mindforge-cc 11.7.1 → 11.8.0

package/.mindforge/dynamic-workflows/scripts/security-hardening.js

@@ -0,0 +1,154 @@
+export const meta = {
+  name: 'security-hardening',
+  description: '5-angle OWASP parallel scout → 3-vote adversarial verification → threat model + remediation roadmap',
+  whenToUse: 'When hardening a codebase before a security review, pentest, or production launch',
+  phases: [
+    { title: 'Scope', detail: 'Define attack surface and target context' },
+    { title: 'Scout', detail: '5 parallel OWASP/CWE dimension scouts' },
+    { title: 'Verify', detail: '3-vote adversarial verification per critical finding' },
+    { title: 'ThreatModel', detail: 'STRIDE threat model from confirmed findings' },
+    { title: 'Roadmap', detail: 'Prioritized remediation roadmap with severity/effort matrix' },
+  ],
+};
+
+export default async function run({ agent, parallel, pipeline, phase, log, args, budget }) {
+  const FINDING_SCHEMA = {
+    type: 'object',
+    properties: {
+      dimension: { type: 'string' },
+      findings: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            cwe: { type: 'string' },
+            owasp: { type: 'string' },
+            severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'] },
+            title: { type: 'string' },
+            location: { type: 'string' },
+            description: { type: 'string' },
+            remediation: { type: 'string' },
+          },
+          required: ['severity', 'title', 'description', 'remediation'],
+        },
+      },
+    },
+    required: ['dimension', 'findings'],
+  };
+
+  const VERDICT_SCHEMA = {
+    type: 'object',
+    properties: { isReal: { type: 'boolean' }, cvssEstimate: { type: 'number' }, reason: { type: 'string' } },
+    required: ['isReal', 'reason'],
+  };
+
+  const THREAT_SCHEMA = {
+    type: 'object',
+    properties: {
+      strideThreats: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            stride: { type: 'string', enum: ['Spoofing', 'Tampering', 'Repudiation', 'InfoDisclosure', 'DoS', 'ElevationOfPrivilege'] },
+            threat: { type: 'string' },
+            likelihood: { type: 'string', enum: ['high', 'medium', 'low'] },
+            impact: { type: 'string', enum: ['high', 'medium', 'low'] },
+            mitigation: { type: 'string' },
+          },
+          required: ['stride', 'threat', 'likelihood', 'impact', 'mitigation'],
+        },
+      },
+    },
+    required: ['strideThreats'],
+  };
+
+  const ROADMAP_SCHEMA = {
+    type: 'object',
+    properties: {
+      summary: { type: 'string' },
+      overallRisk: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+      immediateActions: { type: 'array', items: { type: 'string' } },
+      roadmap: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            sprint: { type: 'number' },
+            items: { type: 'array', items: { type: 'string' } },
+            riskReduction: { type: 'string' },
+          },
+          required: ['sprint', 'items', 'riskReduction'],
+        },
+      },
+    },
+    required: ['summary', 'overallRisk', 'immediateActions', 'roadmap'],
+  };
+
+  const target = args || 'current codebase (run from repo root)';
+
+  phase('Scope');
+  log(`Security hardening target: ${target}`);
+
+  const SCOUTS = [
+    { label: 'injection', prompt: `Scout for injection vulnerabilities in: "${target}". Cover: SQL injection, command injection, LDAP injection, XSS (stored/reflected/DOM), SSTI, XXE, path traversal (CWE-89, CWE-78, CWE-79, CWE-611, CWE-22). For each finding provide CWE ID, OWASP category, exact file/line if possible, and remediation.` },
+    { label: 'auth-access', prompt: `Scout for authentication and access control issues in: "${target}". Cover: broken authentication, missing auth checks, JWT flaws, session fixation, privilege escalation, IDOR, missing rate limits (OWASP A01, A07). Include CWE IDs and remediation.` },
+    { label: 'crypto-secrets', prompt: `Scout for cryptographic failures and secret exposure in: "${target}". Cover: hardcoded secrets, weak hashing (MD5/SHA1 for passwords), insecure random, unencrypted PII in transit/at-rest, certificate validation bypass (CWE-327, CWE-798, CWE-330). Include CWE IDs and remediation.` },
+    { label: 'config-supply', prompt: `Scout for security misconfiguration and supply chain risks in: "${target}". Cover: debug endpoints exposed, CORS misconfig, CSP missing, dependency vulns, unpinned deps, outdated packages with CVEs (OWASP A05, A06). Include CWE IDs and remediation.` },
+    { label: 'logging-monitoring', prompt: `Scout for logging, monitoring, and error handling security gaps in: "${target}". Cover: sensitive data in logs, missing audit trails, verbose error messages leaking internals, missing security event logging, SSRF via fetch/request (OWASP A09, A10, CWE-209). Include CWE IDs and remediation.` },
+  ];
+
+  phase('Scout');
+  const scouts = await parallel(
+    SCOUTS.map(s => () => agent(s.prompt, { schema: FINDING_SCHEMA, label: `scout:${s.label}`, phase: 'Scout' }))
+  );
+
+  phase('Verify');
+  const allFindings = scouts.filter(Boolean).flatMap(s => (s.findings || []).map(f => ({ ...f, dimension: s.dimension })));
+  const criticalAndHigh = allFindings.filter(f => f.severity === 'critical' || f.severity === 'high');
+  log(`${allFindings.length} total findings, ${criticalAndHigh.length} critical/high → 3-vote adversarial verify`);
+
+  const verified = await parallel(
+    criticalAndHigh.map(f => () =>
+      parallel([
+        () => agent(`Try to REFUTE this security finding — is it a false positive? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}. Default refuted=false only if clearly real.`, { schema: VERDICT_SCHEMA, label: `v1:${f.title.slice(0, 25)}`, phase: 'Verify' }),
+        () => agent(`Challenge this finding from an attacker's perspective — is it actually exploitable? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}. Rate exploitability.`, { schema: VERDICT_SCHEMA, label: `v2:${f.title.slice(0, 25)}`, phase: 'Verify' }),
+        () => agent(`Assess business impact of this finding being exploited. Is the severity rating accurate? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}.`, { schema: VERDICT_SCHEMA, label: `v3:${f.title.slice(0, 25)}`, phase: 'Verify' }),
+      ]).then(votes => {
+        if (!votes) return { ...f, confirmed: false };
+        const realVotes = votes.filter(Boolean).filter(v => v.isReal).length;
+        return { ...f, confirmed: realVotes >= 2 };
+      })
+    )
+  );
+
+  const confirmedHigh = verified.filter(Boolean).filter(f => f.confirmed);
+  const lowerSeverity = allFindings.filter(f => f.severity !== 'critical' && f.severity !== 'high');
+  const allConfirmed = [...confirmedHigh, ...lowerSeverity];
+  log(`${confirmedHigh.length}/${criticalAndHigh.length} critical/high confirmed after 3-vote verification`);
+
+  phase('ThreatModel');
+  const findingSummary = allConfirmed.slice(0, 15).map(f => `[${f.severity}] ${f.title}: ${f.description}`).join('\n');
+  const threatModel = await agent(
+    `Generate a STRIDE threat model for: "${target}"\n\nBased on these confirmed findings:\n${findingSummary}\n\nFor each STRIDE category (Spoofing, Tampering, Repudiation, InfoDisclosure, DoS, ElevationOfPrivilege) identify the top threat, likelihood, impact, and mitigation.`,
+    { schema: THREAT_SCHEMA, label: 'threat-model', phase: 'ThreatModel' }
+  );
+  if (!threatModel) { log('Warning: agent returned null for threatModel, skipping'); return { target, error: 'agent-null' }; }
+
+  phase('Roadmap');
+  const threatSummary = (threatModel.strideThreats || []).map(t => `[${t.stride}] ${t.threat} (${t.likelihood} likelihood, ${t.impact} impact) → ${t.mitigation}`).join('\n');
+  const roadmap = await agent(
+    `Create a prioritized security remediation roadmap for: "${target}"\n\nConfirmed findings (${allConfirmed.length} total):\n${findingSummary}\n\nSTRIDE threats:\n${threatSummary}\n\nGroup into 3 sprints by severity+effort. Sprint 1 = immediate (critical/high, low effort). Sprint 2 = short-term (high, higher effort + medium). Sprint 3 = long-term (medium/low). Include risk reduction estimate per sprint.`,
+    { schema: ROADMAP_SCHEMA, label: 'roadmap', phase: 'Roadmap' }
+  );
+  if (!roadmap) { return { target, threats: threatModel, error: 'roadmap-agent-null', stats: { total: allFindings.length, criticalHigh: criticalAndHigh.length, confirmed: confirmedHigh.length } }; }
+
+  return {
+    target,
+    threats: threatModel,
+    report: {
+      ...roadmap,
+      stats: { total: allFindings.length, criticalHigh: criticalAndHigh.length, confirmed: confirmedHigh.length, lower: lowerSeverity.length },
+    },
+  };
+}

package/.mindforge/dynamic-workflows/scripts/security-threat-model.js

@@ -0,0 +1,159 @@
+export const meta = {
+  name: 'security-threat-model',
+  description: 'Asset inventory → STRIDE threat enumeration → parallel mitigations → CVSS-style score matrix',
+  whenToUse: 'When threat modeling a system architecture, new feature, or service before implementation or security review',
+  phases: [
+    { title: 'Assets', detail: 'Inventory system assets, data flows, and trust boundaries' },
+    { title: 'STRIDE', detail: '6 parallel STRIDE threat agents — one per threat category' },
+    { title: 'Mitigate', detail: 'Parallel mitigation agent per identified threat' },
+    { title: 'Score', detail: 'CVSS-style risk score matrix with remediation priority' },
+  ],
+};
+
+export default async function run({ agent, parallel, pipeline, phase, log, args, budget }) {
+  const ASSETS_SCHEMA = {
+    type: 'object',
+    properties: {
+      assets: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            name: { type: 'string' },
+            type: { type: 'string', enum: ['data', 'service', 'credential', 'infrastructure', 'user'] },
+            sensitivity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+            description: { type: 'string' },
+          },
+          required: ['name', 'type', 'sensitivity'],
+        },
+      },
+      dataFlows: { type: 'array', items: { type: 'string' } },
+      trustBoundaries: { type: 'array', items: { type: 'string' } },
+      entryPoints: { type: 'array', items: { type: 'string' } },
+    },
+    required: ['assets', 'dataFlows', 'trustBoundaries', 'entryPoints'],
+  };
+
+  const STRIDE_SCHEMA = {
+    type: 'object',
+    properties: {
+      category: { type: 'string', enum: ['Spoofing', 'Tampering', 'Repudiation', 'InformationDisclosure', 'DenialOfService', 'ElevationOfPrivilege'] },
+      threats: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            threatId: { type: 'string' },
+            title: { type: 'string' },
+            affectedAsset: { type: 'string' },
+            attackVector: { type: 'string' },
+            likelihood: { type: 'string', enum: ['high', 'medium', 'low'] },
+            impact: { type: 'string', enum: ['high', 'medium', 'low'] },
+            description: { type: 'string' },
+          },
+          required: ['threatId', 'title', 'affectedAsset', 'likelihood', 'impact', 'description'],
+        },
+      },
+    },
+    required: ['category', 'threats'],
+  };
+
+  const MITIGATION_SCHEMA = {
+    type: 'object',
+    properties: {
+      threatId: { type: 'string' },
+      controls: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            control: { type: 'string' },
+            type: { type: 'string', enum: ['preventive', 'detective', 'corrective'] },
+            implementation: { type: 'string' },
+            effort: { type: 'string', enum: ['low', 'medium', 'high'] },
+          },
+          required: ['control', 'type', 'implementation', 'effort'],
+        },
+      },
+      residualRisk: { type: 'string', enum: ['high', 'medium', 'low', 'accepted'] },
+    },
+    required: ['threatId', 'controls', 'residualRisk'],
+  };
+
+  const SCORE_SCHEMA = {
+    type: 'object',
+    properties: {
+      summary: { type: 'string' },
+      overallRiskLevel: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+      scoreMatrix: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            threatId: { type: 'string' },
+            title: { type: 'string' },
+            category: { type: 'string' },
+            cvssEstimate: { type: 'number' },
+            priority: { type: 'string', enum: ['p0', 'p1', 'p2', 'p3'] },
+            mitigationStatus: { type: 'string', enum: ['mitigated', 'partial', 'unmitigated'] },
+          },
+          required: ['threatId', 'title', 'category', 'cvssEstimate', 'priority'],
+        },
+      },
+      topRisks: { type: 'array', items: { type: 'string' } },
+    },
+    required: ['summary', 'overallRiskLevel', 'scoreMatrix', 'topRisks'],
+  };
+
+  const target = args || 'current system (run from repo root or describe the system in args)';
+
+  phase('Assets');
+  log(`Threat modeling target: ${target}`);
+  const assetModel = await agent(
+    `Inventory the security-relevant assets, data flows, and trust boundaries for: "${target}". Identify: (1) assets (data stores, services, credentials, infrastructure) with sensitivity level, (2) data flows between components, (3) trust boundaries (where data crosses privilege levels), (4) entry points (public APIs, user inputs, external integrations).`,
+    { schema: ASSETS_SCHEMA, label: 'assets' }
+  );
+  if (!assetModel) { return { target, error: 'assetModel-agent-null' }; }
+  log(`${assetModel.assets.length} assets, ${assetModel.trustBoundaries.length} trust boundaries, ${assetModel.entryPoints.length} entry points`);
+
+  const assetContext = `Assets: ${assetModel.assets.slice(0, 5).map(a => `${a.name}(${a.sensitivity})`).join(', ')}\nData flows: ${assetModel.dataFlows.slice(0, 3).join(', ')}\nTrust boundaries: ${assetModel.trustBoundaries.slice(0, 3).join(', ')}\nEntry points: ${assetModel.entryPoints.slice(0, 3).join(', ')}`;
+
+  phase('STRIDE');
+  const STRIDE_CATEGORIES = [
+    { cat: 'Spoofing', prompt: `Identify SPOOFING threats for: "${target}". ${assetContext}. Spoofing = an attacker pretends to be someone/something they're not. Look for: weak authentication, missing identity verification, forged tokens/sessions, impersonation attacks. Assign each threat a unique ID (S-01, S-02...), affected asset, likelihood, and impact.` },
+    { cat: 'Tampering', prompt: `Identify TAMPERING threats for: "${target}". ${assetContext}. Tampering = malicious modification of data. Look for: insufficient authorization on write operations, missing integrity checks, SQL/command injection, insecure deserialization, CSRF. Assign IDs (T-01...), affected asset, likelihood, impact.` },
+    { cat: 'Repudiation', prompt: `Identify REPUDIATION threats for: "${target}". ${assetContext}. Repudiation = ability to deny performing an action. Look for: missing audit logs, insufficient logging of sensitive operations, lack of digital signatures, no non-repudiation controls. Assign IDs (R-01...).` },
+    { cat: 'InformationDisclosure', prompt: `Identify INFORMATION DISCLOSURE threats for: "${target}". ${assetContext}. Info disclosure = exposure of data to unauthorized parties. Look for: verbose error messages, debug endpoints, insecure data storage, missing encryption at rest/transit, over-permissive APIs, PII exposure. Assign IDs (I-01...).` },
+    { cat: 'DenialOfService', prompt: `Identify DENIAL OF SERVICE threats for: "${target}". ${assetContext}. DoS = making resources unavailable. Look for: missing rate limits, resource exhaustion endpoints, expensive unbounded queries, large payload acceptance without limits, connection pool exhaustion. Assign IDs (D-01...).` },
+    { cat: 'ElevationOfPrivilege', prompt: `Identify ELEVATION OF PRIVILEGE threats for: "${target}". ${assetContext}. EoP = gaining unauthorized capabilities. Look for: broken access control, IDOR, privilege escalation paths, JWT/token manipulation, missing authorization checks on admin functions. Assign IDs (E-01...).` },
+  ];
+
+  const strideResults = await parallel(
+    STRIDE_CATEGORIES.map(s => () => agent(s.prompt, { schema: STRIDE_SCHEMA, label: `stride:${s.cat.toLowerCase()}`, phase: 'STRIDE' }))
+  );
+
+  const allThreats = strideResults.filter(Boolean).flatMap(s => s.threats.map(t => ({ category: s.category, ...t })));
+  log(`${allThreats.length} threats identified across 6 STRIDE categories`);
+
+  phase('Mitigate');
+  const highPriorityThreats = allThreats.filter(t => t.likelihood === 'high' || t.impact === 'high').slice(0, 12);
+  log(`Generating mitigations for ${highPriorityThreats.length} high-priority threats`);
+
+  const mitigations = await parallel(
+    highPriorityThreats.map(t => () => agent(
+      `Design mitigations for this threat in: "${target}"\n\nThreat ${t.threatId} [${t.category}]: ${t.title}\nDescription: ${t.description}\nAffected asset: ${t.affectedAsset}\nLikelihood: ${t.likelihood}, Impact: ${t.impact}\n\nProvide 2-3 security controls: preventive (stop it), detective (detect it), or corrective (respond to it). Include specific implementation steps and effort estimate. Rate residual risk after controls.`,
+      { schema: MITIGATION_SCHEMA, label: `mitigate:${t.threatId}`, phase: 'Mitigate' }
+    ))
+  );
+
+  phase('Score');
+  const threatContext = allThreats.slice(0, 15).map(t => `${t.threatId} [${t.category}/${t.likelihood}/${t.impact}]: ${t.title}`).join('\n');
+  const mitigationContext = mitigations.filter(Boolean).map(m => `${m.threatId}: ${m.controls.length} controls, residual=${m.residualRisk}`).join('\n');
+
+  const scoreMatrix = await agent(
+    `Create a CVSS-style risk score matrix for: "${target}"\n\nThreats:\n${threatContext}\n\nMitigations:\n${mitigationContext}\n\nFor each threat estimate a CVSS base score (0.0-10.0) based on likelihood×impact. Assign priority (P0=CVSS≥9, P1=7-8.9, P2=4-6.9, P3=<4). Determine overall risk level and list top 5 risks to address immediately.`,
+    { schema: SCORE_SCHEMA, label: 'score-matrix' }
+  );
+
+  return { target, assetModel, threats: allThreats, mitigations: mitigations.filter(Boolean), scoreMatrix };
+}

package/.mindforge/dynamic-workflows/scripts/test-coverage-gap.js

@@ -0,0 +1,95 @@
+export const meta = {
+  name: 'test-coverage-gap',
+  description: 'Parallel per-module coverage analysis → gap map → prioritized test-writing plan',
+  whenToUse: 'When you need to find and fix test coverage gaps across a codebase or module',
+  phases: [
+    { title: 'Discover', detail: 'Map modules and identify testable units' },
+    { title: 'Analyze', detail: 'Parallel coverage analysis per module' },
+    { title: 'GapMap', detail: 'Synthesize gaps by severity and risk' },
+    { title: 'Plan', detail: 'Prioritized test-writing plan with concrete test cases' },
+  ],
+};
+
+export default async function run({ agent, parallel, pipeline, phase, log, args, budget }) {
+  const MODULE_SCHEMA = {
+    type: 'object',
+    properties: {
+      modules: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: { name: { type: 'string' }, path: { type: 'string' }, risk: { type: 'string', enum: ['high', 'medium', 'low'] } },
+          required: ['name', 'path', 'risk'],
+        },
+      },
+    },
+    required: ['modules'],
+  };
+
+  const COVERAGE_SCHEMA = {
+    type: 'object',
+    properties: {
+      module: { type: 'string' },
+      testedBehaviors: { type: 'array', items: { type: 'string' } },
+      untestedBehaviors: { type: 'array', items: { type: 'string' } },
+      missingEdgeCases: { type: 'array', items: { type: 'string' } },
+      estimatedCoverage: { type: 'number' },
+    },
+    required: ['module', 'testedBehaviors', 'untestedBehaviors', 'missingEdgeCases', 'estimatedCoverage'],
+  };
+
+  const PLAN_SCHEMA = {
+    type: 'object',
+    properties: {
+      summary: { type: 'string' },
+      prioritizedTests: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            module: { type: 'string' },
+            behavior: { type: 'string' },
+            priority: { type: 'string', enum: ['p0', 'p1', 'p2'] },
+            testDescription: { type: 'string' },
+            skeletonCode: { type: 'string' },
+          },
+          required: ['module', 'behavior', 'priority', 'testDescription', 'skeletonCode'],
+        },
+      },
+    },
+    required: ['summary', 'prioritizedTests'],
+  };
+
+  const target = args || 'current codebase (run from repo root)';
+
+  phase('Discover');
+  log(`Discovering testable modules in: ${target}`);
+  const discovery = await agent(
+    `Discover and list all testable modules in: "${target}". For each module identify its path and risk level (high=core business logic/auth/payment, medium=data processing, low=utilities/helpers). Focus on source files that should have tests.`,
+    { schema: MODULE_SCHEMA, label: 'discover' }
+  );
+  const modules = ((discovery || {}).modules || []).slice(0, 12);
+  log(`Found ${modules.length} modules to analyze`);
+
+  phase('Analyze');
+  const coverageResults = await parallel(
+    modules.map(m => () => agent(
+      `Analyze test coverage for module: "${m.name}" at path: "${m.path}" in codebase: "${target}". List: (1) behaviors currently tested, (2) behaviors NOT tested that should be, (3) missing edge cases. Estimate current coverage % (0-100).`,
+      { schema: COVERAGE_SCHEMA, label: `cov:${m.name.slice(0, 20)}`, phase: 'Analyze' }
+    ))
+  );
+
+  phase('GapMap');
+  const gaps = coverageResults.filter(Boolean);
+  const gapSummary = gaps.map(g => `${g.module} (~${g.estimatedCoverage}% covered): untested=[${g.untestedBehaviors.slice(0, 3).join(', ')}]`).join('\n');
+  log(`Coverage gaps identified across ${gaps.length} modules`);
+
+  phase('Plan');
+  const plan = await agent(
+    `Create a prioritized test-writing plan for: "${target}"\n\nCoverage gaps:\n${gapSummary}\n\nFor each gap, write a concrete test description and skeleton code. Prioritize: P0=high-risk untested, P1=medium-risk gaps, P2=edge cases. Include the actual test skeleton (describe/it or test() blocks) for each.`,
+    { schema: PLAN_SCHEMA, label: 'plan' }
+  );
+  if (!plan) { return { target, modules, gaps, error: 'plan-agent-null' }; }
+
+  return { target, modules, gaps, plan };
+}

package/.mindforge/dynamic-workflows/scripts/ux-heuristic-audit.js

@@ -0,0 +1,122 @@
+export const meta = {
+  name: 'ux-heuristic-audit',
+  description: '10 Nielsen heuristics parallel audit → severity ranking → fix brief',
+  whenToUse: 'When auditing a UI for usability problems using Nielsen\'s 10 heuristics before launch or redesign',
+  phases: [
+    { title: 'Scope', detail: 'Define target UI and identify key user flows to audit' },
+    { title: 'Audit', detail: '10 parallel heuristic evaluators — one per Nielsen heuristic' },
+    { title: 'Rank', detail: 'Severity ranking of all violations by impact on user experience' },
+    { title: 'Brief', detail: 'Prioritized fix brief with specific design recommendations' },
+  ],
+};
+
+export default async function run({ agent, parallel, pipeline, phase, log, args, budget }) {
+  const HEURISTIC_SCHEMA = {
+    type: 'object',
+    properties: {
+      heuristic: { type: 'string' },
+      violations: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            component: { type: 'string' },
+            severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+            description: { type: 'string' },
+            recommendation: { type: 'string' },
+          },
+          required: ['severity', 'description', 'recommendation'],
+        },
+      },
+      score: { type: 'number' },
+    },
+    required: ['heuristic', 'violations', 'score'],
+  };
+
+  const RANK_SCHEMA = {
+    type: 'object',
+    properties: {
+      rankedViolations: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            rank: { type: 'number' },
+            heuristic: { type: 'string' },
+            description: { type: 'string' },
+            severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+            impactScore: { type: 'number' },
+          },
+          required: ['rank', 'heuristic', 'description', 'severity', 'impactScore'],
+        },
+      },
+      overallUsabilityScore: { type: 'number' },
+    },
+    required: ['rankedViolations', 'overallUsabilityScore'],
+  };
+
+  const BRIEF_SCHEMA = {
+    type: 'object',
+    properties: {
+      summary: { type: 'string' },
+      criticalFixes: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            issue: { type: 'string' },
+            heuristic: { type: 'string' },
+            fix: { type: 'string' },
+            effort: { type: 'string', enum: ['low', 'medium', 'high'] },
+          },
+          required: ['issue', 'heuristic', 'fix', 'effort'],
+        },
+      },
+      quickWins: { type: 'array', items: { type: 'string' } },
+    },
+    required: ['summary', 'criticalFixes', 'quickWins'],
+  };
+
+  const target = args || 'current codebase (run from repo root)';
+
+  phase('Scope');
+  log(`UX heuristic audit target: ${target}`);
+
+  const HEURISTICS = [
+    { label: 'visibility-of-status', prompt: `Evaluate Nielsen Heuristic #1 "Visibility of System Status" for: "${target}". Check: Does the UI always keep users informed about what is going on? Are loading states shown? Is progress communicated? Are confirmations displayed after actions? Score 0-100 (100=perfect) and list all violations with severity.` },
+    { label: 'match-real-world', prompt: `Evaluate Nielsen Heuristic #2 "Match Between System and the Real World" for: "${target}". Check: Does the UI use language and concepts familiar to users? Are metaphors and icons intuitive? Is information ordered naturally? Score 0-100 and list violations.` },
+    { label: 'user-control', prompt: `Evaluate Nielsen Heuristic #3 "User Control and Freedom" for: "${target}". Check: Can users undo/redo actions? Is there a clear exit from every state? Are emergency exits clearly marked? Can users cancel ongoing operations? Score 0-100 and list violations.` },
+    { label: 'consistency', prompt: `Evaluate Nielsen Heuristic #4 "Consistency and Standards" for: "${target}". Check: Do similar actions have similar appearance and behavior? Are platform conventions followed? Are labels consistent across screens? Score 0-100 and list violations.` },
+    { label: 'error-prevention', prompt: `Evaluate Nielsen Heuristic #5 "Error Prevention" for: "${target}". Check: Are good error-prone conditions eliminated? Are confirmation dialogs shown for destructive actions? Is inline validation used? Are form constraints visible before submission? Score 0-100 and list violations.` },
+    { label: 'recognition-over-recall', prompt: `Evaluate Nielsen Heuristic #6 "Recognition Rather Than Recall" for: "${target}". Check: Are options visible rather than remembered? Are instructions visible in context? Are recently used items surfaced? Are tooltips and help text available? Score 0-100 and list violations.` },
+    { label: 'flexibility', prompt: `Evaluate Nielsen Heuristic #7 "Flexibility and Efficiency of Use" for: "${target}". Check: Are there keyboard shortcuts for expert users? Can users customize frequent actions? Are there accelerators for power users? Does the UI serve both novice and expert? Score 0-100 and list violations.` },
+    { label: 'aesthetic-minimalism', prompt: `Evaluate Nielsen Heuristic #8 "Aesthetic and Minimalist Design" for: "${target}". Check: Does every element serve a purpose? Is irrelevant information removed? Are visual hierarchies clear? Is there excessive decoration or noise? Score 0-100 and list violations.` },
+    { label: 'error-recognition', prompt: `Evaluate Nielsen Heuristic #9 "Help Users Recognize, Diagnose, and Recover from Errors" for: "${target}". Check: Are error messages in plain language (not error codes)? Do they precisely indicate the problem? Do they constructively suggest solutions? Score 0-100 and list violations.` },
+    { label: 'help-docs', prompt: `Evaluate Nielsen Heuristic #10 "Help and Documentation" for: "${target}". Check: Is help easy to search? Is documentation focused on user tasks? Are concrete steps listed? Is context-sensitive help available? Score 0-100 and list violations.` },
+  ];
+
+  phase('Audit');
+  const auditResults = await parallel(
+    HEURISTICS.map(h => () => agent(h.prompt, { schema: HEURISTIC_SCHEMA, label: `heuristic:${h.label}`, phase: 'Audit' }))
+  );
+
+  phase('Rank');
+  const allViolations = auditResults.filter(Boolean).flatMap(r => (r.violations || []).map(v => ({ heuristic: r.heuristic, ...v })));
+  log(`${allViolations.length} violations found across 10 heuristics — ranking by severity`);
+
+  const violationSummary = allViolations.slice(0, 30).map(v => `[${v.severity}] ${v.heuristic || 'unknown'}: ${v.description}`).join('\n');
+  const ranked = await agent(
+    `Rank these UX violations by impact on user experience for: "${target}"\n\nViolations:\n${violationSummary}\n\nRank each by impact score (1-10), assign a rank number starting from 1 (most critical). Calculate an overall usability score (0-100) across all heuristics.`,
+    { schema: RANK_SCHEMA, label: 'rank' }
+  );
+  if (!ranked) { log('Warning: agent returned null for ranked, skipping'); return { target, error: 'agent-null' }; }
+
+  phase('Brief');
+  const topViolations = (ranked.rankedViolations || []).slice(0, 10).map(v => `[Rank ${v.rank}/${v.severity}] ${v.heuristic}: ${v.description}`).join('\n');
+  const brief = await agent(
+    `Create a UX fix brief for: "${target}"\n\nOverall usability score: ${ranked.overallUsabilityScore}/100\n\nTop violations:\n${topViolations}\n\nFor each critical/high violation provide: specific fix with design recommendation, implementation effort (low/medium/high). Also list quick wins (low effort, high impact fixes). Write a 2-3 sentence executive summary.`,
+    { schema: BRIEF_SCHEMA, label: 'brief' }
+  );
+
+  return { target, audits: auditResults.filter(Boolean), ranked, brief };
+}

package/.mindforge/dynamic-workflows/scripts/writer-reviewer.js

@@ -0,0 +1,85 @@
+export const meta = {
+  name: 'writer-reviewer',
+  description: 'Anthropic Writer/Reviewer pattern: implement in Context A → fresh Context B reviews the diff',
+  whenToUse: 'When you want unbiased code review — a fresh context reviewer has no bias toward code it did not write',
+  phases: [
+    { title: 'Implement', detail: 'Writer agent implements the requested change' },
+    { title: 'Review', detail: 'Fresh reviewer agent inspects only the diff without implementation context' },
+    { title: 'Verdict', detail: 'Accept / request-changes verdict with specific actionable feedback' },
+  ],
+};
+
+export default async function run({ agent, parallel, pipeline, phase, log, args, budget }) {
+  const IMPL_SCHEMA = {
+    type: 'object',
+    properties: {
+      description: { type: 'string' },
+      filesChanged: { type: 'array', items: { type: 'string' } },
+      approach: { type: 'string' },
+      diff: { type: 'string' },
+      testingDone: { type: 'string' },
+    },
+    required: ['description', 'filesChanged', 'approach', 'diff'],
+  };
+
+  const REVIEW_SCHEMA = {
+    type: 'object',
+    properties: {
+      verdict: { type: 'string', enum: ['approve', 'request-changes', 'comment'] },
+      summary: { type: 'string' },
+      issues: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            severity: { type: 'string', enum: ['blocker', 'major', 'minor', 'nit'] },
+            location: { type: 'string' },
+            issue: { type: 'string' },
+            suggestion: { type: 'string' },
+          },
+          required: ['severity', 'location', 'issue', 'suggestion'],
+        },
+      },
+      positives: { type: 'array', items: { type: 'string' } },
+      approvalConditions: { type: 'array', items: { type: 'string' } },
+    },
+    required: ['verdict', 'summary', 'issues'],
+  };
+
+  const task = args || 'No task specified — describe the implementation task in args.';
+
+  phase('Implement');
+  log(`Writer implementing: ${task.slice(0, 80)}`);
+  const implementation = await agent(
+    `Implement this task in the current codebase: "${task}"\n\nWrite the complete implementation. After implementing, provide: (1) description of what you built, (2) list of files changed, (3) your implementation approach and key decisions, (4) a diff-style summary of changes (show old → new for key parts), (5) testing done or test commands to run.`,
+    { schema: IMPL_SCHEMA, label: 'writer' }
+  );
+  if (!implementation) { log('Warning: agent returned null for implementation, skipping'); return { task, error: 'agent-null' }; }
+  log(`Writer: ${implementation.description} | Changed: ${implementation.filesChanged.join(', ')}`);
+
+  phase('Review');
+  const diffContext = `TASK: ${task}\n\nCHANGES MADE:\n${implementation.diff}\n\nFILES CHANGED: ${implementation.filesChanged.join(', ')}\n\nTESTING: ${implementation.testingDone || 'not specified'}`;
+  const review = await agent(
+    `You are a senior code reviewer. Review this code change with fresh eyes — you were NOT involved in the implementation.\n\n${diffContext}\n\nReview for: correctness (does it actually solve the task?), edge cases (null/empty/large inputs), security (injection, auth, secrets), performance (N+1, unbounded loops), maintainability (naming, complexity, DRY). Give a verdict: approve / request-changes / comment. For each issue: severity (blocker/major/minor/nit), exact location, what's wrong, specific suggestion.`,
+    { schema: REVIEW_SCHEMA, label: 'reviewer' }
+  );
+  if (!review) { log('Warning: agent returned null for review, skipping'); return { task, implementation, error: 'agent-null' }; }
+  log(`Reviewer verdict: ${review.verdict} | ${review.issues.length} issues (${review.issues.filter(i => i.severity === 'blocker').length} blockers)`);
+
+  phase('Verdict');
+  const blockers = review.issues.filter(i => i.severity === 'blocker');
+  const majors = review.issues.filter(i => i.severity === 'major');
+
+  return {
+    task,
+    implementation,
+    review,
+    verdict: {
+      decision: review.verdict,
+      blockerCount: blockers.length,
+      majorCount: majors.length,
+      approved: review.verdict === 'approve',
+      requiredFixes: blockers.concat(majors).map(i => `[${i.severity.toUpperCase()}] ${i.location}: ${i.suggestion}`),
+    },
+  };
+}

package/.mindforge/memory/sync-manifest.json

@@ -1,6 +1,6 @@
 {
   "pattern-library.jsonl": {
-    "lastSync": "2026-06-23T08:21:37.029Z",
+    "lastSync": "2026-06-24T05:48:11.891Z",
     "localCount": 1
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [11.8.0] - 2026-06-24 — Workflow Forge II
+
+Expands the Dynamic Workflow Library from 12 to 33 workflows across 5 tiers, adding a new **Beast tier** for compound multi-phase multi-agent workflows with adversarial verification. 21 new workflows added. 92/92 tests pass.
+
+### Added
+
+- **Beast tier** (3 compound workflows, 5 phases, 8+ agents): `security-hardening` (5-angle OWASP parallel scout + 3-vote adversarial verify + STRIDE threat model + remediation roadmap), `accessibility-audit` (WCAG 2.2 6-principle parallel audit + 3-vote verify + remediation spec), `security-threat-model` (asset inventory + 6-parallel STRIDE + mitigations + CVSS scoring)
+- **Dev tier additions** (7): `test-coverage-gap`, `api-contract-test`, `mutation-testing`, `debug-detective`, `writer-reviewer`, `code-explainer`, `design-system-audit`
+- **Ops tier additions** (4): `database-migration`, `dependency-health`, `multi-repo-sync`, `cost-analysis`
+- **Intelligence tier additions** (3): `architecture-modernization`, `documentation-gen`, `api-migration`, `data-pipeline-validate` (4 total)
+- **Research tier additions** (3): `ai-model-eval`, `ux-heuristic-audit`, `competitive-teardown`
+- 21 new `/mindforge:wf-*` slash command pairs
+- Updated `wf-catalog` listing all 33 workflows across 5 tiers
+- `tests/workflow-registry.test.js` — `beast` added to valid tier allowlist
+
+---
+
 ## [11.7.1] - 2026-06-23 — Workflow Forge (patch)
 
 Patch release: adds `bin/parse-workflow-args.js` (slash command argument splitter, produced by the tdd-sprint E2E run) and resolves 2 high-severity npm vulnerabilities in the tmp/inquirer dependency chain. No feature changes; all 94 tests pass.