnclaveProvider extends KeyProvider {
     const record = this.enclaveStore.get(did);
     if (!record) throw new Error(`Enclave record not found for ${did}`);
     
-    console.log(`[ZTAI-HSM] Delegating signature to hardware enclave [DID: ${did}]`);
+    console.log(`[ZTAI-HSM-SIM] Signing via simulated in-process enclave (NOT a hardware HSM/TPM) [DID: ${did}]`);
     
     // Simulate enclave "wrapping" or "sealing" logic
     const signature = crypto.sign(null, Buffer.from(data), record.privateKey);
@@ -92,7 +93,7 @@ class SecureEnclaveProvider extends KeyProvider {
   }
 
   async rotate(did) {
-    console.log(`[ZTAI-HSM] Rotating enclave keys for ${did}...`);
+    console.log(`[ZTAI-HSM-SIM] Rotating simulated enclave keys for ${did}...`);
     return this.generate(did);
   }
 
@@ -147,6 +148,34 @@ class ZTAIManager {
     };
   }
 
+  /**
+   * Selects a key provider for a given trust tier.
+   *
+   * UC-24: All tiers route to REAL crypto by default — Tier 1-2 use the
+   * in-memory Ed25519 provider, Tier 3+ use the (simulated-HSM) enclave
+   * provider which also signs with REAL Ed25519. The SIMULATED post-quantum
+   * lattice provider ('quantum') is NEVER selected on the live trust path
+   * unless the operator has explicitly opted into the demo via
+   * experimental.pqc_demo. This keeps false-assurance signatures off the
+   * default trust path while preserving the demo for explicit exploration.
+   *
+   * @param {number} tier - Trust tier (1-4)
+   * @returns {'local'|'enclave'|'quantum'}
+   */
+  _selectProvider(tier) {
+    const pqcDemo = configManager.get('experimental.pqc_demo', false) === true;
+
+    // Tier 4+ MAY use the simulated lattice provider, but only when the
+    // operator has explicitly enabled the PQC demo. Otherwise it falls back to
+    // the real-Ed25519 enclave provider so the trust path stays verifiable.
+    if (tier >= 4) {
+      return pqcDemo ? 'quantum' : 'enclave';
+    }
+
+    // Tier 3 agents use the SecureEnclaveProvider (real Ed25519).
+    return tier >= 3 ? 'enclave' : 'local';
+  }
+
   /**
    * Registers a new agent and assigns a provider based on Trust Tier.
    * @param {string} persona - Agent persona identifier
@@ -157,8 +186,7 @@ class ZTAIManager {
     const uuid = crypto.randomUUID();
     const did = `did:mindforge:${uuid}`;
 
-    // Tier 3 agents use the SecureEnclaveProvider
-    const providerType = tier >= 3 ? 'enclave' : 'local';
+    const providerType = this._selectProvider(tier);
     const provider = this.providers[providerType];
 
     const publicKeyPEM = await provider.generate(did);

package/bin/hindsight-injector.js

@@ -21,17 +21,16 @@ class HindsightInjector {
       // 1. Rollback .planning directory
       TemporalHub.rollbackTo(auditId);
 
-      // 2. Append the "Hindsight" event to AUDIT.jsonl
+      // 2. Append the "Hindsight" event to AUDIT.jsonl via the unified, hash-chained,
+      //    durable append (UC-04b) so this entry links into the single verifiable chain.
+      const { appendAuditEntrySync } = require('./autonomous/audit-writer');
       const auditPath = path.join(process.cwd(), '.planning', 'AUDIT.jsonl');
-      const hindsightEvent = {
-        id:          require('crypto').randomBytes(8).toString('hex'),
-        timestamp:   new Date().toISOString(),
+      const hindsightEvent = appendAuditEntrySync(auditPath, {
         event:       'hindsight_injected',
         target_id:   auditId,
         description: fixDescription,
         agent:       'temporal-hub'
-      };
-      fs.appendFileSync(auditPath, JSON.stringify(hindsightEvent) + '\n');
+      });
 
       // 3. Mark the state as "ready_for_regeneration"
       const statePath = path.join(process.cwd(), '.planning', 'auto-state.json');

package/bin/hooks/instinct-capture-hook.js

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+'use strict';
+/**
+ * MindForge — Instinct Auto-Capture Hook (UC-11)
+ * Invoked as a PostToolUse hook. Reads hook event JSON from stdin,
+ * detects successful task completions, and appends lightweight instinct
+ * entries to the configured store path.
+ *
+ * Session capture limit is enforced via a temp counter file to avoid
+ * flooding the store with low-signal entries.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const os = require('os');
+
+// ── Configuration ────────────────────────────────────────────────────────────
+
+const CONFIG_PATH = path.join(process.cwd(), '.mindforge', 'config.json');
+const SESSION_ID = process.env.MINDFORGE_SESSION_ID || process.ppid || 'default';
+const SESSION_COUNTER_PATH = path.join(
+  os.tmpdir(),
+  `mindforge-instinct-session-${SESSION_ID}.count`
+);
+
+function loadConfig() {
+  try {
+    const raw = fs.readFileSync(CONFIG_PATH, 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function getSessionCount() {
+  try {
+    const raw = fs.readFileSync(SESSION_COUNTER_PATH, 'utf8');
+    return parseInt(raw, 10) || 0;
+  } catch {
+    return 0;
+  }
+}
+
+function incrementSessionCount() {
+  const current = getSessionCount();
+  fs.writeFileSync(SESSION_COUNTER_PATH, String(current + 1));
+}
+
+// ── Success Detection ────────────────────────────────────────────────────────
+
+function isSuccessfulCompletion(payload) {
+  const tool = (payload.tool_name || payload.tool || '').toLowerCase();
+
+  // Bash tool with exit code 0
+  if (tool === 'bash') {
+    const exitCode = payload.exit_code ?? payload.result?.exit_code ?? null;
+    if (exitCode === 0) return true;
+    // If no explicit exit code but has output and no error marker
+    if (exitCode === null && payload.output && !payload.error) return true;
+    return false;
+  }
+
+  // Task tool with completed status
+  if (tool === 'task') {
+    const status = (payload.status || payload.result?.status || '').toLowerCase();
+    return status === 'completed' || status === 'done';
+  }
+
+  return false;
+}
+
+// ── Pattern Extraction ───────────────────────────────────────────────────────
+
+function extractPattern(payload) {
+  const tool = (payload.tool_name || payload.tool || '').toLowerCase();
+
+  if (tool === 'bash') {
+    const command = payload.command || payload.input?.command || payload.tool_input?.command || '';
+    if (!command || command.length < 5) return null;
+    // Skip trivial commands
+    if (/^(ls|pwd|echo|cat|cd)\b/.test(command.trim())) return null;
+    return {
+      observation: `Bash command succeeded: ${command.slice(0, 200)}`,
+      behavior: `Use pattern: ${command.slice(0, 200)}`,
+    };
+  }
+
+  if (tool === 'task') {
+    const description = payload.description || payload.task_description || payload.name || '';
+    if (!description) return null;
+    return {
+      observation: `Task completed successfully: ${description.slice(0, 200)}`,
+      behavior: `Reuse approach for similar tasks: ${description.slice(0, 200)}`,
+    };
+  }
+
+  return null;
+}
+
+// ── Main ─────────────────────────────────────────────────────────────────────
+
+function main() {
+  const config = loadConfig();
+  if (!config || !config.instincts) {
+    process.exit(0);
+  }
+
+  const { mode, max_capture_per_session, store_path } = config.instincts;
+  if (mode !== 'auto-capture') {
+    process.exit(0);
+  }
+
+  // Check session limit
+  const sessionCount = getSessionCount();
+  if (sessionCount >= (max_capture_per_session || 5)) {
+    process.exit(0);
+  }
+
+  // Read stdin (hook payload)
+  let input = '';
+  try {
+    input = fs.readFileSync(0, 'utf8');
+  } catch {
+    process.exit(0);
+  }
+
+  if (!input.trim()) {
+    process.exit(0);
+  }
+
+  let payload;
+  try {
+    payload = JSON.parse(input);
+  } catch {
+    process.exit(0);
+  }
+
+  // Check if this is a successful completion
+  if (!isSuccessfulCompletion(payload)) {
+    process.exit(0);
+  }
+
+  // Extract pattern
+  const pattern = extractPattern(payload);
+  if (!pattern) {
+    process.exit(0);
+  }
+
+  // Build instinct entry
+  const entry = {
+    id: `inst-${crypto.randomUUID()}`,
+    created_at: new Date().toISOString(),
+    updated_at: new Date().toISOString(),
+    observation: pattern.observation,
+    behavior: pattern.behavior,
+    confidence: 0.3,
+    times_applied: 0,
+    times_succeeded: 0,
+    times_failed: 0,
+    project: 'mindforge',
+    tags: [],
+    status: 'active',
+    promoted_to_skill: null,
+    last_applied_at: null,
+    source: 'auto-capture',
+  };
+
+  // Write to store
+  const storePath = path.resolve(process.cwd(), store_path);
+  const storeDir = path.dirname(storePath);
+
+  try {
+    if (!fs.existsSync(storeDir)) {
+      fs.mkdirSync(storeDir, { recursive: true });
+    }
+    fs.appendFileSync(storePath, JSON.stringify(entry) + '\n');
+    incrementSessionCount();
+  } catch {
+    // Non-fatal — hooks must not block
+  }
+
+  process.exit(0);
+}
+
+main();

package/bin/installer-core.js

@@ -95,6 +95,25 @@ const RUNTIMES = {
   },
 };
 
+/**
+ * Reads the target project's experimental.pqc_demo flag — the SINGLE gate that
+ * the engine (bin/governance/quantum-crypto.js) uses to enable the simulated
+ * PQAS minter. Defaults to false (engine default) when the config is absent or
+ * unreadable, so the installer never over-claims that PQAS is enabled.
+ * @param {string} cwd - Target project root being installed into.
+ * @returns {boolean} - true only when experimental.pqc_demo === true.
+ */
+function isPqcDemoEnabled(cwd) {
+  try {
+    const cfgPath = path.join(cwd, '.mindforge', 'config.json');
+    if (!fs.existsSync(cfgPath)) return false;
+    const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+    return cfg && cfg.experimental && cfg.experimental.pqc_demo === true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Generates runtime-specific entry file content.
  * e.g. replacing "Claude" with "Gemini" in GEMINI.md
@@ -650,9 +669,19 @@ async function install(runtime, scope, options = {}) {
       }
     });
 
-    // ✨ SOVEREIGN INITIALIZATION: Mark project as PQAS & Proactive enabled
+    // ✨ SOVEREIGN INITIALIZATION: report actual security posture honestly.
+    // The PQAS minter is gated SOLELY behind experimental.pqc_demo (see
+    // bin/governance/quantum-crypto.js: getProvider/_assertPqcDemoEnabled). When
+    // that flag is off (the default) PQAS is inert/simulated — claiming it is
+    // "enabled" would contradict the engine and mislead operators (UC-22).
     Theme.printStatus(c.magenta('Sovereign Intelligence v8.2.0 activated'), 'done');
-    Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS) enabled'), 'info');
+    if (isPqcDemoEnabled(process.cwd())) {
+      Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS): SIMULATED demo ENABLED '
+        + '(experimental.pqc_demo=true — simulated lattice crypto, NOT production trust)'), 'info');
+    } else {
+      Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS): available in simulated/experimental '
+        + 'mode (inactive by default — set experimental.pqc_demo=true to enable the simulated demo)'), 'info');
+    }
     Theme.printStatus(c.dim('  - Proactive Semantic Intent Harvesting active'), 'info');
 
     // bin/ utilities (remaining non-engine scripts)

package/bin/memory/auto-shadow.js

@@ -18,6 +18,8 @@ const path     = require('path');
 const Store    = require('./knowledge-store');
 const Graph    = require('./knowledge-graph');
 const Embedder = require('./embedding-engine');
+const Indexer  = require('./knowledge-indexer');
+const { fuseResults } = require('./retrieval-fusion');
 
 // ── Configuration ─────────────────────────────────────────────────────────────
 const MAX_SHADOW_CHARS  = 8000;    // ~2KB tokens
@@ -63,13 +65,40 @@ function generateShadowContext(opts = {}) {
 
   const { vectors, df, N } = Embedder.buildEmbeddings(activeEntries);
 
-  // 2. Hybrid query: embedding similarity + graph traversal
+  // 2. Multi-path retrieval with RRF fusion (UC-20)
+  //    Path 1: Knowledge Graph (embedding + graph traversal)
+  //    Path 2: Knowledge Indexer (BM25 + confidence)
+  //    Results are fused via Reciprocal Rank Fusion for scale-free merging.
   const queryText = `${taskDescription} ${techStack.join(' ')}`;
-  const related = Graph.findRelated(queryText, vectors, df, N, {
+  const fetchK = maxItems * 3; // Over-fetch for filtering headroom
+
+  const graphResults = Graph.findRelated(queryText, vectors, df, N, {
     maxHops: 2,
-    topK: maxItems * 2, // Over-fetch for filtering
+    topK: fetchK,
   });
 
+  let indexerResults = [];
+  try {
+    const rawIndexer = Indexer.search(queryText, { includeGlobal: true }, fetchK);
+    indexerResults = rawIndexer.map((entry, rank) => ({
+      id: entry.id,
+      score: entry.confidence || 0,
+      source: 'indexer',
+    }));
+  } catch {
+    // Indexer may fail on empty store — non-fatal
+  }
+
+  // RRF fusion: merge both ranked lists by ordinal position
+  const fusedResults = fuseResults([graphResults, indexerResults]);
+
+  // Map fused results back to the legacy shape expected downstream
+  const related = fusedResults.map(item => ({
+    id: item.id,
+    score: item.rrfScore, // RRF score replaces incomparable linear blends
+    source: item.source || 'fused',
+  }));
+
   // 3. Filter and enrich results
   const excludeSet = new Set(excludeIds);
   const enriched = [];

package/bin/memory/eis-client.js

@@ -100,10 +100,48 @@ class EISClient {
     return [];
   }
 
-  // TODO: implement when remote nodes are available
+  /**
+   * Verifies the provenance of a remote knowledge entry by cryptographically
+   * checking its signature against the signer DID's registered public key.
+   *
+   * HONEST / FAIL-CLOSED CONTRACT (UC-22, finding #22): this method NEVER
+   * returns true for a signature it has not actually verified. It returns true
+   * ONLY when ZTAI.verifySignature confirms the signature against a public key
+   * that is resolvable in the local trust registry. Every other case fails
+   * closed → false:
+   *   - no/empty signature,
+   *   - no signer DID on the entry,
+   *   - the DID is not resolvable here (e.g. a genuinely remote peer whose key
+   *     is not in the local registry — there is no remote DID-resolution infra
+   *     yet, see resolveRemoteNode),
+   *   - tampered payload or signature (crypto.verify returns false / throws).
+   *
+   * @param {{did?: string, signedData?: string}} entry - Provenance-bearing entry.
+   *   `did` is the signer's DID; `signedData` is the exact canonical bytes that
+   *   were signed (defaults to a deterministic JSON of the entry if absent).
+   * @param {string} signature - Base64 signature to verify.
+   * @returns {boolean} true only if cryptographically verified; false otherwise.
+   */
   verifyRemoteProvenance(entry, signature) {
-    if (!signature) return false;
-    return true;
+    if (!signature || typeof signature !== 'string') return false;
+    if (!entry || typeof entry !== 'object') return false;
+
+    const did = entry.did;
+    if (!did || typeof did !== 'string') return false;
+
+    // Canonical signed bytes: prefer an explicit signedData field, else a
+    // deterministic JSON of the entry (excluding the signature envelope).
+    const signedData = typeof entry.signedData === 'string'
+      ? entry.signedData
+      : JSON.stringify(entry);
+
+    try {
+      // ZTAI.verifySignature throws for an unresolvable (unregistered) DID —
+      // treat that as fail-closed rather than asserting verified provenance.
+      return ZTAI.verifySignature(did, signedData, signature) === true;
+    } catch {
+      return false;
+    }
   }
 
   // TODO: implement when remote nodes are available
@@ -113,7 +151,10 @@ class EISClient {
 
   /**
    * [HARDEN] Generates a cryptographically signed auth header using the agent's DID.
-   * This ensures verifiable provenance of knowledge within the mesh.
+   * This attaches OUTBOUND provenance to locally-originated requests (it signs
+   * what this node sends). It does NOT verify the provenance of inbound remote
+   * entries — that is verifyRemoteProvenance's job, which fails closed unless a
+   * signature is cryptographically verified against a resolvable public key.
    */
   async getAuthHeader(action, resource) {
     const manager = new ZTAI();

package/bin/memory/identity-synthesizer.js

@@ -25,7 +25,7 @@ class IdentitySynthesizer {
       .replace(/{PROJECT_OBJECTIVE}/g, answers.goal || 'Maximizing engineering leverage');
 
     await fs.writeFile(this.soulPath, soulContent);
-    console.log(`[IDENTITY] SOUL.md bootstrapped successfully from the Grand Blueprint.`);
+    console.log('[IDENTITY] SOUL.md bootstrapped successfully from the Grand Blueprint.');
   }
 
   /**
@@ -41,7 +41,7 @@ class IdentitySynthesizer {
     );
 
     if (traces.length === 0) {
-      console.log(`[IDENTITY] No execution traces found in celestial.db. Evolution skipped.`);
+      console.log('[IDENTITY] No execution traces found in celestial.db. Evolution skipped.');
       return;
     }
 

package/bin/memory/knowledge-store.js

@@ -15,6 +15,30 @@ const path = require('path');
 const os   = require('os');
 const crypto = require('crypto');
 
+// ── Durable append (UC-09) ──────────────────────────────────────────────────
+// The knowledge-store public API (add/deprecate/reinforce) is SYNCHRONOUS and
+// callers read-after-write synchronously (e.g. `const id = Store.add(...)`
+// immediately followed by `Store.readAll()`). Routing through the async
+// append-queue would make those reads observe stale data and would require an
+// API change across 9+ consumers — out of scope for UC-09.
+//
+// Instead we centralize every append through one durable, fsync'd, synchronous
+// writer. This delivers UC-09's durability guarantee (acknowledged writes are on
+// disk before the call returns) and a single serialized append path per file,
+// while preserving the synchronous read-after-write contract. appendFileSync's
+// per-call append is atomic on POSIX, so concurrent in-process appends do not
+// interleave at the byte level.
+function appendDurableSync(filePath, line) {
+  const record = line.endsWith('\n') ? line : line + '\n';
+  const fd = fs.openSync(filePath, 'a');
+  try {
+    fs.writeSync(fd, record);
+    fs.fsyncSync(fd);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 // ── ID Index for fast lookups (built lazily, invalidated on writes) ───────────
 let _idIndex = null;       // Map<id, entry> — latest version per ID
 let _indexDirty = true;    // Invalidated whenever entries are appended
@@ -201,12 +225,12 @@ function add(entry) {
 
   const filePath = getFilePath(entry.type);
   verifyFileIntegrity(filePath);
-  fs.appendFileSync(filePath, JSON.stringify(full) + '\n');
+  appendDurableSync(filePath, JSON.stringify(full));
 
   // Also append to unified knowledge-base.jsonl for cross-type queries
   if (filePath !== paths.KB_PATH) {
     verifyFileIntegrity(paths.KB_PATH);
-    fs.appendFileSync(paths.KB_PATH, JSON.stringify(full) + '\n');
+    appendDurableSync(paths.KB_PATH, JSON.stringify(full));
   }
 
   _invalidateIndex();
@@ -236,10 +260,10 @@ function deprecate(id, reason, supersededBy = null) {
   };
 
   verifyFileIntegrity(filePath);
-  fs.appendFileSync(filePath, JSON.stringify(deprecated) + '\n');
+  appendDurableSync(filePath, JSON.stringify(deprecated));
   if (filePath !== paths.KB_PATH) {
     verifyFileIntegrity(paths.KB_PATH);
-    fs.appendFileSync(paths.KB_PATH, JSON.stringify(deprecated) + '\n');
+    appendDurableSync(paths.KB_PATH, JSON.stringify(deprecated));
   }
 
   _invalidateIndex();
@@ -267,10 +291,10 @@ function reinforce(id) {
 
   const filePath = getFilePath(entry.type);
   verifyFileIntegrity(filePath);
-  fs.appendFileSync(filePath, JSON.stringify(reinforced) + '\n');
+  appendDurableSync(filePath, JSON.stringify(reinforced));
   if (filePath !== paths.KB_PATH) {
     verifyFileIntegrity(paths.KB_PATH);
-    fs.appendFileSync(paths.KB_PATH, JSON.stringify(reinforced) + '\n');
+    appendDurableSync(paths.KB_PATH, JSON.stringify(reinforced));
   }
 
   _invalidateIndex();

package/bin/memory/retrieval-fusion.js

@@ -0,0 +1,58 @@
+'use strict';
+/**
+ * MindForge — Reciprocal Rank Fusion (UC-20).
+ * Merges multiple ranked lists using scale-free RRF scoring.
+ *
+ * RRF eliminates the need for score normalization across retrieval paths
+ * with incomparable scoring functions (embedding similarity, BM25, graph
+ * traversal, FTS rank). Only ordinal rank matters, not score magnitude.
+ *
+ * Formula:
+ *   rrfScore(item) = SUM( 1 / (K + rank_i) ) for all lists containing the item
+ *
+ * Where K=60 is the standard constant from the original RRF paper
+ * (Cormack, Clarke, Butt — 2009).
+ */
+
+const K = 60; // Standard RRF constant — dampens the influence of high ranks
+
+/**
+ * Fuse multiple ranked result lists using Reciprocal Rank Fusion.
+ *
+ * Each list is an array of objects with at least an `id` field.
+ * Items appearing in multiple lists accumulate RRF score and rank higher.
+ *
+ * @param {Array<Array<{id: string, [key: string]: any}>>} rankedLists
+ *   Array of ranked lists. Each list is ordered by relevance (index 0 = most relevant).
+ * @returns {Array<{id: string, rrfScore: number, [key: string]: any}>}
+ *   Fused results sorted by RRF score descending. Each item retains its
+ *   original properties from the first list it appeared in.
+ */
+function fuseResults(rankedLists) {
+  if (!rankedLists || rankedLists.length === 0) return [];
+
+  const scores = new Map(); // id -> merged item with rrfScore
+
+  for (const list of rankedLists) {
+    if (!Array.isArray(list)) continue;
+
+    for (let rank = 0; rank < list.length; rank++) {
+      const item = list[rank];
+      if (!item || !item.id) continue;
+
+      const id = item.id;
+      const rrfContribution = 1 / (K + rank + 1); // rank is 0-based, +1 makes it 1-based
+
+      if (scores.has(id)) {
+        const existing = scores.get(id);
+        existing.rrfScore += rrfContribution;
+      } else {
+        scores.set(id, { ...item, rrfScore: rrfContribution });
+      }
+    }
+  }
+
+  return [...scores.values()].sort((a, b) => b.rrfScore - a.rrfScore);
+}
+
+module.exports = { fuseResults, K };

package/bin/memory/semantic-hub.js

@@ -83,7 +83,7 @@ class SemanticHub {
     try {
       const data = await fs.readFile(this.syncManifest, 'utf8');
       manifest = JSON.parse(data);
-    } catch (e) {}
+    } catch (e) { /* intentionally empty */ }
 
     manifest[libraryName] = {
       lastSync: new Date().toISOString(),
@@ -106,7 +106,7 @@ class SemanticHub {
         sqliteTraces = await vectorHub.searchTraces(skillFilter);
       } else {
         sqliteTraces = vectorHub.query(
-          "SELECT * FROM traces WHERE event = ? LIMIT 20",
+          'SELECT * FROM traces WHERE event = ? LIMIT 20',
           ['reasoning_trace']
         );
       }