mindforge-cc 11.3.0 → 11.3.1

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [11.3.1] - 2026-06-05 — Packaging hotfix (commands, skills & framework now ship)
+
+Critical fix for v11.3.0, where a too-narrow npm `files` allowlist silently dropped
+most of the product from the published tarball. Users who ran `npx mindforge-cc` got
+only hooks, personas, subagents, and three `.mindforge/` folders — **no slash commands,
+no skills, and an incomplete framework** — with no error (the installer skips any source
+absent from the tarball). v11.3.1 restores the full payload and adds a regression test
+so this class of bug cannot ship silently again.
+
+### Fixed
+
+- **npm `files` allowlist** (`package.json`) widened to ship what the installer reads:
+  `.claude/commands/` (174 slash commands), `.agent/mindforge/` + `.agent/forge/`,
+  `.agent/skills/` (73 skills), the entry `.claude/CLAUDE.md`, and the full `.mindforge/`
+  framework (`governance`, `integrations`, `intelligence`, `memory`, `metrics`, `models`,
+  `org`, `plugins`, `team` — previously only `engine`/`personas`/`skills` reached users).
+  Runtime state is explicitly **excluded** (`celestial.db`, `metrics/token-usage.jsonl`,
+  `memory/pattern-library.jsonl`) — `files` overrides `.npmignore`, so these are negated
+  in the allowlist itself.
+- **`.planning/` scaffolding now ships and installs** — sourced from the clean, generic
+  `examples/starter-project/.planning/` (never the framework repo's own live `.planning/`,
+  which holds dev state: `AUDIT.jsonl`, `slack-threads.json`, `jira-sync.json`). Added the
+  four missing starter templates (`ROADMAP.md`, `REQUIREMENTS.md`, `ARCHITECTURE.md`,
+  `RELEASE-CHECKLIST.md`) so the autonomous engine (`/mindforge:auto`, `:next`) has the
+  files it expects.
+- **`docs/References` / `docs/Templates` case-sensitivity bug** — the installer read
+  lowercase `docs/references`/`templates`, which "worked" on case-insensitive macOS but
+  silently missed on case-sensitive Linux/npm (manifest showed `REFERENCES 0 / TEMPLATES 0`).
+  Installer now reads the exact on-disk case and both dirs are allowlisted.
+
+### Added
+
+- **`tests/packaging-allowlist.test.js`** — packs the real tarball (`npm pack --dry-run
+  --json`) and asserts commands, skills, subagents, entry files, the full `.mindforge/`
+  framework, and `.planning/` templates all ship, while runtime DBs/telemetry do not.
+  Proven to fail under the broken v11.3.0 allowlist. Skips loudly if npm is unavailable.
+
 ## [11.3.0] - 2026-06-04 — "Legion" (154-subagent expansion)
 
 Imports the full VoltAgent `awesome-claude-code-subagents` collection (154 Claude-Code-native

package/MINDFORGE.md

@@ -1,12 +1,12 @@
-# MINDFORGE.md — Parameter Registry (v11.3.0)
+# MINDFORGE.md — Parameter Registry (v11.3.1)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.3.0
+[VERSION] = 11.3.1
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
-[REQUIRED_CORE_VERSION] = 11.3.0
+[REQUIRED_CORE_VERSION] = 11.3.1
 [SOVEREIGN_IDENTITY] = true
 [SRE_LAYER_ENABLED]  = true
 

package/bin/installer-core.js

@@ -444,8 +444,11 @@ async function install(runtime, scope, options = {}) {
       { key: 'skillsSubdir',   src: src('.agent', 'skills'),      label: 'skills' },
       { key: 'hooksSubdir',    src: src('.agent', 'hooks'),       label: 'hooks' },
       { key: 'personasSubdir', src: src('.mindforge', 'personas'), label: 'personas' },
-      { key: 'docsSubdir',     src: src('docs', 'references'),    label: 'references' },
-      { key: 'docsSubdir',     src: src('docs', 'templates'),     label: 'templates' }
+      // NB: on-disk dirs are capitalized (docs/References, docs/Templates). macOS is
+      // case-insensitive so lowercase used to "work" locally, but npm/Linux is
+      // case-sensitive — the lookup silently missed in production (UC: REFERENCES 0).
+      { key: 'docsSubdir',     src: src('docs', 'References'),    label: 'references' },
+      { key: 'docsSubdir',     src: src('docs', 'Templates'),     label: 'templates' }
     ];
 
     assetMappings.forEach(asset => {
@@ -580,8 +583,8 @@ async function install(runtime, scope, options = {}) {
       { key: 'skillsSubdir',   src: src('.agent', 'skills'),      label: 'skills' },
       { key: 'hooksSubdir',    src: src('.agent', 'hooks'),       label: 'hooks' },
       { key: 'personasSubdir', src: src('.mindforge', 'personas'), label: 'personas' },
-      { key: 'docsSubdir',     src: src('docs', 'references'),    label: 'references' },
-      { key: 'docsSubdir',     src: src('docs', 'templates'),     label: 'templates' },
+      { key: 'docsSubdir',     src: src('docs', 'References'),    label: 'references' },
+      { key: 'docsSubdir',     src: src('docs', 'Templates'),     label: 'templates' },
       { key: 'memorySubdir',   src: src('.mindforge', 'memory'),   label: 'memory' },
       { key: 'pluginsSubdir',  src: src('.mindforge', 'plugins'),  label: 'plugins' }
     ];
@@ -658,9 +661,12 @@ async function install(runtime, scope, options = {}) {
       }
     }
 
-    // .planning/ — merge templates but preserve existing state
+    // .planning/ — merge templates but preserve existing state.
+    // Source from examples/starter-project/.planning (clean, generic, always shipped)
+    // — NEVER from the framework repo's own .planning/, which holds live dev state
+    // (AUDIT.jsonl, slack-threads.json, jira-sync.json) that must not reach users.
     const planningDst = path.join(process.cwd(), '.planning');
-    const planningSrc = src('.planning');
+    const planningSrc = src('examples', 'starter-project', '.planning');
     if (fsu.exists(planningSrc)) {
       fsu.ensureDir(planningDst);
       
@@ -700,7 +706,7 @@ async function install(runtime, scope, options = {}) {
 
     // AGENTS_LEARNING.md — create only if it doesn't already exist
     const learningDst = path.join(process.cwd(), 'AGENTS_LEARNING.md');
-    const learningSrc = src('docs', 'templates', 'Project', 'AGENTS_LEARNING.md');
+    const learningSrc = src('docs', 'Templates', 'Project', 'AGENTS_LEARNING.md');
     if (!fsu.exists(learningDst) && fsu.exists(learningSrc)) {
       fsu.copy(learningSrc, learningDst);
       Theme.printResolved(`${c.bold('AGENTS_LEARNING.md')} (agentic memory)`);
@@ -708,7 +714,7 @@ async function install(runtime, scope, options = {}) {
 
     // WALKTHROUGH.md — update if exists
     const walkDst = path.join(process.cwd(), 'WALKTHROUGH.md');
-    const walkSrc = src('docs', 'templates', 'Project', 'WALKTHROUGH.md');
+    const walkSrc = src('docs', 'Templates', 'Project', 'WALKTHROUGH.md');
     if (fsu.exists(walkSrc)) {
       fsu.copy(walkSrc, walkDst);
       Theme.printResolved(`${c.bold('WALKTHROUGH.md')} (updated)`);
@@ -854,9 +860,9 @@ function collectManifestStats() {
         .filter(f => path.basename(f) !== 'README.md').length;
     }
 
-    // Docs & Templates count
-    const refSrc = src('docs', 'references');
-    const tmpSrc = src('docs', 'templates');
+    // Docs & Templates count (on-disk dirs are capitalized — see assetMappings note)
+    const refSrc = src('docs', 'References');
+    const tmpSrc = src('docs', 'Templates');
     if (fsu.exists(refSrc)) stats.docs = fsu.listFiles(refSrc).filter(f => f.endsWith('.md')).length;
     if (fsu.exists(tmpSrc)) stats.templates = fsu.listFilesRecursive(tmpSrc).length;
     

package/docs/References/audit-events.md

@@ -0,0 +1,59 @@
+# MindForge Audit Events — Reference (v1.0.0)
+
+## Overview
+`AUDIT.jsonl` is the append-only record of MindForge operations.
+Each line is a JSON object with a required `event` type and a `session_id`.
+
+## Location
+`.planning/AUDIT.jsonl`
+
+## Required fields (all events)
+- `id` (UUID v4)
+- `timestamp` (ISO-8601)
+- `event` (string)
+- `agent` (string)
+- `phase` (number or null)
+- `session_id` (string)
+- `trace_id` (string, v4.1+) - UUID linking multiple related spans.
+- `span_id` (string, v4.1+) - ID for the current execution unit.
+- `parent_span_id` (string, v4.1+) - Link to the calling span.
+
+## Common event types
+### `project_initialised`
+Fields: `project_name`, `tech_stack`, `compliance`
+
+### `phase_planned`
+Fields: `plan_count`, `wave_count`, `research_conducted`
+
+### `phase_execution_started`
+Fields: `plan_count`, `wave_count`, `dependency_graph_path`
+
+### `phase_execution_completed`
+Fields: `tasks_completed`, `tasks_failed`, `verify_status`, `verification_path`
+
+### `task_started`
+Fields: `plan`, `task_name`
+
+### `task_completed`
+Fields: `plan`, `commit_sha`, `verify_result`
+
+### `security_scan_completed`
+Fields: `critical`, `high`, `medium`, `low`, `findings_path`
+
+### `gate_result`
+Fields: `gate`, `status`, `detail`
+
+### `plugin_installed`
+Fields: `plugin_name`, `version`, `permissions`
+
+### `plugin_uninstalled`
+Fields: `plugin_name`
+
+### `reasoning_trace` (v4.1+)
+Fields: `trace_id`, `span_id`, `persona`, `thought_chain`, `decision_point`, `adversarial_critique` (optional)
+
+## Rotation
+Rotate when file exceeds 10,000 lines. Archive into `.planning/audit-archive/`.
+
+## Schema source
+See `.mindforge/audit/AUDIT-SCHEMA.md` for full examples and field definitions.