mindforge-cc 11.3.0 → 11.4.0

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## [11.4.0] - 2026-06-06 — Claude Code plugin distribution
+
+MindForge is now installable as a native **Claude Code plugin** from a marketplace, in
+addition to the `npx mindforge-cc` installer. This release ships the plugin tooling so
+both the GitHub plugin channel and the npm tarball stay coherent.
+
+### Added
+
+- **Plugin marketplace** (`.claude-plugin/marketplace.json` at the repo root) — users run
+  `/plugin marketplace add sairam0424/MindForge` then `/plugin install mindforge@mindforge`.
+  Lists 11 plugins: the comprehensive `mindforge` plugin + 10 à-la-carte subagent packs.
+- **Comprehensive `mindforge` plugin** (`plugins/mindforge/`) bundling the full surface:
+  174 commands, 154 subagents, 73 skills + a synthesized `mindforge-protocol` skill (the
+  CLAUDE.md operating directive, since a plugin-root CLAUDE.md isn't loaded as context),
+  and governance hooks (translated to Claude `PreToolUse`/`PostToolUse` events with
+  `${CLAUDE_PLUGIN_ROOT}`-relative paths).
+- **Bundled MindForge MCP server** — a self-contained esbuild single-file build
+  (`mcp/dist/index.js`, all deps inlined, no runtime `node_modules`) exposing 7 tools over
+  stdio: `mindforge_health`, `mindforge_status`, `mindforge_memory_query`,
+  `mindforge_memory_stats`, `mindforge_memory_find_related`, `mindforge_audit_log`
+  (read-only), and append-only `mindforge_memory_remember`. Scoped to the user's project
+  via `${CLAUDE_PROJECT_DIR}`; degrades gracefully when MindForge isn't set up.
+- **Generators** (single source of truth, drift-guarded): `build-plugin-marketplace.js`,
+  `build-subagent-plugins.js`, `build-mindforge-plugin.js`, `vendor-sdk-into-mcp.js`,
+  `fix-command-frontmatter.js`; new `mcp-server/` package with esbuild build.
+- **`tests/plugin-packaging.test.js`** (in `npm test`) — guards the generated plugin tree,
+  frontmatter validity, and MCP-bundle self-containment.
+
+### Fixed
+
+- Quoted YAML-unsafe `name`/`description` frontmatter across commands/agents/skills that
+  the plugin validator flagged (leading `-`/`@`, embedded `: `, trailing `:`) — these
+  silently loaded empty metadata. The npx installer inherits the fix.
+- Per-category subagent `plugin.json` `agents[]` now derived from on-disk files, fixing
+  stale bare names for the 16 collision-renamed (`-cc`) agents.
+
+## [11.3.1] - 2026-06-05 — Packaging hotfix (commands, skills & framework now ship)
+
+Critical fix for v11.3.0, where a too-narrow npm `files` allowlist silently dropped
+most of the product from the published tarball. Users who ran `npx mindforge-cc` got
+only hooks, personas, subagents, and three `.mindforge/` folders — **no slash commands,
+no skills, and an incomplete framework** — with no error (the installer skips any source
+absent from the tarball). v11.3.1 restores the full payload and adds a regression test
+so this class of bug cannot ship silently again.
+
+### Fixed
+
+- **npm `files` allowlist** (`package.json`) widened to ship what the installer reads:
+  `.claude/commands/` (174 slash commands), `.agent/mindforge/` + `.agent/forge/`,
+  `.agent/skills/` (73 skills), the entry `.claude/CLAUDE.md`, and the full `.mindforge/`
+  framework (`governance`, `integrations`, `intelligence`, `memory`, `metrics`, `models`,
+  `org`, `plugins`, `team` — previously only `engine`/`personas`/`skills` reached users).
+  Runtime state is explicitly **excluded** (`celestial.db`, `metrics/token-usage.jsonl`,
+  `memory/pattern-library.jsonl`) — `files` overrides `.npmignore`, so these are negated
+  in the allowlist itself.
+- **`.planning/` scaffolding now ships and installs** — sourced from the clean, generic
+  `examples/starter-project/.planning/` (never the framework repo's own live `.planning/`,
+  which holds dev state: `AUDIT.jsonl`, `slack-threads.json`, `jira-sync.json`). Added the
+  four missing starter templates (`ROADMAP.md`, `REQUIREMENTS.md`, `ARCHITECTURE.md`,
+  `RELEASE-CHECKLIST.md`) so the autonomous engine (`/mindforge:auto`, `:next`) has the
+  files it expects.
+- **`docs/References` / `docs/Templates` case-sensitivity bug** — the installer read
+  lowercase `docs/references`/`templates`, which "worked" on case-insensitive macOS but
+  silently missed on case-sensitive Linux/npm (manifest showed `REFERENCES 0 / TEMPLATES 0`).
+  Installer now reads the exact on-disk case and both dirs are allowlisted.
+
+### Added
+
+- **`tests/packaging-allowlist.test.js`** — packs the real tarball (`npm pack --dry-run
+  --json`) and asserts commands, skills, subagents, entry files, the full `.mindforge/`
+  framework, and `.planning/` templates all ship, while runtime DBs/telemetry do not.
+  Proven to fail under the broken v11.3.0 allowlist. Skips loudly if npm is unavailable.
+
 ## [11.3.0] - 2026-06-04 — "Legion" (154-subagent expansion)
 
 Imports the full VoltAgent `awesome-claude-code-subagents` collection (154 Claude-Code-native

package/MINDFORGE.md

@@ -1,12 +1,12 @@
-# MINDFORGE.md — Parameter Registry (v11.3.0)
+# MINDFORGE.md — Parameter Registry (v11.4.0)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.3.0
+[VERSION] = 11.4.0
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
-[REQUIRED_CORE_VERSION] = 11.3.0
+[REQUIRED_CORE_VERSION] = 11.4.0
 [SOVEREIGN_IDENTITY] = true
 [SRE_LAYER_ENABLED]  = true
 

package/README.md

@@ -4,6 +4,13 @@
 
 ---
 
+## Latest: v11.3.1
+
+- **v11.3.1 — Packaging hotfix.** Restores the full published payload: every `npx mindforge-cc` install now delivers all 174 slash commands, 73 skills, 154 subagents, and the complete `.mindforge/` framework. (v11.3.0 shipped a too-narrow npm allowlist that silently dropped commands and skills — fixed here, with a tarball regression test so it cannot recur.)
+- **v11.3.0 — "Legion".** Imports 154 specialized Claude-Code-native subagents across 10 categories into `.claude/agents/`, fully rebranded and collision-safe. Additive and backward-compatible.
+
+See [CHANGELOG.md](./CHANGELOG.md) for full release history.
+
 ## v11.0.0 — Sovereign Stability
 
 MindForge v11.0.0 "Sovereign Stability" is a production-hardening release focused on reliability, performance, and real-world deployment readiness. Key highlights:
@@ -15,14 +22,29 @@ MindForge v11.0.0 "Sovereign Stability" is a production-hardening release focuse
 - **Production observability** — `/api/v1/system` health endpoint, P95 latency tracking, heap health monitoring, and real EIS client with retry logic.
 - **Graduated intelligence** — Adaptive tier escalation (+1/+2/MAX) with cost-awareness, 3-tier stuck detection, and adaptive context windows.
 
-This release ships 200+ skills, 400+ personas, 154 specialized subagents, 18 pillars, and 49 swarm templates across 12 engineering domains.
+This release ships 211 personas, 73 skills, 154 specialized subagents, 174 commands, 18 pillars, and 49 swarm templates across 12 engineering domains.
 
 
 ## Installation & Setup
 
-### 🚀 Quick Start (No Install)
+### 🔌 Claude Code Plugin (fastest)
+
+Install MindForge's commands, subagents, and skills directly from the marketplace —
+no project files written:
+
+```bash
+/plugin marketplace add sairam0424/MindForge
+/plugin install mindforge@mindforge
+```
+
+Prefer just a slice (e.g. Python agents)? Install a focused pack like
+`mindforge-lang@mindforge` instead. See [docs/plugin-installation.md](docs/plugin-installation.md)
+for all 11 plugins, token-budget guidance, and team setup.
+
+### 🚀 Quick Start (npx — full framework engine)
 
-Run MindForge immediately for a specific runtime without a permanent installation:
+The npx installer also writes the complete `.mindforge/` engine (governance, memory,
+planning) into your project:
 
 ```bash
 # For Claude Code

package/RELEASENOTES.md

@@ -1,4 +1,48 @@
-# Release Notes — v11.0.0 "Sovereign Stability"
+# Release Notes
+
+## v11.3.1 — Packaging hotfix
+
+**Release Date**: 2026-06-05
+**Type**: Patch (no API changes)
+**Upgrade Path**: `npm install -g mindforge-cc@latest` (or `npx mindforge-cc@latest`)
+
+Fixes a critical packaging regression in v11.3.0, where a too-narrow npm `files`
+allowlist silently dropped most of the product from the published tarball. Users who
+installed v11.3.0 received only hooks, personas, subagents, and three `.mindforge/`
+folders — **no slash commands, no skills, and an incomplete framework** — with no error,
+because the installer skips any source absent from the tarball.
+
+- **Restored payload** — every install now delivers all **174 slash commands**, **73 skills**,
+  **154 subagents**, the entry `CLAUDE.md`, and the full `.mindforge/` framework
+  (`governance`, `integrations`, `intelligence`, `memory`, `metrics`, `models`, `org`,
+  `plugins`, `team`). Runtime state (`celestial.db`, telemetry `.jsonl`) is explicitly excluded.
+- **`.planning/` scaffolding** now ships from a clean generic source (never the framework's
+  own dev state) so the autonomous engine has its templates.
+- **docs/References + docs/Templates** case-sensitivity fixed (worked on macOS, silently
+  missed on Linux/npm — they now install correctly).
+- **Regression test** (`tests/packaging-allowlist.test.js`) packs the real tarball and
+  asserts the full payload ships — proven to fail under the broken v11.3.0 allowlist.
+
+> v11.3.0 is deprecated on npm. Upgrade to v11.3.1.
+
+## v11.3.0 — "Legion" (154-subagent expansion)
+
+**Release Date**: 2026-06-04
+**Type**: Minor (additive, backward-compatible)
+
+Imports 154 specialized Claude-Code-native subagents across 10 categories
+(`01-core-development` … `10-research-analysis`) into `.claude/agents/`, fully rebranded
+and collision-safe (16 names that clashed with existing personas were suffixed `-cc`).
+Adds `bin/spawn-agent.js subagent <name>` with a hardened name allowlist and path-traversal
+guards, plus a generated `.mindforge/imported-agents.jsonl` index. No existing persona,
+skill, or command changed behavior.
+
+> Note: the v11.3.0 npm artifact was affected by the packaging regression fixed in v11.3.1.
+> Install v11.3.1 to get the subagents and the rest of the payload.
+
+---
+
+# v11.0.0 "Sovereign Stability"
 
 **Release Date**: 2026-05-28  
 **Type**: Major (breaking changes)  

package/bin/installer-core.js

@@ -444,8 +444,11 @@ async function install(runtime, scope, options = {}) {
       { key: 'skillsSubdir',   src: src('.agent', 'skills'),      label: 'skills' },
       { key: 'hooksSubdir',    src: src('.agent', 'hooks'),       label: 'hooks' },
       { key: 'personasSubdir', src: src('.mindforge', 'personas'), label: 'personas' },
-      { key: 'docsSubdir',     src: src('docs', 'references'),    label: 'references' },
-      { key: 'docsSubdir',     src: src('docs', 'templates'),     label: 'templates' }
+      // NB: on-disk dirs are capitalized (docs/References, docs/Templates). macOS is
+      // case-insensitive so lowercase used to "work" locally, but npm/Linux is
+      // case-sensitive — the lookup silently missed in production (UC: REFERENCES 0).
+      { key: 'docsSubdir',     src: src('docs', 'References'),    label: 'references' },
+      { key: 'docsSubdir',     src: src('docs', 'Templates'),     label: 'templates' }
     ];
 
     assetMappings.forEach(asset => {
@@ -580,8 +583,8 @@ async function install(runtime, scope, options = {}) {
       { key: 'skillsSubdir',   src: src('.agent', 'skills'),      label: 'skills' },
       { key: 'hooksSubdir',    src: src('.agent', 'hooks'),       label: 'hooks' },
       { key: 'personasSubdir', src: src('.mindforge', 'personas'), label: 'personas' },
-      { key: 'docsSubdir',     src: src('docs', 'references'),    label: 'references' },
-      { key: 'docsSubdir',     src: src('docs', 'templates'),     label: 'templates' },
+      { key: 'docsSubdir',     src: src('docs', 'References'),    label: 'references' },
+      { key: 'docsSubdir',     src: src('docs', 'Templates'),     label: 'templates' },
       { key: 'memorySubdir',   src: src('.mindforge', 'memory'),   label: 'memory' },
       { key: 'pluginsSubdir',  src: src('.mindforge', 'plugins'),  label: 'plugins' }
     ];
@@ -658,9 +661,12 @@ async function install(runtime, scope, options = {}) {
       }
     }
 
-    // .planning/ — merge templates but preserve existing state
+    // .planning/ — merge templates but preserve existing state.
+    // Source from examples/starter-project/.planning (clean, generic, always shipped)
+    // — NEVER from the framework repo's own .planning/, which holds live dev state
+    // (AUDIT.jsonl, slack-threads.json, jira-sync.json) that must not reach users.
     const planningDst = path.join(process.cwd(), '.planning');
-    const planningSrc = src('.planning');
+    const planningSrc = src('examples', 'starter-project', '.planning');
     if (fsu.exists(planningSrc)) {
       fsu.ensureDir(planningDst);
       
@@ -700,7 +706,7 @@ async function install(runtime, scope, options = {}) {
 
     // AGENTS_LEARNING.md — create only if it doesn't already exist
     const learningDst = path.join(process.cwd(), 'AGENTS_LEARNING.md');
-    const learningSrc = src('docs', 'templates', 'Project', 'AGENTS_LEARNING.md');
+    const learningSrc = src('docs', 'Templates', 'Project', 'AGENTS_LEARNING.md');
     if (!fsu.exists(learningDst) && fsu.exists(learningSrc)) {
       fsu.copy(learningSrc, learningDst);
       Theme.printResolved(`${c.bold('AGENTS_LEARNING.md')} (agentic memory)`);
@@ -708,7 +714,7 @@ async function install(runtime, scope, options = {}) {
 
     // WALKTHROUGH.md — update if exists
     const walkDst = path.join(process.cwd(), 'WALKTHROUGH.md');
-    const walkSrc = src('docs', 'templates', 'Project', 'WALKTHROUGH.md');
+    const walkSrc = src('docs', 'Templates', 'Project', 'WALKTHROUGH.md');
     if (fsu.exists(walkSrc)) {
       fsu.copy(walkSrc, walkDst);
       Theme.printResolved(`${c.bold('WALKTHROUGH.md')} (updated)`);
@@ -854,9 +860,9 @@ function collectManifestStats() {
         .filter(f => path.basename(f) !== 'README.md').length;
     }
 
-    // Docs & Templates count
-    const refSrc = src('docs', 'references');
-    const tmpSrc = src('docs', 'templates');
+    // Docs & Templates count (on-disk dirs are capitalized — see assetMappings note)
+    const refSrc = src('docs', 'References');
+    const tmpSrc = src('docs', 'Templates');
     if (fsu.exists(refSrc)) stats.docs = fsu.listFiles(refSrc).filter(f => f.endsWith('.md')).length;
     if (fsu.exists(tmpSrc)) stats.templates = fsu.listFilesRecursive(tmpSrc).length;
     

package/docs/References/audit-events.md

@@ -0,0 +1,59 @@
+# MindForge Audit Events — Reference (v1.0.0)
+
+## Overview
+`AUDIT.jsonl` is the append-only record of MindForge operations.
+Each line is a JSON object with a required `event` type and a `session_id`.
+
+## Location
+`.planning/AUDIT.jsonl`
+
+## Required fields (all events)
+- `id` (UUID v4)
+- `timestamp` (ISO-8601)
+- `event` (string)
+- `agent` (string)
+- `phase` (number or null)
+- `session_id` (string)
+- `trace_id` (string, v4.1+) - UUID linking multiple related spans.
+- `span_id` (string, v4.1+) - ID for the current execution unit.
+- `parent_span_id` (string, v4.1+) - Link to the calling span.
+
+## Common event types
+### `project_initialised`
+Fields: `project_name`, `tech_stack`, `compliance`
+
+### `phase_planned`
+Fields: `plan_count`, `wave_count`, `research_conducted`
+
+### `phase_execution_started`
+Fields: `plan_count`, `wave_count`, `dependency_graph_path`
+
+### `phase_execution_completed`
+Fields: `tasks_completed`, `tasks_failed`, `verify_status`, `verification_path`
+
+### `task_started`
+Fields: `plan`, `task_name`
+
+### `task_completed`
+Fields: `plan`, `commit_sha`, `verify_result`
+
+### `security_scan_completed`
+Fields: `critical`, `high`, `medium`, `low`, `findings_path`
+
+### `gate_result`
+Fields: `gate`, `status`, `detail`
+
+### `plugin_installed`
+Fields: `plugin_name`, `version`, `permissions`
+
+### `plugin_uninstalled`
+Fields: `plugin_name`
+
+### `reasoning_trace` (v4.1+)
+Fields: `trace_id`, `span_id`, `persona`, `thought_chain`, `decision_point`, `adversarial_critique` (optional)
+
+## Rotation
+Rotate when file exceeds 10,000 lines. Archive into `.planning/audit-archive/`.
+
+## Schema source
+See `.mindforge/audit/AUDIT-SCHEMA.md` for full examples and field definitions.