mindforge-cc 11.3.0 → 11.3.1

package/.mindforge/org/integrations/INTEGRATIONS-CONFIG.md

@@ -0,0 +1,58 @@
+# MindForge Integrations Configuration
+# IMPORTANT: Never store API tokens, passwords, or private keys in this file.
+# Credentials belong in environment variables or a managed secrets service.
+
+## Jira Configuration
+JIRA_BASE_URL=https://your-org.atlassian.net
+JIRA_PROJECT_KEY=ENG
+JIRA_EPIC_LABEL=mindforge-phase
+JIRA_STORY_TYPE=Story
+JIRA_BUG_TYPE=Bug
+JIRA_STORY_POINTS_FIELD=story_points
+
+## Confluence Configuration
+CONFLUENCE_BASE_URL=https://your-org.atlassian.net/wiki
+CONFLUENCE_SPACE_KEY=ENG
+CONFLUENCE_ARCHITECTURE_PAGE_TITLE=MindForge Architecture
+CONFLUENCE_ADR_PARENT_PAGE_TITLE=Architecture Decision Records
+CONFLUENCE_PHASE_DOCS_PARENT_PAGE_TITLE=Sprint Documentation
+CONFLUENCE_AUTO_PUBLISH=false
+
+## Slack Configuration
+SLACK_CHANNEL_ID=C01234ABCDE
+SLACK_NOTIFY_ON=phase_complete,security_finding,approval_needed,blocker
+SLACK_MENTION_ON_CRITICAL=@oncall
+SLACK_USE_THREADS=true
+
+## Governance Configuration
+TIER2_APPROVERS=senior-engineer-1,senior-engineer-2,tech-lead
+TIER3_APPROVERS=security-officer,compliance-officer,cto
+EMERGENCY_APPROVERS=cto,vp-engineering
+TIER2_SLA_HOURS=24
+TIER3_SLA_HOURS=4
+TIER2_ESCALATE_AFTER_HOURS=48
+TIER3_ESCALATE_AFTER_HOURS=8
+TIER2_EXPIRY_HOURS=48
+TIER3_EXPIRY_HOURS=8
+ESCALATION_CONTACT=engineering-lead@your-org.com
+ESCALATION_SLACK_CHANNEL=C0ESCALATE
+
+## GitHub Configuration
+GITHUB_REPO=your-org/your-repo
+GITHUB_DEFAULT_BRANCH=main
+GITHUB_REQUIRED_REVIEWERS=2
+GITHUB_DEFAULT_REVIEWERS=senior-engineer-1,senior-engineer-2
+GITHUB_PR_TEMPLATE_PATH=.github/pull_request_template.md
+GITHUB_DRAFT_BY_DEFAULT=false
+
+## GitLab Configuration
+GITLAB_PROJECT_ID=
+GITLAB_DEFAULT_BRANCH=main
+GITLAB_DEFAULT_REVIEWERS=
+
+## Notification Preferences
+NOTIFY_PHASE_COMPLETE=true
+NOTIFY_SECURITY_CRITICAL=true
+NOTIFY_APPROVAL_NEEDED=true
+NOTIFY_MILESTONE_COMPLETE=true
+NOTIFY_BLOCKER_ADDED=true

package/.mindforge/org/skills/MANIFEST.md

@@ -0,0 +1,255 @@
+# MindForge Skills Manifest
+
+schema version: 2.0.0
+
+This file tracks all active, validated, and legacy skills within the MindForge ecosystem.
+
+## Core Skills (Tier 1)
+
+| Skill | Path | Status |
+|-------|------|--------|
+| security-review | .mindforge/skills/security-review/SKILL.md | stable |
+| code-quality | .mindforge/skills/code-quality/SKILL.md | stable |
+| api-design | .mindforge/skills/api-design/SKILL.md | stable |
+| testing-standards | .mindforge/skills/testing-standards/SKILL.md | stable |
+| documentation | .mindforge/skills/documentation/SKILL.md | stable |
+| performance | .mindforge/skills/performance/SKILL.md | stable |
+| accessibility | .mindforge/skills/accessibility/SKILL.md | stable |
+| data-privacy | .mindforge/skills/data-privacy/SKILL.md | stable |
+| incident-response | .mindforge/skills/incident-response/SKILL.md | stable |
+| database-patterns | .mindforge/skills/database-patterns/SKILL.md | stable |
+| agent-loops | .mindforge/skills/agent-loops/SKILL.md | stable |
+| multi-llm-consult | .mindforge/skills/multi-llm-consult/SKILL.md | stable |
+| continuous-learning | .mindforge/skills/continuous-learning/SKILL.md | stable |
+| council | .mindforge/skills/council/SKILL.md | stable |
+| verification-loop | .mindforge/skills/verification-loop/SKILL.md | stable |
+| threat-modeling | .mindforge/skills/threat-modeling/SKILL.md | stable |
+| autonomous-loops | .mindforge/skills/autonomous-loops/SKILL.md | stable |
+| agent-introspection-debugging | .mindforge/skills/agent-introspection-debugging/SKILL.md | stable |
+| cost-aware-routing | .mindforge/skills/cost-aware-routing/SKILL.md | stable |
+| doc-health-audit | .mindforge/skills/doc-health-audit/SKILL.md | stable |
+| santa-method | .mindforge/skills/santa-method/SKILL.md | stable |
+| eval-harness | .mindforge/skills/eval-harness/SKILL.md | stable |
+| quality-audit | .mindforge/skills/quality-audit/SKILL.md | stable |
+| testing-anti-patterns | .mindforge/skills/testing-anti-patterns/SKILL.md | stable |
+| defense-in-depth | .mindforge/skills/defense-in-depth/SKILL.md | stable |
+| codebase-onboarding | .mindforge/skills/codebase-onboarding/SKILL.md | stable |
+| rfc-pipeline | .mindforge/skills/rfc-pipeline/SKILL.md | stable |
+| de-sloppify | .mindforge/skills/de-sloppify/SKILL.md | stable |
+| skill-creator-meta | .mindforge/skills/skill-creator-meta/SKILL.md | stable |
+| deployment-workflow | .mindforge/skills/deployment-workflow/SKILL.md | stable |
+| dmux-workflows | .mindforge/skills/dmux-workflows/SKILL.md | stable |
+| vibe-security | .mindforge/skills/vibe-security/SKILL.md | stable |
+| instinct-clustering | .mindforge/skills/instinct-clustering/SKILL.md | stable |
+| microservices-patterns | .mindforge/skills/microservices-patterns/SKILL.md | stable |
+| cqrs-event-sourcing | .mindforge/skills/cqrs-event-sourcing/SKILL.md | stable |
+| system-design | .mindforge/skills/system-design/SKILL.md | stable |
+| business-analyst | .mindforge/skills/business-analyst/SKILL.md | stable |
+| product-manager | .mindforge/skills/product-manager/SKILL.md | stable |
+| market-researcher | .mindforge/skills/market-researcher/SKILL.md | stable |
+| typescript-advanced | .mindforge/skills/typescript-advanced/SKILL.md | stable |
+| python-performance | .mindforge/skills/python-performance/SKILL.md | stable |
+| react-performance | .mindforge/skills/react-performance/SKILL.md | stable |
+| k8s-deployment | .mindforge/skills/k8s-deployment/SKILL.md | stable |
+| writing-plans | .mindforge/skills/writing-plans/SKILL.md | stable |
+| writing-skills | .mindforge/skills/writing-skills/SKILL.md | stable |
+| using-git-worktrees | .mindforge/skills/using-git-worktrees/SKILL.md | stable |
+| code-tour | .mindforge/skills/code-tour/SKILL.md | stable |
+| autonomous-agent-harness | .mindforge/skills/autonomous-agent-harness/SKILL.md | stable |
+| mcp-server-patterns | .mindforge/skills/mcp-server-patterns/SKILL.md | stable |
+| proofreader | .mindforge/skills/proofreader/SKILL.md | stable |
+| prompt-engineering | .mindforge/skills/prompt-engineering/SKILL.md | stable |
+| context-engineering | .mindforge/skills/context-engineering/SKILL.md | stable |
+| agent-orchestration-patterns | .mindforge/skills/agent-orchestration-patterns/SKILL.md | stable |
+| tool-design | .mindforge/skills/tool-design/SKILL.md | stable |
+| guardrails-and-safety | .mindforge/skills/guardrails-and-safety/SKILL.md | stable |
+| observability-stack | .mindforge/skills/observability-stack/SKILL.md | stable |
+| ci-cd-pipeline | .mindforge/skills/ci-cd-pipeline/SKILL.md | stable |
+| infrastructure-as-code | .mindforge/skills/infrastructure-as-code/SKILL.md | stable |
+| incident-management | .mindforge/skills/incident-management/SKILL.md | stable |
+| chaos-engineering | .mindforge/skills/chaos-engineering/SKILL.md | stable |
+| data-modeling | .mindforge/skills/data-modeling/SKILL.md | stable |
+| api-versioning | .mindforge/skills/api-versioning/SKILL.md | stable |
+| search-implementation | .mindforge/skills/search-implementation/SKILL.md | stable |
+| design-system | .mindforge/skills/design-system/SKILL.md | stable |
+| state-management | .mindforge/skills/state-management/SKILL.md | stable |
+| responsive-patterns | .mindforge/skills/responsive-patterns/SKILL.md | stable |
+| auth-patterns | .mindforge/skills/auth-patterns/SKILL.md | stable |
+| supply-chain-security | .mindforge/skills/supply-chain-security/SKILL.md | stable |
+| technical-writing | .mindforge/skills/technical-writing/SKILL.md | stable |
+| code-review-methodology | .mindforge/skills/code-review-methodology/SKILL.md | stable |
+| contract-testing | .mindforge/skills/contract-testing/SKILL.md | stable |
+| load-testing | .mindforge/skills/load-testing/SKILL.md | stable |
+| mutation-testing | .mindforge/skills/mutation-testing/SKILL.md | stable |
+| visual-regression-testing | .mindforge/skills/visual-regression-testing/SKILL.md | stable |
+| monorepo-management | .mindforge/skills/monorepo-management/SKILL.md | stable |
+| cli-design | .mindforge/skills/cli-design/SKILL.md | stable |
+| developer-onboarding | .mindforge/skills/developer-onboarding/SKILL.md | stable |
+| error-handling-architecture | .mindforge/skills/error-handling-architecture/SKILL.md | stable |
+| caching-strategies | .mindforge/skills/caching-strategies/SKILL.md | stable |
+| migration-strategies | .mindforge/skills/migration-strategies/SKILL.md | stable |
+| connection-pooling | .mindforge/skills/connection-pooling/SKILL.md | stable |
+| event-driven-architecture | .mindforge/skills/event-driven-architecture/SKILL.md | stable |
+| api-gateway-patterns | .mindforge/skills/api-gateway-patterns/SKILL.md | stable |
+| websocket-patterns | .mindforge/skills/websocket-patterns/SKILL.md | stable |
+| feature-flag-management | .mindforge/skills/feature-flag-management/SKILL.md | stable |
+| secrets-rotation | .mindforge/skills/secrets-rotation/SKILL.md | stable |
+| compliance-as-code | .mindforge/skills/compliance-as-code/SKILL.md | stable |
+| rag-architecture | .mindforge/skills/rag-architecture/SKILL.md | stable |
+| fine-tuning-workflow | .mindforge/skills/fine-tuning-workflow/SKILL.md | stable |
+| llm-cost-optimization | .mindforge/skills/llm-cost-optimization/SKILL.md | stable |
+| streaming-architecture | .mindforge/skills/streaming-architecture/SKILL.md | stable |
+| queue-design | .mindforge/skills/queue-design/SKILL.md | stable |
+| real-time-sync | .mindforge/skills/real-time-sync/SKILL.md | stable |
+| cost-estimation | .mindforge/skills/cost-estimation/SKILL.md | stable |
+| technical-debt-management | .mindforge/skills/technical-debt-management/SKILL.md | stable |
+| capacity-planning | .mindforge/skills/capacity-planning/SKILL.md | stable |
+| graceful-degradation | .mindforge/skills/graceful-degradation/SKILL.md | stable |
+| idempotency-patterns | .mindforge/skills/idempotency-patterns/SKILL.md | stable |
+| rate-limiting-design | .mindforge/skills/rate-limiting-design/SKILL.md | stable |
+| code-generation-patterns | .mindforge/skills/code-generation-patterns/SKILL.md | stable |
+| dependency-management | .mindforge/skills/dependency-management/SKILL.md | stable |
+| git-workflow-design | .mindforge/skills/git-workflow-design/SKILL.md | stable |
+| i18n-architecture | .mindforge/skills/i18n-architecture/SKILL.md | stable |
+| a11y-testing | .mindforge/skills/a11y-testing/SKILL.md | stable |
+| multi-tenancy-patterns | .mindforge/skills/multi-tenancy-patterns/SKILL.md | stable |
+| audit-logging | .mindforge/skills/audit-logging/SKILL.md | stable |
+| database-performance | .mindforge/skills/database-performance/SKILL.md | stable |
+| bundle-optimization | .mindforge/skills/bundle-optimization/SKILL.md | stable |
+| graphql-patterns | .mindforge/skills/graphql-patterns/SKILL.md | stable |
+| pagination-patterns | .mindforge/skills/pagination-patterns/SKILL.md | stable |
+| build-vs-buy | .mindforge/skills/build-vs-buy/SKILL.md | stable |
+| technology-radar | .mindforge/skills/technology-radar/SKILL.md | stable |
+| architecture-tradeoff-analysis | .mindforge/skills/architecture-tradeoff-analysis/SKILL.md | stable |
+| technical-interview-design | .mindforge/skills/technical-interview-design/SKILL.md | stable |
+| post-incident-learning | .mindforge/skills/post-incident-learning/SKILL.md | stable |
+| team-topology-design | .mindforge/skills/team-topology-design/SKILL.md | stable |
+| sprint-retrospective-facilitation | .mindforge/skills/sprint-retrospective-facilitation/SKILL.md | stable |
+| knowledge-sharing-systems | .mindforge/skills/knowledge-sharing-systems/SKILL.md | stable |
+| estimation-techniques | .mindforge/skills/estimation-techniques/SKILL.md | stable |
+| on-call-design | .mindforge/skills/on-call-design/SKILL.md | stable |
+| experiment-design | .mindforge/skills/experiment-design/SKILL.md | stable |
+| analytics-instrumentation | .mindforge/skills/analytics-instrumentation/SKILL.md | stable |
+| notification-system-design | .mindforge/skills/notification-system-design/SKILL.md | stable |
+| payment-integration | .mindforge/skills/payment-integration/SKILL.md | stable |
+| email-deliverability | .mindforge/skills/email-deliverability/SKILL.md | stable |
+| agent-memory-design | .mindforge/skills/agent-memory-design/SKILL.md | stable |
+| agent-evaluation-framework | .mindforge/skills/agent-evaluation-framework/SKILL.md | stable |
+| multi-turn-conversation-design | .mindforge/skills/multi-turn-conversation-design/SKILL.md | stable |
+| agent-tool-selection | .mindforge/skills/agent-tool-selection/SKILL.md | stable |
+| human-in-the-loop-design | .mindforge/skills/human-in-the-loop-design/SKILL.md | stable |
+| edge-computing | .mindforge/skills/edge-computing/SKILL.md | stable |
+| serverless-patterns | .mindforge/skills/serverless-patterns/SKILL.md | stable |
+| container-security | .mindforge/skills/container-security/SKILL.md | stable |
+| zero-trust-architecture | .mindforge/skills/zero-trust-architecture/SKILL.md | stable |
+| ai-agent-deployment | .mindforge/skills/ai-agent-deployment/SKILL.md | stable |
+| distributed-consensus | .mindforge/skills/distributed-consensus/SKILL.md | stable |
+| data-pipeline-design | .mindforge/skills/data-pipeline-design/SKILL.md | stable |
+| dns-architecture | .mindforge/skills/dns-architecture/SKILL.md | stable |
+| cdn-optimization | .mindforge/skills/cdn-optimization/SKILL.md | stable |
+| database-sharding-advanced | .mindforge/skills/database-sharding-advanced/SKILL.md | stable |
+
+## Multi-Agent Skills
+
+- [x] agency-agents-orchestrator (Tier 1)
+- [x] agency-senior-developer (Tier 1)
+- [x] agency-software-architect (Tier 1)
+
+## Enterprise Governance
+
+- [x] sovereign-integrity-checker (v6.2.0)
+- [x] proactive-intent-harvester (v6.2.0)
+
+## Knowledge Base
+
+- [ ] project-specific-knowledge
+
+## v10.2.0 — Industry Forge
+
+| Skill | Path | Status |
+|-------|------|--------|
+| healthcare-systems | .mindforge/skills/healthcare-systems/SKILL.md | stable |
+| fintech-patterns | .mindforge/skills/fintech-patterns/SKILL.md | stable |
+| ecommerce-architecture | .mindforge/skills/ecommerce-architecture/SKILL.md | stable |
+| gaming-backend | .mindforge/skills/gaming-backend/SKILL.md | stable |
+| edtech-platform | .mindforge/skills/edtech-platform/SKILL.md | stable |
+| saas-multi-tenant | .mindforge/skills/saas-multi-tenant/SKILL.md | stable |
+| media-streaming | .mindforge/skills/media-streaming/SKILL.md | stable |
+| iot-platform | .mindforge/skills/iot-platform/SKILL.md | stable |
+| marketplace-trust | .mindforge/skills/marketplace-trust/SKILL.md | stable |
+| logistics-optimization | .mindforge/skills/logistics-optimization/SKILL.md | stable |
+
+## v10.3.0 — Leader's Edge
+
+| Skill | Path | Status |
+|-------|------|--------|
+| technical-leadership | .mindforge/skills/technical-leadership/SKILL.md | stable |
+| mentoring-patterns | .mindforge/skills/mentoring-patterns/SKILL.md | stable |
+| stakeholder-communication | .mindforge/skills/stakeholder-communication/SKILL.md | stable |
+| conflict-resolution | .mindforge/skills/conflict-resolution/SKILL.md | stable |
+| incident-communication | .mindforge/skills/incident-communication/SKILL.md | stable |
+| hiring-engineering | .mindforge/skills/hiring-engineering/SKILL.md | stable |
+| delegation-patterns | .mindforge/skills/delegation-patterns/SKILL.md | stable |
+| meeting-architecture | .mindforge/skills/meeting-architecture/SKILL.md | stable |
+| performance-reviews | .mindforge/skills/performance-reviews/SKILL.md | stable |
+| change-management | .mindforge/skills/change-management/SKILL.md | stable |
+
+## v10.4.0 — Cross-Platform
+
+| Skill | Path | Status |
+|-------|------|--------|
+| react-native-patterns | .mindforge/skills/react-native-patterns/SKILL.md | stable |
+| flutter-architecture | .mindforge/skills/flutter-architecture/SKILL.md | stable |
+| offline-first-design | .mindforge/skills/offline-first-design/SKILL.md | stable |
+| progressive-web-app | .mindforge/skills/progressive-web-app/SKILL.md | stable |
+| mobile-performance | .mindforge/skills/mobile-performance/SKILL.md | stable |
+| cross-platform-testing | .mindforge/skills/cross-platform-testing/SKILL.md | stable |
+| app-store-deployment | .mindforge/skills/app-store-deployment/SKILL.md | stable |
+| mobile-security | .mindforge/skills/mobile-security/SKILL.md | stable |
+| responsive-native | .mindforge/skills/responsive-native/SKILL.md | stable |
+| push-notification-architecture | .mindforge/skills/push-notification-architecture/SKILL.md | stable |
+
+## v10.5.0 — AI Frontier
+
+| Skill | Path | Status |
+|-------|------|--------|
+| multimodal-ai | .mindforge/skills/multimodal-ai/SKILL.md | stable |
+| ai-safety-alignment | .mindforge/skills/ai-safety-alignment/SKILL.md | stable |
+| synthetic-data-generation | .mindforge/skills/synthetic-data-generation/SKILL.md | stable |
+| model-evaluation | .mindforge/skills/model-evaluation/SKILL.md | stable |
+| embedding-systems | .mindforge/skills/embedding-systems/SKILL.md | stable |
+| llm-orchestration | .mindforge/skills/llm-orchestration/SKILL.md | stable |
+| knowledge-graphs | .mindforge/skills/knowledge-graphs/SKILL.md | stable |
+| ml-feature-store | .mindforge/skills/ml-feature-store/SKILL.md | stable |
+| ai-cost-management | .mindforge/skills/ai-cost-management/SKILL.md | stable |
+| autonomous-agents | .mindforge/skills/autonomous-agents/SKILL.md | stable |
+
+## v10.6.0 — Data Alchemy
+
+| Skill | Path | Status |
+|-------|------|--------|
+| causal-inference | .mindforge/skills/causal-inference/SKILL.md | stable |
+| feature-engineering | .mindforge/skills/feature-engineering/SKILL.md | stable |
+| ml-monitoring | .mindforge/skills/ml-monitoring/SKILL.md | stable |
+| data-governance | .mindforge/skills/data-governance/SKILL.md | stable |
+| stream-processing | .mindforge/skills/stream-processing/SKILL.md | stable |
+| data-lakehouse | .mindforge/skills/data-lakehouse/SKILL.md | stable |
+| experiment-platform | .mindforge/skills/experiment-platform/SKILL.md | stable |
+| data-mesh | .mindforge/skills/data-mesh/SKILL.md | stable |
+| real-time-analytics | .mindforge/skills/real-time-analytics/SKILL.md | stable |
+| data-privacy-engineering | .mindforge/skills/data-privacy-engineering/SKILL.md | stable |
+
+## v10.7.0 — Platform Sovereign
+
+| Skill | Path | Status |
+|-------|------|--------|
+| internal-developer-platform | .mindforge/skills/internal-developer-platform/SKILL.md | stable |
+| self-serve-infrastructure | .mindforge/skills/self-serve-infrastructure/SKILL.md | stable |
+| platform-reliability | .mindforge/skills/platform-reliability/SKILL.md | stable |
+| developer-productivity-metrics | .mindforge/skills/developer-productivity-metrics/SKILL.md | stable |
+| api-marketplace | .mindforge/skills/api-marketplace/SKILL.md | stable |
+| build-system-optimization | .mindforge/skills/build-system-optimization/SKILL.md | stable |
+| secrets-platform | .mindforge/skills/secrets-platform/SKILL.md | stable |
+| environment-management | .mindforge/skills/environment-management/SKILL.md | stable |
+| platform-observability | .mindforge/skills/platform-observability/SKILL.md | stable |
+| migration-platform | .mindforge/skills/migration-platform/SKILL.md | stable |

package/.mindforge/plugins/PLUGINS-MANIFEST.md

@@ -0,0 +1,23 @@
+# MindForge Plugins Manifest
+# Schema version: 1.0.0
+# This file is managed by /mindforge:plugins install|uninstall
+
+## Installed plugins
+
+| Name | Version | Status | Min MindForge | Permissions |
+|---|---|---|---|---|
+| (no plugins installed) | | | | |
+
+## Available plugins (public registry)
+
+Search: `npm search mindforge-plugin`
+Install: `/mindforge:plugins install [plugin-name]`
+
+## Plugin development
+
+To create a plugin: see `docs/contributing/plugin-authoring.md`
+To publish:        `npm publish --access public`
+To validate:       `node bin/validate-config.js --type plugin ./plugin.json`
+
+## Hooks registry
+(populated automatically when plugins with hooks are installed)

package/.mindforge/plugins/plugin-loader.md

@@ -0,0 +1,93 @@
+# MindForge Plugin System — Loader Protocol
+
+## Loading sequence (runs at session start)
+
+### Step 1 — Discover installed plugins
+```bash
+MANIFEST=".mindforge/plugins/PLUGINS-MANIFEST.md"
+[ -f "${MANIFEST}" ] || { echo "No plugins installed"; return; }
+
+# Extract plugin names from manifest table rows
+PLUGINS=$(grep "^| " "${MANIFEST}" | grep -v "^| Name" | grep -v "none" | \
+  awk -F'|' '{gsub(/[[:space:]]/, "", $2); print $2}' | grep -v '^$')
+```
+
+### Step 2 — Validate each installed plugin
+
+For each installed plugin directory at `.mindforge/plugins/[plugin-name]/`:
+
+1. **plugin.json exists and is valid JSON**
+2. **plugin_api_version compatibility**: read `plugin.json mindforge.plugin_api_version`
+   and verify it matches the current supported API version (`1.0.0`)
+3. **min_mindforge_version compatibility**: verify current MindForge version satisfies minimum
+4. **Injection guard**: run against all command, skill, and persona `.md` files in the plugin
+   - If injection patterns found: do NOT load. Log AUDIT entry, alert user
+5. **Level 1 + Level 2 validation**: for every `SKILL.md` in the plugin
+
+**Permission model note:** permissions are advisory, not OS‑enforced. They are
+declared for user trust decisions and logged in `AUDIT.jsonl`. Governance gates
+still apply to all plugin actions.
+
+### Step 3 — Load plugin components
+
+**Commands:**
+```bash
+# Detect currently installed built-in command names (dynamic, not hardcoded)
+get_reserved_command_names() {
+  ls ".claude/commands/mindforge/"*.md 2>/dev/null | \
+    xargs -I{} basename {} .md | \
+    sort
+}
+
+RESERVED_NAMES=$(get_reserved_command_names)
+
+for CMD_FILE in ".mindforge/plugins/[plugin]/commands/"*.md; do
+  CMD_NAME=$(basename "${CMD_FILE}" .md)
+
+  # Check for conflict with reserved names
+  if echo "${RESERVED_NAMES}" | grep -q "^${CMD_NAME}$"; then
+    FINAL_NAME="${PLUGIN_NAME}-${CMD_NAME}"
+    echo "  ⚠️  Command '${CMD_NAME}' conflicts with built-in — renaming to '${FINAL_NAME}'"
+  else
+    FINAL_NAME="${CMD_NAME}"
+  fi
+
+  cp "${CMD_FILE}" ".claude/commands/mindforge/${FINAL_NAME}.md"
+  cp "${CMD_FILE}" ".agent/mindforge/${FINAL_NAME}.md"
+done
+```
+
+**Skills:** Registered in MANIFEST.md under Tier 2 section (prefix: `[plugin-name]-`)
+
+**Personas:** Installed as `.mindforge/personas/[plugin-name]-[persona].md`
+
+**Hooks:** Registered in `.mindforge/plugins/hooks-registry.md`
+
+Hook execution order:
+- Multiple plugins with the same hook are executed in **PLUGINS-MANIFEST.md order**
+  (first installed, first executed)
+- Hook failures do not prevent other hooks from running
+
+### Step 4 — Report loaded plugins
+
+At session start, CLAUDE.md reads the loaded plugins list and reports:
+```
+Active plugins (2):
+  jira-advanced v1.0.0 — hooks: post_phase_complete
+  testing-playwright v0.9.0 — skills: playwright-e2e
+```
+
+If any plugin fails validation: skip it, report error, continue loading others.
+Never fail the session start because a plugin is invalid.
+
+### Step 5 — Write AUDIT entry for plugin load
+
+```json
+{
+  "event": "plugins_loaded",
+  "plugins": [
+    { "name": "mindforge-plugin-jira-advanced", "version": "1.0.0", "hooks": ["post_phase_complete"] }
+  ],
+  "failed": []
+}
+```

package/.mindforge/plugins/plugin-registry.md

@@ -0,0 +1,44 @@
+# MindForge Plugin Registry
+
+## Purpose
+Defines how MindForge discovers, validates, and installs third-party plugins
+from the npm ecosystem.
+
+## Naming convention
+Plugins must be published under the `mindforge-plugin-*` namespace.
+Format:
+- `mindforge-plugin-<category>-<name>`
+
+Examples:
+- `mindforge-plugin-jira-advanced`
+- `mindforge-plugin-testing-playwright`
+
+## Registry source
+The public npm registry is the default source. Private registries are supported
+via standard npm configuration (`.npmrc`) and environment variables.
+
+## Install flow (high level)
+1. Resolve package name and version (default: latest)
+2. Download tarball to a temp directory (mode 700)
+3. Validate structure and `plugin.json`
+4. Run injection guard on all `.md` files
+5. Copy into `.mindforge/plugins/<plugin-name>/`
+6. Append to `PLUGINS-MANIFEST.md`
+7. Log AUDIT event `plugin_installed`
+
+## Validation rules (summary)
+- `plugin.json` is required and must match schema in `plugin-schema.md`
+- Commands and skills must be listed in `plugin.json`
+- Any command name conflicts with built-ins must be renamed per `plugin-loader.md`
+- Plugins with `write_state: true` must be listed in `ELEVATED_PLUGINS`
+
+## Uninstall flow
+- Remove plugin directory
+- Remove manifest entry
+- Log AUDIT event `plugin_uninstalled`
+
+## Security posture
+Plugins are powerful. Treat them like VSCode extensions:
+- Install only from trusted sources
+- Review command content before enabling
+- Prefer version pinning in production environments

package/.mindforge/plugins/plugin-schema.md

@@ -0,0 +1,68 @@
+# MindForge Plugin System — Schema v1.0.0
+
+## Philosophy
+Plugins extend MindForge without modifying the core framework files.
+They are first-class citizens: versioned, validated, injection-guarded, and audited.
+
+## Package naming convention
+`mindforge-plugin-[category]-[name]`
+
+Examples:
+- `mindforge-plugin-jira-advanced`    — Advanced Jira sprint and velocity commands
+- `mindforge-plugin-testing-playwright` — Playwright E2E testing skill and commands
+- `mindforge-plugin-cloud-aws`        — AWS deployment patterns and runbooks
+- `mindforge-plugin-design-figma`     — Figma design review integration
+
+## What a plugin can provide
+
+| Component | Description | File location |
+|---|---|---|
+| Commands | New slash commands | `commands/[name].md` |
+| Skills | New skill packs | `skills/[name]/SKILL.md` |
+| Personas | New agent personas | `personas/[name].md` |
+| Hooks | Lifecycle event handlers | `hooks/[hook-name].md` |
+
+## `plugin.json` manifest (required in every plugin package)
+
+### Required fields
+- `name` (string) — package name
+- `version` (semver)
+- `mindforge_plugin_api_version` (string, must be `1.0.0` for v1.x.x)
+- `min_mindforge_version` (string)
+- `commands` (array of command file paths)
+- `skills` (array of SKILL.md paths)
+- `permissions` (object, see below)
+
+### Permissions — advisory model
+The permission system is advisory, not OS‑enforced. Permissions are:
+- **Declared** in `plugin.json` before installation
+- **Displayed** to the user for review at install time
+- **Recorded** in `AUDIT.jsonl` with plugin name as the agent field
+- **Enforced** through MindForge governance (plan‑first, audit, gates)
+
+The permission declaration is a statement of intent — it enables trust
+decisions, not OS‑level sandboxing.
+
+Example permissions object:
+```json
+\"permissions\": {
+  \"read_state\": true,
+  \"write_state\": false,
+  \"network\": false,
+  \"network_access\": false,
+  \"file_system_write\": false
+}
+```
+
+### Reserved command names (v1.0.0)
+These names are permanently reserved for MindForge built‑ins. If a plugin
+declares a command with one of these names, it must be renamed at install time:
+
+```
+help, init-project, plan-phase, execute-phase, verify-phase, ship,
+next, quick, status, debug, skills, review, security-scan, map-codebase,
+discuss-phase, audit, milestone, complete-milestone, approve, sync-jira,
+sync-confluence, health, retrospective, profile-team, metrics, init-org,
+install-skill, publish-skill, pr-review, workspace, benchmark, update,
+migrate, plugins, tokens, release
+```

package/.mindforge/team/TEAM-PROFILE.md

@@ -0,0 +1,42 @@
+# MindForge Team Profile
+# Auto-generated by /mindforge:profile-team
+
+## IMPORTANT: Metrics usage policy
+Per ADR-014, data in this file and `.mindforge/metrics/` is for system
+improvement only, not developer performance evaluation.
+
+Use data for:
+- response personalization
+- skill loading improvements
+- compaction and planning tuning
+- process retrospectives (not people scoring)
+
+## Team composition
+| Name | Email | Primary role | Timezone | Experience |
+|---|---|---|---|---|
+| [Name] | [email] | [role] | [UTC+X] | [level] |
+
+## Tech stack preferences
+| Layer | Preferred | Comfortable | Learning |
+|---|---|---|---|
+| Backend | TypeScript/Node.js | Python | Go |
+| Frontend | React/Next.js | Vue | Svelte |
+| Database | PostgreSQL | MySQL | MongoDB |
+| Testing | Vitest | Jest | Playwright |
+
+## Working patterns
+- Average session length: [N] minutes
+- Peak working hours: [N-N]
+- Verify pass rate: [N%]
+- Common failure type: [from AUDIT]
+
+## Personalization rules
+- Verbosity: concise
+- Review style: direct
+- Preferred code organization: feature-based
+
+## Known strengths
+- [area]
+
+## Known growth areas
+- [area]

package/.mindforge/team/multi-handoff.md

@@ -0,0 +1,23 @@
+# MindForge Team — Multi-Developer HANDOFF
+
+## Purpose
+Allow multiple developers or agent sessions to collaborate without silently
+ stomping shared state.
+
+## Shared coordination rules
+When a developer starts a plan, first check shared `HANDOFF.json` state. If the
+ same plan already appears under `active_developers`, stop and ask for
+ clarification before proceeding.
+
+Developers with `last_seen` older than 4 hours are considered stale and may be
+ removed automatically on the next session start.
+
+## Required shared state fields
+- `active_developers`
+- current phase and plan ownership
+- recent files
+- blockers and decisions needed
+
+## Audit discipline
+Each task completion or failure commit must include any new AUDIT entries so
+ shared history is not stranded in an uncommitted worktree.

package/.mindforge/team/profiles/README.md

@@ -0,0 +1,13 @@
+# MindForge Per-Developer Profiles
+
+Use `PROFILE-[dev-id].md` files to store per-developer preferences and observed
+patterns. `dev-id` is a sanitized email.
+
+Template fields:
+- Identity (name/email/role/timezone)
+- Communication preferences
+- Technical preferences
+- Observed session metrics
+- Strengths and growth areas
+
+Privacy: include only professional, collaboration-relevant data.

package/.mindforge/team/session-merger.md

@@ -0,0 +1,18 @@
+# MindForge Team — Session Merger
+
+## Purpose
+Merge concurrent session state safely after parallel work or multi-developer
+ execution.
+
+## Merge strategy
+1. Merge `HANDOFF.json` through git, not ad hoc overwrite
+2. Resolve conflicts explicitly when two sessions claim the same plan
+3. Preserve both sides' blockers and decisions until reconciled
+4. Keep AUDIT append-only; ensure entries were committed with the task commits
+
+Git merge conflicts are the correct mechanism for contested shared state.
+
+## Conflict rules
+- Same plan claimed by two developers: escalate for human resolution
+- Different plans touching shared files: merge carefully, then rerun verification
+- Stale active developer entry: prune if `last_seen` is older than 4 hours