mindforge-cc 11.9.1 → 11.9.3

package/bin/migrations/0.6.0-to-1.0.0.js

@@ -3,18 +3,19 @@
  *
  * Changes:
  * 1. HANDOFF.json: add `plugin_api_version` field
- * 2. AUDIT.jsonl: backfill `session_id` for entries missing it
+ * 2. AUDIT.jsonl: append a migration record — existing entries are NEVER rewritten (see step 2)
  * 3. MINDFORGE.md: convert VERIFY_PASS_RATE_WARNING_THRESHOLD if in old 0-100 format
  * 4. STATE.md: add v1.0.0 compatibility note if it doesn't already have one
  */
 'use strict';
 
 const fs = require('fs');
+const { appendAuditEntrySync } = require('../autonomous/audit-writer');
 
 module.exports = {
   fromVersion: '0.6.0',
   toVersion:   '1.0.0',
-  description: 'Add plugin_api_version; backfill session_id; normalise MINDFORGE.md thresholds',
+  description: 'Add plugin_api_version; record the migration in the audit log; normalise MINDFORGE.md thresholds',
 
   async run(paths) {
     // ── 1. HANDOFF.json ───────────────────────────────────────────────────────
@@ -36,31 +37,35 @@ module.exports = {
     }
 
     // ── 2. AUDIT.jsonl ────────────────────────────────────────────────────────
+    //
+    // APPEND-ONLY. This step used to rewrite every entry to backfill `session_id`, which BROKE the
+    // hash chain and then reported success. Measured on a 50-entry chain written by the real writer:
+    //
+    //     before  ->  audit chain valid: 50 entries          exit 0
+    //     after   ->  audit chain BROKEN at entry 0: hash mismatch (entry mutated)   exit 1
+    //
+    // 50 of 50 entries mutated, integrity destroyed at the very first entry, and the migration printed
+    // "backfilled session_id in 50 of 50 entries" and carried on to report "All migrations complete".
+    // bin/governance/audit-hash.js hashes {...entry, previous_hash} with JSON.stringify, so ANY added
+    // key changes the material — a back-linked log cannot be edited in place, only appended to. No file
+    // in this directory referenced the canonical hasher.
+    //
+    // AND THE BACKFILL BOUGHT NOTHING. The only consumer of `session_id` on an audit entry is
+    // bin/dashboard/metrics-aggregator.js:253,286, which reads
+    // `entry.authored_by || entry.session_id || 'unknown'`. So the rewrite swapped the placeholder
+    // 'unknown' for the placeholder 'migrated-from-pre-1.0' — no consumer distinguishes them — at the
+    // cost of every integrity guarantee in the file. Deleting it loses nothing.
+    //
+    // What IS worth recording is that a migration touched this project, so one entry is APPENDED
+    // through the canonical writer. An append extends the chain instead of invalidating it.
     if (fs.existsSync(paths.audit)) {
-      const raw   = fs.readFileSync(paths.audit, 'utf8');
-      const lines = raw.split('\n').filter(Boolean);
-      let modified = 0;
-
-      const updated = lines.map(line => {
-        try {
-          const entry = JSON.parse(line);
-          if (!entry.session_id) {
-            entry.session_id = 'migrated-from-pre-1.0';
-            modified++;
-            return JSON.stringify(entry);
-          }
-          return line;
-        } catch {
-          return line;  // Preserve unparseable lines exactly as-is (quarantine pattern)
-        }
+      appendAuditEntrySync(paths.audit, {
+        event:       'schema_migrated',
+        target_id:   'AUDIT.jsonl',
+        description: 'schema 0.6.0 -> 1.0.0; existing entries left byte-identical (append-only log)',
+        agent:       'migrate',
       });
-
-      if (modified > 0) {
-        fs.writeFileSync(paths.audit, updated.join('\n') + '\n');
-        console.log(`    • AUDIT.jsonl: backfilled session_id in ${modified} of ${lines.length} entries`);
-      } else {
-        console.log('    • AUDIT.jsonl: all entries already have session_id');
-      }
+      console.log('    • AUDIT.jsonl: recorded the migration as a new entry; existing entries untouched');
     }
 
     // ── 3. MINDFORGE.md ───────────────────────────────────────────────────────

package/bin/migrations/1.0.0-to-2.0.0.js

@@ -11,11 +11,12 @@
 
 const fs = require('fs');
 const path = require('path');
+const { appendAuditEntrySync } = require('../autonomous/audit-writer');
 
 module.exports = {
   fromVersion: '1.0.0',
   toVersion:   '2.0.0',
-  description: 'Additive schema upgrade: backfill runtime/agent_id in audit; model_group in tokens',
+  description: 'Additive schema upgrade: record the migration in the audit log; model_group in tokens',
 
   async run(paths) {
     const backupDir = path.join(path.dirname(paths.handoff), '.backups', `v1-to-v2-${Date.now()}`);
@@ -65,29 +66,27 @@ module.exports = {
     });
 
     // ── 2. AUDIT.jsonl ────────────────────────────────────────────────────────
-    safeMigrate(paths.audit, (raw) => {
-      const lines = raw.split('\n').filter(Boolean);
-      let modified = 0;
-      
-      const updated = lines.map(line => {
-        try {
-          const entry = JSON.parse(line);
-          let changed = false;
-          if (!entry.runtime) { entry.runtime = 'unknown'; changed = true; }
-          if (!entry.agent_id) { entry.agent_id = 'migrated-v1'; changed = true; }
-          
-          if (changed) {
-            modified++;
-            return JSON.stringify(entry);
-          }
-          return line;
-        } catch {
-          return line;
-        }
+    //
+    // APPEND-ONLY, for the same reason as 0.6.0-to-1.0.0.js step 2: this rewrote every entry to add
+    // `runtime` and `agent_id`, and bin/governance/audit-hash.js hashes {...entry, previous_hash}, so
+    // any added key changes the hash material and the chain breaks at the first entry while the
+    // migration reports success.
+    //
+    // Worse than its sibling, because here the backfill had NO consumer at all: `git grep agent_id`
+    // and `git grep model_group` outside bin/migrations/ return zero readers in bin/. The chain was
+    // being destroyed to populate fields nothing reads.
+    //
+    // Note safeMigrate() cannot express this — it takes raw content and returns replacement content,
+    // which is a rewrite by construction. An append goes through the canonical writer instead.
+    if (fs.existsSync(paths.audit)) {
+      appendAuditEntrySync(paths.audit, {
+        event:       'schema_migrated',
+        target_id:   'AUDIT.jsonl',
+        description: 'schema 1.0.0 -> 2.0.0; existing entries left byte-identical (append-only log)',
+        agent:       'migrate',
       });
-      
-      return modified > 0 ? updated.join('\n') + '\n' : raw;
-    });
+      console.log('    • AUDIT.jsonl: recorded the migration as a new entry; existing entries untouched');
+    }
 
     // ── 3. token-usage.jsonl ──────────────────────────────────────────────────
     const tokensFile = path.join(path.dirname(paths.handoff), 'token-usage.jsonl');

package/bin/mindforge-cli.js

@@ -25,8 +25,10 @@ const ROOT = path.resolve(__dirname, '..');
 const COMMANDS = {
   'security-scan': {
     script: 'bin/validate-config.js',
-    description: 'Validate configuration and run security checks',
-    defaultArgs: ['MINDFORGE.md']
+    description: 'Validate configuration and run security checks'
+    // No defaultArgs: validate-config.js already defaults to MINDFORGE.md
+    // (bin/validate-config.js:13). Declaring it here would prepend a positional
+    // that shadows a user-supplied config path.
   },
   'health': {
     script: 'bin/installer-core.js',
@@ -57,20 +59,31 @@ const COMMANDS = {
     script: 'bin/skill-validator.js',
     description: 'Run Level 1 & 2 validation on a SKILL.md file'
   },
+  // NOTE: install-skill / register-skill / audit-skill deliberately carry NO
+  // defaultArgs. Supplying their subcommand token here reaches skill-registry's
+  // write paths, which perform no existence or validation checks:
+  //   - audit-skill <name> <ver> <tier> appended a hash-chained
+  //     {event:'skill_installed', validation_passed:true} entry for a skill that
+  //     does not exist, and exited 0. For a product whose central claim is a
+  //     tamper-evident audit chain, a CLI that mints authentic-looking false
+  //     entries on request is worse than one that refuses.
+  //   - register-skill <name> <ver> 1 wrote a malformed 5-column row above the
+  //     table header of .mindforge/org/skills/MANIFEST.md, which ships in the
+  //     tarball, and exited 0.
+  // Without defaultArgs these refuse with "Invalid or missing action" (exit 1),
+  // which is the pre-11.9.2 behaviour. Re-enable only once skill-registry gates
+  // on skill existence and fixes its table-separator match.
   'install-skill': {
     script: 'bin/skill-registry.js',
-    description: 'Install a skill to the correct tier folder (Tier 1/2/3)',
-    defaultArgs: ['install']
+    description: 'Install a skill to the correct tier folder (pass the "install" action explicitly)'
   },
   'register-skill': {
     script: 'bin/skill-registry.js',
-    description: 'Register a skill in MANIFEST.md',
-    defaultArgs: ['register']
+    description: 'Register a skill in MANIFEST.md (pass the "register" action explicitly)'
   },
   'audit-skill': {
     script: 'bin/skill-registry.js',
-    description: 'Record skill life cycle events in audit log',
-    defaultArgs: ['audit']
+    description: 'Record skill life cycle events in audit log (pass the "audit" action explicitly)'
   },
   'remember': {
     script: 'bin/memory/cli.js',
@@ -98,6 +111,15 @@ const COMMANDS = {
     description: 'Invoke a specialized identity from /agents/',
     defaultArgs: ['identity']
   },
+  // spawn-agent.js reads MODE from ARGS[0] and supports spawn|identity|subagent.
+  // 'subagent' had no router entry, so it was reached as `mindforge spawn subagent
+  // <name>` — which prepending 'spawn' now shadows (MODE='spawn', TARGET='subagent').
+  // Promoting it to a first-class command keeps the only implemented mode reachable.
+  'subagent': {
+    script: 'bin/spawn-agent.js',
+    description: 'Invoke a subagent definition from /subagents/',
+    defaultArgs: ['subagent']
+  },
   'temporal': {
     script: 'bin/engine/temporal-cli.js',
     description: 'Manage time-travel debugging and state history'
@@ -129,10 +151,14 @@ const COMMANDS = {
     script: 'bin/engine/learning-manager.js',
     description: 'Consult or initialize the project agentic learning memory'
   },
+  // No defaultArgs: 'record' reaches a writer that resolves its target relative to
+  // the spawn cwd, which is still ROOT (deferred to v12). In a consumer install that
+  // writes inside node_modules/mindforge-cc/ and is destroyed by the next npm ci.
+  // Activating a writer while its path resolution is known-wrong is worse than
+  // leaving it inert; re-enable together with the cwd fix.
   'record-learning': {
     script: 'bin/engine/learning-manager.js',
-    description: 'Append a new Learning Entry to the Evolution Log',
-    defaultArgs: ['record']
+    description: 'Append a new Learning Entry to the Evolution Log (pass the "record" action explicitly)'
   },
   'verify': {
     script: 'bin/engine/verify-cli.js',
@@ -141,6 +167,17 @@ const COMMANDS = {
 };
 
 // ── Workflow subcommand (non-script, handled inline) ─────────────────────────
+//
+// Routable but NOT a COMMANDS key, because it dispatches to a module rather than spawning a script.
+// That made the CLI lie about itself: `workflow` is the most-documented verb in the project (126
+// references across the docs) and it works, yet it appeared in neither `--help` nor the
+// "Available commands" list, so a user who mistyped it was told it does not exist. Declared here, next
+// to the handler that makes it real, and consumed by both self-report sites below — one source, so the
+// two cannot drift.
+const INLINE_COMMANDS = ['workflow'];
+/** Every verb the router will actually dispatch: table-driven plus inline. */
+const ROUTABLE = [...Object.keys(COMMANDS), ...INLINE_COMMANDS].sort();
+
 if (COMMAND === 'workflow') {
   const workflowRunner = require('./workflows/workflow-runner');
   workflowRunner.run(COMMAND_ARGS[0], COMMAND_ARGS.slice(1));
@@ -148,8 +185,18 @@ if (COMMAND === 'workflow') {
 }
 
 if (ARGS.includes('--version') || ARGS.includes('-V')) {
-  console.log(require('../package.json').version);
-  process.exit(0);
+  // Resolve by package NAME. In an install this file lands at <project>/bin/mindforge-cli.js, so
+  // '../package.json' is the CONSUMER's manifest and `--version` confidently printed THEIR app's
+  // version as MindForge's — measured: 1.0.0 for a host app at 1.0.0, while MindForge was 11.9.2.
+  // Exit non-zero on an unresolvable version rather than guessing: the whole point of this command
+  // is to be trusted, and a plausible wrong answer is worse than an honest failure.
+  try {
+    console.log(require('./utils/mindforge-version').resolveMindforgeVersion().version);
+    process.exit(0);
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
 }
 
 if (!COMMAND || ARGS.includes('--help') || ARGS.includes('-h')) {
@@ -161,8 +208,10 @@ const target = COMMANDS[COMMAND];
 if (!target) {
   console.error(`Unknown command: ${COMMAND}`);
 
-  // Suggest similar commands using Levenshtein distance
-  const suggestions = Object.keys(COMMANDS)
+  // Suggest similar commands using Levenshtein distance. ROUTABLE, not Object.keys(COMMANDS): a
+  // near-miss on `workflow` (`worklow`, `wokflow`) previously produced no suggestion at all, because
+  // the only verb it resembles was absent from the pool.
+  const suggestions = ROUTABLE
     .map(cmd => ({ cmd, dist: levenshtein(COMMAND, cmd) }))
     .filter(s => s.dist <= 3)
     .sort((a, b) => a.dist - b.dist)
@@ -171,18 +220,58 @@ if (!target) {
   if (suggestions.length > 0) {
     console.error(`\nDid you mean: ${suggestions.map(s => s.cmd).join(', ')}?`);
   } else {
-    console.error('Available commands: ' + Object.keys(COMMANDS).join(', '));
+    console.error('Available commands: ' + ROUTABLE.join(', '));
   }
   process.exit(1);
 }
 
 const scriptPath = path.join(ROOT, target.script);
-const finalArgs = COMMAND_ARGS.length > 0 ? COMMAND_ARGS : (target.defaultArgs || []);
+
+// defaultArgs are PREPENDED, never replaced. They carry the subcommand token or
+// mode flag the child script requires (e.g. 'inject' for hindsight, '--check' for
+// health), so dropping them when the user supplies an argument silently changes
+// which code path runs — `health --force` used to lose '--check' and fall through
+// to installer-core's install() path.
+const finalArgs = [...(target.defaultArgs || []), ...COMMAND_ARGS];
 
 console.log(`🚀 Executing: ${COMMAND} (${target.description})`);
 
+// The child runs in the USER'S project, not in MindForge's install directory.
+//
+// This was `cwd: ROOT`, which made every routed command operate on the framework's own tree
+// instead of the caller's. The worst case was `security-scan`, the command the protocol mandates
+// pre-commit for any Auth/Payment/PII change: measured against a fixture project whose
+// MINDFORGE.md declared 4 settings including `[MIN_SOUL_SCORE] = 99` (schema maximum is 10) and
+// `[COST_HARD_LIMIT_USD] = not-a-number`, it printed
+//
+//     ✅ MINDFORGE.md valid — 43 settings configured
+//
+// and exited 0. 43 is MindForge's OWN setting count. Two different fixture configs produced
+// byte-identical output, which is the proof it read neither: a security gate that cannot fail,
+// because it never sees the input it claims to check.
+//
+// MEASURED BLAST RADIUS before changing it — all 27 routed commands run under both values against
+// the same fixture. 7 differ, every one of them moving from the vendor's tree to the caller's, and
+// NONE regressed from success to failure:
+//
+//   security-scan                validated MindForge's config      -> reads the caller's
+//   classify                     TIER=2 from MindForge's git diff  -> diffs the caller's repo
+//   pr-review, cross-review      loaded MindForge's ConfigManager  -> looks in the caller's project
+//   learning, record-learning    reported MindForge's state        -> reports the caller's
+//   test-memory                  same ConfigManager shift
+//
+// `classify` deserves its own note: for every consumer it was classifying MindForge's changes.
+//
+// CI is unaffected, checked rather than assumed. control-plane.yml:80 runs `security-scan` as the
+// required ⚖️ Governance Enforcement check and mindforge-ci.yml:46 runs validate-config.js
+// directly; both execute with the repo root as cwd, so ROOT and process.cwd() are the same path
+// there and behaviour is byte-identical.
+//
+// A script that needs the FRAMEWORK's own assets must resolve them from __dirname, which is
+// independent of cwd — see the SCHEMA_PATH note in bin/validate-config.js. Anchoring vendor assets
+// to the process's working directory is what coupled these two unrelated things in the first place.
 const result = spawnSync('node', [scriptPath, ...finalArgs], {
-  cwd: ROOT,
+  cwd: process.cwd(),
   stdio: 'inherit',
   env: { ...process.env, MINDFORGE_CLI: 'true' }
 });
@@ -220,8 +309,12 @@ function printUsage() {
   for (const [name, cfg] of Object.entries(COMMANDS)) {
     console.log(`  ${name.padEnd(15)} ${cfg.description}`);
   }
+  // Listed separately because it dispatches to a module rather than spawning a script, so it has no
+  // COMMANDS entry to carry a description. Omitting it made --help contradict the router.
+  console.log(`  ${'workflow'.padEnd(15)} Run a registered dynamic workflow (see \`workflow list\`)`);
   console.log('\nExamples:');
   console.log('  node bin/mindforge-cli.js security-scan');
   console.log('  node bin/mindforge-cli.js headless --phase 1');
+  console.log('  node bin/mindforge-cli.js workflow list');
   console.log('\n');
 }

package/bin/models/cost-tracker.js

@@ -4,32 +4,34 @@
 'use strict';
 
 const fs = require('fs');
-const path = require('path');
-
-const METRICS_DIR = path.join(process.cwd(), '.mindforge', 'metrics');
-const USAGE_LOG = path.join(METRICS_DIR, 'token-usage.jsonl');
+const { ledgerPath, ledgerDir, buildRecord, entryCost, entryDay } = require('./usage-record');
 
+// Paths are resolved lazily (see usage-record.js) so the suite can exercise the
+// ledger inside a temp cwd instead of appending to the developer's real ledger.
 function ensureDir() {
-  if (!fs.existsSync(METRICS_DIR)) {
-    fs.mkdirSync(METRICS_DIR, { recursive: true });
+  const dir = ledgerDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
   }
 }
 
 let _dailyCache = { value: 0, computed_at: 0 };
 
 function getTodaySpend() {
-  if (!fs.existsSync(USAGE_LOG)) return 0;
-  
+  const usageLog = ledgerPath();
+  if (!fs.existsSync(usageLog)) return 0;
+
   const today = new Date().toISOString().slice(0, 10);
-  const content = fs.readFileSync(USAGE_LOG, 'utf8');
+  const content = fs.readFileSync(usageLog, 'utf8');
   const lines = content.trim().split('\n');
-  
+
   let total = 0;
   for (const line of lines) {
+    if (!line) continue;
     try {
       const entry = JSON.parse(line);
-      if (entry.date === today) {
-        total += entry.cost_usd || 0;
+      if (entryDay(entry) === today) {
+        total += entryCost(entry);
       }
     } catch (e) {
       process.stderr.write('[cost-tracker] Skipped malformed entry\n');
@@ -47,42 +49,137 @@ function getTodaySpendCached() {
   return _dailyCache.value;
 }
 
+// COST-02 — the $25/day cap declared at MINDFORGE.md:54 was inert from the day it
+// was written. v11.9.2 read `settings.MODEL_COST_HARD_LIMIT_USD`; the registry
+// declares `[COST_HARD_LIMIT_USD]`. The MODEL_-prefixed name appears in exactly one
+// shipped file (.mindforge/MINDFORGE-V2-SCHEMA.json:58) and that file has no code
+// reader, so the lookup was always undefined -> parseFloat('0.0') -> 0 -> the
+// `hardLimit <= 0` guard returned before any spend was compared. Canonical registry
+// key first; the MODEL_-prefixed name is still read second so anyone who copied it
+// out of the V2 schema keeps the working cap they have instead of silently losing it.
+const HARD_LIMIT_KEYS = ['COST_HARD_LIMIT_USD', 'MODEL_COST_HARD_LIMIT_USD'];
+const WARN_LIMIT_KEYS = ['COST_WARN_USD', 'MODEL_COST_WARN_USD'];
+
+/** First non-empty key from `keys`, canonical-first. Returns null when none is set. */
+function findThreshold(settings, keys) {
+  for (const key of keys) {
+    const raw = settings[key];
+    if (raw !== undefined && raw !== null && String(raw).trim() !== '') {
+      return { key, raw: String(raw) };
+    }
+  }
+  return null;
+}
+
+/**
+ * Classify a registry cost threshold. Returns a new object, never mutates input:
+ *   { state: 'unset' }                  key absent/empty        -> caller fails OPEN
+ *   { state: 'disabled', key, value:0 } explicit 0              -> caller fails OPEN
+ *   { state: 'armed', key, value }      finite positive USD     -> caller enforces
+ *   { state: 'invalid', key, raw }      unreadable or negative  -> caller fails CLOSED
+ *
+ * parseFloat after stripping a leading `$` and thousands separators — not Number() —
+ * because `= $25.00` and `= 25.00 USD` are shapes a human types into MINDFORGE.md and
+ * both plainly mean 25; Number() would call them invalid and refuse every model call.
+ * Only a value with no leading number at all is invalid. Non-finite is invalid on
+ * purpose: `Infinity` compares false against every projection, i.e. it is not a cap.
+ */
+function classifyThreshold(found) {
+  if (!found) return { state: 'unset' };
+  const value = parseFloat(found.raw.trim());
+  if (!Number.isFinite(value) || value < 0) return { state: 'invalid', key: found.key, raw: found.raw };
+  if (value === 0) return { state: 'disabled', key: found.key, value: 0 };
+  return { state: 'armed', key: found.key, value };
+}
+
+// [COST_WARN_USD] had no reader anywhere in bin/ before COST-02. At most one line per
+// UTC day per threshold, so an armed warning does not append to stderr on every call.
+// Replaced as a whole object rather than mutated in place.
+let _warnState = { day: '', threshold: 0 };
+
+/** Soft threshold. Must never throw — a warning that blocks is a second hard cap. */
+function warnIfCrossed(settings, projected, hardLimit) {
+  const warn = classifyThreshold(findThreshold(settings, WARN_LIMIT_KEYS));
+  if (warn.state !== 'armed') return;
+  // Suppress only when an ARMED hard cap sits at or below the warn value — there the
+  // throw preempts this line anyway. With no hard cap, nothing preempts it, and an
+  // upgraded install without [COST_HARD_LIMIT_USD] is the common case
+  // (installer-core.js:706 never rewrites an existing MINDFORGE.md) — precisely the
+  // install that most needs a spend warning.
+  if (hardLimit !== null && warn.value >= hardLimit) return;
+  if (projected < warn.value) return;
+
+  const today = new Date().toISOString().slice(0, 10);
+  if (_warnState.day === today && _warnState.threshold === warn.value) return;
+  _warnState = { day: today, threshold: warn.value };
+  const cap = hardLimit === null ? 'no hard cap set' : `hard cap ${hardLimit}`;
+  process.stderr.write(
+    `[cost-tracker] Projected daily spend ${projected.toFixed(4)} crossed [${warn.key}] = ${warn.value} (${cap})\n`
+  );
+}
+
 async function preflight(estimatedCost = 0) {
   const settings = require('./model-router').getAllSettings();
-  const hardLimit = parseFloat(settings.MODEL_COST_HARD_LIMIT_USD || '0.0');
-  
-  if (hardLimit <= 0) return;
+  const limit = classifyThreshold(findThreshold(settings, HARD_LIMIT_KEYS));
+
+  // Fail CLOSED on a limit that is present but unreadable: a cap nobody can parse is
+  // not a cap. Not a new surprise either — bin/validate-config.js already rejects this
+  // exact config with exit 1, because COST_HARD_LIMIT_USD is typed "number" at
+  // .mindforge/MINDFORGE-SCHEMA.json:87. The code is distinct from COST_LIMIT_REACHED
+  // so a caller can tell a spend stop from a config fault; bin/models/model-client.js
+  // re-throws both, which is the only reason this throw is not swallowed.
+  if (limit.state === 'invalid') {
+    throw Object.assign(
+      new Error(`[${limit.key}] = "${limit.raw}" is not a USD amount — the daily cost cap cannot be evaluated. Set a number in MINDFORGE.md (0 disables the cap).`),
+      { code: 'COST_LIMIT_MISCONFIGURED', key: limit.key, raw: limit.raw }
+    );
+  }
+
+  // Fail OPEN when the key is absent or explicitly 0. DELIBERATE — do not invert it.
+  // docs/research/2026-08-v12-upgrade-report.md:85 recommends making an unset limit a
+  // config error, but bin/installer-core.js:706 writes MINDFORGE.md only when it does
+  // not already exist, so every install upgraded from a registry predating this key
+  // would start refusing every model call. The shipped schema agrees the key is
+  // optional: it sits in `recommended`, not `required` (.mindforge/MINDFORGE-SCHEMA.json
+  // :13-17), and bin/validate-config.js:48-49 only warns and exits 0 when it is absent.
+  if (limit.state !== 'armed') {
+    // The soft threshold must NOT depend on the hard cap. Guarded on the warn key so
+    // the no-cost-config fast path stays a pure early return and never reads the ledger.
+    if (classifyThreshold(findThreshold(settings, WARN_LIMIT_KEYS)).state === 'armed') {
+      warnIfCrossed(settings, getTodaySpendCached() + estimatedCost, null);
+    }
+    return;
+  }
 
   const todaySpend = getTodaySpendCached();
   const projected = todaySpend + estimatedCost;
 
-  if (projected >= hardLimit) {
+  if (projected >= limit.value) {
     throw Object.assign(
-      new Error(`Daily cost limit $${hardLimit} reached (Today: $${todaySpend.toFixed(4)})`),
-      { code: 'COST_LIMIT_REACHED', spend: todaySpend, limit: hardLimit }
+      new Error(`Daily cost limit $${limit.value} reached (Today: $${todaySpend.toFixed(4)})`),
+      { code: 'COST_LIMIT_REACHED', spend: todaySpend, limit: limit.value }
     );
   }
+
+  warnIfCrossed(settings, projected, limit.value);
 }
 
 async function record(entry) {
   ensureDir();
-  const enriched = {
-    ...entry,
-    date: new Date().toISOString().slice(0, 10),
-    timestamp: new Date().toISOString()
-  };
-  fs.appendFileSync(USAGE_LOG, JSON.stringify(enriched) + '\n');
+  const enriched = buildRecord(entry);
+  fs.appendFileSync(ledgerPath(), JSON.stringify(enriched) + '\n');
   _dailyCache.computed_at = 0; // Invalidate cache
 }
 
 function getSummary(params = { days: 7 }) {
-  if (!fs.existsSync(USAGE_LOG)) return { total_usd: 0, by_model: {} };
-  
+  const usageLog = ledgerPath();
+  if (!fs.existsSync(usageLog)) return { total_usd: 0, by_model: {} };
+
   const cutoffDate = new Date();
   cutoffDate.setDate(cutoffDate.getDate() - params.days);
   const cutoffStr = cutoffDate.toISOString().slice(0, 10);
 
-  const content = fs.readFileSync(USAGE_LOG, 'utf8');
+  const content = fs.readFileSync(usageLog, 'utf8');
   const lines = content.trim().split('\n');
   
   const result = {
@@ -95,8 +192,8 @@ function getSummary(params = { days: 7 }) {
   for (const line of lines) {
     try {
       const entry = JSON.parse(line);
-      if (entry.date >= cutoffStr) {
-        const cost = entry.cost_usd || 0;
+      if (entryDay(entry) >= cutoffStr) {
+        const cost = entryCost(entry);
         result.total_usd += cost;
         result.calls++;
         

package/bin/models/model-client.js

@@ -41,10 +41,15 @@ class ModelClient {
     let modelId = routing.model;
 
     // 2. Pre-flight cost check
+    // Both COST_ codes must propagate. This catch re-threw only COST_LIMIT_REACHED,
+    // so COST-02's fail-closed config fault would have been discarded here and the
+    // call would have proceeded uncapped — an interlock reporting success while doing
+    // nothing. Anything else still falls through on purpose: an unreadable ledger is
+    // a broken meter, and a broken meter must not block work.
     try {
       await CostTracker.preflight(0.05); // Conservative estimate
     } catch (e) {
-      if (e.code === 'COST_LIMIT_REACHED') throw e;
+      if (e.code === 'COST_LIMIT_REACHED' || e.code === 'COST_LIMIT_MISCONFIGURED') throw e;
     }
 
     // 3. Execute with fallbacks

package/bin/models/model-router.js

@@ -7,11 +7,15 @@
 const fs = require('fs');
 const path = require('path');
 
+// The one bracket-aware MINDFORGE.md reader (see bin/utils/mindforge-params.js).
+const { readParams } = require('../utils/mindforge-params');
+
 // v9: Model topology aligned to Claude 4.x family (2026-04)
 const DEFAULTS = {
   PLANNER_MODEL:          'claude-opus-4-7',
   EXECUTOR_MODEL:         'claude-sonnet-4-6',
   REVIEWER_MODEL:         'claude-sonnet-4-6',
+  VERIFIER_MODEL:         'claude-sonnet-4-6',
   SECURITY_MODEL:         'claude-opus-4-7',
   RESEARCH_MODEL:         'gemini-2.5-pro',
   QA_MODEL:               'claude-sonnet-4-6',
@@ -40,14 +44,31 @@ let _settingsMtime = 0;
 const CACHE_CHECK_INTERVAL_MS = 60000;
 let _lastCacheCheck = 0;
 
+// MINDFORGE.md declares the model topology with SHORT persona keys ([PLANNER]);
+// the router's canonical setting keys are the *_MODEL names in DEFAULTS above,
+// which is what every getAllSettings() consumer reads. Map short -> canonical
+// and keep BOTH in the returned object so nothing reading *_MODEL breaks.
+const KEY_ALIASES = {
+  PLANNER:  'PLANNER_MODEL',
+  EXECUTOR: 'EXECUTOR_MODEL',
+  REVIEWER: 'REVIEWER_MODEL',
+  VERIFIER: 'VERIFIER_MODEL',
+  SECURITY: 'SECURITY_MODEL',
+  RESEARCH: 'RESEARCH_MODEL',
+  QA:       'QA_MODEL',
+  DEBUG:    'DEBUG_MODEL',
+  QUICK:    'QUICK_MODEL',
+};
+
 function parseSettings(filePath) {
-  const content = fs.readFileSync(filePath, 'utf8');
-  const settings = { ...DEFAULTS };
-  const lines = content.split('\n');
-  for (const line of lines) {
-    const match = line.match(/^([A-Z0-9_]+)=(.*)$/);
-    if (match) {
-      settings[match[1]] = match[2].trim();
+  // v11.9.2 matched /^([A-Z0-9_]+)=(.*)$/ here, which matches ZERO lines of a
+  // bracketed MINDFORGE.md — routing silently always used DEFAULTS.
+  const raw = readParams(filePath);
+  const settings = { ...DEFAULTS, ...raw };
+  // An explicit [PLANNER_MODEL] always wins over the short [PLANNER] form.
+  for (const [shortKey, canonicalKey] of Object.entries(KEY_ALIASES)) {
+    if (raw[shortKey] !== undefined && raw[canonicalKey] === undefined) {
+      settings[canonicalKey] = raw[shortKey];
     }
   }
   return settings;