mindforge-cc 11.5.1 → 11.6.0

package/.agent/skills/web-pentest/templates/pentest-report.md

@@ -0,0 +1,178 @@
+# Penetration Test Report
+
+**Target:** <name + URL>
+**Engagement ID:** <slug>
+**Engagement window:** <start> – <end>
+**Operator:** <name>
+**Tester:** 
+**Report generated:** <ISO 8601 timestamp>
+
+---
+
+## Executive Summary
+
+<2-4 paragraph plain-language summary. Focus on:
+ - What was tested
+ - What was found (count by severity)
+ - Most critical finding in one sentence
+ - High-level remediation recommendation>
+
+| Severity | Count |
+|----------|-------|
+| Critical | 0     |
+| High     | 0     |
+| Medium   | 0     |
+| Low      | 0     |
+| Info     | 0     |
+
+---
+
+## Engagement Scope
+
+In-scope targets (from `engagement/scope.txt`):
+
+- <host or CIDR>
+
+Out of scope: see `engagement/authorization.md`.
+
+Authorization basis: see `engagement/authorization.md`.
+
+## Methodology
+
+Approach was based on the `web-pentest` skill (a 
+adaptation of the OWASP Testing Guide with elements of Shannon's
+proof-based methodology). Phases performed:
+
+- [ ] Pre-recon (source code review)
+- [ ] Recon (live, read-only)
+- [ ] Vulnerability analysis (one queue per OWASP class)
+- [ ] Exploitation (proof-based)
+- [ ] Reporting
+
+Tools used: <nmap, whatweb, curl, browser tool, ...>.
+
+## Findings (L3/L4 — Verified Exploitable)
+
+> Every finding in this section has a reproducible proof-of-concept.
+> L1/L2 candidates that were not promoted to confirmed exploitation
+> are listed in the "Not Exploited" section.
+
+### F-001: <Title>
+
+- **Severity:** Critical | High | Medium | Low
+- **CVSS 3.1 vector:** `CVSS:3.1/AV:N/AC:L/...`
+- **CVSS 3.1 base score:** N.N
+- **CWE:** CWE-XX
+- **Affected endpoint(s):** `GET https://target.example/api/...`
+- **Affected parameter(s):** `id`
+- **Discovered:** <date>
+
+#### Description
+
+<What is the bug, in plain language.>
+
+#### Proof
+
+Request:
+
+```http
+GET /api/items?id=1%27%20OR%201=1-- HTTP/1.1
+Host: target.example
+Cookie: session=...
+```
+
+Response (excerpt):
+
+```http
+HTTP/1.1 200 OK
+Content-Type: application/json
+
+[{"id":1,...}, {"id":2,...}, ... <full table dumped>]
+```
+
+#### Reproduction
+
+```bash
+curl -sS 'https://target.example/api/items?id=1%27%20OR%201=1--' \
+     -H 'Cookie: session=YOUR_TEST_SESSION'
+```
+
+#### Impact
+
+<What an attacker gains. Be specific. "Could allow data extraction" is
+worse than "Allowed extraction of all 4 columns from the `users` table
+in our test (PoC redacted PII), and the same query shape applies to
+any other parameter using the same code path.">
+
+#### Remediation
+
+<Specific, actionable. "Use parameterized queries" is better than
+"sanitize inputs." Include code example if possible.>
+
+#### Verification (post-fix)
+
+To verify the fix, re-run the reproduction command. The response
+should be HTTP 400, an empty result, or a result containing only the
+record matching `id=1` literally.
+
+---
+
+(repeat per finding)
+
+---
+
+## Not Exploited (L1/L2 candidates)
+
+Candidates that pattern-matched but were not promoted to L3 within
+the engagement window. Listed for completeness; do NOT report these
+as confirmed vulnerabilities.
+
+| ID | Class | Endpoint | Status | Why not promoted |
+|----|-------|----------|--------|------------------|
+| INJ-002 | SQLi | `/api/search?q=` | L2 partial | Bypass set exhausted; appears to use parameterized binding |
+| XSS-003 | reflected | `/error?msg=` | L1 identified | Could not produce executable context — output is JSON-encoded |
+
+---
+
+## Out-of-Scope Observations
+
+(Findings or hints noticed but NOT tested because they were outside
+scope. These are documentation, not findings. The operator decides
+whether to extend scope and re-test.)
+
+- The application sends to `https://third-party.example/...` — payload
+  could trigger third-party-side bugs but third party is out of scope.
+
+---
+
+## Limitations
+
+What was NOT tested, and why:
+
+- <Class of test>: <reason>
+
+Examples:
+- DDoS / stress testing — explicitly excluded by engagement scope.
+- Authenticated business-logic flows requiring billing — no test
+  credit card available.
+- Mobile API surfaces — out of scope.
+
+---
+
+## Appendices
+
+- A: `engagement/authorization.md` — authorization on file
+- B: `engagement/scope.txt` — machine-readable scope
+- C: `engagement/request-log.jsonl` — every active request issued
+- D: `findings/*-queue.json` — per-class candidate queues
+- E: `evidence/` — raw captures (request/response pairs)
+
+---
+
+## Disclaimer
+
+This report describes vulnerabilities discovered during a
+time-bounded penetration test against the listed targets within the
+listed scope. Absence of a finding in this report does not imply the
+target is secure; only that no exploitable issue was found in scope
+X within time T using methods Y.

package/.claude/commands/mindforge/skill-tdd.md

@@ -0,0 +1,53 @@
+---
+description: "Test-Driven Development — RED-GREEN-REFACTOR discipline. Write the failing test first, always."
+---
+
+# MindForge — TDD Skill Command
+# Usage: /mindforge:skill-tdd [feature or bug to implement]
+
+Activates the test-driven development skill. The core rule: **if you didn't watch the test fail, you don't know if it tests the right thing.**
+
+## Activation
+
+Load `.mindforge/skills/test-driven-development/SKILL.md` immediately.
+Follow its RED-GREEN-REFACTOR cycle strictly for the full duration of this session.
+
+## The Cycle (non-negotiable)
+
+### RED — Write a failing test
+1. Identify the smallest next behavior to implement.
+2. Write one test that asserts that behavior.
+3. Run it — confirm it FAILS for the right reason (not a syntax error, not a missing import — the actual assertion fails).
+4. Do not proceed until the test fails correctly.
+
+### GREEN — Write minimal code to pass
+1. Write the simplest code that makes the test pass.
+2. No gold-plating, no extra features. Minimum viable.
+3. Run the test — it must pass.
+4. Run the full suite — no regressions.
+
+### REFACTOR — Clean up
+1. Improve code structure, naming, and clarity.
+2. Remove duplication.
+3. Tests stay green throughout — run after every change.
+
+## Mandatory gates
+
+- **Never write code without a failing test.** Not for "obvious" cases, not for "quick" fixes, not for "trivial" implementations.
+- **One cycle at a time.** Complete RED-GREEN-REFACTOR before starting the next behavior.
+- **A passing test suite is always the starting state.** If tests are red when you begin, fix them first.
+
+## When the user asks for a feature
+
+1. Decompose into the smallest testable behavior.
+2. Start with the first RED step before writing any implementation.
+3. Repeat the cycle for each behavior.
+
+## When the user asks for a bug fix
+
+1. Write a failing test that reproduces the bug (this is your RED step).
+2. Confirm it fails.
+3. Fix the code (GREEN).
+4. Refactor if needed.
+
+The bug test becomes the regression guard — it must remain in the suite permanently.

package/.claude/commands/mindforge/skills-index.md

@@ -0,0 +1,118 @@
+---
+description: "Browse all available skills by category — discover and activate any skill by name."
+---
+
+# MindForge — Skills Index
+# Usage: /mindforge:skills-index [optional: category or keyword filter]
+
+Lists all skills available in this MindForge installation. Skills in the **Engine** tier activate automatically via trigger-matching. Skills in the **Extended** tier require explicit invocation.
+
+---
+
+## How to activate a skill
+
+**Engine tier** (auto-triggers from `.mindforge/skills/`): Just describe the task — the skill-loader matches your request against each skill's `triggers:` field and loads the relevant skill automatically.
+
+**Extended tier** (explicit from `.agent/skills/`): Ask Claude to "use the [skill-name] skill" or invoke it by name.
+
+---
+
+## Engine Tier Skills (auto-triggered)
+
+### Software Development
+| Skill | Triggers |
+|---|---|
+| `systematic-debugging` | systematic debugging, root cause analysis, debug methodology, 4-phase debug |
+| `test-driven-development` | TDD, red green refactor, write test first, test before code |
+| `plan` | write a plan, plan mode, implementation plan, plan before coding |
+| `simplify-code` | simplify code, clean up code, refactor for clarity, reduce complexity |
+| `requesting-code-review` | request code review, code review protocol, review this PR |
+| `spike` | technical spike, time-boxed spike, explore this problem |
+| `subagent-driven-development` | subagent driven development, delegate to subagent, multi-agent implementation |
+| `code-wiki` | code wiki, document codebase, knowledge wiki, explain codebase |
+
+### DevOps & Orchestration
+| Skill | Triggers |
+|---|---|
+| `kanban-orchestrator` | kanban orchestrator, multi-agent kanban, decompose and route, orchestrate tasks |
+| `kanban-worker` | kanban worker, pick up kanban task, complete kanban card |
+
+### GitHub Workflows
+| Skill | Triggers |
+|---|---|
+| `github-code-review` | github code review, review PR, pull request review workflow |
+| `github-pr-workflow` | github pr workflow, pull request lifecycle, open PR, merge PR |
+| `github-issues` | github issues, create issue, manage issues, issue triage |
+| `codebase-inspection` | codebase inspection, explore codebase, understand repository |
+
+### Research & Intelligence
+| Skill | Triggers |
+|---|---|
+| `research-paper-writing` | research paper, academic paper, write paper, arxiv paper |
+| `arxiv` | arxiv search, find papers, search arxiv, academic literature |
+| `osint-investigation` | OSINT investigation, public records research, entity investigation |
+| `domain-intel` | domain intelligence, investigate domain, domain research |
+| `duckduckgo-search` | duckduckgo search, DDG search, web search |
+| `scrapling` | scrape website, web scraping, extract web content |
+| `blogwatcher` | monitor blog, watch blog, track blog updates |
+
+### Creative
+| Skill | Triggers |
+|---|---|
+| `concept-diagrams` | concept diagram, educational diagram, SVG diagram, visual explanation |
+| `creative-ideation` | creative ideation, brainstorm ideas, creative ideas, generate concepts |
+| `pixel-art` | pixel art, create pixel art, sprite design |
+| `meme-generation` | meme generation, create meme, generate meme |
+
+### Security
+| Skill | Triggers |
+|---|---|
+| `web-pentest` | web penetration test, pentest this app, security test web app, OWASP test |
+| `oss-forensics` | OSS forensics, open source forensics, supply chain audit |
+| `sherlock` | sherlock, username investigation, find accounts, OSINT username |
+
+### Data & Tooling
+| Skill | Triggers |
+|---|---|
+| `jupyter-live-kernel` | jupyter kernel, live jupyter, interactive notebook |
+| `obsidian` | obsidian notes, obsidian vault, obsidian workflow |
+
+---
+
+## Extended Tier Skills (`.agent/skills/`, explicit activation)
+
+### Software Development
+`node-inspect-debugger` · `python-debugpy` · `skill-authoring` · `rest-graphql-debug`
+
+### GitHub
+`github-auth` · `github-repo-management`
+
+### DevOps
+`docker-management` · `devops-cli` · `devops-watchers` · `pinggy-tunnel` · `s6-container-supervision`
+
+### Research
+`llm-wiki` · `polymarket` · `parallel-cli`
+
+### Security
+`godmode` · `1password-skill`
+
+### Creative
+`hyperframes` · `article-illustrator` · `comic-creator` · `video-orchestrator`
+
+---
+
+## Usage examples
+
+```
+"Debug this null pointer — use systematic debugging"
+→ Engine tier: systematic-debugging activates automatically
+
+"I want to do TDD on this new auth module"
+→ Engine tier: test-driven-development activates automatically
+
+"Use the docker-management skill to set up my containers"
+→ Extended tier: explicit invocation of docker-management
+
+"Run an OSINT investigation on this company"
+→ Engine tier: osint-investigation activates automatically
+```

package/.claude/commands/mindforge/systematic-debug.md

@@ -0,0 +1,60 @@
+---
+description: "4-phase root cause debugging — understand the bug completely before attempting any fix."
+---
+
+# MindForge — Systematic Debug Command
+# Usage: /mindforge:systematic-debug [problem description]
+
+Activates the systematic debugging skill. The iron law: **NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST**. Symptom fixes are failure.
+
+## Activation
+
+Load `.mindforge/skills/systematic-debugging/SKILL.md` immediately.
+Follow its 4-phase protocol for the full duration of this session.
+
+## Phase 1 — Understand the Bug
+
+Before touching any code:
+
+1. **Reproduce it.** Can you reproduce it in a minimal, isolated environment?
+   - If no: document what you tried. Ask the user for more context. Do not guess.
+   - If yes: record the exact reproduction steps.
+
+2. **Read the error completely.** Stack trace, logs, error message — read every line.
+
+3. **Identify the invariant.** What assumption is being violated? What should be true that isn't?
+
+4. **Map the control flow.** Trace the path from input to failure point.
+
+**Output of Phase 1:** A written statement of the root cause hypothesis with evidence.
+
+## Phase 2 — Isolate the Root Cause
+
+1. Write a failing test that exercises exactly the broken invariant.
+2. Confirm the test fails for the right reason (not just any reason).
+3. Narrow scope: is the bug in this file? This function? This line?
+4. Check: is this a regression? Run `git log --oneline -20` on affected files.
+
+**Gate:** Do not proceed to Phase 3 without a failing test that proves the bug.
+
+## Phase 3 — Fix
+
+1. Apply the minimal fix that restores the invariant.
+2. Do not fix adjacent issues or refactor — single responsibility per fix.
+3. Run the failing test — it must now pass.
+4. Run the full test suite — zero new failures allowed.
+
+## Phase 4 — Verify and Document
+
+1. Confirm the original reproduction steps no longer trigger the bug.
+2. Write a one-paragraph RCA summary: what was broken, why, how it was fixed.
+3. Commit with a message that explains the root cause, not the symptom.
+
+## When you cannot find the root cause
+
+- Add logging/instrumentation at the point of failure.
+- Form 2–3 competing hypotheses and test each independently.
+- Document what you ruled out — negative evidence is evidence.
+- Ask the user for additional context before guessing.
+
+Do not apply a fix that "might work." Every fix requires a root cause explanation.

package/.mindforge/config.json

@@ -1,11 +1,11 @@
 {
-  "version": "11.5.1",
+  "version": "11.6.0",
   "environment": "development",
   "governance": {
     "drift_threshold": 0.75,
     "critical_drift_threshold": 0.5,
     "res_threshold": 0.8,
-    "active_did": "did:mindforge:7dffeae7-eb70-45c9-9001-701fba7809d2"
+    "active_did": "did:mindforge:9c7c1685-aa97-4317-974c-d782fb64005c"
   },
   "revops": {
     "market_registry": {

package/.mindforge/memory/sync-manifest.json

@@ -1,6 +1,6 @@
 {
   "pattern-library.jsonl": {
-    "lastSync": "2026-06-11T11:41:34.054Z",
+    "lastSync": "2026-06-17T12:34:17.920Z",
     "localCount": 1
   }
 }