mindforge-cc 11.8.0 → 11.8.1

package/.mindforge/memory/sync-manifest.json

@@ -1,6 +1,6 @@
 {
   "pattern-library.jsonl": {
-    "lastSync": "2026-06-24T05:48:11.891Z",
+    "lastSync": "2026-07-01T05:23:03.053Z",
     "localCount": 1
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [11.8.1] — 2026-07-01 — First Stable Release
+
+### Security
+- **mcp-server:** Patched hono to >=4.12.25 — fixes CORS credential reflection, path traversal (Windows), body-limit bypass, Set-Cookie merging, Lambda@Edge header drop
+- **sdk:** Patched picomatch — fixes ReDoS via extglob quantifiers and Method Injection via POSIX character classes
+- **ztai:** Added SECURITY_TIER_3_SIMULATED disclosure constant and startup warning for in-process key simulation
+
+### Fixes
+- `bin/sre/sli-verifier.js`: `simulateShadowWave()` now throws in non-simulate mode — gate with `MINDFORGE_SRE_SIMULATE=true`
+- `bin/spawn-agent.js`: spawn stub now exits 1 with actionable error instead of silently succeeding
+- `bin/memory/eis-client.js`: `resolveRemoteNode()` now throws explicitly instead of returning null
+- `bin/browser/session-manager.js`: added `capabilities.importFromBrowser=false` export
+- `.mindforge/config.json`: `mesh.node_id` changed from "beta-node" placeholder to "auto"
+
+### Docs
+- README: fixed stale version refs (11.5.1→11.8.1), corrected workflow count to 32, added Node.js >=18 prerequisite and Hello World section
+- SECURITY.md: documented Tier-3 simulation scope, audit-hash replay boundary, spawn dispatch status
+- docs/troubleshooting.md: added spawn stub, importFromBrowser, and test cwd entries
+- docs/sdk-reference.md: updated version to 11.8.1, marked unimplemented methods
+- docs/enterprise-setup.md: documented mesh.node_id configuration requirement
+
+### Tests
+- install.test.js + production.test.js: added cwd guard, scoped secrets scan to MindForge root only
+
+---
+
 ## [11.8.0] - 2026-06-24 — Workflow Forge II
 
 Expands the Dynamic Workflow Library from 12 to 33 workflows across 5 tiers, adding a new **Beast tier** for compound multi-phase multi-agent workflows with adversarial verification. 21 new workflows added. 92/92 tests pass.

package/MINDFORGE.md

@@ -3,10 +3,10 @@
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.8.0
+[VERSION] = 11.8.1
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
-[REQUIRED_CORE_VERSION] = 11.8.0
+[REQUIRED_CORE_VERSION] = 11.8.1
 [SOVEREIGN_IDENTITY] = true
 [SRE_LAYER_ENABLED]  = true
 

package/README.md

@@ -6,7 +6,7 @@
 
 ## Latest: v11.8.0
 
-- **v11.8.0 — "Workflow Forge II".** Expands the Dynamic Workflow Library from 12 to 33 workflows across 5 tiers — adds a new **Beast tier** for compound 5-phase adversarial workflows (security-hardening, accessibility-audit, security-threat-model), plus 18 more across Dev/Ops/Intelligence/Research. 21 new `/mindforge:wf-*` commands. Total: 219 commands.
+- **v11.8.0 — "Workflow Forge II".** Expands the Dynamic Workflow Library from 12 to 32 workflows across 5 tiers — adds a new **Beast tier** for compound 5-phase adversarial workflows (security-hardening, accessibility-audit, security-threat-model), plus 18 more across Dev/Ops/Intelligence/Research. 21 new `/mindforge:wf-*` commands. Total: 219 commands.
 - **v11.7.0 — "Workflow Forge".** Ships the first Dynamic Workflow Library — 12 pre-built multi-agent workflow scripts that run via Claude Code's `Workflow` tool with true parallel agent execution. Four tiers: Research (deep-research, competitive-analysis, tech-evaluation), Dev (code-audit, feature-planner, pr-review, tdd-sprint, refactor-plan), Ops (incident-response, release-prep), Intelligence (onboard-codebase, perf-optimize). 13 new `/mindforge:wf-*` commands. Total: 198 commands.
 - **v11.6.0 — "Skill Forge".** Adds 80 community-sourced skills across 8 domains (software-development, github, devops, research, security, creative, data-science, note-taking) — 30 promoted to engine tier for automatic trigger-matching, 50 in the extended tier for explicit activation. Three new slash commands: `/mindforge:systematic-debug`, `/mindforge:skill-tdd`, `/mindforge:skills-index`. Total: 153 skills, 232 engine-tier entries, 185 commands.
 - **v11.5.1 — Standalone MCP server.** The MindForge MCP server now ships as its own npm package, `mindforge-mcp-server@11.5.1`, listed on the official MCP Registry as `io.github.sairam0424/mindforge`. Add it to Claude Code with one command (see [Use the MCP server](#-use-the-mcp-server-standalone)); it exposes 7 tools over stdio (6 read-only + 1 guarded write).
@@ -14,6 +14,9 @@
 
 See [CHANGELOG.md](./CHANGELOG.md) for full release history.
 
+<details>
+<summary>v11.0.0 — Sovereign Stability highlights</summary>
+
 ## v11.0.0 — Sovereign Stability
 
 MindForge v11.0.0 "Sovereign Stability" is a production-hardening release focused on reliability, performance, and real-world deployment readiness. Key highlights:
@@ -27,6 +30,8 @@ MindForge v11.0.0 "Sovereign Stability" is a production-hardening release focuse
 
 This release ships 211 personas, 153 skills, 154 specialized subagents, 198 commands, 18 pillars, and 49 swarm templates across 12 engineering domains.
 
+</details>
+
 
 ## Installation & Setup
 
@@ -46,6 +51,8 @@ for all 11 plugins, token-budget guidance, and team setup.
 
 ### 🚀 Quick Start (npx — full framework engine)
 
+**Prerequisites:** Node.js >= 18.0.0
+
 The npx installer also writes the complete `.mindforge/` engine (governance, memory,
 planning) into your project:
 
@@ -80,7 +87,7 @@ npx mindforge-cc@latest --antigravity --local
 ### 🔗 Use the MCP server (standalone)
 
 The MindForge MCP server is published as its own npm package,
-**`mindforge-mcp-server`** (`11.5.1`), and is listed on the official
+**`mindforge-mcp-server`** (`11.8.1`), and is listed on the official
 [MCP Registry](https://registry.modelcontextprotocol.io) as
 `io.github.sairam0424/mindforge`. Wire it into Claude Code with one command:
 
@@ -102,6 +109,14 @@ It exposes **7 tools over stdio** — 6 read-only plus 1 guarded write:
 
 ---
 
+## Quick Verification
+
+After install, open Claude Code and type:
+- `/mindforge:status` — verify installation and show project health
+- `/mindforge:next` — auto-discover your first task
+
+---
+
 - **Production Hardening (v11.0.0)** — LRU caches, atomic JSON writes, log rotation, HANDOFF validation, and temporal snapshot GC for crash-safe long-running sessions.
 - **True Wave Parallelism (v11.0.0)** — Semaphore-based concurrent wave execution with configurable max concurrency replaces sequential dispatch.
 - **Streaming SDK (v11.0.0)** — WebSocket event streaming, `streamExecution()` AsyncIterable, `batchExecute()`, model streaming across Anthropic/OpenAI/Gemini providers.
@@ -383,7 +398,7 @@ See `.mindforge/production/token-optimiser.md`.
 
 ## 🚀 Dynamic Workflow Library
 
-33 pre-built multi-agent workflow scripts that run via Claude Code's `Workflow` tool. Each workflow fans out concurrent agents, synthesizes results, and returns structured output.
+32 pre-built multi-agent workflow scripts that run via Claude Code's `Workflow` tool. Each workflow fans out concurrent agents, synthesizes results, and returns structured output.
 
 **Discover:** `/mindforge:wf-catalog` or `node bin/mindforge-cli.js workflow list`
 

package/SECURITY.md

@@ -136,3 +136,12 @@ narrow disposable memory · scan skills/hooks/MCP/agents as supply-chain artifac
 ## Contact
 
 For security questions that are not vulnerability reports, open a GitHub Discussion with the "security" label.
+
+## Tier-3 Trust (ZTAI Secure Enclave)
+Tier-3 trust in v1.0 uses **in-process key simulation** (`bin/governance/ztai-manager.js` `SecureEnclaveProvider`). Key material resides in the Node.js heap — it is NOT hardware-isolated. A real TPM/HSM provider is planned for v1.2. **Do not use Tier-3 trust for production credential workflows in v1.0.**
+
+## Audit Log Tamper Evidence
+The Merkle chain (`bin/governance/audit-hash.js`) provides tamper-evidence for content and ordering but does not prevent replay of identical entries. Restrict OS-level write access to `.planning/AUDIT.jsonl` to prevent replay attacks.
+
+## Agent Dispatch (spawn mode)
+`bin/spawn-agent.js` spawn mode exits with an error in v1.0 — real agent dispatch is not yet implemented at the shell level. Use Claude Code slash commands (`/mindforge:auto`, `/mindforge:next`) to dispatch agents. Direct shell-level dispatch is planned for v1.1.

package/bin/autonomous/auto-runner.js

@@ -776,8 +776,14 @@ class AutoRunner {
       const mirrorPath = await this.mirror.replicate(incident);
       const decision = await this.adversary.runDebate(incident, mirrorPath);
       if (decision.verdict === 'APPROVED' || decision.verdict === 'AMENDED') {
-        const baseline = this.verifier.simulateShadowWave(false);
-        const postFix = this.verifier.simulateShadowWave(true);
+        let baseline, postFix;
+        try {
+          baseline = this.verifier.simulateShadowWave(false);
+          postFix  = this.verifier.simulateShadowWave(true);
+        } catch (e) {
+          this.writeAudit({ event: 'sre_sli_unavailable', rid: incident.remediation_id, reason: e.message });
+          return;
+        }
         const verification = await this.verifier.verify(baseline, postFix);
         if (verification.isHealthy) {
           this.writeAudit({ event: 'sre_remediation_applied', rid: incident.remediation_id, verdict: decision.verdict });

package/bin/autonomous/dependency-dag.js

@@ -4,7 +4,7 @@
  * Kahn topological sort + cycle detection.
  * Ported from the previously test-only implementation into the real engine.
  *
- * TODO(UC-xx): same-wave file-conflict detection once tasks carry file lists.
+ * TODO(UC-xx): same-wave file-conflict detection — deferred until handoff schema carries per-task file lists. See docs/architecture/ for scope.
  *   Handoff tasks (see normalizeTask in wave-executor.js and validateHandoff in
  *   state-manager.js) currently expose only id/name/plan/depends_on — there is
  *   no `files` field to compare. A `findFileConflicts(plans)` check (two tasks

package/bin/browser/session-manager.js

@@ -94,4 +94,6 @@ function importFromBrowser(source) {
   );
 }
 
-module.exports = { saveSession, loadSession, importFromBrowser };
+const capabilities = { importFromBrowser: false };
+
+module.exports = { saveSession, loadSession, importFromBrowser, capabilities };

package/bin/governance/ztai-manager.js

@@ -9,6 +9,8 @@ const configManager = require('./config-manager');
 
 const generateKeyPair = promisify(crypto.generateKeyPair);
 
+const SECURITY_TIER_3_SIMULATED = true;
+
 /**
  * Abstract Base Class for Key Providers
  */
@@ -61,6 +63,9 @@ class LocalKeyProvider extends KeyProvider {
 class SecureEnclaveProvider extends KeyProvider {
   constructor() {
     super();
+    console.warn('[ZTAI] WARNING: Tier-3 trust using simulated in-process key storage. ' +
+      'Key material resides in the Node.js heap — not hardware-isolated. ' +
+      'Do not use Tier-3 trust for production credential workflows in v1.0.');
     this.enclaveStore = new Map(); // DID -> { privateKey, metadata }
   }
 
@@ -307,3 +312,4 @@ class ZTAIManager {
 }
 
 module.exports = new ZTAIManager();
+module.exports.SECURITY_TIER_3_SIMULATED = SECURITY_TIER_3_SIMULATED;

package/bin/memory/eis-client.js

@@ -144,9 +144,13 @@ class EISClient {
     }
   }
 
-  // TODO: implement when remote nodes are available
+  // TODO(EIS-remote): implement cross-node context resolution in v1.1
   async resolveRemoteNode(nodeId) {
-    return null;
+    // TODO(EIS-remote): implement cross-node context resolution in v1.1
+    throw new Error(
+      `EIS remote node resolution not implemented (nodeId: ${nodeId}). ` +
+      'Cross-node context is local-only in v1.0.'
+    );
   }
 
   /**

package/bin/spawn-agent.js

@@ -125,13 +125,16 @@ async function run() {
     process.exit(0);
   }
 
-  // Future: Integration with Antigravity / Claude Code runtime
-  console.log('🛠️ Dispatching to agent runtime...');
-  // For now, we simulate the environment preparation
-  setTimeout(() => {
-    console.log('✅ Agent environment active.');
-    process.exit(0);
-  }, 500);
+  // Agent dispatch to Claude Code runtime is not yet implemented.
+  // Use Claude Code slash commands to dispatch agents instead.
+  console.error(
+    'Agent spawn dispatch not implemented in v1.0.\n' +
+    '  Use Claude Code slash commands instead:\n' +
+    '  /mindforge:auto  — reactive engine start\n' +
+    '  /mindforge:next  — primary auto-discovery\n' +
+    '  See docs/troubleshooting.md for details.'
+  );
+  process.exit(1);
 }
 
 run().catch(err => {

package/bin/sre/sli-verifier.js

@@ -66,9 +66,17 @@ class SLIVerifier {
 
   /**
    * Heuristic simulation of a "Shadow Wave" to generate metrics.
+   * Gated behind MINDFORGE_SRE_SIMULATE=true — must not run in production
+   * without explicit opt-in.
    */
   simulateShadowWave(isFixApplied = false) {
-    // Generate jittery but realistic metrics
+    if (process.env.MINDFORGE_SRE_SIMULATE !== 'true') {
+      throw new Error(
+        '[SRE] simulateShadowWave() called outside simulate mode. ' +
+        'Set MINDFORGE_SRE_SIMULATE=true to enable SLI simulation, ' +
+        'or implement real metric collection from /api/v1/system.'
+      );
+    }
     return {
       latency: 120 + (Math.random() * 20),
       error_rate: isFixApplied ? 0.001 : 0.05,

package/docs/sdk-reference.md

@@ -14,7 +14,7 @@ import {
 } from '@mindforge/sdk';
 ```
 
-Current SDK version: `10.0.1`
+Current SDK version: `11.8.1`
 
 ---
 
@@ -93,6 +93,18 @@ Returns `true` if the unified SQLite knowledge database (`celestial.db`) exists
 
 Returns the absolute path to the project's `celestial.db` SQLite database file.
 
+#### `importFromBrowser(sessionData: unknown): Promise<void>`
+
+Imports a session snapshot captured from a browser environment into the local session store.
+
+> **[NOT IMPLEMENTED — v1.0]** This method always throws. Check `sessionManager.capabilities.importFromBrowser === false` before calling. Use `saveSession`/`loadSession` instead.
+
+#### `resolveRemoteNode(nodeId: string): Promise<unknown>`
+
+Resolves context for a node residing on a remote EIS (Edge Intelligence Shard) instance.
+
+> **[NOT IMPLEMENTED — v1.0]** `resolveRemoteNode(nodeId)` always throws. Cross-node context resolution is local-only in v1.0. Planned for v1.1.
+
 ---
 
 ## `MindForgeMemory`

package/docs/troubleshooting.md

@@ -137,3 +137,12 @@ If the above doesn’t resolve it:
 - **Architecture**: `docs/architecture/V5-ENTERPRISE.md`
 - **Commands**: `docs/commands-reference.md`
 - **Personas**: `docs/PERSONAS.md`
+
+## Agent spawn returns immediately with no action
+`spawn` mode in `bin/spawn-agent.js` exits with an error in v1.0. Real agent dispatch requires Claude Code slash commands. Use `/mindforge:auto` or `/mindforge:next` to dispatch agents.
+
+## `importFromBrowser` crashes
+Browser cookie import from native browser profiles is not implemented in v1.0. Use `saveSession`/`loadSession` instead. Check `sessionManager.capabilities.importFromBrowser` before calling.
+
+## Tests fail when run from a parent directory
+All tests must be run from the MindForge project root: `cd /path/to/MindForge && npm test`. Running from the parent workspace will produce false failures.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindforge-cc",
-  "version": "11.8.0",
+  "version": "11.8.1",
   "description": "MindForge \u2014 Sovereign Agentic Intelligence Framework. Sovereign Stability: Production-Hardened Agentic Intelligence (v11)",
   "bin": {
     "mindforge-cc": "bin/install.js",

package/.agent/mindforge/wf-deep-research.md

@@ -1,32 +0,0 @@
----
-description: "Fan-out web research with adversarial claim verification and cited synthesis"
----
-# /mindforge:wf-deep-research
-
-Runs the **Deep Research** dynamic workflow.
-
-## Usage
-`/mindforge:wf-deep-research <your research question>`
-
-## What it does
-- **Scope**: Decomposes your question into 5 independent search angles
-- **Search**: 5 parallel web search agents, one per angle (~30s)
-- **Fetch**: Deduplicates URLs, fetches top 15 sources, extracts falsifiable claims
-- **Verify**: 3-vote adversarial verification per claim — 2/3 refutes kills a claim
-- **Synthesize**: Merges confirmed findings, ranks by confidence, cites all sources
-
-## Running
-
-Invoke via Claude Code's Workflow tool:
-
-```
-Workflow({
-  scriptPath: ".mindforge/dynamic-workflows/scripts/deep-research.js",
-  args: "<your input>"
-})
-```
-
-Or discover via CLI:
-```bash
-node bin/mindforge-cli.js workflow info deep-research
-```

package/.claude/commands/mindforge/wf-deep-research.md

@@ -1,32 +0,0 @@
----
-description: "Fan-out web research with adversarial claim verification and cited synthesis"
----
-# /mindforge:wf-deep-research
-
-Runs the **Deep Research** dynamic workflow.
-
-## Usage
-`/mindforge:wf-deep-research <your research question>`
-
-## What it does
-- **Scope**: Decomposes your question into 5 independent search angles
-- **Search**: 5 parallel web search agents, one per angle (~30s)
-- **Fetch**: Deduplicates URLs, fetches top 15 sources, extracts falsifiable claims
-- **Verify**: 3-vote adversarial verification per claim — 2/3 refutes kills a claim
-- **Synthesize**: Merges confirmed findings, ranks by confidence, cites all sources
-
-## Running
-
-Invoke via Claude Code's Workflow tool:
-
-```
-Workflow({
-  scriptPath: ".mindforge/dynamic-workflows/scripts/deep-research.js",
-  args: "<your input>"
-})
-```
-
-Or discover via CLI:
-```bash
-node bin/mindforge-cli.js workflow info deep-research
-```

package/.mindforge/dynamic-workflows/scripts/deep-research.js

@@ -1,151 +0,0 @@
-export const meta = {
-  name: 'deep-research',
-  description: 'Fan-out web research with adversarial claim verification and cited synthesis',
-  whenToUse: 'When you need a deep, multi-source, fact-checked research report on any topic',
-  phases: [
-    { title: 'Scope', detail: 'Decompose question into 5 search angles' },
-    { title: 'Search', detail: '5 parallel web search agents, one per angle' },
-    { title: 'Fetch', detail: 'Dedup URLs, fetch top 15 sources, extract falsifiable claims' },
-    { title: 'Verify', detail: '3-vote adversarial verification per claim (need 2/3 to kill)' },
-    { title: 'Synthesize', detail: 'Merge semantic dupes, rank by confidence, cite sources' },
-  ],
-};
-
-export default async function run({ agent, parallel, pipeline, phase, log, args, budget }) {
-  const ANGLES_SCHEMA = {
-    type: 'object',
-    properties: {
-      angles: {
-        type: 'array',
-        items: { type: 'object', properties: { label: { type: 'string' }, query: { type: 'string' } }, required: ['label', 'query'] },
-        minItems: 5, maxItems: 5,
-      },
-    },
-    required: ['angles'],
-  };
-
-  const SEARCH_SCHEMA = {
-    type: 'object',
-    properties: {
-      results: {
-        type: 'array',
-        items: { type: 'object', properties: { title: { type: 'string' }, url: { type: 'string' }, snippet: { type: 'string' } }, required: ['title', 'url', 'snippet'] },
-      },
-    },
-    required: ['results'],
-  };
-
-  const CLAIMS_SCHEMA = {
-    type: 'object',
-    properties: {
-      claims: {
-        type: 'array',
-        items: { type: 'object', properties: { claim: { type: 'string' }, source: { type: 'string' }, evidence: { type: 'string' } }, required: ['claim', 'source', 'evidence'] },
-      },
-    },
-    required: ['claims'],
-  };
-
-  const VERDICT_SCHEMA = {
-    type: 'object',
-    properties: { refuted: { type: 'boolean' }, reason: { type: 'string' } },
-    required: ['refuted', 'reason'],
-  };
-
-  const SYNTH_SCHEMA = {
-    type: 'object',
-    properties: {
-      summary: { type: 'string' },
-      findings: {
-        type: 'array',
-        items: { type: 'object', properties: { claim: { type: 'string' }, confidence: { type: 'string' }, sources: { type: 'array', items: { type: 'string' } }, evidence: { type: 'string' } }, required: ['claim', 'confidence', 'sources', 'evidence'] },
-      },
-    },
-    required: ['summary', 'findings'],
-  };
-
-  const question = args || 'No question provided — please pass your research question as args.';
-
-  phase('Scope');
-  log(`Q: ${question.slice(0, 60)}…`);
-  const scoped = await agent(
-    `Decompose this research question into exactly 5 independent search angles. Each angle should approach the topic from a different perspective (e.g., implementation, theory, examples, trade-offs, contrarian view). Question: "${question}"`,
-    { schema: ANGLES_SCHEMA, label: 'decompose' }
-  );
-  const angles = scoped.angles;
-  log(`Decomposed into ${angles.length} angles: ${angles.map(a => a.label).join(', ')}`);
-
-  phase('Search');
-  const searchResults = await parallel(
-    angles.map(angle => () => agent(
-      `Web search for: "${angle.query}". Return the top 6 most relevant results with title, URL, and a brief snippet explaining why each is relevant to: "${angle.query}"`,
-      { schema: SEARCH_SCHEMA, label: angle.label }
-    ))
-  );
-
-  phase('Fetch');
-  const allUrls = new Map();
-  for (const res of searchResults.filter(Boolean)) {
-    for (const r of res.results) {
-      if (!allUrls.has(r.url)) allUrls.set(r.url, r);
-    }
-  }
-  const uniqueUrls = [...allUrls.values()].slice(0, 15);
-  log(`Fetched ${searchResults.filter(Boolean).length * 6} results → ${uniqueUrls.length} unique sources → extracting claims`);
-
-  const claimBatches = await parallel(
-    uniqueUrls.map(src => () => agent(
-      `Read this source and extract up to 5 specific, falsifiable factual claims from it. Only extract claims that are directly relevant to: "${question}". Source URL: ${src.url}\nSnippet: ${src.snippet}`,
-      { schema: CLAIMS_SCHEMA, label: `claims:${src.url.slice(8, 40)}` }
-    ))
-  );
-  const allClaims = claimBatches.filter(Boolean).flatMap(b => b.claims).slice(0, 25);
-  log(`Extracted ${allClaims.length} claims → verifying top 25`);
-
-  phase('Verify');
-  const verified = await parallel(
-    allClaims.map(c => () =>
-      parallel([
-        () => agent(`Try to REFUTE this claim. Default to refuted=true if uncertain or unverifiable. Claim: "${c.claim}"`, { schema: VERDICT_SCHEMA, label: `verify-1:${c.claim.slice(0, 30)}` }),
-        () => agent(`Adversarially challenge this claim from a different angle. Default to refuted=true if you cannot confirm it. Claim: "${c.claim}"`, { schema: VERDICT_SCHEMA, label: `verify-2:${c.claim.slice(0, 30)}` }),
-        () => agent(`As a skeptical fact-checker, evaluate this claim. Default to refuted=true if evidence is weak. Claim: "${c.claim}"`, { schema: VERDICT_SCHEMA, label: `verify-3:${c.claim.slice(0, 30)}` }),
-      ]).then(votes => {
-        const refutes = votes.filter(Boolean).filter(v => v.refuted).length;
-        return { ...c, survives: refutes <= 1, votes: `${3 - refutes}-${refutes}` };
-      })
-    )
-  );
-  const confirmed = verified.filter(Boolean).filter(c => c.survives);
-  const killed = verified.filter(Boolean).filter(c => !c.survives);
-  log(`Verify done: ${allClaims.length} claims → ${confirmed.length} confirmed, ${killed.length} killed`);
-
-  phase('Synthesize');
-  const synthesis = await agent(
-    `Synthesize these verified research findings into a comprehensive report answering: "${question}"
-
-  Confirmed findings (${confirmed.length}):
-  ${confirmed.map((c, i) => `${i + 1}. [${c.votes}] ${c.claim} (source: ${c.source})`).join('\n')}
-
-  Killed findings (${killed.length}):
-  ${killed.map(c => `- [${c.votes}] ${c.claim}`).join('\n')}
-
-  Produce a clear summary and a ranked findings list. For each finding, state the claim, confidence level (high/medium/low), sources, and evidence.`,
-    { schema: SYNTH_SCHEMA, label: 'synthesize' }
-  );
-
-  return {
-    question,
-    summary: synthesis.summary,
-    findings: synthesis.findings,
-    refuted: killed.map(c => ({ claim: c.claim, vote: c.votes, source: c.source })),
-    sources: uniqueUrls.map(u => u.url),
-    stats: {
-      angles: angles.length,
-      sourcesFetched: uniqueUrls.length,
-      claimsExtracted: allClaims.length,
-      claimsVerified: allClaims.length,
-      confirmed: confirmed.length,
-      killed: killed.length,
-    },
-  };
-}