mindforge-cc 11.9.1 → 11.9.3

package/.agent/mindforge/cost-report.md

@@ -19,7 +19,7 @@ $ARGUMENTS
 
 <process>
 1. Parse flags: --window (time period, default: current session), --by-model, --by-task, --phase.
-2. Read `.mindforge/metrics/token-ledger.jsonl` for the specified window.
+2. Read `.mindforge/metrics/token-usage.jsonl` for the specified window.
 3. **Compute totals:**
    - Total tokens (input, output, cached)
    - Total estimated cost (USD)

package/.agent/mindforge/harness-audit.md

@@ -31,7 +31,7 @@ LLM layer judges *whether it matters here* and proposes the highest-leverage fix
 
 ## Step 3 — Report + AUDIT entry
 
-Summarize the scorecard, then write a Merkle-linked AUDIT.jsonl entry:
+Summarize the scorecard, then write a hash-chained AUDIT.jsonl entry:
 
 ```json
 {

package/.agent/mindforge/orch-add-feature.md

@@ -34,7 +34,7 @@ with `$ARGUMENTS` as the request and `operation = add-feature`. The engine will:
 3. TDD each task via `mindforge-tdd_extended` (new failing tests → green), then
    `/mindforge:review` (+ the `quick.md` security auto-trigger / `security-reviewer`
    if a security trigger is touched).
-4. Commit as conventional `feat(...)` commits, each writing a Merkle-linked
+4. Commit as conventional `feat(...)` commits, each writing a hash-chained
    AUDIT.jsonl entry. → **GATE 2** (confirm before commit).
 
 Honor both gates — do not write implementation before Gate 1, do not commit

package/.agent/mindforge/orch-build-mvp.md

@@ -42,7 +42,7 @@ with `$ARGUMENTS` as the doc path and `operation = build-mvp` (default floor:
    > the orch-pipeline skill.
 4. `/mindforge:review` (+ the `quick.md` security auto-trigger / `security-reviewer`
    on any security-trigger slice), then commit the scaffold and each slice as
-   separate conventional `feat(...)` commits, each writing a Merkle-linked
+   separate conventional `feat(...)` commits, each writing a hash-chained
    AUDIT.jsonl entry. → **GATE 2**.
 
 If `$ARGUMENTS` is empty, ask the user for the path to the design/spec doc.

package/.agent/mindforge/orch-change-feature.md

@@ -36,7 +36,7 @@ with `$ARGUMENTS` as the request and `operation = change-feature`. The engine wi
    first is what makes this a tweak, not a fix.)
 4. `/mindforge:review` (+ the `quick.md` security auto-trigger / `security-reviewer`
    on a security trigger), then commit as conventional `feat(...)` / `refactor(...)`
-   + Merkle-linked AUDIT.jsonl entry. → **GATE 2**.
+   + hash-chained AUDIT.jsonl entry. → **GATE 2**.
 
 Use this only when the feature **works** but should behave differently — not for
 bugs (`/mindforge:orch-fix-defect`) or net-new capability

package/.agent/mindforge/orch-fix-defect.md

@@ -33,7 +33,7 @@ with `$ARGUMENTS` as the request and `operation = fix-defect`. The engine will:
    this a fix, not a tweak.)
 3. `/mindforge:review` (+ the `quick.md` security auto-trigger / `security-reviewer`
    if the defect sits in a sensitive path).
-4. Commit as a conventional `fix(...)` commit + Merkle-linked AUDIT.jsonl entry.
+4. Commit as a conventional `fix(...)` commit + hash-chained AUDIT.jsonl entry.
    → **GATE 2** (confirm before commit).
 
 Use this only when behavior is **broken/wrong** — not for intentional changes

package/.agent/mindforge/orch-refine-code.md

@@ -35,7 +35,7 @@ with `$ARGUMENTS` as the request and `operation = refine-code`. The engine will:
    — the existing suite proves behavior is unchanged). Dead-code/dup sweeps
    delegate to `/mindforge:de-slop`.
 4. `/mindforge:review`, then commit as `refactor(...)` (the diff must be
-   behavior-neutral) + Merkle-linked AUDIT.jsonl entry. → **GATE 2**.
+   behavior-neutral) + hash-chained AUDIT.jsonl entry. → **GATE 2**.
 
 Use this only when behavior must **not** change. If behavior should change at
 all, use `/mindforge:orch-change-feature` or `/mindforge:orch-fix-defect`.

package/.agent/mindforge/qa.md

@@ -1,11 +1,11 @@
 ---
-description: @mindforge qa [--phase N] [--auto]
+description: /mindforge:qa [--phase N] [--auto]
 ---
 
 # /mindforge:qa
 
 ## Usage
-`@mindforge qa [--phase N] [--auto]`
+`/mindforge:qa [--phase N] [--auto]`
 
 ## Description
 Runs systematic visual QA on UI surfaces changed in the current phase.

package/.claude/CLAUDE.md

@@ -25,25 +25,37 @@ You are a **Dynamic Multi-Agent Swarm (Agentic Mesh)**. Your mission is to execu
 
 ## 🛠️ CORE PROTOCOLS (The "How")
 
+> **These are protocols you follow, not modules you call.** `SwarmController`, `PersonaFactory`
+> and `WaveExecutor` are role names in the specs under `.mindforge/engine/`, not importable code —
+> there is no file by any of those names. Every step below is something you do by reasoning and by
+> using your own tools. Where a real executable exists, it is named with its path.
+
 ### 1. Swarm Dynamic Orchestration (V4)
 **IF** task complexity/impact is high **OR** cross-disciplinary logic is required:
-1.  Invoke `SwarmController` and activate `mindforge-swarm-execution`.
+1.  Adopt the swarm-orchestration protocol described in `.mindforge/engine/`.
 2.  Spawn task-specific ephemeral specialist cluster (AIEngineering, Security, etc.).
-3.  Inject knowledge patches via `PersonaFactory` (Context7).
-4.  Execute parallel mesh waves via `WaveExecutor` guided by `mindforge-parallel-mesh_extended`.
+3.  Load the relevant persona brief from `.mindforge/personas/` before each specialist acts.
+4.  Execute parallel mesh waves, consolidating dependent work before independent work.
 5.  Consolidate mesh findings into a single `SWARM-SUMMARY`.
 
 ### 2. The Sharded Memory Loop (SRD)
 **IF** context ≥ 70% **OR** starting a new task:
-1. Initialize `shard-controller.js`.
-2. Rotate context per the Tri-Tier strategy (Hot/Warm/Cold).
-3. Inject only sharded relevant data into the active buffer.
+1. Rotate context per the Tri-Tier strategy (Hot/Warm/Cold) yourself — this is an advisory
+   discipline, not an automated step.
+2. Inject only sharded relevant data into the active buffer.
+3. Re-read the current phase's plan rather than carrying stale detail forward.
 
 ### 3. The Adversarial Decision Loop (ADS)
 **BEFORE** committing any architectural change:
-1. Spawn Red-Team/Blue-Team debate contexts.
-2. Run `soul-engine.js` on the proposed diff.
-3. **STOP** if SOUL Score < `[MIN_SOUL_SCORE]` from MINDFORGE.md.
+1. Spawn Red-Team/Blue-Team debate contexts and argue the change against itself.
+2. Score the proposal on impact, leverage, reversibility, effort, risk and cost.
+3. **STOP** if the resulting SOUL Score < `[MIN_SOUL_SCORE]` from MINDFORGE.md.
+
+ADS is a reasoning protocol you run, not a command. Do not look for a script: measured, the two
+scripts this section used to name (soul-engine.js and shard-controller.js) do not exist
+anywhere in the package. The nearest real implementation, `runADSSynthesis()` in
+`bin/review/ads-engine.js`, is a library with a single internal caller, exposes no CLI, and takes
+`{phaseNum, goal, context, sessionId}` rather than a diff, so it cannot be invoked here either.
 
 ### 4. Standard Extended Protocols (Quality Gates)
 **MANDATORY**: For specific workflows, activate the corresponding `_extended` protocol:
@@ -78,18 +90,26 @@ Prioritize based on `[REACTIVE_MODE]` in MINDFORGE.md. These are the **Quality g
 - [ ] **AgRevOps Check**: Verify ROI trends and Security Health Score via `/api/revops`.
 - [ ] **PLAN-FIRST RULE**: Never code without a verified XML plan.
 - [ ] **Verify First**: Never task-complete without successful `<verify>` output.
-- [ ] **Audit Always**: Write a JSONL entry for every significant session event. All entries must be Merkle-linked.
+- [ ] **Audit Always**: Write a JSONL entry for every significant session event. The result is a hash-chained append-only audit log (SHA-256 back-links): each entry sets `previous_hash` to the prior entry's `_hash`.
 
 ---
 
 ## ⚡ COMMAND SUITE
 
+Every entry below has a backing command file, checked by `tests/protocol-claims.test.js`. Two that
+did not (the brainstorming and history entries) are gone: neither existed in
+`.claude/commands/mindforge/` or `.agent/mindforge/` (both hold exactly 221 files, so this was not
+a mirror gap), and neither had a near-match to correct to. Temporal history is reachable, just not
+as a slash command, so it is named as what it actually is.
+
 - `/mindforge:next` — Primary auto-discovery.
 - `/mindforge:auto` — Reactive engine start.
-- `/mindforge:brainstorming` — Creative & architectural exploration.
-- `/mindforge:history` — Temporal Hub access.
+- `/mindforge:plan-phase` — Plan the next phase before writing code.
+- `/mindforge:verify-phase` — Verify the phase against its plan.
 - `/mindforge:status` — Project health & sharding state.
 - `/mindforge:audit` — Day 4 governance access.
+- `mindforge temporal <status|cleanup|inject>` — reasoning-history access (a CLI command, not a
+  slash command).
 
 ---
 
@@ -109,7 +129,11 @@ Adopt the Principal AI persona. Be instruction-dense, unambiguous, and architect
 
 **Source of Truth Hierarchy**:
 
-1. SOUL.md (Sovereign Identity — Behavioral OS)
+1. SOUL.md (Sovereign Identity — Behavioral OS). **Not shipped in the package**, and generated
+   locally rather than installed: `bin/memory/identity-synthesizer.js` creates and evolves it. If
+   your project has no SOUL.md, this entry is vacant and authority passes to MINDFORGE.md — do not
+   infer its contents. The prompt-defense baseline it carries is reproduced verbatim at the top of
+   this file, so that part reaches you either way.
 2. MINDFORGE.md (Parameter Registry)
 3. .agent/CLAUDE.md (Protocols)
 4. `.mindforge/` (Framework Binary Logic)

package/.claude/commands/mindforge/browse.md

@@ -1,11 +1,11 @@
 ---
-description: "@mindforge browse <url | action>"
+description: "/mindforge:browse <url | action>"
 ---
 
 # /mindforge:browse
 
 ## Usage
-`@mindforge browse <url | action>`
+`/mindforge:browse <url | action>`
 
 ## Description
 Controls the persistent MindForge browser daemon. 

package/.claude/commands/mindforge/checkpoint.md

@@ -61,7 +61,7 @@ Remove old checkpoints, keeping the last 5.
 
 ## AUDIT linkage
 
-Each create/verify optionally writes a Merkle-linked AUDIT.jsonl entry:
+Each create/verify optionally writes a hash-chained AUDIT.jsonl entry:
 
 ```json
 { "event": "checkpoint_created", "name": "core-done", "sha": "abc1234", "tests_pass_rate": 1.0, "coverage": 0.0 }

package/.claude/commands/mindforge/consult.md

@@ -31,7 +31,7 @@ $ARGUMENTS
    - Identify divergence (models disagree — flag for user)
    - Identify novel insights (unique points from one model)
 7. **Present results** with clear attribution (which model said what).
-8. Log consultation in token-ledger.jsonl (model, tokens, cost per call).
+8. Log consultation in token-usage.jsonl (model, tokens, cost per call).
 9. Report total cost of this consultation.
 10. Remind: "External opinions are advisory — user sovereignty applies."
 </process>

package/.claude/commands/mindforge/cost-report.md

@@ -19,7 +19,7 @@ $ARGUMENTS
 
 <process>
 1. Parse flags: --window (time period, default: current session), --by-model, --by-task, --phase.
-2. Read `.mindforge/metrics/token-ledger.jsonl` for the specified window.
+2. Read `.mindforge/metrics/token-usage.jsonl` for the specified window.
 3. **Compute totals:**
    - Total tokens (input, output, cached)
    - Total estimated cost (USD)

package/.claude/commands/mindforge/harness-audit.md

@@ -31,7 +31,7 @@ LLM layer judges *whether it matters here* and proposes the highest-leverage fix
 
 ## Step 3 — Report + AUDIT entry
 
-Summarize the scorecard, then write a Merkle-linked AUDIT.jsonl entry:
+Summarize the scorecard, then write a hash-chained AUDIT.jsonl entry:
 
 ```json
 {

package/.claude/commands/mindforge/orch-add-feature.md

@@ -34,7 +34,7 @@ with `$ARGUMENTS` as the request and `operation = add-feature`. The engine will:
 3. TDD each task via `mindforge-tdd_extended` (new failing tests → green), then
    `/mindforge:review` (+ the `quick.md` security auto-trigger / `security-reviewer`
    if a security trigger is touched).
-4. Commit as conventional `feat(...)` commits, each writing a Merkle-linked
+4. Commit as conventional `feat(...)` commits, each writing a hash-chained
    AUDIT.jsonl entry. → **GATE 2** (confirm before commit).
 
 Honor both gates — do not write implementation before Gate 1, do not commit

package/.claude/commands/mindforge/orch-build-mvp.md

@@ -42,7 +42,7 @@ with `$ARGUMENTS` as the doc path and `operation = build-mvp` (default floor:
    > the orch-pipeline skill.
 4. `/mindforge:review` (+ the `quick.md` security auto-trigger / `security-reviewer`
    on any security-trigger slice), then commit the scaffold and each slice as
-   separate conventional `feat(...)` commits, each writing a Merkle-linked
+   separate conventional `feat(...)` commits, each writing a hash-chained
    AUDIT.jsonl entry. → **GATE 2**.
 
 If `$ARGUMENTS` is empty, ask the user for the path to the design/spec doc.

package/.claude/commands/mindforge/orch-change-feature.md

@@ -36,7 +36,7 @@ with `$ARGUMENTS` as the request and `operation = change-feature`. The engine wi
    first is what makes this a tweak, not a fix.)
 4. `/mindforge:review` (+ the `quick.md` security auto-trigger / `security-reviewer`
    on a security trigger), then commit as conventional `feat(...)` / `refactor(...)`
-   + Merkle-linked AUDIT.jsonl entry. → **GATE 2**.
+   + hash-chained AUDIT.jsonl entry. → **GATE 2**.
 
 Use this only when the feature **works** but should behave differently — not for
 bugs (`/mindforge:orch-fix-defect`) or net-new capability

package/.claude/commands/mindforge/orch-fix-defect.md

@@ -33,7 +33,7 @@ with `$ARGUMENTS` as the request and `operation = fix-defect`. The engine will:
    this a fix, not a tweak.)
 3. `/mindforge:review` (+ the `quick.md` security auto-trigger / `security-reviewer`
    if the defect sits in a sensitive path).
-4. Commit as a conventional `fix(...)` commit + Merkle-linked AUDIT.jsonl entry.
+4. Commit as a conventional `fix(...)` commit + hash-chained AUDIT.jsonl entry.
    → **GATE 2** (confirm before commit).
 
 Use this only when behavior is **broken/wrong** — not for intentional changes

package/.claude/commands/mindforge/orch-refine-code.md

@@ -35,7 +35,7 @@ with `$ARGUMENTS` as the request and `operation = refine-code`. The engine will:
    — the existing suite proves behavior is unchanged). Dead-code/dup sweeps
    delegate to `/mindforge:de-slop`.
 4. `/mindforge:review`, then commit as `refactor(...)` (the diff must be
-   behavior-neutral) + Merkle-linked AUDIT.jsonl entry. → **GATE 2**.
+   behavior-neutral) + hash-chained AUDIT.jsonl entry. → **GATE 2**.
 
 Use this only when behavior must **not** change. If behavior should change at
 all, use `/mindforge:orch-change-feature` or `/mindforge:orch-fix-defect`.

package/.claude/commands/mindforge/qa.md

@@ -1,11 +1,11 @@
 ---
-description: "@mindforge qa [--phase N] [--auto]"
+description: "/mindforge:qa [--phase N] [--auto]"
 ---
 
 # /mindforge:qa
 
 ## Usage
-`@mindforge qa [--phase N] [--auto]`
+`/mindforge:qa [--phase N] [--auto]`
 
 ## Description
 Runs systematic visual QA on UI surfaces changed in the current phase.

package/.mindforge/MINDFORGE-SCHEMA.json

@@ -1,33 +1,146 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "title": "MindForge Project Configuration Schema",
-  "description": "JSON Schema for MINDFORGE.md key-value settings",
+  "description": "JSON Schema for MINDFORGE.md bracketed parameter assignments ([KEY] = value)",
   "type": "object",
+  "required": [
+    "VERSION",
+    "REACTIVE_MODE",
+    "PLANNER",
+    "EXECUTOR",
+    "MIN_SOUL_SCORE"
+  ],
+  "recommended": [
+    "COST_WARN_USD",
+    "COST_HARD_LIMIT_USD",
+    "BLOCK_ON_SECURITY"
+  ],
   "properties": {
+    "NAME": { "type": "string", "description": "Project display name" },
+    "VERSION": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+$",
+      "description": "MindForge version this registry targets (must equal package.json version)"
+    },
+    "STABLE": { "type": "boolean", "description": "Registry is a released/stable configuration" },
+    "MODE": { "type": "string", "description": "Operating mode label (free-form)" },
+    "REQUIRED_CORE_VERSION": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+$",
+      "description": "Minimum MindForge core version required by this project"
+    },
+    "SOVEREIGN_IDENTITY": {
+      "type": "boolean",
+      "nonOverridable": true,
+      "description": "NON-OVERRIDABLE: identity verification is always required"
+    },
+    "SRE_LAYER_ENABLED": { "type": "boolean", "description": "Enable the SRE persona layer" },
+    "SWARM_ORCHESTRATION": { "type": "boolean", "description": "Enable dynamic swarm orchestration" },
+    "AUTO_SWARM_THRESHOLD": {
+      "type": "number", "minimum": 0, "maximum": 10,
+      "description": "Difficulty score above which a swarm is auto-spawned"
+    },
+    "CONTEXT7_DEPTH": {
+      "type": "enum", "values": ["MINIMAL", "STANDARD", "EXTENDED"],
+      "description": "Depth of Context7 knowledge injection"
+    },
+    "DYNAMISM_LEVEL": {
+      "type": "number", "minimum": 1, "maximum": 5,
+      "description": "How aggressively the engine reshapes its own plan (1=static, 5=fully dynamic)"
+    },
+    "REACTIVE_MODE": { "type": "boolean", "description": "Enable the reactive (auto-discovery) engine" },
+    "CONTEXT_SHARDING": { "type": "boolean", "description": "Enable the sharded memory loop" },
+    "ADS_LOOP_ENFORCED": { "type": "boolean", "description": "Enforce the adversarial decision loop before architectural change" },
+    "TEMPORAL_VISION": { "type": "boolean", "description": "Enable temporal hindsight / steering" },
+    "RAG_2_AUTO_SHADOW": { "type": "boolean", "description": "Run RAG-2 retrieval in shadow mode" },
+    "ENABLE_ART_TRACING": { "type": "boolean", "description": "Enable agent reasoning trace (ART) capture" },
+    "ENABLE_ZTAI": {
+      "type": "boolean",
+      "nonOverridable": true,
+      "description": "NON-OVERRIDABLE: zero-trust agent identity cannot be bypassed"
+    },
+    "ZTAI_KEY_TYPE": { "type": "string", "description": "Declared ZTAI key algorithm label" },
+    "NEXUS_TRACE_RETENTION_DAYS": {
+      "type": "number", "minimum": 1, "maximum": 365,
+      "description": "Days of NexusTracer trace retention"
+    },
+    "CADIA_CORE": { "type": "boolean", "description": "Enable the CADIA core layer" },
+    "PQAS_ENFORCED": {
+      "type": "boolean",
+      "description": "Post-quantum attestation enforcement (SIMULATED/inactive by default — see bin/governance/quantum-crypto.js)"
+    },
+    "PROACTIVE_HOMING": { "type": "boolean", "description": "Enable proactive homing / next-task discovery" },
+    "PLANNER": { "type": "string", "description": "Model id for the planning persona (canonical: PLANNER_MODEL)" },
+    "EXECUTOR": { "type": "string", "description": "Model id for execution agents (canonical: EXECUTOR_MODEL)" },
+    "REVIEWER": { "type": "string", "description": "Model id for the code reviewer (canonical: REVIEWER_MODEL)" },
+    "VERIFIER": { "type": "string", "description": "Model id for the verification persona (canonical: VERIFIER_MODEL)" },
+    "SECURITY": { "type": "string", "description": "Model id for security review (canonical: SECURITY_MODEL)" },
+    "DEBUG": { "type": "string", "description": "Model id for the debug specialist (canonical: DEBUG_MODEL)" },
+    "RESEARCH": { "type": "string", "description": "Model id for the research agent (canonical: RESEARCH_MODEL)" },
+    "QA": { "type": "string", "description": "Model id for the QA engineer (canonical: QA_MODEL)" },
+    "QUICK": { "type": "string", "description": "Model id for tier-1 budget-bias tasks (canonical: QUICK_MODEL)" },
+    "COST_WARN_USD": {
+      "type": "number", "minimum": 0, "maximum": 10000,
+      "description": "Daily spend at which a cost warning is emitted"
+    },
+    "COST_HARD_LIMIT_USD": {
+      "type": "number", "minimum": 0, "maximum": 10000,
+      "description": "Daily hard cost limit in USD. ENFORCED as of 11.9.3 (COST-02): bin/models/cost-tracker.js preflight() throws COST_LIMIT_REACHED once today's ledger spend plus the call estimate reaches this value, and bin/models/model-client.js re-throws it. 0 disables the cap, and so does omitting the key (it is `recommended`, not `required`) — an upgrade never rewrites an existing MINDFORGE.md. A present-but-unparseable value throws COST_LIMIT_MISCONFIGURED rather than silently running uncapped."
+    },
+    "ADS_DEBATE_ROUNDS": {
+      "type": "number", "minimum": 1, "maximum": 10,
+      "description": "Red-team/blue-team debate rounds per architectural decision"
+    },
+    "MIN_SOUL_SCORE": {
+      "type": "number", "minimum": 0, "maximum": 10,
+      "nonOverridable": true,
+      "description": "NON-OVERRIDABLE: minimum SOUL score required for architectural changes"
+    },
+    "REQUIRE_ADR": { "type": "boolean", "description": "Require an ADR for architectural decisions" },
+    "BLOCK_ON_SECURITY": {
+      "type": "boolean",
+      "nonOverridable": true,
+      "description": "NON-OVERRIDABLE: security gate enforcement cannot be disabled"
+    },
+    "BROWSER_PORT": {
+      "type": "number", "minimum": 1024, "maximum": 65535,
+      "description": "Port for the browser/QA harness"
+    },
+    "DASHBOARD_PORT": {
+      "type": "number", "minimum": 1024, "maximum": 65535,
+      "description": "Port for the MindForge dashboard"
+    },
+    "API_URL": { "type": "string", "description": "Base URL of the project API under development" },
+    "SHARD_RETAIN_DAYS": {
+      "type": "number", "minimum": 1, "maximum": 365,
+      "description": "Days to retain context shards"
+    },
+    "FORBIDDEN": { "type": "string", "description": "Multi-line block of project prohibitions injected into every agent prompt" },
+    "INSTRUCTIONS": { "type": "string", "description": "Multi-line block of project instructions injected into every agent prompt" },
     "MINDFORGE_VERSION_REQUIRED": {
       "type": "string",
       "pattern": "^\\d+\\.\\d+\\.\\d+$",
       "description": "Minimum MindForge version required for this config"
     },
     "PLANNER_MODEL": {
-      "type": "enum",
-      "values": ["claude-opus-4-5", "claude-sonnet-4-5", "claude-haiku-4-5", "inherit"],
-      "description": "Claude model to use for the planning agent"
+      "type": "string",
+      "deprecated": true,
+      "description": "DEPRECATED long form of [PLANNER]. Model id for the planning agent (free-form: model ids churn faster than this schema)"
     },
     "EXECUTOR_MODEL": {
-      "type": "enum",
-      "values": ["claude-opus-4-5", "claude-sonnet-4-5", "claude-haiku-4-5", "inherit"],
-      "description": "Claude model to use for execution agents"
+      "type": "string",
+      "deprecated": true,
+      "description": "DEPRECATED long form of [EXECUTOR]. Model id for execution agents"
     },
     "REVIEWER_MODEL": {
-      "type": "enum",
-      "values": ["claude-opus-4-5", "claude-sonnet-4-5", "claude-haiku-4-5", "inherit"],
-      "description": "Claude model to use for the code reviewer"
+      "type": "string",
+      "deprecated": true,
+      "description": "DEPRECATED long form of [REVIEWER]. Model id for the code reviewer"
     },
     "SECURITY_MODEL": {
-      "type": "enum",
-      "values": ["claude-opus-4-5", "claude-sonnet-4-5", "claude-haiku-4-5", "inherit"],
-      "description": "Claude model to use for security review (recommend Opus for thoroughness)"
+      "type": "string",
+      "deprecated": true,
+      "description": "DEPRECATED long form of [SECURITY]. Model id for security review"
     },
     "TIER1_AUTO_APPROVE": {
       "type": "boolean",

package/.mindforge/config.json

@@ -1,11 +1,11 @@
 {
-  "version": "11.9.1",
+  "version": "11.9.3",
   "environment": "development",
   "governance": {
     "drift_threshold": 0.75,
     "critical_drift_threshold": 0.5,
     "res_threshold": 0.8,
-    "active_did": "did:mindforge:ea8ace55-c2f0-46f2-af28-4d5a8ee3293a"
+    "active_did": ""
   },
   "revops": {
     "market_registry": {
@@ -71,7 +71,7 @@
   },
   "mesh": {
     "_node_id_note": "Set node_id to a unique value per node in multi-node deployments. auto = hostname-derived.",
-    "node_id": "beta-node",
+    "node_id": "auto",
     "peers": []
   },
   "ase": {
@@ -125,7 +125,7 @@
       "project_weekly_warn_usd": 50,
       "project_weekly_hard_limit_usd": 200
     },
-    "ledger_path": ".mindforge/metrics/token-ledger.jsonl"
+    "ledger_path": ".mindforge/metrics/token-usage.jsonl"
   },
   "proactive_suggestions": {
     "enabled": true,

package/.mindforge/engine/autonomous/headless-adapter.md

@@ -46,8 +46,8 @@ Typical GitHub Action setup:
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - name: Run MindForge Auto
-    run: npx mindforge auto --phase 3 --headless
+  - name: Run MindForge headless
+    run: npx mindforge headless --phase 3
     env:
       MINDFORGE_TOKEN: ${{ secrets.MINDFORGE_TOKEN }}
       AUTO_PUSH_ON_WAVE_COMPLETE: true

package/.mindforge/engine/cost-tracking/router.md

@@ -41,7 +41,7 @@ These always override the matrix:
 3. Map score to tier via decision matrix
 4. Apply override rules
 5. Check budget: if remaining budget < estimated cost, downgrade one tier with WARNING
-6. Log routing decision to token-ledger.jsonl
+6. Log routing decision to token-usage.jsonl
 7. Return selected model ID
 
 ## Budget Guard

package/.mindforge/engine/cost-tracking/token-ledger.md

@@ -5,43 +5,40 @@ Append-only ledger recording all token usage for analytics, budgeting, and optim
 
 ## Storage
 
-- Location: `.mindforge/metrics/token-ledger.jsonl`
+- Location: `.mindforge/metrics/token-usage.jsonl` (canonical shape: `bin/models/usage-record.js`)
 - Format: JSON Lines (one entry per model interaction)
 - Rotation: Archive entries older than 30 days to `.mindforge/metrics/archive/`
 - Retention: Archives kept for 90 days, then deleted
 
 ## Entry Format
 
-Each line in the ledger is a complete JSON object:
+Each line in the ledger is a complete JSON object. The authoritative shape is
+`bin/models/usage-record.js`; this is what `bin/models/cost-tracker.js`
+actually appends today (all five providers in `bin/models/*-provider.js` emit it):
 
 ```json
 {
-  "id": "txn-[uuid]",
-  "timestamp": "2026-05-25T10:30:00Z",
-  "session_id": "session-abc123",
-  "task_id": "task-def456",
-  "phase": "execute",
   "model": "claude-sonnet-4-6",
-  "tier": "standard",
-  "routing_reason": "difficulty_score_5_multi_file",
-  "tokens": {
-    "input": 12500,
-    "output": 3200,
-    "cached_input": 8000,
-    "total": 15700
-  },
+  "input_tokens": 12500,
+  "output_tokens": 3200,
+  "cache_read_input_tokens": 8000,
+  "cache_creation_input_tokens": 0,
   "cost_usd": 0.085,
-  "budget_remaining": {
-    "session": 4.915,
-    "project_weekly": 49.915
-  },
-  "task_type": "implementation",
-  "files_touched": 3,
-  "skills_loaded": ["code-quality", "testing-standards"],
-  "outcome": "success"
+  "task_name": "Plan 3-04",
+  "session_id": "session-abc123",
+  "phase": 3,
+  "date": "2026-05-25",
+  "timestamp": "2026-05-25T10:30:00.000Z"
 }
 ```
 
+`cost_usd` is the ONLY cost field. `total_cost_usd` belongs to cross-review
+reports (`bin/review/cross-review-engine.js`) and must never appear here.
+
+Not yet emitted (aspirational — do not read these): `id`, `task_id`, `tier`,
+`routing_reason`, `budget_remaining`, `task_type`, `files_touched`,
+`skills_loaded`, `outcome`.
+
 ## Reporting Queries
 
 The `/mindforge:cost-report` command reads this ledger to produce:
@@ -71,7 +68,7 @@ debugging       | $0.85    | 32,000     | 8
 
 ## Integration
 
-- Written to by the budget-enforcer after every model interaction
+- Written to by `bin/models/cost-tracker.js` `record()` after every model interaction (called from `bin/models/model-client.js:77`)
 - Read by `/mindforge:cost-report` command
 - Summarized weekly into `.mindforge/metrics/weekly-cost-summary.json`
 - Referenced by AgRevOps dashboard for ROI tracking

package/.mindforge/engine/temporal-protocol.md

@@ -10,7 +10,7 @@ Temporal Vision enables high-fidelity "Time-Travel Debugging" by snapshotting th
    - `task_completed`
    - `hindsight_injected`
 2. **Persistence**: Snapshots are stored in `.planning/history/[audit_id]/`.
-3. **Retention**: The system retains snapshots for the current milestone. Completed milestones should be archived or purged using `/mindforge:temporal --cleanup`.
+3. **Retention**: The system retains snapshots for the current milestone. Completed milestones should be archived or purged using `mindforge temporal cleanup`.
 
 ## Hindsight Injection Protocol
 Hindsight Injection is a powerful tool and must be used according to these safety rules:
@@ -37,4 +37,4 @@ Hindsight Injection is a powerful tool and must be used according to these safet
 ## Common Operations
 - `GET /api/temporal/history`: View the timeline.
 - `POST /api/temporal/inject`: Perform hindsight repair.
-- `/mindforge:temporal --status`: Check history size and snapshot count.
+- `mindforge temporal status`: Check history size and snapshot count.