mindforge-cc 11.9.0 → 11.9.1

package/changelogs/v1.0.3.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## [1.0.3] — v1.0.3 Antigravity Agents Folder — 2026-03-22
+
+### Changed (v1.0.3)
+
+- Local Antigravity installs now target `agents/` by default (legacy `.agent/` detected and supported).
+
+---
+

package/changelogs/v1.0.4.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## [1.0.4] — v1.0.4 Antigravity Install Fix — 2026-03-22
+
+### Fixed (v1.0.4)
+
+- Antigravity local install now correctly copies commands and CLAUDE.md into `agents/`.
+
+---
+

package/changelogs/v1.0.5.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## [1.0.5] — v1.0.5 Minimal Install Option — 2026-03-22
+
+### Added (v1.0.5)
+
+- `--minimal` flag to install only essential project scaffolding.
+
+---
+

package/changelogs/v10.0.0.md

@@ -0,0 +1,71 @@
+# Changelog
+
+## [10.0.0] - 2026-05-21 — "Bedrock Fortified"
+
+### Added (v10.0.0)
+
+- **Bearer token authentication** — All dashboard mutating endpoints now require `Authorization: Bearer <token>` header. Protects SSE, steering, and approval routes.
+- **Auth on browser daemon** — The `/evaluate` endpoint on the Playwright browser daemon now requires authentication, closing a remote code execution vector.
+- **Unified test runner** — `tests/run-all.js` discovers and executes all 43 test files with pass/fail summary and exit code propagation.
+- **Shared utilities layer** — `bin/utils/paths.js`, `file-io.js`, and `errors.js` provide consistent path resolution, safe file I/O, and typed error classes across the codebase.
+- **AuditWriter module** — Buffered async writes with Merkle hash chaining, replacing direct synchronous file append calls in the auto-runner.
+- **State manager module** — Extracted from auto-runner for clean separation of execution state persistence.
+- **Task dispatcher module** — Extracted from auto-runner for isolated task routing and repair-operator logic.
+- **Wave executor module** — Extracted from auto-runner for wave-level orchestration and progress tracking.
+- **Dependabot configuration** — Weekly npm dependency updates and monthly GitHub Actions version bumps.
+- **CODEOWNERS file** — Defines review ownership for security-sensitive paths (`bin/governance/`, `bin/engine/`, SDK).
+- **npm provenance** — Release workflow now publishes with `--provenance` for SLSA Build Level 2 supply chain attestation.
+- **CLI "Did you mean?" suggestions** — Levenshtein distance matching for mistyped commands (e.g., `mindforge statsus` suggests `status`).
+- **CLI --verbose flag** — Enables detailed execution tracing for debugging framework behavior.
+- **CLI mindforge bin entry** — Post-install accessible binary for direct invocation without `npx`.
+- **Structured action allowlist** — Replaces the regex-based prompt injection blocklist with an explicit allowlist of permitted autonomous actions.
+- **.npmignore** — Excludes runtime artifacts, test fixtures, planning state, and intelligence logs from the published package.
+- **Knowledge store O(1) index** — Hash-map index for stores exceeding 100 entries, eliminating linear scans.
+- **SSE idle detection** — Dashboard polling pauses when no clients are connected, reducing CPU and I/O overhead.
+- **Metrics TTL cache** — 5-second time-to-live cache prevents redundant metrics recomputation on rapid dashboard refreshes.
+- **Smart mtime-based polling** — File watchers skip re-reads when mtime has not changed since last poll cycle.
+- **NON-OVERRIDABLE governance** — Added non-overridable parameter section to MINDFORGE.md for security-critical settings.
+- **HANDOFF schema alignment** — Unified HANDOFF.json to v1.0.0 schema with all required fields.
+
+### Changed (v10.0.0)
+
+- **VectorHub: sql.js (WASM) replaces better-sqlite3 (native C++)** — Eliminates native compilation, node-gyp, and platform-specific build failures. Zero native dependencies.
+- **VectorHub: lazy Proxy + factory pattern** — Database connection is deferred until first query. Callers use `createVectorHub()` factory instead of direct constructor.
+- **VectorHub: WAL mode + FTS4** — Write-Ahead Logging for concurrent reads; FTS4 replaces FTS5 for sql.js compatibility.
+- **VectorHub: parameterized queries throughout** — All user-influenced values use bound parameters, closing SQL injection vectors.
+- **Auto-runner decomposition** — Reduced from 672 lines to 367 lines by extracting 4 focused modules (task-dispatcher, wave-executor, state-manager, audit-writer).
+- **NexusTracer async migration** — Moved from synchronous file appends to non-blocking writes with back-pressure handling.
+- **PolicyEngine async migration** — Governance evaluation no longer blocks the event loop during high-throughput wave execution.
+- **SDK memory.ts rewrite** — Now self-contained with no imports from `../../bin/`. Independently publishable.
+- **SDK exports field** — Package.json `exports` map enables tree-shaking and prevents deep import of internal modules.
+- **SDK files field** — Only ships compiled output and type declarations; source maps excluded from production.
+- **Real validateConfig() implementation** — Validates 5 required fields with type checking and schema enforcement (replaces no-op stub).
+- **Lazy module loading in auto-runner** — 12 heavy `require()` calls deferred to first-use, cutting cold-start time.
+- **Package size reduction** — From 3.9 MB / 866 files to 1.1 MB / 245 files (72% smaller).
+- **CI workflow** — Node 18/20/22 matrix, `npm ci`, npm caching, c8 coverage at 30% threshold.
+- **Model topology assertions** — Updated test expectations to match Claude 4.x and Gemini 2.5 model family.
+- **Skills MANIFEST** — Updated manifest to register all 10 core skills with proper paths and schema version.
+- **README rewritten** — Clear value proposition, quick-start, and architecture overview at the top.
+- **All docs version-stamped** — References updated to v10.0.0 throughout.
+- **SDK reference documentation** — Expanded from 28 lines to 230+ lines with full API surface coverage.
+
+### Fixed (v10.0.0)
+
+- **CRITICAL: Hardcoded npm token removed** — `NPM_TOKEN` was embedded in CI config; now sourced exclusively from environment variables with startup validation.
+- **CRITICAL: ZK-proof governance bypass closed** — `verifyZKProof()` previously returned `true` unconditionally; now throws `GovernanceViolationError` with fail-closed semantics.
+- **CRITICAL: Path traversal in temporal API** — `auditId` parameter accepted `../` sequences; now validated with regex allowlist and directory containment check.
+- **CRITICAL: Command injection in change-classifier** — Shell-interpreted user input replaced with argument-array invocation, eliminating shell interpretation.
+- **Runtime crash in learning-manager.js** — Null reference on empty knowledge store; added defensive initialization.
+- **4 broken test files** — Fixed `nexus-tracing.test.js`, `model-broker.test.js`, `feedback-loop.test.js`, and `security-audit.test.js` (stale mocks, missing fixtures, async race conditions).
+- **Observability workflow trigger** — Workflow `name:` field now matches the `workflow_run.workflows` reference in dependent jobs.
+- **Duplicate release-plane.yml** — Removed conflicting workflow file that caused CI confusion.
+
+### Removed (v10.0.0)
+
+- **better-sqlite3 dependency** — Native C++ addon removed in favor of sql.js (pure WASM). Eliminates `node-gyp`, Python, and platform-specific build toolchains.
+- **Dead CLI routes** — `sync-jira` and `sync-confluence` commands removed (integration stubs with no implementation).
+- **Duplicate release workflow** — `release-plane.yml` deleted; single `release.yml` is the canonical publish pipeline.
+- **Regex-based prompt injection blocklist** — Replaced by structured action allowlist (fewer false positives, auditable).
+
+---
+

package/changelogs/v10.0.2.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## [10.0.2] - 2026-05-24 — "Persona Expansion"
+
+### Added (v10.0.2)
+
+- **47 new specialist personas** — Security & Compliance (6), Architecture & System Design (8), Frontend & UX (10), Performance & Reliability (5), Data & ML (4), DevOps & Infrastructure (6), Language Specialists (5), DX & Operations (8), Strategy & Review (9), Specialized Engineering (10).
+- **6 new swarm templates** — ArchitectureSwarm, PerformanceSwarm, InfrastructureSwarm, AccessibilitySwarm, ReviewSwarm, MigrationSwarm.
+- **Updated existing swarms** — UISwarm, BackendSwarm, SecuritySwarm, DeveloperExperienceSwarm, DataMeshSwarm, IncidentResponseSwarm, ComplianceSwarm, QualityAssuranceSwarm now include relevant new specialist personas.
+- **Swarm templates v5.0.0** — Bump from 4.2.0 with expanded member rosters and new specialist orchestration patterns.
+- **Persona registry documentation** — 10 new category tables in `docs/registry/PERSONAS.md`.
+- **Persona reference guide** — Updated `docs/PERSONAS.md` with all 47 entries (total: 108 personas).
+
+---
+

package/changelogs/v10.0.3.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## [10.0.3] - 2026-05-25 — "Council Awakens"
+
+### Added (v10.0.3)
+
+- **10 new core skills** — agent-loops, multi-llm-consult, continuous-learning, council, verification-loop, threat-modeling, autonomous-loops, agent-introspection-debugging, cost-aware-routing, doc-health-audit.
+- **8 new commands** — `/mindforge:council`, `/mindforge:consult`, `/mindforge:verify-loop`, `/mindforge:introspect`, `/mindforge:cost-report`, `/mindforge:threat-model`, `/mindforge:learn-instinct`, `/mindforge:evolve-skills`.
+- **9 new personas** — cost-optimizer, threat-modeler, council-architect, council-skeptic, council-pragmatist, council-critic, instinct-curator, doc-auditor, multi-model-bridge.
+- **3 new swarm templates** — CouncilSwarm (HITL decision gate), VerificationSwarm (autonomous quality gates), LearningSwarm (instinct management).
+- **Skill Composition System** — Skills can now declare dependencies on other skills via `compose:` frontmatter field. Composed skills are injected as summaries (max 2-level depth, cycle detection).
+- **Instinct Engine** — Auto-capture learned behaviors with confidence scoring. Instincts auto-promote to skills at 0.85 confidence after 5+ successful applications. Project-scoped, max 100 per project.
+- **Cost Tracking Module** — Token budgeting, 5-tier model routing (Haiku/Sonnet/Opus/Gemini/GPT-4o), spend analytics via token-ledger.jsonl.
+- **Council Framework** — 4-voice decision harness (Architect, Skeptic, Pragmatist, Critic) with weighted consensus scoring, dissent documentation, and 5 pre-built templates.
+- **Cross-Iteration Bridge** — SHARED_TASK_NOTES.md for semantic context persistence across autonomous mode iterations (complements HANDOFF.json).
+- **Swarm templates v6.0.0** — Bump from v5.0.0 with 3 new templates (total: 21 swarm templates).
+- **claude-opus-4-7** added to market_registry in config.json.
+- **Loader composition step** — New Step 4.1 in skill loader for resolving `compose:` dependencies.
+
+---
+

package/changelogs/v10.0.4.md

@@ -0,0 +1,16 @@
+# Changelog
+
+## [10.0.4] - 2026-05-26 — "Santa's Eval"
+
+### Added (v10.0.4)
+
+- **8 new core skills** — santa-method, eval-harness, quality-audit, testing-anti-patterns, defense-in-depth, codebase-onboarding, rfc-pipeline, de-sloppify.
+- **6 new commands** — `/mindforge:santa`, `/mindforge:eval`, `/mindforge:quality-audit`, `/mindforge:rfc`, `/mindforge:onboard`, `/mindforge:de-slop`.
+- **6 new personas** — eval-judge, rfc-architect, anti-pattern-hunter, onboarding-navigator, de-sloppifier, quality-scorer.
+- **3 new swarm templates** — EvalSwarm (autonomous eval gate), OnboardingSwarm (autonomous codebase discovery), RFCSwarm (HITL spec decomposition).
+- **Proactive Skill Suggestion Engine** — Signal-based skill detection (file/error/task patterns) with confidence threshold (0.7), cooldown tracking, and debounce logic.
+- **Eval storage** — `.mindforge/evals/` directory for persisting eval configs, rubrics, and results.
+- **Swarm templates v7.0.0** — Bump from v6.0.0 with 3 new templates (total: 24 swarm templates).
+
+---
+

package/changelogs/v10.0.5.md

@@ -0,0 +1,16 @@
+# Changelog
+
+## [10.0.5] - 2026-05-26 — "Forge Master"
+
+### Added (v10.0.5)
+
+- **5 new core skills** — skill-creator-meta, deployment-workflow, dmux-workflows, vibe-security, instinct-clustering.
+- **5 new commands** — `/mindforge:create-skill`, `/mindforge:deploy`, `/mindforge:dmux`, `/mindforge:vibe-check`, `/mindforge:cluster-instincts`.
+- **5 new personas** — skill-smith, deployment-captain, dmux-orchestrator, vibe-checker, saga-orchestrator.
+- **2 new swarm templates** — DeploymentSwarm (HITL staged rollout), ForgeSwarm (autonomous skill creation).
+- **De-slop gate** — Phase 6.5 in verification-loop: informational de-slop scan before shipping (non-blocking).
+- **Cross-model eval spec** — `.mindforge/engine/cross-model-eval.md` for routing same task to 2 models and comparing outputs.
+- **Swarm templates v8.0.0** — Bump from v7.0.0 with 2 new templates (total: 26 swarm templates).
+
+---
+

package/changelogs/v10.0.6.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## [10.0.6] - 2026-05-26 — "Complete Arsenal"
+
+### Added (v10.0.6)
+
+- **17 new core skills** — microservices-patterns, cqrs-event-sourcing, system-design, business-analyst, product-manager, market-researcher, typescript-advanced, python-performance, react-performance, k8s-deployment, writing-plans, writing-skills, using-git-worktrees, code-tour, autonomous-agent-harness, mcp-server-patterns, proofreader.
+- **10 new commands** — `/mindforge:microservices`, `/mindforge:system-design`, `/mindforge:brd`, `/mindforge:product-spec`, `/mindforge:market-research`, `/mindforge:code-tour`, `/mindforge:mcp-server`, `/mindforge:proofread`, `/mindforge:worktrees`, `/mindforge:plan-write`.
+- **8 new personas** — business-analyst, product-owner, market-analyst, mcp-designer, proofreader, system-designer, worktree-manager, code-narrator.
+- **3 new swarm templates** — ArchDesignSwarm (HITL system design), ProductSwarm (HITL product strategy), DocumentationSwarm (autonomous content quality).
+- **Swarm templates v9.0.0** — Bump from v8.0.0 with 3 new templates (total: 29 swarm templates).
+- **50 core skills milestone** — Framework now covers architecture, business, languages, workflow, infrastructure, and documentation domains.
+
+---
+

package/changelogs/v10.0.7.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## [10.0.7] - 2026-05-26 — "Meta Engineer"
+
+### Added (v10.0.7)
+
+- **20 new core skills** — prompt-engineering, context-engineering, agent-orchestration-patterns, tool-design, guardrails-and-safety, observability-stack, ci-cd-pipeline, infrastructure-as-code, incident-management, chaos-engineering, data-modeling, api-versioning, search-implementation, design-system, state-management, responsive-patterns, auth-patterns, supply-chain-security, technical-writing, code-review-methodology.
+- **10 new commands** — `/mindforge:prompt`, `/mindforge:context-budget`, `/mindforge:orchestrate`, `/mindforge:observability`, `/mindforge:pipeline`, `/mindforge:data-model`, `/mindforge:design-tokens`, `/mindforge:auth-flow`, `/mindforge:write-rfc`, `/mindforge:review-guide`.
+- **8 new personas** — prompt-architect, agent-orchestrator, sre-lead, pipeline-engineer, data-architect, design-system-lead, auth-engineer, technical-writer-lead.
+- **3 new swarm templates** — PromptEngineeringSwarm (HITL AI engineering), SRESwarm (HITL reliability), FrontendSwarm (autonomous design system).
+- **70 core skills milestone** — Framework now covers AI engineering, DevOps, reliability, data, frontend, advanced security, and technical communication.
+- **Swarm templates v10.0.0** — Bump from v9.0.0 with 3 new templates (total: 32 swarm templates).
+
+---
+

package/changelogs/v10.0.8.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## [10.0.8] - 2026-05-26 — "Deep Patterns"
+
+### Added (v10.0.8)
+
+- **20 new core skills** — contract-testing, load-testing, mutation-testing, visual-regression-testing, monorepo-management, cli-design, developer-onboarding, error-handling-architecture, caching-strategies, migration-strategies, connection-pooling, event-driven-architecture, api-gateway-patterns, websocket-patterns, feature-flag-management, secrets-rotation, compliance-as-code, rag-architecture, fine-tuning-workflow, llm-cost-optimization.
+- **10 new commands** — `/mindforge:contract-test`, `/mindforge:load-test`, `/mindforge:monorepo`, `/mindforge:cli`, `/mindforge:cache`, `/mindforge:events`, `/mindforge:secrets`, `/mindforge:rag`, `/mindforge:feature-flags`, `/mindforge:compliance`.
+- **8 new personas** — contract-tester, dx-engineer, cache-architect, event-architect, compliance-engineer, ml-ops-engineer, platform-engineer, api-gateway-designer.
+- **3 new swarm templates** — TestingDeepSwarm (autonomous deep testing), PlatformSwarm (HITL platform engineering), MLOpsSwarm (HITL ML operations).
+- **90 core skills milestone** — Production-depth coverage for testing, caching, events, secrets, compliance, RAG, and cost optimization.
+- **Swarm templates v11.0.0** — Bump from v10.0.0 with 3 new templates (total: 35 swarm templates).
+
+---
+

package/changelogs/v10.0.9.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## [10.0.9] - 2026-05-26 — "Full Spectrum"
+
+### Added (v10.0.9)
+
+- **20 new core skills** — streaming-architecture, queue-design, real-time-sync, cost-estimation, technical-debt-management, capacity-planning, graceful-degradation, idempotency-patterns, rate-limiting-design, code-generation-patterns, dependency-management, git-workflow-design, i18n-architecture, a11y-testing, multi-tenancy-patterns, audit-logging, database-performance, bundle-optimization, graphql-patterns, pagination-patterns.
+- **10 new commands** — `/mindforge:stream`, `/mindforge:queue`, `/mindforge:finops`, `/mindforge:tech-debt`, `/mindforge:degrade`, `/mindforge:idempotent`, `/mindforge:rate-limit`, `/mindforge:i18n`, `/mindforge:multi-tenant`, `/mindforge:graphql`.
+- **8 new personas** — streaming-engineer, finops-analyst, debt-manager, resilience-engineer, codegen-specialist, i18n-architect, multi-tenancy-architect, graphql-designer.
+- **3 new swarm templates** — StreamingSwarm (HITL real-time), ResilienceSwarm (autonomous failure engineering), GovernanceSwarm (HITL data governance).
+- **110 core skills milestone** — Comprehensive coverage across all major software engineering domains achieved.
+- **Swarm templates v12.0.0** — Bump from v11.0.0 with 3 new templates (total: 38 swarm templates).
+
+---
+

package/changelogs/v10.1.0.md

@@ -0,0 +1,16 @@
+# Changelog
+
+## [10.1.0] - 2026-05-26 — "Strategic Intelligence"
+
+### Added (v10.1.0)
+
+- **20 new core skills** — build-vs-buy, technology-radar, architecture-tradeoff-analysis, technical-interview-design, post-incident-learning, team-topology-design, sprint-retrospective-facilitation, knowledge-sharing-systems, estimation-techniques, on-call-design, experiment-design, analytics-instrumentation, notification-system-design, payment-integration, email-deliverability, agent-memory-design, agent-evaluation-framework, multi-turn-conversation-design, agent-tool-selection, human-in-the-loop-design.
+- **10 new commands** — `/mindforge:build-vs-buy`, `/mindforge:tech-radar`, `/mindforge:team-topology`, `/mindforge:retro`, `/mindforge:experiment`, `/mindforge:analytics`, `/mindforge:payments`, `/mindforge:agent-memory`, `/mindforge:agent-eval`, `/mindforge:hitl`.
+- **8 new personas** — decision-architect, team-coach, knowledge-curator, experiment-designer, payments-engineer, agent-memory-designer, agent-evaluator, hitl-architect.
+- **3 new swarm templates** — DecisionSwarm (HITL decision quality), TeamDesignSwarm (HITL team topology), AgentMetaSwarm (autonomous self-improvement).
+- **130 core skills milestone** — Category expansion into decision science, team engineering, product patterns, and agent meta-intelligence.
+- **Minor version bump (10.1.0)** — Represents category expansion beyond pure engineering into strategy and meta-intelligence.
+- **Swarm templates v13.0.0** — Bump from v12.0.0 with 3 new templates (total: 41 swarm templates).
+
+---
+

package/changelogs/v10.1.1.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## [10.1.1] - 2026-05-26 — "Scale & Edge"
+
+### Added (v10.1.1)
+
+- **10 new core skills** — edge-computing, serverless-patterns, container-security, zero-trust-architecture, ai-agent-deployment, distributed-consensus, data-pipeline-design, dns-architecture, cdn-optimization, database-sharding-advanced.
+- **6 new commands** — `/mindforge:edge`, `/mindforge:serverless`, `/mindforge:zero-trust`, `/mindforge:agent-deploy`, `/mindforge:data-pipeline`, `/mindforge:cdn`.
+- **6 new personas** — edge-engineer, zero-trust-engineer, agent-ops-engineer, consensus-engineer, data-pipeline-architect, cdn-architect.
+- **2 new swarm templates** — EdgeScaleSwarm (HITL edge + CDN), DistributedSwarm (HITL consensus + pipelines).
+- **140 core skills milestone** — Comprehensive coverage of emerging technology and massive-scale patterns.
+- **Swarm templates v14.0.0** — Bump from v13.0.0 with 2 new templates (total: 43 swarm templates).
+
+---
+

package/changelogs/v10.2.0.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## [10.2.0] - 2026-05-27 — "Industry Forge"
+
+### Added (v10.2.0)
+
+- **10 new core skills** — healthcare-systems, fintech-patterns, ecommerce-architecture, gaming-backend, edtech-platform, saas-multi-tenant, media-streaming, iot-platform, marketplace-trust, logistics-optimization.
+- **8 new commands** — `/mindforge:healthcare`, `/mindforge:fintech`, `/mindforge:ecommerce`, `/mindforge:gaming`, `/mindforge:edtech`, `/mindforge:iot`, `/mindforge:marketplace`, `/mindforge:logistics`.
+- **8 new personas** — healthcare-engineer, fintech-architect, ecommerce-engineer, gaming-engineer, edtech-architect, iot-architect, marketplace-engineer, logistics-architect.
+- **1 new swarm template** — IndustryVerticalSwarm (HITL domain-specific architecture).
+- **150 core skills milestone** — Industry vertical coverage added.
+
+---
+

package/changelogs/v10.3.0.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## [10.3.0] - 2026-05-27 — "Leader's Edge"
+
+### Added (v10.3.0)
+
+- **10 new core skills** — technical-leadership, mentoring-patterns, stakeholder-communication, conflict-resolution, incident-communication, hiring-engineering, delegation-patterns, meeting-architecture, performance-reviews, change-management.
+- **6 new commands** — `/mindforge:lead`, `/mindforge:communicate`, `/mindforge:hire`, `/mindforge:delegate`, `/mindforge:meeting-design`, `/mindforge:change`.
+- **6 new personas** — tech-lead-coach, communication-architect, hiring-strategist, change-agent, meeting-designer, mentorship-lead.
+- **1 new swarm template** — LeadershipSwarm (HITL engineering leadership).
+
+---
+

package/changelogs/v10.4.0.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## [10.4.0] - 2026-05-27 — "Cross-Platform"
+
+### Added (v10.4.0)
+
+- **10 new core skills** — react-native-patterns, flutter-architecture, offline-first-design, progressive-web-app, mobile-performance, cross-platform-testing, app-store-deployment, mobile-security, responsive-native, push-notification-architecture.
+- **6 new commands** — `/mindforge:mobile`, `/mindforge:react-native`, `/mindforge:flutter`, `/mindforge:offline`, `/mindforge:pwa`, `/mindforge:push-notify`.
+- **6 new personas** — mobile-architect, react-native-engineer, flutter-engineer, offline-specialist, mobile-security-engineer, pwa-architect.
+- **1 new swarm template** — MobileSwarm (HITL cross-platform architecture).
+
+---
+

package/changelogs/v10.5.0.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## [10.5.0] - 2026-05-27 — "AI Frontier"
+
+### Added (v10.5.0)
+
+- **10 new core skills** — multimodal-ai, ai-safety-alignment, synthetic-data-generation, model-evaluation, embedding-systems, llm-orchestration, knowledge-graphs, ml-feature-store, ai-cost-management, autonomous-agents.
+- **8 new commands** — `/mindforge:multimodal`, `/mindforge:ai-safety`, `/mindforge:embeddings`, `/mindforge:llm-route`, `/mindforge:knowledge-graph`, `/mindforge:feature-store`, `/mindforge:ai-cost`, `/mindforge:agent-design`.
+- **8 new personas** — multimodal-engineer, ai-safety-engineer, embedding-architect, llm-orchestrator, knowledge-engineer, feature-store-engineer, ai-economist, agent-architect.
+- **1 new swarm template** — AIFrontierSwarm (HITL AI system architecture + safety).
+
+---
+

package/changelogs/v10.6.0.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## [10.6.0] - 2026-05-27 — "Data Alchemy"
+
+### Added (v10.6.0)
+
+- **10 new core skills** — causal-inference, feature-engineering, ml-monitoring, data-governance, stream-processing, data-lakehouse, experiment-platform, data-mesh, real-time-analytics, data-privacy-engineering.
+- **6 new commands** — `/mindforge:causal`, `/mindforge:lakehouse`, `/mindforge:data-mesh`, `/mindforge:stream`, `/mindforge:privacy-eng`, `/mindforge:realtime-analytics`.
+- **6 new personas** — causal-scientist, data-mesh-architect, stream-engineer, lakehouse-architect, privacy-engineer, analytics-engineer.
+- **1 new swarm template** — DataAlchemySwarm (HITL data architecture + privacy).
+
+---
+

package/changelogs/v10.7.0.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## [10.7.0] - 2026-05-27 — "Platform Sovereign"
+
+### Added (v10.7.0)
+
+- **10 new core skills** — internal-developer-platform, self-serve-infrastructure, platform-reliability, developer-productivity-metrics, api-marketplace, build-system-optimization, secrets-platform, environment-management, platform-observability, migration-platform.
+- **6 new commands** — `/mindforge:platform`, `/mindforge:build-opt`, `/mindforge:secrets-mgmt`, `/mindforge:environments`, `/mindforge:observability-platform`, `/mindforge:migration-mgmt`.
+- **6 new personas** — platform-lead, build-engineer, environment-engineer, productivity-analyst, secrets-engineer, migration-architect.
+- **1 new swarm template** — PlatformSwarmV2 (HITL platform engineering + migration).
+- **200 core skills milestone** — Full coverage across 12 domains.
+- **Swarm templates v15.0.0** — 49 total templates.
+
+---
+

package/changelogs/v11.0.0.md

@@ -0,0 +1,66 @@
+# Changelog
+
+## [11.0.0] - 2026-05-28 — "Sovereign Stability"
+
+### Breaking Changes
+
+- `verifyZKProof()` returns structured `{ verified, reason }` instead of throwing
+- `signPQ()` returns `{ signature, simulated, algorithm }` object instead of raw string
+- Wave task execution order within waves is no longer deterministic
+- SDK bumped to 11.0.0 with new type exports
+- Dashboard tokens now expire after 24 hours
+- `TemporalHub.captureState()` and `rollbackTo()` are now async
+
+### Added
+
+- LRUMap utility class for bounded caches with eviction callbacks
+- Atomic JSON write primitives (write-to-temp, fsync, rename)
+- AUDIT.jsonl log rotation with gzip archival (max 5000 lines)
+- HANDOFF.json structural validation (fail-open)
+- Temporal snapshot garbage collection (retain 50, expire > 7 days)
+- BM25 scoring with document-length normalization
+- Persistent index cache (mtime-based invalidation)
+- Persistent adjacency index for knowledge graph
+- Correction effectiveness tracking in self-corrective synthesizer
+- Full remediation strategy implementations (CONTEXT_COMPRESSION, GOLDEN_TRACE_INJECTION, REASONING_RESTART)
+- Graduated intelligence interlock (+1/+2/MAX tier) with cost-awareness
+- 3-tier stuck detection (hash → length → truncated Levenshtein)
+- Adaptive context window (10/20/30 based on velocity)
+- Configurable external ZK verifier module path
+- Ephemeral SRE enclave keys (crypto.randomBytes)
+- Time-limited RBAC role elevation with auto-expiry
+- Session-scoped ZTAI agent registry
+- Dashboard rate limiting (100 req/min/IP) and token expiration (24h)
+- /api/v1/token/refresh endpoint
+- Optional GPG approval verification
+- GET /api/v1/system observability endpoint (heap, uptime, audit stats)
+- checkHeapHealth() with warning/critical thresholds
+- Remediation effectiveness persistence
+- Model router dynamic reload (mtime-based, 60s interval)
+- P95 latency ring buffer for cloud broker
+- EIS client with real fetch + 3-retry exponential backoff
+- Semaphore-based parallel wave execution (max concurrency configurable)
+- WebSocketEventStream with auto-reconnect
+- SDK streamExecution() with AsyncIterable<StreamChunk>
+- SDK batchExecute() with concurrent task execution
+- SDK validateRuntimeConfig()
+- Model streaming support (Anthropic, OpenAI, Gemini providers)
+- Migration script (bin/migrations/10.7.0-to-11.0.0.js)
+
+### Changed
+
+- sessionDriftHistory bounded to 500 entries via LRUMap
+- entropyCache bounded to 1000 entries via LRUMap
+- Cloud broker failure tracking uses 5-minute sliding window
+- Self-corrective synthesizer window expanded from 10 → 50 events
+- Context refactorer uses adaptive window instead of fixed 20
+
+### Fixed
+
+- Memory leaks from unbounded Maps in long-running sessions
+- Data corruption risk on process crash during state file writes
+- Disk exhaustion from unbounded AUDIT.jsonl and snapshot growth
+- Hardcoded SRE enclave private key (security issue)
+
+---
+

package/changelogs/v11.0.1.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## [11.0.1] - 2026-05-30 — "Stability Patch"
+
+### Fixed
+
+- **Version drift**: reconciled `.mindforge/config.json` (was 10.7.0) with the 11.x line; added a fail-closed pre-flight version-consistency assertion (`bin/utils/version-check.js`) and a regression test that runs the migration and asserts its post-state, so the drift cannot silently return. (UC-01)
+- **Lint & dead code**: resolved all 109 ESLint errors, removed orphaned `bin/dashboard/team-tracker.js`, and made CI fail on any lint error. Fixed a latent `no-const-assign` runtime crash in `bin/review/ads-engine.js`. (UC-02)
+- **SDK `executeCommand` no-op**: replaced the published no-op stub (which made `batchExecute` report every task "fulfilled" while executing nothing) with a real `child_process.spawn` executor with stdout/stderr capture, timeout (SIGTERM→SIGKILL), and exit-code propagation; added a regression test against the compiled dist. (UC-07a)
+

package/changelogs/v11.1.0.md

@@ -0,0 +1,56 @@
+# Changelog
+
+## [11.1.0] - 2026-05-31 — "Beast Mode"
+
+### Added
+
+- **Pillar I — Integrity & Trust**
+  - `bin/utils/append-queue.js`: single-writer fsync'd append queue for concurrent-safe durable writes (UC-09)
+  - `bin/governance/audit-hash.js`: single canonical SHA-256 hasher shared by writer + verifier (UC-04)
+  - `bin/governance/audit-verifier.js` + `bin/verify-audit.js` CLI: fail-closed hash-chain verifier (`exit 1` on any break) (UC-04)
+  - All 7 audit-write paths unified through `appendAuditEntrySync` — the audit log is now genuinely tamper-evident with a verifiable prev-hash chain (UC-04b)
+  - Simulated PQC demoted: `pqas_enabled=false` by default, gated behind `experimental.pqc_demo`; Tier-3 uses real Ed25519 (UC-24)
+
+- **Pillar II — Orchestration Correctness**
+  - `bin/autonomous/dependency-dag.js`: real Kahn topological sort + cycle detection, ported from test-only to the engine (UC-03)
+  - `planWaves(handoffs, {useDag:true})` opt-in DAG wave planning — explicit `.wave` always wins, legacy default unchanged (UC-03)
+  - Pre-flight cycle detection halts loud before any wave executes (UC-03)
+  - Wave-boundary timeout enforcement: `isTimedOut` + status `'timeout'` + resumable state (UC-14)
+  - Opt-in rollback hook records intent on terminal ESCALATE (no auto git-reset by default) (UC-14)
+  - `bin/engine/council-runtime.js`: minimal 4-voice council runtime (ADS loop) with injectable model, consensus scoring, dissent capture (UC-10)
+
+- **Pillar III — Cost-Aware Routing**
+  - `bin/models/pricing-registry.js`: single source of truth for model pricing, loaded from `config.json` market_registry (UC-05)
+  - All 3 providers routed through the registry — hardcoded pricing eliminated (UC-05)
+  - Prompt-cache accounting: `cache_control:{type:'ephemeral'}` on system blocks, `cache_read`/`cache_creation` parsed + priced at ~10% input rate (UC-21)
+  - `bin/models/difficulty-scorer.js`: heuristic 1-10 scorer with Tier-3 floor (UC-06)
+  - Shadow-mode difficulty routing: logs intended model without changing actual selection (UC-06)
+
+- **Pillar IV — Native Alignment + Observability**
+  - `.claude/settings.json` with hooks under real native events (`PostToolUse`/`PreToolUse`/`SessionStart`) — the security guard and context monitor now actually fire (UC-19a)
+  - `bin/hooks/instinct-capture-hook.js`: auto-captures behavioral patterns via PostToolUse, respects session limit (UC-11)
+  - `bin/engine/otel-exporter.js`: optional OTel GenAI exporter mapping NexusTracer spans to `gen_ai.*` semantic conventions, gated behind `OTEL_EXPORTER_OTLP_ENDPOINT` (UC-18)
+  - `bin/memory/retrieval-fusion.js`: Reciprocal Rank Fusion (RRF) over knowledge-graph + BM25 retrieval paths, replacing incomparable linear blends (UC-20)
+
+### Fixed
+
+- Audit-writer `close()` data-loss bug: threshold-triggered flushes were un-awaited, losing up to 10 entries on close (UC-09)
+- Audit-writer flush failure no longer crashes the process via unhandled rejection — logs to stderr (UC-09)
+- Vector-hub exit guard: `_dirty` boolean → pending-saves counter, closing a window where scheduled-but-unwritten saves were lost on hard exit (UC-09)
+- `isTimedOut` fails CLOSED on malformed `timeout_at` (garbage deadline = halt, not run unbounded) (UC-14)
+- Council position validation rejects NaN confidence / invalid recommendations (UC-10)
+- Dissent is now captured under NO_CONSENSUS verdict (the deadlock case where it matters most) (UC-10)
+- Pre-flight DAG check only cycle-checks stable-id tasks (id-less tasks can't be dependency targets) (UC-03)
+- `groupIntoWaves` self-defends: dangling dep throws "Unknown dependency" (not misleading "Circular") (UC-03)
+
+### Changed
+
+- Audit rotation retired (it broke the hash chain at every 5000-line boundary); AUDIT.jsonl grows unbounded for now — chain-aware compaction is a deferred future feature (UC-04b)
+- `knowledge-store.js` appends now use `appendDurableSync` (openSync+writeSync+fsyncSync+closeSync) for guaranteed durability (UC-09)
+- `auto-shadow.js` `generateShadowContext()` now fuses retrieval paths via RRF instead of a single-path linear blend (UC-20)
+
+### Removed
+
+- Orphaned `createAuditWriter` buffered path (zero production callers after UC-04b unification)
+- Hardcoded per-token pricing from `anthropic-provider.js`, `openai-provider.js`, `gemini-provider.js` (replaced by PricingRegistry)
+

package/changelogs/v11.2.0.md

@@ -0,0 +1,41 @@
+# Changelog
+
+## [11.2.0] - 2026-05-31 — "Verification & Trust"
+
+### Added
+
+- **UC-08 — Unified Verification Runner**
+  - `bin/engine/verification-runner.js`: orchestrates test/lint/audit/typecheck stages into structured results with pass/fail/skip per stage
+  - `bin/engine/verify-cli.js`: CLI entrypoint writing `.planning/VERIFICATION.md` reports
+  - `mindforge verify` command registered in CLI
+
+- **UC-25 — Eval Harness**
+  - `bin/eval/eval-harness.js`: recall@k, nDCG (graded relevance), and `runEval()` orchestrator for measuring retrieval quality
+  - `bin/eval/golden-set-retrieval.json`: 10-query seed golden set covering orchestration, security, memory, cost, verification, hooks, and architecture domains
+
+- **UC-22 — Tool/MCP Trust Boundaries**
+  - `bin/security/trust-boundaries.js`: manifest pinning (deterministic SHA-256 with recursive key sort), tamper detection, untrusted output tagging with provenance, and high-impact command detection
+  - `bin/security/trust-gate-hook.js`: PreToolUse hook that blocks destructive Bash commands (rm -rf, force-push, DROP TABLE, hard reset) via native Claude Code hooks
+  - Trust-gate registered in `.claude/settings.json` PreToolUse
+
+- **Council CLI**
+  - `bin/council-cli.js`: thin wrapper wiring `runCouncil` to the `/mindforge:council` command with structured JSON output and formatted display
+
+### Fixed
+
+- `auto-runner.js`: removed erroneous `new` on singleton ZTAIManager instance (was line 692)
+
+### Removed
+
+- Dead `quantum-verify` CLI command entry (no handler existed)
+- Dead `AuditRotator` class and its export from `bin/utils/file-io.js` (zero callers; rotation broke the hash chain at rotation boundaries — see `bin/autonomous/audit-writer.js`)
+
+### Changed
+
+- Config `pqas_signing` provider clarified as "Dilithium-5 (simulated — inactive)"
+- Banner version strings updated to v11.1.0 in self-corrective-synthesizer and remediation-engine
+- SDK README heading updated to "New in v11.1.0"
+- Version bumped to 11.2.0 across package.json and config.json
+
+---
+

package/changelogs/v11.2.1.md

@@ -0,0 +1,38 @@
+# Changelog
+
+## [11.2.1] - 2026-05-31 — "Hardening" (security & integrity audit remediation)
+
+Post-v11.2.0 audit remediation. Closes every exploitable security defect and
+false-assurance stub surfaced by the end-to-end audit. No new features, no
+breaking changes — fixes and honest-labeling only.
+
+### Security (fixed)
+
+- **trust-gate-hook**: scans the whole command + every line (a benign first line could previously cloak a destructive later line)
+- **orbital-guardian**: `verify()` re-checks the Ed25519 attestation signature (added `did`/`signed_message` columns + migration); rejects forged APPROVED rows
+- **policy-engine**: `reasoning_proof` alone no longer bypasses the blast-radius limit (`isProofValid` inits false; cryptographic `pq_proof` path unchanged)
+- **shadow-mirror**: git calls use `execFileSync` (argv) + fail-closed `sanitizeRemediationId()` — closes command injection via `remediation_id`
+- **trust-boundaries `isHighImpact`**: added chmod/chown/dd/mv/kill/shutdown/eval/command-substitution/redirect detection + shell-obfuscation normalization; narrowed interpreter-script pattern to stop false-positives on `node <projectfile>`
+- **eis-client**: `verifyRemoteProvenance` delegates to real ZTAI signature verification, fail-closed (was returning true for any non-empty signature)
+
+### Integrity / honest labeling (fixed)
+
+- **ztai-archiver**: `verifyIntegrity()` recomputes the Merkle root from the live log (was a no-op `return true`); fail-closed on tamper/delete/reorder
+- **mesh-self-healer**: emits an honest degraded advisory instead of fabricated 94%/100% consensus
+- **logic-validator**: probes Ollama when reachable, honest heuristic fallback; stopped advertising the dead model path
+- **reason-source-aligner**: consistent return shape (uninitialized no longer silently disables the mission-fidelity gate); real Jaccard similarity
+- **sre-manager**: HMAC artifact relabeled as integrity tag, not "ZK-Proof"
+- **installer-core**: PQAS-enabled message gated on the real `experimental.pqc_demo` flag
+- **finding-synthesizer**: detects real severity-gap contradictions (was hardcoded `[]`)
+- **logic-drift-detector**: relabeled heuristic, not "Neural"
+- **session-manager / shadow-mirror(docker) / regression-writer / skill-registry**: honest disclosure instead of silent empties / fake isolation / tautological tests / mock placeholders
+- **MINDFORGE.md**: `[PQAS_ENFORCED]` reconciled to reflect simulated/inactive default; **ztai-manager** logs relabeled `[ZTAI-HSM-SIM]`
+
+### CI / hygiene
+
+- **release workflow**: asserts the git tag matches `package.json` version (fail-closed) + skips publish if the version is already on npm
+- **version-check**: runtime drift check widened to all 4 sources (was 2); SDK README guarded by test
+- removed dead `AuditRotator` class (CHANGELOG had wrongly claimed it removed); deprecated orphaned `createAppendQueue`
+- refreshed stale `v11.1.0` banners → current; added `cost_routing.shadow_mode` latch
+- version bumped to 11.2.1 across all sources
+