mindforge-cc 11.4.0 → 11.5.0

package/bin/governance/approve.js

@@ -12,14 +12,9 @@ const os = require('os');
 const crypto = require('crypto');
 const { execFileSync } = require('child_process');
 
-const REASON = process.argv[2] || 'Manual approval for sensitive changes.';
 const ROOT = path.resolve(__dirname, '../../');
 const APPROVALS_DIR = path.join(ROOT, '.planning/approvals');
 
-if (!fs.existsSync(APPROVALS_DIR)) {
-  fs.mkdirSync(APPROVALS_DIR, { recursive: true });
-}
-
 /**
  * Attempts to retrieve the GPG signing key configured in git.
  * Returns null if no key is configured or git is unavailable.
@@ -34,35 +29,65 @@ function getGPGSigningKey() {
 }
 
 /**
- * Verifies the identity of the approver using GPG if available.
- * Falls back to git identity only (with warning) if no GPG key is configured.
+ * Verifies the identity of the approver using GPG.
+ *
+ * FAIL-CLOSED (Wave 6): a Tier 3 approval is a security gate. If no GPG signing
+ * key is configured, identity cannot be cryptographically attributed — git
+ * identity comes from spoofable env (USER / git config), so it is NOT a
+ * verification. We therefore REFUSE to mint an approval unless the operator
+ * explicitly opts into the weaker git-identity mode via
+ * MINDFORGE_ALLOW_UNVERIFIED_APPROVAL=1 (audited as unverified). Previously this
+ * returned {verified:false} but the record was written anyway and no consumer
+ * checked the flag — a cosmetic gate.
+ *
  * @param {string} approver - The approver identity string
+ * @returns {{verified:boolean, method:string, identity:string, keyId?:string}}
+ * @throws if no GPG key AND the unverified-approval opt-in is not set.
  */
 function verifyApproverIdentity(approver) {
   const gpgKey = getGPGSigningKey();
 
   if (!gpgKey) {
-    console.warn('[GOVERNANCE] No GPG signing key configured — approval accepted with git identity only');
-    return { verified: false, method: 'git_identity', identity: approver };
+    const allowUnverified = process.env.MINDFORGE_ALLOW_UNVERIFIED_APPROVAL === '1';
+    if (!allowUnverified) {
+      throw new Error(
+        'No GPG signing key configured (git config user.signingkey is empty). ' +
+        'A Tier 3 approval requires a verifiable identity. Either configure GPG signing, ' +
+        'or explicitly accept an UNVERIFIED approval by setting ' +
+        'MINDFORGE_ALLOW_UNVERIFIED_APPROVAL=1 (the record will be marked verified:false).'
+      );
+    }
+    console.warn('[GOVERNANCE] No GPG key — minting an UNVERIFIED approval (MINDFORGE_ALLOW_UNVERIFIED_APPROVAL=1). ' +
+      'git identity is spoofable; this approval is NOT cryptographically attributed.');
+    return { verified: false, method: 'git_identity_unverified', identity: approver };
   }
 
   return { verified: true, method: 'gpg_key', identity: approver, keyId: gpgKey };
 }
 
-async function approve() {
-  const pkgPath = path.join(ROOT, 'package.json');
-  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+/**
+ * Mint a Tier 3 approval record. Throws (fail-closed) if identity cannot be
+ * verified and the unverified-approval opt-in is not set — the record is NOT
+ * written in that case.
+ * @param {{reason?:string, approvalsDir?:string, root?:string}} [opts]
+ * @returns {{filePath:string, record:object}}
+ */
+function approve(opts = {}) {
+  const reason = opts.reason || 'Manual approval for sensitive changes.';
+  const root = opts.root || ROOT;
+  const approvalsDir = opts.approvalsDir || APPROVALS_DIR;
+
+  const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
 
   const id = `MF-AUTH-${Date.now().toString(36).toUpperCase()}`;
   const timestamp = new Date().toISOString();
   const approver = process.env.USER || 'MindForge User';
 
-  // Verify approver identity (GPG if available, git identity fallback)
+  // Verify approver identity — THROWS fail-closed if unverifiable (before any write).
   const identityVerification = verifyApproverIdentity(approver);
 
-  // Calculate a signature based on current state
   const signature = crypto.createHash('sha256')
-    .update(`${id}:${REASON}:${timestamp}:${os.hostname()}`)
+    .update(`${id}:${reason}:${timestamp}:${os.hostname()}`)
     .digest('hex');
 
   const record = {
@@ -72,25 +97,33 @@ async function approve() {
     tier: 3,
     approved_by: approver,
     timestamp,
-    reason: REASON,
+    reason,
     signature: `sha256:${signature}`,
     identity_verification: identityVerification
   };
 
+  if (!fs.existsSync(approvalsDir)) fs.mkdirSync(approvalsDir, { recursive: true });
   const filename = `approval-${id.toLowerCase()}.json`;
-  const filePath = path.join(APPROVALS_DIR, filename);
-
+  const filePath = path.join(approvalsDir, filename);
   fs.writeFileSync(filePath, JSON.stringify(record, null, 2));
 
-  console.log('\n✅ Governance approval generated!\n');
-  console.log(`ID:       ${id}`);
-  console.log(`Reason:   ${REASON}`);
-  console.log(`Verified: ${identityVerification.verified ? 'GPG (' + identityVerification.keyId + ')' : 'git identity only (no GPG key)'}`);
-  console.log(`File:     .planning/approvals/${filename}`);
-  console.log('\nCommit this file to unblock Tier 3 gates in CI.\n');
+  return { filePath, record, filename };
 }
 
-approve().catch(err => {
-  console.error(`❌ Approval failed: ${err.message}`);
-  process.exit(1);
-});
+module.exports = { verifyApproverIdentity, getGPGSigningKey, approve };
+
+if (require.main === module) {
+  try {
+    const { filename, record } = approve({ reason: process.argv[2] });
+    const iv = record.identity_verification;
+    console.log('\n✅ Governance approval generated!\n');
+    console.log(`ID:       ${record.id}`);
+    console.log(`Reason:   ${record.reason}`);
+    console.log(`Verified: ${iv.verified ? 'GPG (' + iv.keyId + ')' : 'git identity only — UNVERIFIED'}`);
+    console.log(`File:     .planning/approvals/${filename}`);
+    console.log('\nCommit this file to unblock Tier 3 gates in CI.\n');
+  } catch (err) {
+    console.error(`❌ Approval failed: ${err.message}`);
+    process.exit(1);
+  }
+}

package/bin/governance/config-manager.js

@@ -21,7 +21,9 @@ class ConfigManager {
       if (fs.existsSync(this.configPath)) {
         const raw = fs.readFileSync(this.configPath, 'utf8');
         this.config = JSON.parse(raw);
-        console.log(`[ConfigManager] Loaded configuration from ${this.configPath}`);
+        // Diagnostic goes to stderr (not stdout) so it never pollutes JSON that a
+        // consumer parses from this process's stdout. Matches the warn/error lines below.
+        console.error(`[ConfigManager] Loaded configuration from ${this.configPath}`);
       } else {
         console.warn(`[ConfigManager] Config file not found at ${this.configPath}. Using defaults.`);
         this.config = { env: 'default' };

package/bin/governance/rbac-manager.js

@@ -40,18 +40,26 @@ class RBACManager {
   }
 
   /**
-   * [HARDEN] Dynamically binds roles based on ZTAI trust tiers if no explicit role exists.
-   * Ensures high-trust agents automatically get architect-level visibility.
+   * [HARDEN] Dynamically binds roles based on ZTAI trust tiers on top of the
+   * agent's explicit/default roles. High-trust agents automatically gain
+   * architect-level visibility.
+   *
+   * ztai-manager is a SINGLETON instance (not a constructor), and exposes no
+   * getIdentity(); the agent's tier lives in the trust registry, read via
+   * getAgent(did). Fails SAFE: an unregistered/unknown DID has no resolvable
+   * tier, so it receives only its base roles (no tier-based elevation) rather
+   * than throwing. (Wave 6: the previous `new ztai().getIdentity()` threw on
+   * every call — "ztai is not a constructor".)
    */
   async getRolesByTier(did) {
-    const manager = new ztai();
-    const identity = await manager.getIdentity();
     const explicit = this.getRoles(did);
+    const agent = ztai.getAgent(did);
+    const tier = agent && typeof agent.tier === 'number' ? agent.tier : 0;
 
-    if (identity.tier >= 3) {
+    if (tier >= 3) {
       return [...new Set([...explicit, 'lead-architect'])];
     }
-    if (identity.tier >= 2) {
+    if (tier >= 2) {
       return [...new Set([...explicit, 'developer'])];
     }
     return explicit;