mindforge-cc 11.9.1 → 11.9.3

package/bin/utils/mindforge-version.js

@@ -0,0 +1,99 @@
+'use strict';
+/**
+ * Resolve MINDFORGE's own version, from any context it might be running in.
+ *
+ * THE DEFECT THIS REPLACES. Three modules read `require('../../package.json').version`:
+ *
+ *     bin/updater/self-update.js:13         const CURRENT_VERSION = ...
+ *     bin/updater/version-comparator.js:47  User-Agent: `mindforge-cc/${...}`
+ *     bin/wizard/setup-wizard.js:9          const VERSION = ...
+ *
+ * In the repo that path IS MindForge's manifest, so it looks correct. In an INSTALL it is not: the
+ * installer copies bin/updater/ into the consumer's project, where `../../package.json` is the
+ * CONSUMER's manifest. Measured on a clean `--claude --local` into an app at 1.0.0:
+ *
+ *     ../../package.json from bin/updater/ -> <project>/package.json
+ *     its version: 1.0.0          (the consumer app)
+ *     MindForge actual: 11.9.2
+ *
+ * That is not cosmetic. self-update.js:89 classifies the upgrade with
+ * `upgradeType(CURRENT_VERSION, latestVersion)`, so 1.0.0 -> 11.9.x reads as a MAJOR upgrade, and
+ * :133 uses `readHandoffSchemaVersion() || CURRENT_VERSION` as the "from" version driving
+ * migrations. A bogus origin version steers migration behaviour.
+ *
+ * Same family as the auto-runner defect fixed in ed977e9, which passed process.cwd() to a version
+ * check that compares MindForge's own manifests: both mistake "the directory I am running in" for
+ * "the package I am part of".
+ *
+ * HOW IT RESOLVES, in order, with the discriminator that makes it work:
+ *
+ *   1. The nearest ancestor package.json whose `name` is 'mindforge-cc'. The NAME is the whole
+ *      trick — it is what distinguishes MindForge's manifest from a consumer's, which a relative
+ *      path cannot do. Covers the repo, a global npm install, and node_modules layouts.
+ *   2. <cwd>/.mindforge/config.json `.version`. In an install this is written BY the installer and
+ *      carries MindForge's version (measured: 11.9.2 in a project whose app is 1.0.0).
+ *      tests/version-consistency.test.js asserts it equals package.json in the repo, so the two
+ *      sources cannot silently disagree.
+ *   3. <cwd>/node_modules/mindforge-cc/package.json, for a consumer that has the package but no
+ *      .mindforge/ yet.
+ *
+ * It THROWS rather than guessing. A wrong version is worse than an absent one here: it produces a
+ * confident, incorrect upgrade classification instead of an error somebody can act on.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const PACKAGE_NAME = 'mindforge-cc';
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+/** Walk up from `dir` looking for a package.json that belongs to MindForge itself. */
+function findOwnManifest(dir) {
+  let current = path.resolve(dir);
+  // Bounded by the filesystem root; path.dirname('/') === '/' terminates the loop.
+  for (let depth = 0; depth < 40; depth++) {
+    const candidate = path.join(current, 'package.json');
+    const pkg = readJson(candidate);
+    if (pkg && pkg.name === PACKAGE_NAME && pkg.version) {
+      return { version: pkg.version, source: candidate };
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return null;
+}
+
+/**
+ * @param {{fromDir?: string, cwd?: string}} [opts]
+ *   fromDir - where to start walking for MindForge's own manifest (defaults to this file).
+ *   cwd     - the project root to consult for installed-context sources.
+ * @returns {{version: string, source: string}}
+ * @throws {Error} when no source can establish MindForge's version.
+ */
+function resolveMindforgeVersion(opts = {}) {
+  const fromDir = opts.fromDir || __dirname;
+  const cwd = opts.cwd || process.cwd();
+
+  const own = findOwnManifest(fromDir);
+  if (own) return own;
+
+  const cfgPath = path.join(cwd, '.mindforge', 'config.json');
+  const cfg = readJson(cfgPath);
+  if (cfg && cfg.version) return { version: cfg.version, source: cfgPath };
+
+  const depPath = path.join(cwd, 'node_modules', PACKAGE_NAME, 'package.json');
+  const dep = readJson(depPath);
+  if (dep && dep.version) return { version: dep.version, source: depPath };
+
+  throw new Error(
+    'Cannot determine the MindForge version. Looked for a package.json named ' +
+    `"${PACKAGE_NAME}" above ${fromDir}, then ${path.join(cwd, '.mindforge/config.json')}, then ` +
+    `${depPath}. Refusing to guess: a wrong version produces a confident but incorrect upgrade ` +
+    'classification.');
+}
+
+module.exports = { resolveMindforgeVersion, findOwnManifest, PACKAGE_NAME };

package/bin/utils/redact-secrets.js

@@ -0,0 +1,106 @@
+'use strict';
+/**
+ * Redact credential-shaped substrings from text that is about to be persisted.
+ *
+ * WHY THIS EXISTS. `bin/hooks/instinct-capture-hook.js` writes the first 200 characters of a raw
+ * Bash command — and of a raw Task description — into BOTH an `observation` and a `behavior` field
+ * of `.mindforge/engine/instincts/instinct-store.jsonl`. Measured on real store files left by
+ * probes: an entry whose `observation` begins `Bash command succeeded: AWS_SE...`, i.e. an
+ * `AWS_SECRET_ACCESS_KEY=<value>` assignment captured verbatim. The store path is not gitignored,
+ * `.mindforge/engine/` is inside `package.json` files[] with no negation for instincts, and the
+ * promotion path (`.mindforge/engine/instincts/promotion-engine.md:33,41,46`) copies these fields
+ * into a generated, tracked, PUBLISHED `SKILL.md`. So a captured secret is amplified from a
+ * data file into committed source.
+ *
+ * WHY REDACT RATHER THAN HASH. Measured, not assumed: three consumers read this text and all three
+ * need it readable.
+ *
+ *   bin/learning/instinct-cli.js:114  `list` prints observation AND behavior verbatim to a human
+ *   bin/learning/instinct-cli.js:241  `promote` prints behavior verbatim as the suggestion
+ *   .mindforge/skills/instinct-clustering/SKILL.md:57-63  word-overlap Jaccard on observation
+ *
+ * And nothing in code dedups on the text — `cmdImport` keys on `e.id` and the hook stamps a fresh
+ * randomUUID per event — so a hash would preserve no collision that anything relies on. Hashing
+ * would break three consumers to buy nothing.
+ *
+ * WHY NOT "KEEP argv[0], REDACT THE REST". Because of the env-assignment form: in
+ * `SECRET=value cmd ...` the secret precedes the program, so the first retained token IS the
+ * secret. That is not hypothetical — it is the shape of the measured on-disk entry above.
+ *
+ * FAIL CLOSED. If redaction throws, this returns a placeholder rather than the input. A redactor
+ * that fails open is not a redactor. Note this does NOT make the calling hook fail closed: the hook
+ * stays advisory and still exits 0. "Do not block the tool call" and "do not write the secret
+ * anyway" are different promises, and both are kept.
+ */
+
+const PLACEHOLDER = (kind) => `<redacted:${kind}>`;
+
+/**
+ * Ordered most-specific first. Each entry replaces only the SECRET portion where a prefix carries
+ * meaning worth keeping (a scheme, a key name), so the redacted text still reads as the same shape
+ * of command — which is what the human-facing and Jaccard consumers need.
+ */
+const RULES = [
+  // PEM private key blocks, header through footer.
+  { kind: 'pem', re: /-----BEGIN[^-]{0,40}(?:PRIVATE )?KEY-----[\s\S]*?-----END[^-]{0,40}KEY-----/g,
+    replace: () => PLACEHOLDER('pem') },
+
+  // Vendor tokens with recognisable prefixes. Keep the prefix: it says WHICH credential leaked,
+  // which is exactly what an operator needs in order to rotate the right one.
+  { kind: 'vendor-token',
+    re: /\b(sk-(?:proj-|ant-)?|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|glpat-|npm_|xox[baprse]-|AKIA|ASIA|AIza|hf_|dop_v1_)[A-Za-z0-9_-]{16,}/g,
+    replace: (m, prefix) => `${prefix}${PLACEHOLDER('token')}` },
+
+  // Authorization headers. Keep the scheme, drop the credential.
+  { kind: 'auth-header', re: /\b(Bearer|Basic|Token)\s+[A-Za-z0-9+/=._~-]{8,}/gi,
+    replace: (m, scheme) => `${scheme} ${PLACEHOLDER('auth')}` },
+
+  // Credentials embedded in a URL: scheme://user:pass@host
+  { kind: 'url-credential', re: /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+):[^\s@/]+@/gi,
+    replace: (m, upToUser) => `${upToUser}:${PLACEHOLDER('url-password')}@` },
+
+  // Environment-assignment form, keyed on the NAME looking secret-bearing. This is the case that
+  // defeats prefix-preserving designs, because the assignment can precede the program name.
+  { kind: 'assignment',
+    re: /\b([A-Za-z_][A-Za-z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY|CREDENTIAL|AUTH)[A-Za-z0-9_]*)\s*=\s*("[^"]*"|'[^']*'|[^\s;|&]+)/gi,
+    replace: (m, name) => `${name}=${PLACEHOLDER('assignment')}` },
+
+  // Flag form: --password X, --token=X, -p X. Keep the flag so the command still parses visually.
+  { kind: 'flag',
+    re: /(--?(?:password|passwd|token|secret|api[-_]?key|access[-_]?key|auth|credential)(?:[=\s]))(?:"[^"]*"|'[^']*'|[^\s;|&]+)/gi,
+    replace: (m, flag) => `${flag}${PLACEHOLDER('flag-value')}` },
+
+  // Generic high-entropy run, last resort for credentials with no recognisable prefix. Requires
+  // BOTH a letter and a digit and >= 28 characters, so English words, long flag names and ordinary
+  // identifiers are left alone. `/` is excluded so a long path is examined segment by segment.
+  { kind: 'opaque', re: /\b(?=[A-Za-z0-9+=_-]{28,}\b)(?=[^\s]*[A-Za-z])(?=[^\s]*\d)[A-Za-z0-9+=_-]{28,}\b/g,
+    replace: () => PLACEHOLDER('opaque') },
+];
+
+/**
+ * @param {string} text
+ * @returns {string} the text with credential-shaped substrings replaced
+ */
+function redactSecrets(text) {
+  if (typeof text !== 'string' || text === '') return text;
+  try {
+    let out = text;
+    for (const rule of RULES) out = out.replace(rule.re, rule.replace);
+    return out;
+  } catch {
+    // Fail closed. Withholding telemetry is always cheaper than persisting a credential.
+    return PLACEHOLDER('redaction-failed');
+  }
+}
+
+/**
+ * True when redactSecrets would change the text. Useful for asserting a fixture is actually
+ * secret-shaped before relying on it, so a test cannot pass because its fixture was inert.
+ * @param {string} text
+ * @returns {boolean}
+ */
+function containsSecretShape(text) {
+  return typeof text === 'string' && text !== '' && redactSecrets(text) !== text;
+}
+
+module.exports = { redactSecrets, containsSecretShape, RULES };

package/bin/validate-config.js

@@ -7,14 +7,56 @@
 
 'use strict';
 
-const fs   = require('fs');
+const fs = require('fs');
 const path = require('path');
 
+// The one bracket-aware MINDFORGE.md reader (see bin/utils/mindforge-params.js).
+const { readParams } = require('./utils/mindforge-params');
+
+// The config belongs to the CALLER, so it stays relative to cwd.
 const CONFIG_PATH  = process.argv[2] || 'MINDFORGE.md';
-const SCHEMA_PATH  = '.mindforge/MINDFORGE-SCHEMA.json';
+
+/**
+ * The schema belongs to the FRAMEWORK, so it is resolved from __dirname first.
+ *
+ * This was the bare relative `'.mindforge/MINDFORGE-SCHEMA.json'`, which only ever resolved
+ * because bin/mindforge-cli.js pinned the child's cwd to MindForge's own install directory. That
+ * pin is what made `security-scan` validate the vendor's MINDFORGE.md and report
+ * `✅ valid — 43 settings configured` over any caller's config. Removing the pin without anchoring
+ * the schema here would have swapped one broken outcome for another: every consumer with a real
+ * MINDFORGE.md would hit the `not found` branch below and exit 0 having validated NOTHING. Measured
+ * that exact regression on a fixture — `ℹ️ MINDFORGE-SCHEMA.json not found — skipping schema
+ * validation`, rc=0 — which is why the two changes ship together.
+ *
+ * Every check in this file is schema-driven (required, recommended, type, minimum, maximum, enum,
+ * pattern, nonOverridable). There is no schema-free validation path, so a missing schema is not a
+ * degraded check, it is no check.
+ *
+ * Package-relative first, cwd-relative second, because the two supported install shapes put the
+ * schema in different places:
+ *   - `npx mindforge-cc` — runs from node_modules/mindforge-cc/, where .mindforge/ ships. Fixed.
+ *   - a copied bin/ tree — the installer copies bin/ but creates no .mindforge/, verified on a
+ *     clean `--claude --local` install. There the schema is genuinely absent and the honest skip
+ *     below is the correct outcome; the cwd fallback still finds one if the project has its own.
+ */
+function resolveSchemaPath() {
+  const candidates = [
+    path.join(__dirname, '..', '.mindforge', 'MINDFORGE-SCHEMA.json'),
+    path.join(process.cwd(), '.mindforge', 'MINDFORGE-SCHEMA.json'),
+  ];
+  return candidates.find((p) => fs.existsSync(p)) || candidates[0];
+}
+
+const SCHEMA_PATH = resolveSchemaPath();
 
 if (!fs.existsSync(CONFIG_PATH)) {
-  console.log('ℹ️  MINDFORGE.md not found — using all defaults. Create one to customise.');
+  // Name the path actually looked for, and where. This said "MINDFORGE.md not found" verbatim even
+  // when argv[2] supplied a different file, so `validate-config.js custom-config.md` reported a
+  // missing MINDFORGE.md — a message about a file the caller never mentioned. It cost real time
+  // during this change: a test failure was diagnosed as "a defaultArgs positional shadowed argv[2]"
+  // when the truth was simply that the named file was not in the working directory.
+  console.log(`ℹ️  ${CONFIG_PATH} not found in ${process.cwd()} — using all defaults. `
+    + 'Create one to customise.');
   process.exit(0);
 }
 
@@ -23,28 +65,36 @@ if (!fs.existsSync(SCHEMA_PATH)) {
   process.exit(0);
 }
 
-const content = fs.readFileSync(CONFIG_PATH, 'utf8');
 const schema  = JSON.parse(fs.readFileSync(SCHEMA_PATH, 'utf8'));
 
 const errors   = [];
 const warnings = [];
 
-// Parse key=value pairs from MINDFORGE.md
-const settings = {};
-const lines = content.split('\n');
-lines.forEach(line => {
-  const match = line.match(/^([A-Z_]+)=(.+)$/);
-  if (match) {
-    const [, key, value] = match;
-    settings[key] = value.trim();
-  }
-});
+// MINDFORGE.md declares parameters as bracketed assignments ([KEY] = value).
+// v11.9.2 and earlier matched /^([A-Z_]+)=(.+)$/, which matches ZERO lines of a
+// real MINDFORGE.md — the validator parsed 0 settings and could never fail.
+// readParams() also still handles the legacy plain KEY=value form.
+const settings = readParams(CONFIG_PATH);
+
+// Required / recommended key sets (top-level arrays in the schema). Kept
+// deliberately identical to sdk/src/client.ts validateConfig() so the SDK and
+// the CLI validator enforce ONE contract.
+const required    = new Set(Array.isArray(schema.required) ? schema.required : []);
+const recommended = new Set(Array.isArray(schema.recommended) ? schema.recommended : []);
+
+for (const key of required) {
+  if (!settings[key]) errors.push(`${key} is required but not set`);
+}
+for (const key of recommended) {
+  if (!settings[key]) warnings.push(`${key} is recommended but not set`);
+}
 
 // Validate against schema
 for (const [key, def] of Object.entries(schema.properties || {})) {
   const value = settings[key];
 
-  if (def.required && !value) {
+  // Legacy per-property `required` flag still honoured (schema.required wins).
+  if (def.required && !value && !required.has(key)) {
     errors.push(`${key} is required but not set`);
     continue;
   }
@@ -68,8 +118,16 @@ for (const [key, def] of Object.entries(schema.properties || {})) {
     errors.push(`${key}: expected true or false, got "${value}"`);
   }
 
-  if (def.nonOverridable) {
-    warnings.push(`${key}: this is a non-overridable governance primitive (value will be ignored)`);
+  if (def.type === 'string' && def.pattern && !new RegExp(def.pattern).test(value)) {
+    errors.push(`${key}: "${value}" does not match required pattern ${def.pattern}`);
+  }
+
+  // A non-overridable governance primitive may be SET (MINDFORGE.md is its
+  // source of truth) but never DISABLED. Mirrors sdk/src/client.ts:176-182,
+  // which errors on `[KEY] = false`. The old code warned on every occurrence
+  // and claimed the value "will be ignored" — which was untrue and pure noise.
+  if (def.nonOverridable && def.type === 'boolean' && value === 'false') {
+    errors.push(`${key}: non-overridable governance primitive cannot be disabled`);
   }
 }
 

package/bin/wizard/setup-wizard.js

@@ -6,7 +6,10 @@ const readline = require('readline');
 const detector = require('./environment-detector');
 const generator = require('./config-generator');
 
-const VERSION = require('../../package.json').version;
+// Resolved by package NAME, not by relative path: in an install `../../package.json` is the
+// consumer's manifest, so the wizard displayed the host app's version as MindForge's.
+const { resolveMindforgeVersion } = require('../utils/mindforge-version');
+const VERSION = resolveMindforgeVersion({ fromDir: __dirname }).version;
 const ARGS = process.argv.slice(2);
 const IS_INTERACTIVE =
   !ARGS.some((a) => ['--claude', '--antigravity', '--all', '--help'].includes(a)) &&

package/bin/wizard/theme.js

@@ -106,7 +106,15 @@ const Theme = {
     console.log(`  ${this.colors.dim('│')}    ${this.colors.bold('Environment')}: ${this.colors.cyan(runtime)} (${this.colors.dim(scope)})                         ${this.colors.dim('│')}`);
     console.log(`  ${this.colors.dim('│')}                                                                        ${this.colors.dim('│')}`);
     console.log(`  ${this.colors.dim('│')}    ${this.colors.bold('Next steps:')}                                                   ${this.colors.dim('│')}`);
-    console.log(`  ${this.colors.dim('│')}      ${this.colors.bold('mindforge-cc init')}   ${this.colors.dim('— Initialize your first workspace')}      ${this.colors.dim('│')}`);
+    // Was `mindforge-cc init`, which does not exist. mindforge-cc takes flags only and silently
+    // ignored the positional, so obeying this line re-ran the installer against whatever directory
+    // the user was standing in: measured 1,836 files written into an empty temp dir, exit 0, and
+    // this same panel printed again — so it loops. `/mindforge:init-project` is the real command and
+    // the install has just placed it in the harness, so the instruction now names something the
+    // user actually has. bin/install.js rejects stray positionals too: a wrong instruction and a
+    // silent acceptance of it are two separate defects, and fixing either alone leaves a trap.
+    // Padding keeps the visible width at 65 so the box border still lines up.
+    console.log(`  ${this.colors.dim('│')}      ${this.colors.bold('/mindforge:init-project')}  ${this.colors.dim('— Initialize your workspace')}       ${this.colors.dim('│')}`);
     console.log(`  ${this.colors.dim('│')}      ${this.colors.bold('/mindforge:help')}    ${this.colors.dim('— Explore the command suite')}        ${this.colors.dim('│')}`);
     console.log(`  ${this.colors.dim('│')}                                                                        ${this.colors.dim('│')}`);
     console.log(`  ${this.colors.dim('├' + '─'.repeat(boxWidth) + '╯')}\n`);

package/changelogs/index.json

@@ -1,5 +1,7 @@
 {
   "versions": [
+    "11.9.3",
+    "11.9.2",
     "11.9.1",
     "11.9.0",
     "11.8.3",
@@ -47,8 +49,8 @@
     "6.5.0",
     "6.4.0",
     "6.3.0",
-    "6.2.0",
     "6.2.0-alpha",
+    "6.2.0",
     "6.1.0-alpha",
     "6.0.0-alpha",
     "5.9.0",
@@ -60,8 +62,8 @@
     "5.3.0",
     "5.2.0",
     "5.1.0",
-    "5.0.0-alpha.2",
     "5.0.0-alpha.1",
+    "5.0.0-alpha.2",
     "4.3.0",
     "4.1.0",
     "4.0.0",
@@ -76,17 +78,17 @@
     "2.1.2",
     "2.1.1",
     "2.1.0",
-    "2.0.0",
-    "2.0.0-alpha.12",
-    "2.0.0-alpha.11",
-    "2.0.0-alpha.10",
     "2.0.0-alpha.9",
     "2.0.0-alpha.8",
-    "2.0.0-alpha.7",
-    "2.0.0-alpha.4",
-    "2.0.0-alpha.3",
+    "2.0.0",
+    "2.0.0-alpha.10",
     "2.0.0-alpha.2",
     "2.0.0-alpha.1",
+    "2.0.0-alpha.11",
+    "2.0.0-alpha.7",
+    "2.0.0-alpha.12",
+    "2.0.0-alpha.3",
+    "2.0.0-alpha.4",
     "1.0.5",
     "1.0.4",
     "1.0.3",

package/changelogs/v11.9.2.md

@@ -0,0 +1,209 @@
+# Changelog
+
+## [11.9.2] — 2026-08-16 — Correctness: audit-chain integrity, dashboard crash policy, secret scanning
+
+Patch release. No new features. Correctness work closing defects found by a
+multi-agent audit of v11.9.1, plus the regression suites that keep them closed.
+Contains a breaking change to the dashboard HTTP surface — see BREAKING below.
+
+### BREAKING
+
+Shipped under a PATCH bump. The break is confined to the dashboard's own HTTP
+surface, which binds to 127.0.0.1 only — but if you script against it, read this.
+
+- **Dashboard error responses changed shape.** `detail` is removed from 5 endpoints and
+  raw errno strings from 10 more; `correlation_id` is added to 15; a malformed request
+  body now returns `application/json` instead of express's `text/html` error page.
+  Anything parsing `detail` must correlate on the logged `correlation_id` instead. This
+  was deliberate — those fields leaked absolute filesystem paths, and therefore the
+  operator's username and home directory, into an unauthenticated response body
+  (`requireAuth` exempts GET).
+- **The dashboard now EXITS on an unhandled rejection or uncaught exception** where
+  11.9.1 logged and continued. If you supervise the process, expect restarts where you
+  previously saw a logged error. Rationale in the Fixed section below: log-and-continue
+  held client sockets open until the client timed out, and had made `shutdown()` swallow
+  a throwing token unlink and keep serving the authenticated mutation API after SIGTERM.
+- **`node bin/validate-config.js` and `mindforge security-scan` can now fail.** They
+  previously reported `MINDFORGE.md valid — 0 settings configured` and exited 0 on every
+  input. If you run either in CI, a genuinely invalid registry will now red-line where it
+  used to pass. Note this reaches **fresh installs and `--force` reinstalls only** — the
+  installer does not overwrite an existing `.mindforge/MINDFORGE-SCHEMA.json`, so a plain
+  upgrade keeps the old permissive schema.
+
+### Fixed
+
+- **`security-scan` could not fail.** `bin/validate-config.js` and
+  `bin/models/model-router.js` each parsed `MINDFORGE.md` with a plain `KEY=value` regex, but
+  the registry declares its 43 parameters as bracketed `[KEY] = value`. Every schema property
+  resolved to `undefined` and short-circuited, so the command reported
+  `MINDFORGE.md valid — 0 settings configured` and exited 0 on any input. The schema also had
+  no `required` key at all. Both parsers now share `bin/utils/mindforge-params.js`, which also
+  accepts the legacy plain form (`examples/starter-project/MINDFORGE.md` ships 28 such lines),
+  and the schema declares real `required`/`recommended` sets.
+  **Behaviour change for consumers:** three CI gates go from unfailable to failable —
+  `.github/workflows/mindforge-ci.yml:38`, `.gitlab-ci-mindforge.yml:12`, and
+  `.github/workflows/control-plane.yml:100`. If one red-lines on a valid value, the schema
+  bound is wrong; do not "fix" it by editing `MINDFORGE.md`. Model routing is unchanged —
+  30 persona x tier combinations resolve identically.
+- **Trace retrieval returned nothing usable.** Queries were wrapped as a single FTS phrase, so
+  any query containing one absent term scored zero; and `traces_search` was keyed on `trace_id`
+  rather than the primary key, so each span's DELETE evicted the previous span and only the last
+  span per trace stayed searchable — 2,270 of 5,117 content-bearing traces, 44.4%, unsearchable.
+  Queries are now tokenised, OR-joined and ranked by tf-idf (`matchinfo('pcnx')`); the index is
+  re-keyed and rebuilt losslessly from the base table. `bin/eval/eval-harness.js` and its golden
+  set had zero callers and are now reachable as `npm run eval:retrieval`, with the baseline
+  committed: mean recall@10 0.6417, nDCG 0.5698 over 519 documents.
+- **The cost ledger reported two totals for one concept.** `sum(cost_usd)` was $13.73 while
+  `sum(total_cost_usd)` was $0.00, and `tests/dashboard.test.js` wrote the reader's field name,
+  so the mismatch tested green. `bin/models/usage-record.js` is now the single definition of the
+  ledger path, record shape, per-entry cost and day bucket. The configured `ledger_path` pointed
+  at `token-ledger.jsonl`, a file that has never existed; that ghost filename had spread to 17
+  places across 13 files and is now absent. The dashboard cost tile no longer renders `$0.00`
+  on a 500 — it had no `res.ok` check, and because errors return well-formed JSON the catch
+  never fired, making an outage indistinguishable from zero spend.
+  A maintainer tool, `scripts/purge-synthetic-usage.js`, removes fixture rows: dry-run by
+  default, backs up first, idempotent, and aborts leaving the ledger untouched if the rewrite
+  fails. It is run from a repository checkout — `scripts/` is not in the published tarball, so
+  installed consumers do not have it.
+- **Audit hash chain could fork under concurrent writers.** `bin/autonomous/audit-writer.js`
+  read the chain head and appended with no mutual exclusion, and cached the head in-process
+  indefinitely — so once a second process appended, the first kept chaining from a superseded
+  hash. Added `bin/utils/file-lock.js` (a fail-closed advisory lock promoted from
+  `bin/learning/instinct-cli.js`, deliberately NOT from `.agent/bin/lib/state.cjs`, which
+  writes anyway when the lock cannot be taken) held across read-head-through-fsync, and made
+  the cached head carry the file size that witnesses it is still the tail. 8 concurrent
+  appenders went from 199 broken links + 4 forks per 200 entries to 0. A lock alone was
+  measured insufficient — it still left 2 breaks and 1 fork, because the stale cache is a
+  second, independent defect.
+- **Knowledge-graph edge updates were lost under concurrency.** `deprecateEdge`,
+  `reinforceEdge` and `applyDecay` in `bin/memory/knowledge-graph.js` each did
+  `readAllEdges()` -> mutate -> append with no lock, and `addEdge` appended unserialised
+  against them. Measured at HEAD over 4 runs of 8 processes x 20 `reinforceEdge` calls:
+  93-129 of 160 increments lost, final `traversal_count` 31-67 instead of 160. All four
+  write paths now hold the `graph-edges.jsonl` lock across read-through-append; the same
+  probe then loses 0 of 160 in every run, with no lock-acquisition failures.
+- `bin/governance/policy-engine.js`: `logAudit`'s un-awaited audit write now has a
+  `.catch()` — a lock-contention failure is reported at the decision site instead of
+  escaping as an unhandled rejection.
+- `bin/hooks/instinct-capture-hook.js` appended to the instinct store without the lock that
+  `instinct-cli`'s prune/import rewrite holds, so a hook append landing in that window was
+  clobbered by the rename. It now takes the same lock.
+- `tests/v7-sovereign-security.test.js`: `new PolicyEngine()` no longer defaults
+  `planningDir` to `process.cwd()`, which appended test verdicts to the operator's real
+  `.planning/RISK-AUDIT.jsonl`.
+- Packaging: `package.json` files[] now excludes `**/*.lock` so a lockfile orphaned by a
+  hard kill cannot leak into the npm tarball (verified: without the negation, a
+  `.mindforge/memory/graph-edges.jsonl.lock` does ship).
+
+- **Audit-chain forgery via un-awaited rollback.** `HindsightInjector.inject` called
+  the async `TemporalHub.rollbackTo` without `await`, so its rejection escaped the
+  surrounding `try/catch` while execution continued: a failed rollback still fsync'd a
+  hash-chained `hindsight_injected` entry and flipped `auto-state.json` to
+  `awaiting_regeneration` for something that never happened. The log gained a
+  cryptographically valid record of a non-event, and `verify-audit` reported the chain
+  valid — valid and wrong.
+- **CLI `defaultArgs` were replaced by user arguments, not prepended.** `mindforge
+  health <anything>` lost `--check` and fell through to `installer-core`'s real
+  `install()` with `force: true`. Now prepended.
+- **`_verifyMetadata` compared UTF-16 code units, not bytes**, so a 64-unit / 65-byte
+  `integrity` still threw `RangeError` — and the caller degraded that throw into
+  "proceeding without integrity check" and restored the snapshot anyway. Read and
+  verify are now separate stages; only a genuinely absent `SNAPSHOT-META.json` reaches
+  the tolerant path.
+- **Dashboard `RevOpsAPI` was required but never mounted**, so `/api/revops/overview`
+  404'd while the AgRevOps panels and docs described it as live. Even mounted it threw:
+  `getAuditEntries()` returns `{entries,total,limit,offset}` and three engines call
+  `.filter()` on it.
+- **Dashboard leaked error internals to clients.** `err.message` reached response
+  bodies from 14 sites (`api-router.js` ×10, `temporal-api.js` ×3, `revops-api.js` ×1);
+  for fs-sourced errors that string carries absolute paths, disclosing the operator's
+  username and home directory. All sites now log server-side and return a generic
+  message plus a `correlation_id`, behind a 4-arg terminal handler that stops express
+  rendering `err.stack` when `NODE_ENV !== 'production'`.
+- **Test runner discovery was a flat `readdirSync`**, so any suite in a subdirectory was
+  invisible. Now a recursive walk that prunes `tmp-*` / `node_modules` / dot
+  directories — directories only, never files.
+- Three orphan files removed: one truncated `.planning/AUDIT.jsonl` to zero, one
+  overwrote `.planning/STATE.md`, one called a function absent from `bin/`. Recursion
+  made the `STATE.md` clobberer reachable by a single in-place rename; the other two
+  were unreachable by the runner at any depth. **The claim in `5177225`'s message that
+  all three were newly armed by recursion is correct for one of the three and
+  over-attributed for the other two.**
+- Three relocated demos kept one-level-up requires after moving a directory deeper, so
+  all three exited 1; corrected to `../../bin/`.
+
+### Changed
+
+- **`mindforge audit-skill`, `register-skill`, `install-skill` and `record-learning` no
+  longer carry `defaultArgs`.** Prepending turned them from inert into live state
+  writers: `audit-skill <name> <ver> <tier>` appended a hash-chained
+  `{event:'skill_installed', validation_passed:true}` entry for a skill that does not
+  exist, and `register-skill` wrote a malformed row above the table header of
+  `.mindforge/org/skills/MANIFEST.md`, which ships in the tarball. Bare invocations now
+  print usage and exit 0 without reaching those writers, as at v11.9.1.
+- **`subagent` is a first-class command.** Prepending `spawn` shadowed `spawn-agent`'s
+  `subagent` mode, whose documented route was `mindforge spawn subagent <name>`.
+- **The dashboard now exits on an unhandled rejection instead of logging and
+  continuing.** An escaped rejection is the only reliable signal that an async call was
+  left un-awaited, and express 4.22.1 does not route async handler rejections to error
+  middleware — log-and-continue held the client socket open until the client gave up
+  (2.5s, 4s and 8s clients all timed out) versus a ~15ms reset on exit. Symmetric with
+  `uncaughtException`, whose log-and-continue form had made `shutdown()` swallow a
+  throwing token unlink and keep serving the token-authenticated mutation API **after
+  SIGTERM**, with the bearer token still on disk and valid in memory.
+- **Dashboard error responses changed shape.** `detail` is removed from 5 endpoints,
+  raw errno strings from 10 more, `correlation_id` is added to 15, and a malformed
+  request body now returns `application/json` rather than express's `text/html` error
+  page. Anything parsing `detail` must correlate on the logged id instead.
+
+### Added
+
+- **Secret scanning enforced at three layers**: `.gitleaks.toml`, a `.husky/pre-commit`
+  gate that fails loudly when gitleaks is absent rather than skipping, and
+  `.github/workflows/secret-scan.yml` scanning full history. `scripts/ci/verify-secret-scan.sh`
+  self-tests the scanner — it distinguishes "scanned clean" from "scanned and found"
+  from "did not scan", because gitleaks exits 1 for both a finding and a failed config
+  load, and writes no report in the latter case.
+
+### Tests
+
+- Suite totals for this release: **105 files, 103 pass, 2 environment-dependent skips**
+  (`browser`, `sre-integration`). Eight new suites across the release:
+  `temporal-integrity`, `dashboard-error-leak`, `dashboard-crash-guards`,
+  `dashboard-wiring`, `cli-router`, `mindforge-params`, `file-lock`, `retrieval-fts`.
+- **Four suites could not report failure and now can.** `v8-persistence`,
+  `v8-skill-evolution` and `v8-orbital-governance` ended `finally { process.exit(0) }`, and
+  `v7-pillar-integration` had zero assertions with a premium-model gate that named two models
+  absent from the registry for several releases. `npm test` is the only quality step before
+  `npm publish`, and the runner gates on child exit codes, so a blind suite blinded the publish
+  gate. Verified by injected failure rather than inspection.
+  `dashboard-wiring` derives the expected router set
+  from `server.js`'s own requires, so adding a router without mounting it fails.
+  `cli-router` runs against a mirror-root sandbox under `os.tmpdir()` — required, not
+  tidiness: the case that proves audit forgery is prevented would otherwise forge an
+  entry into the real chain on every run. `revops-roi.test.js` had 0 assertions and
+  could not fail; it now has 6.
+
+### Not fixed — deferred to v12
+
+- **No hook is registered in any consumer install.** The installer copies 9 hook
+  scripts into `<runtime>/hooks/`, but nothing writes `.claude/settings.json` and it is
+  absent from `package.json` `files[]`. Verified by installing the tarball into a
+  scratch project. Every gate this release hardens is inert until that lands.
+- **`requireAuth` exempts GET and OPTIONS**, so every read route — including
+  `/api/audit`, which serves the hash-chained audit log — is credential-free to any
+  local process. Mutations are protected. This is a threat-model decision, not a patch.
+- **`audit-skill audit <name> <ver> <tier>`** — the explicit form — still reaches a
+  writer that performs no existence check and hardcodes `validation_passed: true`. Only
+  the bare invocation is closed.
+- **Snapshot integrity is not an authenticity control.** `HMAC_KEY` is a literal in
+  shipped source, the HMAC covers only the metadata object so file **contents** are
+  unsigned (editing a file inside a signed snapshot leaves the signature valid), and
+  deleting `SNAPSHOT-META.json` bypasses verification entirely.
+- `cwd: ROOT` in the CLI, which resolves consumer state inside `node_modules`.
+- `security-scan` cannot fail: its parser expects `KEY=value` while `MINDFORGE.md` uses
+  `[KEY] = value`, so it always reports 0 settings and exits 0.
+- Version drift in six publishable manifests (`Formula/mindforge.rb`, `Dockerfile`,
+  `mcp-server/server.json`, `mcp-server/src/index.ts`, the plugin manifest and the
+  marketplace entry) is untouched here — none is gated, and the Formula pins a tarball
+  sha256 that cannot exist before publish.