mindforge-cc 11.4.0 → 11.5.1

package/bin/autonomous/supervisor.js

@@ -0,0 +1,98 @@
+'use strict';
+
+/**
+ * MindForge — Autonomous session supervisor (PID-liveness crash recovery).
+ *
+ * Adapted from ECC's Rust session daemon (ecc2/src/session/daemon.rs). Ports
+ * ONLY the two pure, high-value functions — NOT the tokio daemon or ECC's
+ * dispatch/merge/rebalance machinery (which overlaps MindForge's existing
+ * task-dispatcher / wave-executor / mesh-self-healer):
+ *
+ *   1. pidIsAlive(pid)        — process.kill(pid, 0): ESRCH=dead, EPERM=alive.
+ *   2. resumeCrashedSessions  — sweep sessions left "running" whose pid is dead
+ *                               and mark them "failed" (stale-pid recovery).
+ *
+ * Plus a heartbeat() that stamps auto-state.json so a supervisor can detect a
+ * wedged/abandoned session. Layered OVER state-manager.js — it does not replace
+ * it. Default-inert: nothing runs unless explicitly invoked.
+ */
+
+const SUPERVISOR_STATUSES = ['idle', 'running', 'paused', 'completed', 'escalated', 'timeout', 'failed'];
+
+/**
+ * Probe whether a process is alive. Cross-platform via Node's process.kill with
+ * signal 0 (no signal delivered — existence check only):
+ *   - kill succeeds            -> alive
+ *   - throws EPERM             -> alive (exists, owned by another user)
+ *   - throws ESRCH (or other)  -> dead
+ * A null/0/invalid pid is treated as dead.
+ */
+function pidIsAlive(pid) {
+  const n = Number(pid);
+  if (!Number.isInteger(n) || n <= 0) return false;
+  try {
+    process.kill(n, 0);
+    return true;
+  } catch (err) {
+    return err && err.code === 'EPERM';
+  }
+}
+
+/**
+ * Sweep a sessions list and mark any that are "running" with a dead pid as
+ * "failed". Pure over its inputs: takes the sessions array + an isAlive probe
+ * (injectable for tests, matching ECC's resume_crashed_sessions_with) and
+ * returns { failed: [...ids], sessions: [...updated] } without side effects.
+ *
+ * @param {Array<{id:string,status:string,pid?:number}>} sessions
+ * @param {(pid:number)=>boolean} [isAlive] defaults to pidIsAlive
+ */
+function resumeCrashedSessions(sessions, isAlive = pidIsAlive) {
+  const failed = [];
+  const updated = (Array.isArray(sessions) ? sessions : []).map(session => {
+    if (session.status !== 'running') return session;
+    if (session.pid != null && isAlive(session.pid)) return session;
+    failed.push(session.id);
+    // Immutable: new object with failed status, pid cleared.
+    return Object.assign({}, session, { status: 'failed', pid: null });
+  });
+  return { failed, sessions: updated };
+}
+
+/**
+ * Stamp a heartbeat onto auto-state.json via a state manager. A supervisor in a
+ * separate process can compare heartbeatAt against now to detect a stalled loop
+ * (pairs with bin/autonomous/session-guardian.sh + loop-operator escalation).
+ *
+ * @param {{updateState:Function}} stateManager  from createStateManager(planningDir)
+ * @param {number} [pid] the live worker pid to record (defaults to current pid)
+ */
+function heartbeat(stateManager, pid = process.pid) {
+  return stateManager.updateState({
+    pid,
+    heartbeatAt: new Date().toISOString(),
+  });
+}
+
+/**
+ * Recover a single state file: if it shows status "running" with a dead pid,
+ * transition it to "failed". Returns true if a recovery was applied.
+ *
+ * @param {{getState:Function,updateState:Function}} stateManager
+ * @param {(pid:number)=>boolean} [isAlive]
+ */
+function recoverState(stateManager, isAlive = pidIsAlive) {
+  const state = stateManager.getState();
+  if (state.status !== 'running') return false;
+  if (state.pid != null && isAlive(state.pid)) return false;
+  stateManager.updateState({ status: 'failed', pid: null, failedAt: new Date().toISOString() });
+  return true;
+}
+
+module.exports = {
+  SUPERVISOR_STATUSES,
+  pidIsAlive,
+  resumeCrashedSessions,
+  heartbeat,
+  recoverState,
+};

package/bin/change-classifier.js

@@ -31,10 +31,21 @@ const SENSITIVE_PATTERNS = [
 
 function classify() {
   try {
-    // Get list of changed files compared to origin/main or HEAD~1
+    // Get list of changed files compared to origin/<base> or HEAD~1.
+    // Three-dot (...) diffs against the MERGE-BASE, so on a PR branch that is behind its base
+    // we see ONLY this branch's own changes — not unrelated commits already on the base.
+    // (Two-dot here caused Tier-3 false positives by pulling in base-only changes.)
     const base = process.env.GITHUB_BASE_REF ? `origin/${process.env.GITHUB_BASE_REF}` : 'HEAD~1';
-    const diffFiles = execFileSync('git', ['diff', '--name-only', `${base}..HEAD`], { encoding: 'utf8' }).split('\n').filter(Boolean);
-    
+    const range = process.env.GITHUB_BASE_REF ? `${base}...HEAD` : `${base}..HEAD`;
+    const diffFiles = execFileSync('git', ['diff', '--name-only', range], { encoding: 'utf8' }).split('\n').filter(Boolean);
+
+    // Test and documentation files are excluded from the sensitive-PATTERN scan below: a test
+    // asserting on "password"/key patterns, or a doc mentioning secrets, is not a sensitive
+    // change and must not trip Tier 3. (Path-based detection still covers genuinely sensitive
+    // source paths.) This is the fix for test-only PRs being misclassified as Tier 3.
+    const isTestOrDoc = (f) =>
+      /(^|\/)(tests?|__tests__|docs)\//.test(f) || /\.(test|spec)\.[cm]?[jt]s$/.test(f) || f.endsWith('.md');
+
     let tier = 1;
     let reasons = [];
 
@@ -45,9 +56,12 @@ function classify() {
       reasons.push(`Sensitive path modified: ${matchedPath}`);
     }
 
-    // 2. Pattern-based detection in diff (Tier 3)
+    // 2. Pattern-based detection in diff (Tier 3) — non-test/doc files only
     if (tier < 3) {
-      const diffContent = execFileSync('git', ['diff', `${base}..HEAD`], { encoding: 'utf8' });
+      const scanFiles = diffFiles.filter(f => !isTestOrDoc(f));
+      const diffContent = scanFiles.length
+        ? execFileSync('git', ['diff', range, '--', ...scanFiles], { encoding: 'utf8' })
+        : '';
       for (const pattern of SENSITIVE_PATTERNS) {
         if (pattern.test(diffContent)) {
           tier = 3;

package/bin/dashboard/api-router.js

@@ -75,12 +75,21 @@ function register(app) {
   app.post('/api/approve/:id', (req, res) => {
     try {
       const { id }                  = req.params;
-      const { decision, comment, approver } = req.body || {};
+      const { decision, comment }   = req.body || {};
 
       if (!decision) {
         return res.status(400).json({ error: 'Missing "decision" field (approve|reject)' });
       }
 
+      // SECURITY (v11.5.1): do NOT trust a client-supplied `approver` for the
+      // recorded identity — it is forgeable and would let any caller write a
+      // false approval audit trail (e.g. resolved_by: 'admin'). requireAuth
+      // (server.js) proves the caller holds the owner-only dashboard token but
+      // exposes no named principal, so we attribute the action to a FIXED
+      // trusted actor. (A future RBAC pass can map a Bearer token -> DID and
+      // record the real principal; until then, never echo req.body.approver.)
+      const approver = 'dashboard-authenticated';
+
       const result = Approval.processDecision(id, decision, comment, approver);
 
       if (!result.success) {

package/bin/governance/approve.js

@@ -12,14 +12,9 @@ const os = require('os');
 const crypto = require('crypto');
 const { execFileSync } = require('child_process');
 
-const REASON = process.argv[2] || 'Manual approval for sensitive changes.';
 const ROOT = path.resolve(__dirname, '../../');
 const APPROVALS_DIR = path.join(ROOT, '.planning/approvals');
 
-if (!fs.existsSync(APPROVALS_DIR)) {
-  fs.mkdirSync(APPROVALS_DIR, { recursive: true });
-}
-
 /**
  * Attempts to retrieve the GPG signing key configured in git.
  * Returns null if no key is configured or git is unavailable.
@@ -34,35 +29,69 @@ function getGPGSigningKey() {
 }
 
 /**
- * Verifies the identity of the approver using GPG if available.
- * Falls back to git identity only (with warning) if no GPG key is configured.
+ * Verifies the identity of the approver using GPG.
+ *
+ * FAIL-CLOSED (Wave 6): a Tier 3 approval is a security gate. If no GPG signing
+ * key is configured, identity cannot be cryptographically attributed — git
+ * identity comes from spoofable env (USER / git config), so it is NOT a
+ * verification. We therefore REFUSE to mint an approval unless the operator
+ * explicitly opts into the weaker git-identity mode via
+ * MINDFORGE_ALLOW_UNVERIFIED_APPROVAL=1 (audited as unverified). Previously this
+ * returned {verified:false} but the record was written anyway and no consumer
+ * checked the flag — a cosmetic gate.
+ *
  * @param {string} approver - The approver identity string
+ * @returns {{verified:boolean, method:string, identity:string, keyId?:string}}
+ * @throws if no GPG key AND the unverified-approval opt-in is not set.
  */
 function verifyApproverIdentity(approver) {
   const gpgKey = getGPGSigningKey();
 
   if (!gpgKey) {
-    console.warn('[GOVERNANCE] No GPG signing key configured — approval accepted with git identity only');
-    return { verified: false, method: 'git_identity', identity: approver };
+    const allowUnverified = process.env.MINDFORGE_ALLOW_UNVERIFIED_APPROVAL === '1';
+    if (!allowUnverified) {
+      throw new Error(
+        'No GPG signing key configured (git config user.signingkey is empty). ' +
+        'A Tier 3 approval requires a verifiable identity. Either configure GPG signing, ' +
+        'or explicitly accept an UNVERIFIED approval by setting ' +
+        'MINDFORGE_ALLOW_UNVERIFIED_APPROVAL=1 (the record will be marked verified:false).'
+      );
+    }
+    console.warn('[GOVERNANCE] No GPG key — minting an UNVERIFIED approval (MINDFORGE_ALLOW_UNVERIFIED_APPROVAL=1). ' +
+      'git identity is spoofable; this approval is NOT cryptographically attributed.');
+    // unverified_ack=true is the EXPLICIT, audited override the CI Tier-3 gate
+    // looks for. A bare verified:false record WITHOUT this marker (e.g. a stale
+    // pre-fail-closed file or a hand-forged empty one) is still rejected by the
+    // gate — only a deliberately opted-in unverified approval is accepted.
+    return { verified: false, method: 'git_identity_unverified', identity: approver, unverified_ack: true };
   }
 
   return { verified: true, method: 'gpg_key', identity: approver, keyId: gpgKey };
 }
 
-async function approve() {
-  const pkgPath = path.join(ROOT, 'package.json');
-  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+/**
+ * Mint a Tier 3 approval record. Throws (fail-closed) if identity cannot be
+ * verified and the unverified-approval opt-in is not set — the record is NOT
+ * written in that case.
+ * @param {{reason?:string, approvalsDir?:string, root?:string}} [opts]
+ * @returns {{filePath:string, record:object}}
+ */
+function approve(opts = {}) {
+  const reason = opts.reason || 'Manual approval for sensitive changes.';
+  const root = opts.root || ROOT;
+  const approvalsDir = opts.approvalsDir || APPROVALS_DIR;
+
+  const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
 
   const id = `MF-AUTH-${Date.now().toString(36).toUpperCase()}`;
   const timestamp = new Date().toISOString();
   const approver = process.env.USER || 'MindForge User';
 
-  // Verify approver identity (GPG if available, git identity fallback)
+  // Verify approver identity — THROWS fail-closed if unverifiable (before any write).
   const identityVerification = verifyApproverIdentity(approver);
 
-  // Calculate a signature based on current state
   const signature = crypto.createHash('sha256')
-    .update(`${id}:${REASON}:${timestamp}:${os.hostname()}`)
+    .update(`${id}:${reason}:${timestamp}:${os.hostname()}`)
     .digest('hex');
 
   const record = {
@@ -72,25 +101,33 @@ async function approve() {
     tier: 3,
     approved_by: approver,
     timestamp,
-    reason: REASON,
+    reason,
     signature: `sha256:${signature}`,
     identity_verification: identityVerification
   };
 
+  if (!fs.existsSync(approvalsDir)) fs.mkdirSync(approvalsDir, { recursive: true });
   const filename = `approval-${id.toLowerCase()}.json`;
-  const filePath = path.join(APPROVALS_DIR, filename);
-
+  const filePath = path.join(approvalsDir, filename);
   fs.writeFileSync(filePath, JSON.stringify(record, null, 2));
 
-  console.log('\n✅ Governance approval generated!\n');
-  console.log(`ID:       ${id}`);
-  console.log(`Reason:   ${REASON}`);
-  console.log(`Verified: ${identityVerification.verified ? 'GPG (' + identityVerification.keyId + ')' : 'git identity only (no GPG key)'}`);
-  console.log(`File:     .planning/approvals/${filename}`);
-  console.log('\nCommit this file to unblock Tier 3 gates in CI.\n');
+  return { filePath, record, filename };
 }
 
-approve().catch(err => {
-  console.error(`❌ Approval failed: ${err.message}`);
-  process.exit(1);
-});
+module.exports = { verifyApproverIdentity, getGPGSigningKey, approve };
+
+if (require.main === module) {
+  try {
+    const { filename, record } = approve({ reason: process.argv[2] });
+    const iv = record.identity_verification;
+    console.log('\n✅ Governance approval generated!\n');
+    console.log(`ID:       ${record.id}`);
+    console.log(`Reason:   ${record.reason}`);
+    console.log(`Verified: ${iv.verified ? 'GPG (' + iv.keyId + ')' : 'git identity only — UNVERIFIED'}`);
+    console.log(`File:     .planning/approvals/${filename}`);
+    console.log('\nCommit this file to unblock Tier 3 gates in CI.\n');
+  } catch (err) {
+    console.error(`❌ Approval failed: ${err.message}`);
+    process.exit(1);
+  }
+}

package/bin/governance/config-manager.js

@@ -21,7 +21,9 @@ class ConfigManager {
       if (fs.existsSync(this.configPath)) {
         const raw = fs.readFileSync(this.configPath, 'utf8');
         this.config = JSON.parse(raw);
-        console.log(`[ConfigManager] Loaded configuration from ${this.configPath}`);
+        // Diagnostic goes to stderr (not stdout) so it never pollutes JSON that a
+        // consumer parses from this process's stdout. Matches the warn/error lines below.
+        console.error(`[ConfigManager] Loaded configuration from ${this.configPath}`);
       } else {
         console.warn(`[ConfigManager] Config file not found at ${this.configPath}. Using defaults.`);
         this.config = { env: 'default' };

package/bin/governance/rbac-manager.js

@@ -40,18 +40,26 @@ class RBACManager {
   }
 
   /**
-   * [HARDEN] Dynamically binds roles based on ZTAI trust tiers if no explicit role exists.
-   * Ensures high-trust agents automatically get architect-level visibility.
+   * [HARDEN] Dynamically binds roles based on ZTAI trust tiers on top of the
+   * agent's explicit/default roles. High-trust agents automatically gain
+   * architect-level visibility.
+   *
+   * ztai-manager is a SINGLETON instance (not a constructor), and exposes no
+   * getIdentity(); the agent's tier lives in the trust registry, read via
+   * getAgent(did). Fails SAFE: an unregistered/unknown DID has no resolvable
+   * tier, so it receives only its base roles (no tier-based elevation) rather
+   * than throwing. (Wave 6: the previous `new ztai().getIdentity()` threw on
+   * every call — "ztai is not a constructor".)
    */
   async getRolesByTier(did) {
-    const manager = new ztai();
-    const identity = await manager.getIdentity();
     const explicit = this.getRoles(did);
+    const agent = ztai.getAgent(did);
+    const tier = agent && typeof agent.tier === 'number' ? agent.tier : 0;
 
-    if (identity.tier >= 3) {
+    if (tier >= 3) {
       return [...new Set([...explicit, 'lead-architect'])];
     }
-    if (identity.tier >= 2) {
+    if (tier >= 2) {
       return [...new Set([...explicit, 'developer'])];
     }
     return explicit;