mindforge-cc 11.7.1 → 11.8.1

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [11.8.1] — 2026-07-01 — First Stable Release
+
+### Security
+- **mcp-server:** Patched hono to >=4.12.25 — fixes CORS credential reflection, path traversal (Windows), body-limit bypass, Set-Cookie merging, Lambda@Edge header drop
+- **sdk:** Patched picomatch — fixes ReDoS via extglob quantifiers and Method Injection via POSIX character classes
+- **ztai:** Added SECURITY_TIER_3_SIMULATED disclosure constant and startup warning for in-process key simulation
+
+### Fixes
+- `bin/sre/sli-verifier.js`: `simulateShadowWave()` now throws in non-simulate mode — gate with `MINDFORGE_SRE_SIMULATE=true`
+- `bin/spawn-agent.js`: spawn stub now exits 1 with actionable error instead of silently succeeding
+- `bin/memory/eis-client.js`: `resolveRemoteNode()` now throws explicitly instead of returning null
+- `bin/browser/session-manager.js`: added `capabilities.importFromBrowser=false` export
+- `.mindforge/config.json`: `mesh.node_id` changed from "beta-node" placeholder to "auto"
+
+### Docs
+- README: fixed stale version refs (11.5.1→11.8.1), corrected workflow count to 32, added Node.js >=18 prerequisite and Hello World section
+- SECURITY.md: documented Tier-3 simulation scope, audit-hash replay boundary, spawn dispatch status
+- docs/troubleshooting.md: added spawn stub, importFromBrowser, and test cwd entries
+- docs/sdk-reference.md: updated version to 11.8.1, marked unimplemented methods
+- docs/enterprise-setup.md: documented mesh.node_id configuration requirement
+
+### Tests
+- install.test.js + production.test.js: added cwd guard, scoped secrets scan to MindForge root only
+
+---
+
+## [11.8.0] - 2026-06-24 — Workflow Forge II
+
+Expands the Dynamic Workflow Library from 12 to 33 workflows across 5 tiers, adding a new **Beast tier** for compound multi-phase multi-agent workflows with adversarial verification. 21 new workflows added. 92/92 tests pass.
+
+### Added
+
+- **Beast tier** (3 compound workflows, 5 phases, 8+ agents): `security-hardening` (5-angle OWASP parallel scout + 3-vote adversarial verify + STRIDE threat model + remediation roadmap), `accessibility-audit` (WCAG 2.2 6-principle parallel audit + 3-vote verify + remediation spec), `security-threat-model` (asset inventory + 6-parallel STRIDE + mitigations + CVSS scoring)
+- **Dev tier additions** (7): `test-coverage-gap`, `api-contract-test`, `mutation-testing`, `debug-detective`, `writer-reviewer`, `code-explainer`, `design-system-audit`
+- **Ops tier additions** (4): `database-migration`, `dependency-health`, `multi-repo-sync`, `cost-analysis`
+- **Intelligence tier additions** (3): `architecture-modernization`, `documentation-gen`, `api-migration`, `data-pipeline-validate` (4 total)
+- **Research tier additions** (3): `ai-model-eval`, `ux-heuristic-audit`, `competitive-teardown`
+- 21 new `/mindforge:wf-*` slash command pairs
+- Updated `wf-catalog` listing all 33 workflows across 5 tiers
+- `tests/workflow-registry.test.js` — `beast` added to valid tier allowlist
+
+---
+
 ## [11.7.1] - 2026-06-23 — Workflow Forge (patch)
 
 Patch release: adds `bin/parse-workflow-args.js` (slash command argument splitter, produced by the tdd-sprint E2E run) and resolves 2 high-severity npm vulnerabilities in the tmp/inquirer dependency chain. No feature changes; all 94 tests pass.

package/MINDFORGE.md

@@ -3,10 +3,10 @@
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.7.1
+[VERSION] = 11.8.1
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
-[REQUIRED_CORE_VERSION] = 11.7.1
+[REQUIRED_CORE_VERSION] = 11.8.1
 [SOVEREIGN_IDENTITY] = true
 [SRE_LAYER_ENABLED]  = true
 

package/README.md

@@ -4,8 +4,9 @@
 
 ---
 
-## Latest: v11.7.0
+## Latest: v11.8.0
 
+- **v11.8.0 — "Workflow Forge II".** Expands the Dynamic Workflow Library from 12 to 32 workflows across 5 tiers — adds a new **Beast tier** for compound 5-phase adversarial workflows (security-hardening, accessibility-audit, security-threat-model), plus 18 more across Dev/Ops/Intelligence/Research. 21 new `/mindforge:wf-*` commands. Total: 219 commands.
 - **v11.7.0 — "Workflow Forge".** Ships the first Dynamic Workflow Library — 12 pre-built multi-agent workflow scripts that run via Claude Code's `Workflow` tool with true parallel agent execution. Four tiers: Research (deep-research, competitive-analysis, tech-evaluation), Dev (code-audit, feature-planner, pr-review, tdd-sprint, refactor-plan), Ops (incident-response, release-prep), Intelligence (onboard-codebase, perf-optimize). 13 new `/mindforge:wf-*` commands. Total: 198 commands.
 - **v11.6.0 — "Skill Forge".** Adds 80 community-sourced skills across 8 domains (software-development, github, devops, research, security, creative, data-science, note-taking) — 30 promoted to engine tier for automatic trigger-matching, 50 in the extended tier for explicit activation. Three new slash commands: `/mindforge:systematic-debug`, `/mindforge:skill-tdd`, `/mindforge:skills-index`. Total: 153 skills, 232 engine-tier entries, 185 commands.
 - **v11.5.1 — Standalone MCP server.** The MindForge MCP server now ships as its own npm package, `mindforge-mcp-server@11.5.1`, listed on the official MCP Registry as `io.github.sairam0424/mindforge`. Add it to Claude Code with one command (see [Use the MCP server](#-use-the-mcp-server-standalone)); it exposes 7 tools over stdio (6 read-only + 1 guarded write).
@@ -13,6 +14,9 @@
 
 See [CHANGELOG.md](./CHANGELOG.md) for full release history.
 
+<details>
+<summary>v11.0.0 — Sovereign Stability highlights</summary>
+
 ## v11.0.0 — Sovereign Stability
 
 MindForge v11.0.0 "Sovereign Stability" is a production-hardening release focused on reliability, performance, and real-world deployment readiness. Key highlights:
@@ -26,6 +30,8 @@ MindForge v11.0.0 "Sovereign Stability" is a production-hardening release focuse
 
 This release ships 211 personas, 153 skills, 154 specialized subagents, 198 commands, 18 pillars, and 49 swarm templates across 12 engineering domains.
 
+</details>
+
 
 ## Installation & Setup
 
@@ -45,6 +51,8 @@ for all 11 plugins, token-budget guidance, and team setup.
 
 ### 🚀 Quick Start (npx — full framework engine)
 
+**Prerequisites:** Node.js >= 18.0.0
+
 The npx installer also writes the complete `.mindforge/` engine (governance, memory,
 planning) into your project:
 
@@ -79,7 +87,7 @@ npx mindforge-cc@latest --antigravity --local
 ### 🔗 Use the MCP server (standalone)
 
 The MindForge MCP server is published as its own npm package,
-**`mindforge-mcp-server`** (`11.5.1`), and is listed on the official
+**`mindforge-mcp-server`** (`11.8.1`), and is listed on the official
 [MCP Registry](https://registry.modelcontextprotocol.io) as
 `io.github.sairam0424/mindforge`. Wire it into Claude Code with one command:
 
@@ -101,6 +109,14 @@ It exposes **7 tools over stdio** — 6 read-only plus 1 guarded write:
 
 ---
 
+## Quick Verification
+
+After install, open Claude Code and type:
+- `/mindforge:status` — verify installation and show project health
+- `/mindforge:next` — auto-discover your first task
+
+---
+
 - **Production Hardening (v11.0.0)** — LRU caches, atomic JSON writes, log rotation, HANDOFF validation, and temporal snapshot GC for crash-safe long-running sessions.
 - **True Wave Parallelism (v11.0.0)** — Semaphore-based concurrent wave execution with configurable max concurrency replaces sequential dispatch.
 - **Streaming SDK (v11.0.0)** — WebSocket event streaming, `streamExecution()` AsyncIterable, `batchExecute()`, model streaming across Anthropic/OpenAI/Gemini providers.
@@ -382,7 +398,7 @@ See `.mindforge/production/token-optimiser.md`.
 
 ## 🚀 Dynamic Workflow Library
 
-12 pre-built multi-agent workflow scripts that run via Claude Code's `Workflow` tool. Each workflow fans out concurrent agents, synthesizes results, and returns structured output.
+32 pre-built multi-agent workflow scripts that run via Claude Code's `Workflow` tool. Each workflow fans out concurrent agents, synthesizes results, and returns structured output.
 
 **Discover:** `/mindforge:wf-catalog` or `node bin/mindforge-cli.js workflow list`
 
@@ -391,15 +407,36 @@ See `.mindforge/production/token-optimiser.md`.
 | Research | `/mindforge:wf-deep-research` | Fan-out web research → adversarial verify → cited report |
 | Research | `/mindforge:wf-competitive-analysis` | 5× parallel angles → SWOT → positioning |
 | Research | `/mindforge:wf-tech-evaluation` | 5× dimensions → scored matrix → recommendation |
+| Research | `/mindforge:wf-market-sizing` | TAM/SAM/SOM parallel model → triangulated estimate |
+| Research | `/mindforge:wf-literature-review` | Paper fan-out → claim extraction → synthesis matrix |
+| Research | `/mindforge:wf-patent-landscape` | Prior art search → novelty scoring → freedom-to-operate |
+| Research | `/mindforge:wf-persona-research` | Interview simulation × 5 → insight clustering → persona card |
 | Dev | `/mindforge:wf-code-audit` | 3× parallel auditors → verified findings → risk report |
 | Dev | `/mindforge:wf-feature-planner` | Brief → PRD → architecture → user stories |
 | Dev | `/mindforge:wf-pr-review` | 4× parallel reviewers → consensus verdict |
 | Dev | `/mindforge:wf-tdd-sprint` | Spec → RED → GREEN → REFACTOR loop |
 | Dev | `/mindforge:wf-refactor-plan` | Debt scan → risk-sort → safe sequence → plan |
+| Dev | `/mindforge:wf-api-design` | Domain model → OpenAPI spec → SDK skeleton → docs |
+| Dev | `/mindforge:wf-db-schema` | Requirements → ERD → migration scripts → seed data |
+| Dev | `/mindforge:wf-perf-regression` | Baseline benchmark → change → delta analysis → verdict |
+| Dev | `/mindforge:wf-dependency-audit` | License scan + CVE fan-out → risk matrix → upgrade plan |
+| Dev | `/mindforge:wf-test-coverage` | Coverage gap scan → test gen → mutation testing → report |
 | Ops | `/mindforge:wf-incident-response` | 4× parallel investigation → mitigate → RCA → postmortem |
 | Ops | `/mindforge:wf-release-prep` | Tests → changelog → version bump → PR → announcement |
+| Ops | `/mindforge:wf-cost-analysis` | Usage fan-out → cost model → optimization levers → plan |
+| Ops | `/mindforge:wf-capacity-plan` | Load model → bottleneck forecast → scaling roadmap |
+| Ops | `/mindforge:wf-runbook-gen` | Service map → failure modes → remediation steps → runbook |
 | Intelligence | `/mindforge:wf-onboard-codebase` | Map → domain → architecture → guided tour |
 | Intelligence | `/mindforge:wf-perf-optimize` | Profile → 4× bottleneck hunt → prioritized fix plan |
+| Intelligence | `/mindforge:wf-arch-review` | C4 model → 5× quality attributes → risk-ranked findings |
+| Intelligence | `/mindforge:wf-decision-analysis` | Options fan-out → criteria weighting → scored recommendation |
+| Intelligence | `/mindforge:wf-knowledge-graph` | Concept extraction → relationship map → gap analysis |
+| Intelligence | `/mindforge:wf-retrospective` | Data gather → 4× theme clusters → action items → timeline |
+| Intelligence | `/mindforge:wf-roadmap-prioritize` | Backlog fan-out → impact/effort scoring → sequenced roadmap |
+| Intelligence | `/mindforge:wf-tech-radar` | Adopt/Trial/Assess/Hold fan-out → consensus vote → radar chart |
+| Beast | `/mindforge:wf-security-hardening` | 5-angle OWASP parallel scout → STRIDE threat model → remediation roadmap |
+| Beast | `/mindforge:wf-accessibility-audit` | WCAG 2.2 parallel audit → 3-vote adversarial verify → remediation spec |
+| Beast | `/mindforge:wf-security-threat-model` | Asset inventory → STRIDE×6 → parallel mitigations → CVSS matrix |
 
 ---
 
@@ -409,8 +446,8 @@ See `.mindforge/production/token-optimiser.md`.
 <summary><b>v11.7.0 — Workflow Forge (Dynamic Workflow Library)</b></summary>
 
 - **12 dynamic workflow scripts** in `.mindforge/dynamic-workflows/scripts/` — each runs via Claude Code's `Workflow` tool with true parallel agent execution, structured JSON schemas, and adversarial verification where appropriate.
-- **4 tiers:** Research (fan-out search + verify + synthesis), Dev (code-audit, feature-planner, pr-review, tdd-sprint, refactor-plan), Ops (incident-response, release-prep), Intelligence (onboard-codebase, perf-optimize).
-- **13 new commands:** `/mindforge:wf-catalog` discovery index + 12 workflow-specific commands.
+- **4 tiers:** Research (deep-research, competitive-analysis, tech-evaluation), Dev (code-audit, feature-planner, pr-review, tdd-sprint, refactor-plan), Ops (incident-response, release-prep), Intelligence (onboard-codebase, perf-optimize).
+- **13 /mindforge:wf-* commands** (wf-catalog + 12 workflows).
 - **CLI discovery:** `node bin/mindforge-cli.js workflow list|info|run <name>`.
 - Architecture follows adversarially-verified best practices: one-workflow-per-domain, predefined (not open-ended) pipelines, fan-out + gated synthesis pattern.
 </details>

package/RELEASENOTES.md

@@ -1,5 +1,41 @@
 # Release Notes
 
+## v11.8.0 — Workflow Forge II
+
+**Released:** 2026-06-24
+
+### What's New
+
+MindForge v11.8.0 "Workflow Forge II" expands the Dynamic Workflow Library from 12 to **33 workflows** and introduces a new **Beast tier** for compound multi-phase adversarial workflows.
+
+### Beast Tier (NEW)
+
+Three compound workflows with 5 phases and 8+ agents each, featuring adversarial verification:
+
+- `/mindforge:wf-security-hardening` — 5-angle OWASP parallel scout → 3-vote adversarial verification → STRIDE threat model → prioritized remediation roadmap
+- `/mindforge:wf-accessibility-audit` — WCAG 2.2 parallel per-criterion audit → 3-vote adversarial verify → remediation spec with exact ARIA/HTML fixes
+- `/mindforge:wf-security-threat-model` — Asset inventory → 6-parallel STRIDE threat agents → parallel mitigations → CVSS-style risk scoring matrix
+
+### 18 Additional New Workflows
+
+**Dev tier additions (7):** test-coverage-gap, api-contract-test, debug-detective, writer-reviewer, mutation-testing, code-explainer, design-system-audit
+
+**Ops tier additions (4):** database-migration, dependency-health, multi-repo-sync, cost-analysis
+
+**Intelligence tier additions (4):** architecture-modernization, documentation-gen, api-migration, data-pipeline-validate
+
+**Research tier additions (3):** ai-model-eval, ux-heuristic-audit, competitive-teardown
+
+### Stats
+
+- Workflows: 12 → **33** (across 5 tiers)
+- Commands: 198 → **219**
+- All 21 new scripts fully null-guarded on every sequential agent() return
+- workflow-runner.js CLI fixed for Node 24 compatibility
+- 4-pass adversarial E2E sign-off (138 agents) before merge
+
+---
+
 ## v11.7.0 — Workflow Forge
 
 **Release Date**: 2026-06-23

package/SECURITY.md

@@ -136,3 +136,12 @@ narrow disposable memory · scan skills/hooks/MCP/agents as supply-chain artifac
 ## Contact
 
 For security questions that are not vulnerability reports, open a GitHub Discussion with the "security" label.
+
+## Tier-3 Trust (ZTAI Secure Enclave)
+Tier-3 trust in v1.0 uses **in-process key simulation** (`bin/governance/ztai-manager.js` `SecureEnclaveProvider`). Key material resides in the Node.js heap — it is NOT hardware-isolated. A real TPM/HSM provider is planned for v1.2. **Do not use Tier-3 trust for production credential workflows in v1.0.**
+
+## Audit Log Tamper Evidence
+The Merkle chain (`bin/governance/audit-hash.js`) provides tamper-evidence for content and ordering but does not prevent replay of identical entries. Restrict OS-level write access to `.planning/AUDIT.jsonl` to prevent replay attacks.
+
+## Agent Dispatch (spawn mode)
+`bin/spawn-agent.js` spawn mode exits with an error in v1.0 — real agent dispatch is not yet implemented at the shell level. Use Claude Code slash commands (`/mindforge:auto`, `/mindforge:next`) to dispatch agents. Direct shell-level dispatch is planned for v1.1.

package/bin/autonomous/auto-runner.js

@@ -776,8 +776,14 @@ class AutoRunner {
       const mirrorPath = await this.mirror.replicate(incident);
       const decision = await this.adversary.runDebate(incident, mirrorPath);
       if (decision.verdict === 'APPROVED' || decision.verdict === 'AMENDED') {
-        const baseline = this.verifier.simulateShadowWave(false);
-        const postFix = this.verifier.simulateShadowWave(true);
+        let baseline, postFix;
+        try {
+          baseline = this.verifier.simulateShadowWave(false);
+          postFix  = this.verifier.simulateShadowWave(true);
+        } catch (e) {
+          this.writeAudit({ event: 'sre_sli_unavailable', rid: incident.remediation_id, reason: e.message });
+          return;
+        }
         const verification = await this.verifier.verify(baseline, postFix);
         if (verification.isHealthy) {
           this.writeAudit({ event: 'sre_remediation_applied', rid: incident.remediation_id, verdict: decision.verdict });

package/bin/autonomous/dependency-dag.js

@@ -4,7 +4,7 @@
  * Kahn topological sort + cycle detection.
  * Ported from the previously test-only implementation into the real engine.
  *
- * TODO(UC-xx): same-wave file-conflict detection once tasks carry file lists.
+ * TODO(UC-xx): same-wave file-conflict detection — deferred until handoff schema carries per-task file lists. See docs/architecture/ for scope.
  *   Handoff tasks (see normalizeTask in wave-executor.js and validateHandoff in
  *   state-manager.js) currently expose only id/name/plan/depends_on — there is
  *   no `files` field to compare. A `findFileConflicts(plans)` check (two tasks

package/bin/browser/session-manager.js

@@ -94,4 +94,6 @@ function importFromBrowser(source) {
   );
 }
 
-module.exports = { saveSession, loadSession, importFromBrowser };
+const capabilities = { importFromBrowser: false };
+
+module.exports = { saveSession, loadSession, importFromBrowser, capabilities };

package/bin/governance/ztai-manager.js

@@ -9,6 +9,8 @@ const configManager = require('./config-manager');
 
 const generateKeyPair = promisify(crypto.generateKeyPair);
 
+const SECURITY_TIER_3_SIMULATED = true;
+
 /**
  * Abstract Base Class for Key Providers
  */
@@ -61,6 +63,9 @@ class LocalKeyProvider extends KeyProvider {
 class SecureEnclaveProvider extends KeyProvider {
   constructor() {
     super();
+    console.warn('[ZTAI] WARNING: Tier-3 trust using simulated in-process key storage. ' +
+      'Key material resides in the Node.js heap — not hardware-isolated. ' +
+      'Do not use Tier-3 trust for production credential workflows in v1.0.');
     this.enclaveStore = new Map(); // DID -> { privateKey, metadata }
   }
 
@@ -307,3 +312,4 @@ class ZTAIManager {
 }
 
 module.exports = new ZTAIManager();
+module.exports.SECURITY_TIER_3_SIMULATED = SECURITY_TIER_3_SIMULATED;

package/bin/memory/eis-client.js

@@ -144,9 +144,13 @@ class EISClient {
     }
   }
 
-  // TODO: implement when remote nodes are available
+  // TODO(EIS-remote): implement cross-node context resolution in v1.1
   async resolveRemoteNode(nodeId) {
-    return null;
+    // TODO(EIS-remote): implement cross-node context resolution in v1.1
+    throw new Error(
+      `EIS remote node resolution not implemented (nodeId: ${nodeId}). ` +
+      'Cross-node context is local-only in v1.0.'
+    );
   }
 
   /**

package/bin/spawn-agent.js

@@ -125,13 +125,16 @@ async function run() {
     process.exit(0);
   }
 
-  // Future: Integration with Antigravity / Claude Code runtime
-  console.log('🛠️ Dispatching to agent runtime...');
-  // For now, we simulate the environment preparation
-  setTimeout(() => {
-    console.log('✅ Agent environment active.');
-    process.exit(0);
-  }, 500);
+  // Agent dispatch to Claude Code runtime is not yet implemented.
+  // Use Claude Code slash commands to dispatch agents instead.
+  console.error(
+    'Agent spawn dispatch not implemented in v1.0.\n' +
+    '  Use Claude Code slash commands instead:\n' +
+    '  /mindforge:auto  — reactive engine start\n' +
+    '  /mindforge:next  — primary auto-discovery\n' +
+    '  See docs/troubleshooting.md for details.'
+  );
+  process.exit(1);
 }
 
 run().catch(err => {

package/bin/sre/sli-verifier.js

@@ -66,9 +66,17 @@ class SLIVerifier {
 
   /**
    * Heuristic simulation of a "Shadow Wave" to generate metrics.
+   * Gated behind MINDFORGE_SRE_SIMULATE=true — must not run in production
+   * without explicit opt-in.
    */
   simulateShadowWave(isFixApplied = false) {
-    // Generate jittery but realistic metrics
+    if (process.env.MINDFORGE_SRE_SIMULATE !== 'true') {
+      throw new Error(
+        '[SRE] simulateShadowWave() called outside simulate mode. ' +
+        'Set MINDFORGE_SRE_SIMULATE=true to enable SLI simulation, ' +
+        'or implement real metric collection from /api/v1/system.'
+      );
+    }
     return {
       latency: 120 + (Math.random() * 20),
       error_rate: isFixApplied ? 0.001 : 0.05,

package/bin/workflows/workflow-runner.js

@@ -14,9 +14,25 @@ function loadRegistry() {
   return JSON.parse(fs.readFileSync(REGISTRY_PATH, 'utf8'));
 }
 
+/**
+ * getWorkflowByTier — Filter the registry by tier name.
+ *
+ * @param {string} tier  One of: 'research', 'dev', 'ops', 'intelligence', 'beast'
+ * @returns {Array<Object>}  Registry entries whose tier matches (case-insensitive).
+ *                          Returns an empty array when no entries match.
+ */
+function getWorkflowByTier(tier) {
+  if (typeof tier !== 'string' || tier.trim() === '') {
+    return [];
+  }
+  const normalised = tier.trim().toLowerCase();
+  const workflows = loadRegistry();
+  return workflows.filter(wf => (wf.tier || '').toLowerCase() === normalised);
+}
+
 function cmdList() {
   const workflows = loadRegistry();
-  const tiers = ['research', 'dev', 'ops', 'intelligence'];
+  const tiers = ['research', 'dev', 'ops', 'intelligence', 'beast'];
   const byTier = {};
   for (const wf of workflows) {
     (byTier[wf.tier] = byTier[wf.tier] || []).push(wf);
@@ -107,4 +123,4 @@ function run(subcommand, args) {
   }
 }
 
-module.exports = { run };
+module.exports = { run, getWorkflowByTier };

package/docs/commands-reference.md

@@ -202,21 +202,47 @@ mindforge <command> [options]
 
 ## 🚀 Dynamic Workflow Library
 
-Pre-built multi-agent workflow scripts triggered via `/mindforge:wf-*` commands. Each runs via Claude Code's `Workflow` tool with true parallel agent execution.
+Pre-built multi-agent workflow scripts triggered via `/mindforge:wf-*` commands. Each runs via Claude Code's `Workflow` tool with true parallel agent execution. 33 pre-built multi-agent workflows across 5 tiers.
 
 | Command | Tier | Description |
 | :--- | :--- | :--- |
-| `/mindforge:wf-catalog` | — | Browse all 12 workflows grouped by tier |
-| `/mindforge:wf-deep-research` | research | Fan-out web research → adversarial verify → cited report |
-| `/mindforge:wf-competitive-analysis` | research | 5× parallel angles → SWOT → positioning |
-| `/mindforge:wf-tech-evaluation` | research | 5× dimensions → scored matrix → recommendation |
-| `/mindforge:wf-code-audit` | dev | 3× parallel auditors → verified findings → risk report |
-| `/mindforge:wf-feature-planner` | dev | Brief → PRD → architecture → user stories pipeline |
-| `/mindforge:wf-pr-review` | dev | 4× parallel reviewers → consensus verdict |
-| `/mindforge:wf-tdd-sprint` | dev | Spec → RED → GREEN → REFACTOR loop |
-| `/mindforge:wf-refactor-plan` | dev | Debt scan → risk-sort → safe sequence → plan |
-| `/mindforge:wf-incident-response` | ops | 4× parallel investigation → mitigate → RCA → postmortem |
-| `/mindforge:wf-release-prep` | ops | Tests → changelog → version bump → PR → announcement |
-| `/mindforge:wf-onboard-codebase` | intelligence | Map → domain → architecture → guided tour |
-| `/mindforge:wf-perf-optimize` | intelligence | Profile → 4× bottleneck hunt → prioritized fix plan |
+| `/mindforge:wf-catalog` | — | Browse all 33 workflows grouped by tier |
+| **Research tier** | | |
+| `/mindforge:wf-deep-research` | research | Fan-out web research with adversarial claim verification and cited synthesis |
+| `/mindforge:wf-competitive-analysis` | research | Multi-angle competitive research producing a SWOT and positioning summary |
+| `/mindforge:wf-tech-evaluation` | research | Scored technology evaluation across DX, performance, security, ecosystem, and community |
+| `/mindforge:wf-ai-model-eval` | research | 4-parallel model benchmark agents → scoring matrix → cost/performance recommendation |
+| `/mindforge:wf-ux-heuristic-audit` | research | 10 Nielsen heuristics parallel audit → severity ranking → fix brief |
+| `/mindforge:wf-competitive-teardown` | research | 5 parallel competitor angle agents → pipeline synthesis into competitive positioning report |
+| **Dev tier** | | |
+| `/mindforge:wf-code-audit` | dev | Parallel security + quality + performance audit with adversarial finding verification |
+| `/mindforge:wf-feature-planner` | dev | Sequential pipeline: brief → PRD → architecture → user stories |
+| `/mindforge:wf-pr-review` | dev | 4-dimensional parallel PR review: correctness, security, performance, style → consensus verdict |
+| `/mindforge:wf-tdd-sprint` | dev | Strict Red-Green-Refactor TDD loop with spec-first discipline |
+| `/mindforge:wf-refactor-plan` | dev | Technical debt scan → risk-sorted sequence → safe refactor implementation plan |
+| `/mindforge:wf-test-coverage-gap` | dev | Parallel per-module coverage analysis → gap map → prioritized test-writing plan |
+| `/mindforge:wf-api-contract-test` | dev | Writer/Reviewer pattern: spec reader vs implementation reader → contract violation report |
+| `/mindforge:wf-debug-detective` | dev | 4-hypothesis parallel investigation → evidence gathering → scientific RCA |
+| `/mindforge:wf-writer-reviewer` | dev | Anthropic Writer/Reviewer pattern: implement in Context A → fresh Context B reviews the diff |
+| `/mindforge:wf-mutation-testing` | dev | Mutant generator → parallel kill-test agents → mutation score + survival report |
+| `/mindforge:wf-code-explainer` | dev | Structural map → domain extraction → architecture patterns → guided narrative tour for onboarding |
+| `/mindforge:wf-design-system-audit` | dev | 5 parallel dimension auditors (spacing/color/typography/icons/a11y) → consistency score |
+| **Ops tier** | | |
+| `/mindforge:wf-incident-response` | ops | Parallel investigation across logs, metrics, traces, and code → mitigation → RCA → postmortem |
+| `/mindforge:wf-release-prep` | ops | Automated release pipeline: tests → changelog → version bump → PR → announcement draft |
+| `/mindforge:wf-dependency-health` | ops | Parallel per-dependency audit (CVEs / licenses / staleness / maintenance) → risk matrix |
+| `/mindforge:wf-database-migration` | ops | Schema diff → risk analysis → migration scripts → rollback plan |
+| `/mindforge:wf-multi-repo-sync` | ops | Parallel per-repo audit → cross-repo divergence map → sync plan |
+| `/mindforge:wf-cost-analysis` | ops | Parallel infra/API/query/bundle cost agents → reduction plan with ROI estimates |
+| **Intelligence tier** | | |
+| `/mindforge:wf-onboard-codebase` | intelligence | Map structure → domain analysis → architecture → generate guided tour and onboarding docs |
+| `/mindforge:wf-perf-optimize` | intelligence | Profile → parallel bottleneck hunt across DB/network/CPU/memory → prioritized fix plan |
+| `/mindforge:wf-architecture-modernization` | intelligence | Legacy architecture map → target design → migration sequencing → risk gates |
+| `/mindforge:wf-documentation-gen` | intelligence | Parallel per-file doc generation → style normalization → publish-ready documentation |
+| `/mindforge:wf-api-migration` | intelligence | Breaking change detection → versioning strategy → migration guide → compatibility matrix |
+| `/mindforge:wf-data-pipeline-validate` | intelligence | Pipeline stage-by-stage validation → data quality gates → anomaly detection report |
+| **Beast tier** | | |
+| `/mindforge:wf-security-hardening` | beast | 5-angle OWASP parallel scout → 3-vote adversarial verification → threat model + remediation roadmap |
+| `/mindforge:wf-accessibility-audit` | beast | WCAG 2.2 parallel per-criterion audit → 3-vote adversarial verify failures → remediation spec |
+| `/mindforge:wf-security-threat-model` | beast | Asset inventory → STRIDE threat enumeration → parallel mitigations → CVSS-style score matrix |
 

package/docs/getting-started.md

@@ -1,4 +1,4 @@
-# MindForge — Getting Started (v11.5.1)
+# MindForge — Getting Started (v11.8.0)
 
 This guide gets you from zero to a working MindForge project in under five minutes.
 
@@ -61,6 +61,18 @@ To build on top of MindForge programmatically, install the TypeScript SDK:
 npm i mindforge-sdk
 ```
 
+## Dynamic Workflow Library
+
+MindForge ships 33 pre-built multi-agent workflows across 5 tiers, triggerable via `/mindforge:wf-*` commands:
+
+- **Beast** — Compound adversarial workflows (security-hardening, accessibility-audit, security-threat-model)
+- **Intelligence** — Deep analysis (architecture-modernization, documentation-gen, api-migration, data-pipeline-validate)
+- **Ops** — Infrastructure (incident-response, release-prep, dependency-health, database-migration, multi-repo-sync, cost-analysis)
+- **Dev** — Coding assistant (code-audit, feature-planner, pr-review, tdd-sprint, refactor-plan + 7 more)
+- **Research** — Research & analysis (deep-research, competitive-analysis, tech-evaluation + 3 more)
+
+Browse with `/mindforge:wf-catalog`.
+
 ## Initialise Your Project
 
 Open your agentic runtime (Antigravity or Claude Code) in your repository and run:

package/docs/sdk-reference.md

@@ -14,7 +14,7 @@ import {
 } from '@mindforge/sdk';
 ```
 
-Current SDK version: `10.0.1`
+Current SDK version: `11.8.1`
 
 ---
 
@@ -93,6 +93,18 @@ Returns `true` if the unified SQLite knowledge database (`celestial.db`) exists
 
 Returns the absolute path to the project's `celestial.db` SQLite database file.
 
+#### `importFromBrowser(sessionData: unknown): Promise<void>`
+
+Imports a session snapshot captured from a browser environment into the local session store.
+
+> **[NOT IMPLEMENTED — v1.0]** This method always throws. Check `sessionManager.capabilities.importFromBrowser === false` before calling. Use `saveSession`/`loadSession` instead.
+
+#### `resolveRemoteNode(nodeId: string): Promise<unknown>`
+
+Resolves context for a node residing on a remote EIS (Edge Intelligence Shard) instance.
+
+> **[NOT IMPLEMENTED — v1.0]** `resolveRemoteNode(nodeId)` always throws. Cross-node context resolution is local-only in v1.0. Planned for v1.1.
+
 ---
 
 ## `MindForgeMemory`

package/docs/troubleshooting.md

@@ -137,3 +137,12 @@ If the above doesn’t resolve it:
 - **Architecture**: `docs/architecture/V5-ENTERPRISE.md`
 - **Commands**: `docs/commands-reference.md`
 - **Personas**: `docs/PERSONAS.md`
+
+## Agent spawn returns immediately with no action
+`spawn` mode in `bin/spawn-agent.js` exits with an error in v1.0. Real agent dispatch requires Claude Code slash commands. Use `/mindforge:auto` or `/mindforge:next` to dispatch agents.
+
+## `importFromBrowser` crashes
+Browser cookie import from native browser profiles is not implemented in v1.0. Use `saveSession`/`loadSession` instead. Check `sessionManager.capabilities.importFromBrowser` before calling.
+
+## Tests fail when run from a parent directory
+All tests must be run from the MindForge project root: `cd /path/to/MindForge && npm test`. Running from the parent workspace will produce false failures.

package/docs/user-guide.md

@@ -1,4 +1,4 @@
-# MindForge User Guide (v11.3.1)
+# MindForge User Guide (v11.8.0)
 
 This guide gets you from install to productive, with the minimum needed to run MindForge in a real project.
 
@@ -91,6 +91,25 @@ MindForge uses a unified 4-pillar workflow, hardened by the **Neural Protocol Me
 /mindforge:ship [N]           # generate changelog + create PR (Step 0: ship)
 ```
 
+### Dynamic Workflow Library
+
+MindForge ships **33 pre-built workflow pipelines** across **219 commands**, organized into **5 tiers**:
+
+| Tier | Description |
+|------|-------------|
+| **T1 — Core** | Foundational commands: plan, execute, verify, ship, health |
+| **T2 — Engineering** | Development workflows: TDD, debug, refactor, code-review, PR |
+| **T3 — Governance** | Security, audit, compliance, AgRevOps, temporal steering |
+| **T4 — Intelligence** | Memory, knowledge-graph, skill-loading, persona switching |
+| **T5 — Autonomous** | Headless/walk-away execution, wave orchestration, swarm coordination |
+
+Discover all available workflows:
+
+```bash
+/mindforge:skills-index          # browse all skills and workflows
+/mindforge:status --workflows    # list active workflow pipelines
+```
+
 ---
 
 ## 6. High-Performance Personas

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindforge-cc",
-  "version": "11.7.1",
+  "version": "11.8.1",
   "description": "MindForge \u2014 Sovereign Agentic Intelligence Framework. Sovereign Stability: Production-Hardened Agentic Intelligence (v11)",
   "bin": {
     "mindforge-cc": "bin/install.js",

package/.agent/mindforge/wf-deep-research.md

@@ -1,32 +0,0 @@
----
-description: "Fan-out web research with adversarial claim verification and cited synthesis"
----
-# /mindforge:wf-deep-research
-
-Runs the **Deep Research** dynamic workflow.
-
-## Usage
-`/mindforge:wf-deep-research <your research question>`
-
-## What it does
-- **Scope**: Decomposes your question into 5 independent search angles
-- **Search**: 5 parallel web search agents, one per angle (~30s)
-- **Fetch**: Deduplicates URLs, fetches top 15 sources, extracts falsifiable claims
-- **Verify**: 3-vote adversarial verification per claim — 2/3 refutes kills a claim
-- **Synthesize**: Merges confirmed findings, ranks by confidence, cites all sources
-
-## Running
-
-Invoke via Claude Code's Workflow tool:
-
-```
-Workflow({
-  scriptPath: ".mindforge/dynamic-workflows/scripts/deep-research.js",
-  args: "<your input>"
-})
-```
-
-Or discover via CLI:
-```bash
-node bin/mindforge-cli.js workflow info deep-research
-```

package/.claude/commands/mindforge/wf-deep-research.md

@@ -1,32 +0,0 @@
----
-description: "Fan-out web research with adversarial claim verification and cited synthesis"
----
-# /mindforge:wf-deep-research
-
-Runs the **Deep Research** dynamic workflow.
-
-## Usage
-`/mindforge:wf-deep-research <your research question>`
-
-## What it does
-- **Scope**: Decomposes your question into 5 independent search angles
-- **Search**: 5 parallel web search agents, one per angle (~30s)
-- **Fetch**: Deduplicates URLs, fetches top 15 sources, extracts falsifiable claims
-- **Verify**: 3-vote adversarial verification per claim — 2/3 refutes kills a claim
-- **Synthesize**: Merges confirmed findings, ranks by confidence, cites all sources
-
-## Running
-
-Invoke via Claude Code's Workflow tool:
-
-```
-Workflow({
-  scriptPath: ".mindforge/dynamic-workflows/scripts/deep-research.js",
-  args: "<your input>"
-})
-```
-
-Or discover via CLI:
-```bash
-node bin/mindforge-cli.js workflow info deep-research
-```