mindforge-cc 11.9.1 → 11.9.3

package/.mindforge/governance/change-classifier.md

@@ -44,9 +44,25 @@ Scan the actual diff content, not only filenames, for patterns such as:
 This protects against security-critical code being added to innocuous filenames
  like `src/utils/helper.ts`.
 
-### Signal C — AUDIT history patterns
-If the current phase has a recent HIGH or CRITICAL `security_finding`, the next
- change in that phase is elevated to Tier 3 automatically.
+### Signal C — AUDIT history patterns (SPECIFIED, NOT IMPLEMENTED)
+Intended behaviour: if the current phase has a recent HIGH or CRITICAL
+ `security_finding`, the next change in that phase is elevated to Tier 3
+ automatically.
+
+**This signal does not exist in `bin/change-classifier.js`.** It is recorded here
+ as a design intent, not as a live protection, because it would read from
+ `.planning/AUDIT.jsonl` — which is gitignored (`.gitignore:81`), untracked, and
+ absent from `package.json` `files[]`. That file therefore does not exist in the
+ fresh clone the classifier actually runs in
+ (`.github/workflows/control-plane.yml`). Implementing it against a source that is
+ structurally unavailable at the point of enforcement would produce a signal that
+ silently never fires — the same defect class as the Signal B gap above, where 13
+ of the 19 documented patterns were specified and absent.
+
+The `security_finding` event itself is real and carries `severity`: see
+ `bin/dashboard/metrics-aggregator.js:160` and `bin/revops/debt-monitor.js:23`,
+ both of which read it from a local audit log. Enabling Signal C needs a decision
+ about how phase history reaches CI, not merely classifier code.
 
 ## Classification audit entry
 Record why the tier was selected:
@@ -56,7 +72,7 @@ Record why the tier was selected:
   "event": "change_classified",
   "tier": 3,
   "classification_reason": "code pattern: jwt.sign found in src/utils/helper.ts",
-  "signals_checked": ["file_path", "code_content", "audit_history"],
+  "signals_checked": ["file_path", "code_content"],
   "signal_triggered": "code_content",
   "pattern_matched": "jwt.sign"
 }

package/.mindforge/memory/sync-manifest.json

@@ -1,6 +1,6 @@
 {
   "pattern-library.jsonl": {
-    "lastSync": "2026-07-29T10:18:46.944Z",
+    "lastSync": "2026-08-21T12:02:25.078Z",
     "localCount": 1
   }
 }

package/.mindforge/metrics/METRICS-SCHEMA.md

@@ -1,13 +1,22 @@
 # MindForge Metrics — Schema Reference
 
 ## Files
-- `session-quality.jsonl`
-- `phase-metrics.jsonl`
-- `skill-usage.jsonl`
-- `compaction-quality.jsonl`
+- `session-quality.jsonl` — **no producer in this repo**; every reference to it
+  (`bin/dashboard/metrics-aggregator.js`, `sdk/src/client.ts`,
+  `mcp-server/src/vendor/client.ts`) is a READ. Expected to be supplied by the
+  agent/host; MindForge only consumes it.
+- `phase-metrics.jsonl` — no producer in this repo
+- `skill-usage.jsonl` — no producer in this repo
+- `compaction-quality.jsonl` — no producer in this repo
+- `token-usage.jsonl` — **code-written** by `bin/models/cost-tracker.js`; canonical
+  shape is `bin/models/usage-record.js`. Cost lives in `cost_usd` and nowhere else.
+  Gitignored and excluded from the npm tarball.
 
 All files are append-only JSONL.
 
+Per-session cost is NOT a `session-quality.jsonl` field: the dashboard joins it
+from `token-usage.jsonl` on `session_id`.
+
 ## session-quality.jsonl fields
 - session_id, date, phase, developer_id
 - tasks_attempted, tasks_completed, tasks_failed

package/.mindforge/personas/cost-optimizer.md

@@ -39,7 +39,7 @@ Map score to model tier via the routing decision matrix.
 </step>
 
 <step name="check_budget">
-Read token-ledger.jsonl for current session/project spend.
+Read token-usage.jsonl for current session/project spend.
 Compare against budget limits in config.json.
 If approaching warn threshold: flag to user.
 </step>
@@ -66,6 +66,6 @@ Recommend routing adjustments for next session.
 - NEVER skip security overrides to save money (auth/payment always >= standard tier)
 - NEVER exceed hard budget limit without explicit user approval
 - NEVER silently downgrade model quality — always inform
-- Track every model interaction in token-ledger.jsonl
+- Track every model interaction in token-usage.jsonl
 - Report cost transparency in every session summary
 </critical_rules>

package/.mindforge/personas/multi-model-bridge.md

@@ -82,5 +82,5 @@ Report to user with:
 - ALWAYS attribute responses to their source model
 - Maximum 2000 tokens per external prompt (cost control)
 - Maximum 3 consultations per session (rate limiting)
-- Log every external call in token-ledger.jsonl
+- Log every external call in token-usage.jsonl
 </critical_rules>

package/.mindforge/skills/agent-architecture-audit/SKILL.md

@@ -79,7 +79,7 @@ audit has a real target, not an abstraction.
 | 9 | Answer shaping | SWARM-SUMMARY consolidation | Format corruption in the final response |
 | 10 | Platform rendering | Dashboard (localhost:7339) / CLI / API transport | Transport-layer mutation of a valid answer |
 | 11 | Hidden repair loops | soul-engine ADS rewrite + Temporal hindsight regeneration | Silent fallback/retry running a second LLM pass |
-| 12 | Persistence | auto-state.json + Merkle audit log | Expired state or cached artifacts reused as live evidence |
+| 12 | Persistence | auto-state.json + hash-chained audit log | Expired state or cached artifacts reused as live evidence |
 
 ### Common Failure Patterns
 
@@ -148,7 +148,7 @@ Define what you're auditing:
 Gather evidence from the codebase:
 - **Source code** — swarm loop, hooks_route tool router, shard admission, prompt
   assembly across the source-of-truth hierarchy
-- **Logs** — NexusTracer session traces, Merkle-linked AUDIT entries, tool-call
+- **Logs** — NexusTracer session traces, hash-chained AUDIT entries, tool-call
   records
 - **Config** — MINDFORGE.md parameters, tool schemas, PersonaFactory patches,
   provider settings

package/.mindforge/skills/cost-aware-routing/SKILL.md

@@ -62,7 +62,7 @@ for cost-performance tradeoffs, or when budget limits are approaching.
 ### Budget Monitoring
 
 Check budget status regularly:
-- Session budget remaining: from token-ledger.jsonl
+- Session budget remaining: from token-usage.jsonl
 - Warning threshold: `[COST_WARN_USD]` from config
 - Hard limit: `[COST_HARD_LIMIT_USD]` from config
 
@@ -72,12 +72,12 @@ Check budget status regularly:
 - Never exceed hard limit without explicit user approval
 
 ### After any task
-- Log actual model used + tokens consumed to token-ledger.jsonl
+- Log actual model used + tokens consumed to token-usage.jsonl
 - Compare actual vs optimal tier (for future routing accuracy)
 - Report cost in session summary
 
 ## Self-check before task completion
 - [ ] Did I log the model routing decision with rationale?
-- [ ] Did I record actual token usage in token-ledger.jsonl?
+- [ ] Did I record actual token usage in token-usage.jsonl?
 - [ ] Did I check remaining budget against session/project limits?
 - [ ] Did I flag any tasks where a cheaper model could have been used?

package/.mindforge/skills/multi-llm-consult/SKILL.md

@@ -57,7 +57,7 @@ multiple AI providers, or when the user explicitly requests cross-model consulta
    ```
 
 ### During consultation
-- Log every external call in token-ledger.jsonl (model, tokens, cost)
+- Log every external call in token-usage.jsonl (model, tokens, cost)
 - Never send more than 2000 tokens to external models per consultation
 - If a model is unavailable: skip it, note in output, continue with available models
 - Respect rate limits — max 3 consultations per session
@@ -70,6 +70,6 @@ multiple AI providers, or when the user explicitly requests cross-model consulta
 
 ## Self-check before task completion
 - [ ] Did I sanitize the prompt before sending to external models?
-- [ ] Did I log every external call in token-ledger.jsonl?
+- [ ] Did I log every external call in token-usage.jsonl?
 - [ ] Did I attribute responses to their source model (no unattributed blending)?
 - [ ] Did I remind the user that external opinions are advisory?

package/.mindforge/skills/orch-pipeline/SKILL.md

@@ -128,7 +128,7 @@ Each phase delegates — it does not do the work inline.
   and `security-auditor` / `penetration-tester` whenever the diff touches a
   security trigger.
 - **6. Commit** — conventional commits (`feat:` / `fix:` / `refactor:` / …), one
-  per logical chunk, **+ a Merkle-linked AUDIT.jsonl entry per commit**. → **GATE 2.**
+  per logical chunk, **+ a hash-chained AUDIT.jsonl entry per commit**. → **GATE 2.**
 
 ---
 
@@ -166,7 +166,7 @@ This family is **gated, not autonomous**:
    work, the manual security overhead is completed here before approval.
 2. **GATE 2 — before Commit.** Present the diff summary and proposed conventional
    commit messages; do not commit until the user confirms. Each confirmed commit
-   writes a Merkle-linked AUDIT.jsonl entry (below).
+   writes a hash-chained AUDIT.jsonl entry (below).
 
 Everything between the gates flows without stopping.
 
@@ -227,7 +227,7 @@ On user confirmation at Gate 2, for **each** logical commit:
 
 1. Commit with a **conventional** message scoped to one logical change:
    `feat(<scope>): …` / `fix(<scope>): …` / `refactor(<scope>): …` / etc.
-2. Append a **Merkle-linked** AUDIT.jsonl entry to `.planning/AUDIT.jsonl`. Each
+2. Append a **hash-chained** AUDIT.jsonl entry to `.planning/AUDIT.jsonl`. Each
    entry sets `previous_hash` to the prior entry's `_hash` and computes its own
    `_hash` (per `.mindforge/audit/AUDIT-SCHEMA.md`):
 
@@ -263,7 +263,7 @@ On user confirmation at Gate 2, for **each** logical commit:
       security trigger was touched; `/mindforge:security-scan` passed PRE-COMMIT
       with no unaddressed Medium+ findings.
 - [ ] Commits are conventional and scoped to one logical change.
-- [ ] Each commit wrote a Merkle-linked AUDIT.jsonl entry (`previous_hash`/`_hash`).
+- [ ] Each commit wrote a hash-chained AUDIT.jsonl entry (`previous_hash`/`_hash`).
 - [ ] New / changed behavior has tests; coverage ≥ 80%.
 
 ---

package/CHANGELOG.md

@@ -1,5 +1,407 @@
 # Changelog
 
+## [11.9.3] — 2026-08-21 — Honesty: gates that can fail, commands that run, a release path that is checked
+
+Patch release. No new features. Twenty-one fixes, and they all turned out to be the
+same defect: **an instrument reported success while doing nothing.** Gates that could
+not fail, tests satisfied by a comment, docs describing capabilities with no code
+behind them, commands printing success while performing no action, and a publish path
+that no check ever touched.
+
+Contains behaviour changes under a patch bump — several of the things being fixed were
+bugs that a consumer could have been relying on. Read BREAKING before upgrading if you
+script against the CLI or the installer.
+
+### BREAKING
+
+Each of these is a bug fix whose correct behaviour differs from the shipped behaviour.
+
+- **Routed CLI commands now act on YOUR project, not MindForge's own checkout.**
+  `bin/mindforge-cli.js` passed `cwd: ROOT` to every routed command, so `mindforge
+  classify` diffed MindForge's repository instead of yours, and `mindforge health`
+  inspected MindForge's `node_modules`. Measured across all 27 routed commands: 7
+  changed behaviour, all in the correct direction, none regressed. If you parsed output
+  that happened to describe MindForge itself, it now describes your project. (#201)
+
+- **`npx mindforge-cc install` — and any other positional argument — now exits 1.**
+  The installer takes flags only and silently ignored stray words, so
+  `npx mindforge-cc install` appeared to work while installing nothing configured.
+  It now refuses with the correct form. `--runtime`'s value token is still accepted.
+  Use `npx mindforge-cc --claude --local`. (#202)
+
+- **`mindforge verify` now SKIPS unavailable stages instead of failing them.** A project
+  with no ESLint config, no test script or no `bin/verify-audit.js` was reported as
+  FAILING those stages rather than as not having them. If your CI relied on a non-zero
+  exit in those cases, it will now pass. A run in which every stage skipped prints a
+  "NOTHING WAS VERIFIED" banner rather than a clean bill of health. (#204)
+
+- **`scripts/sync-version.js` now exits non-zero when the plugin build artifacts are
+  stale.** A bump used to report `✅ every derivable channel is at <version>` and exit 0
+  while leaving `npm test` red. If you script this, handle the new exit code — it means
+  "run the build chain it just printed". (#211)
+
+- **A self-install no longer writes over your tracked files.** Running the installer
+  inside a MindForge checkout printed that it was skipping and then overwrote 149
+  tracked files, including `CLAUDE.md`, `.claude/**`, `.agent/**` and `.mindforge/**`.
+  The skip is now honoured for local scope. (#200)
+
+- **Releases must be tagged on a commit reachable from `main`.** The release workflow
+  now refuses a tag that is not an ancestor of `origin/main`. The documented flow is
+  develop → release → main; tagging elsewhere previously published, with provenance
+  attesting to that tree. (#216)
+
+### Fixed
+
+**Installer**
+
+- A self-install claimed to skip and then overwrote 149 tracked files. The gate is now
+  scope-aware (`isSelfInstall() && scope === 'local'`). (#200)
+- Every `--global` install reported failure on a correct run: `verifyInstall` demanded
+  six `bin/**` paths regardless of scope, so a global install ended
+  `❌ 6 of 12 required file(s) missing` and exit 1, with a `--force` retry that could
+  not help. A global install writes 389 files to `$HOME/.claude` and, deliberately,
+  zero to `bin/`. (#210)
+- 11 of 27 routed CLI verbs died on `MODULE_NOT_FOUND` in a real install: the router
+  shipped but 6 of the scripts it dispatches to did not. `coreFiles` grew from 2 entries
+  to 8. (#210)
+- Two leaks: `/tmp` staging files left behind on abandoned runs, and developer runtime
+  state (`celestial.db`, `.browser-daemon-token`) copied into consumer projects.
+  `SENSITIVE_EXCLUDE` now covers both. (#210)
+- The forge commands overwrote three `mindforge` commands of the same name. (#197)
+- The documented default install did not deliver the CLI it documents. (#196)
+
+**Versioning and release**
+
+- `sync-version.js --fetch-sha` hashed npm's 404 error body. For an unpublished version
+  the registry answers `{"error":"Not found"}` and `curl -sL` exits 0, so the digest
+  written into the Homebrew formula was the SHA-256 of that error text — the same
+  constant for every unpublished version — and `--check` then passed. Now `curl -fsSL`
+  plus a gzip magic-byte check, and it refuses rather than writing a digest no artifact
+  can match. (#203)
+- The Homebrew formula may now LAG canonical but never LEAD it. Requiring equality
+  before publishing required something impossible: the digest is the hash of a tarball
+  that does not exist yet, and `npm test` blocked the publish that would have made it
+  satisfiable. (#208)
+- Semver comparison is numeric per component. Lexicographically, `11.10.0` reads as
+  *behind* `11.9.2` — wrong on exactly the first release past a `.9` minor. (#208)
+- Three version channels had no writer at all, so `npm test` failed on every bump and
+  the documented remedy could not fix it: `mcp-server/server.json` (both keys, matched
+  by identifier), `AGENTS.md`, and `sdk/README.md`'s second shape. (#207, #211)
+- **No channel covered a document a user receives.** `SECURITY.md` — the security policy
+  at the root of the published package — said "Current version: 11.9.0", and
+  getting-started, faq, troubleshooting, user-guide and sdk-reference all titled
+  themselves v11.9.0: three releases stale, while every npm manifest was correct.
+  `--check` was green throughout, because a channel that does not exist cannot drift.
+  Structural markers now track canonical; narrative measurements deliberately do not.
+  (#211)
+- A bump is not finished when `sync-version.js` exits. Two tracked artifacts are gated
+  against `package.json` and only a build can write them —
+  `plugins/mindforge/.claude-plugin/plugin.json` and
+  `plugins/mindforge/mcp/dist/index.js`. They are now reported under
+  `🔨 REQUIRE A BUILD` with the exact three-command chain, which nothing had documented.
+  (#211)
+- `sync-version.js` reported "a channel is AHEAD of canonical" whenever its exit code
+  was non-zero for any reason, so the `--fetch-sha` refusal for an unpublished tarball
+  claimed the formula LEADS canonical in the same run that printed "DEFERRED until after
+  publish (behind, not ahead)". (#211)
+- `changelogs/index.json`, which `bin/updater/changelog-fetcher.js` reads as the
+  authoritative version list, was missing 11.9.2. (#218)
+
+**Publishing**
+
+- **The tag push that publishes was exempt from every gate.** Publishing is triggered by
+  exactly one event — a `v*` tag push — and the repository's only ruleset targets
+  branches, so its six required checks applied to nothing on the path that ships. GitHub
+  cannot attach required status checks to a tag. A `preflight` job now gates it. (#216)
+- The `stable` npm dist-tag was moved by hand, or not at all — it sat four releases
+  behind `latest` (11.8.3 against 11.9.2), so `npm i mindforge-cc@stable` delivered a
+  build with none of the 11.9.x fixes. The release workflow now moves it as its final
+  step: forward-only, prereleases skipped, and verified against npm's uncached dist-tags
+  endpoint rather than the CDN-cached packument. (#216)
+
+**Dashboard**
+
+- `--status` and `--stop` were documented in nine places and implemented in none; both
+  printed nothing and exited 0. Now implemented, before `express` is required, so they
+  work without the dependency installed. (#206)
+- `--stop` identified the target by the SHAPE of its command line, which matched any
+  `node <anything>/dashboard/server.js` — verified against
+  `node /var/www/unrelated_app/dashboard/server.js`. It now resolves the script's
+  realpath and compares it to its own. (#206)
+- `--status` printed a port it could not know: the PID file records only the pid, so it
+  reported whatever port that invocation happened to receive. Measured, `--status` on a
+  server started with `--port 7466` printed "port 7339". (#206)
+
+**Memory**
+
+- Every abandoned exit left a full copy of the database on disk — 1.8 GB of orphaned
+  `.tmp` files. (#199)
+- The SDK's WebSocket client took the caller's process down on a failed reconnect. (#191)
+
+**Verification**
+
+- `mindforge verify`'s lint stage used `--max-warnings=0`, which made it impossible to
+  pass in the repository it ships from: `npx eslint .` reports 199 problems / 0 errors /
+  199 warnings, so `verify` reported a lint FAILURE on a tree that is green by the
+  project's own contract. Aligned with the project's definition; errors still fail. (#204)
+- `temporal cleanup` printed "🧹 Cleaning up old temporal snapshots..." and
+  "✅ Cleanup complete." with no cleanup between them. Now wired to
+  `TemporalHub.gc({maxSnapshots: 50, maxAgeDays: 30})` with `--dry-run` and honest
+  counts, including zero. (#209)
+
+**Documentation that named things that do not exist**
+
+- The protocol files instructed the agent to run `soul-engine.js` and
+  `shard-controller.js`, neither of which exists anywhere in the package. Those steps
+  are reasoning protocols and now say so. (#205)
+- Fifteen phantom `/mindforge:` slash commands in shipped docs. A reader following
+  `docs/user-guide.md` typed `/mindforge:personas --list` and got nothing. They were not
+  typos: `.agent/workflows/` holds 130 tracked files using those exact names — an old
+  target layout, committed and orphaned, shipping zero files. (#209)
+- Four documented CLI invocations could not be run, each verified by running it:
+  `npx mindforge-cc@latest install` (exit 1), `mindforge-cli.js dashboard` (exit 1),
+  `npx mindforge auto` in a shipped engine doc (`auto` is a slash command, never a CLI
+  verb), and `@mindforge <verb>`, a syntax that exists nowhere. (#213)
+- `workflow` is the most-documented CLI verb in the project and works, but appeared in
+  neither `--help` nor the "Available commands" list, so a user who mistyped it was told
+  it does not exist. (#213)
+- Root `CLAUDE.md` named `bin/hooks/mindforge-context-monitor.js`; the file is under
+  `.agent/hooks/`. (#214)
+
+### Added
+
+- **`preflight` job on the release workflow.** Asserts the tagged commit is an ancestor
+  of `origin/main`, then runs the six gates a tag push never saw, with the publish job
+  behind `needs:`. (#216)
+- **Automatic `stable` dist-tag movement**, forward-only and verified. (#216)
+- **`node bin/dashboard/server.js --status` / `--stop`.** Not CLI verbs —
+  `mindforge-cli.js dashboard` does not route. (#206)
+- **`mindforge temporal cleanup --dry-run`.** (#209)
+- New regression gates, each falsified by mutation before being trusted:
+  `tests/protocol-claims.test.js` (no exemption list, deliberately — a name-keyed
+  allowlist was shown to excuse the exact defect it was written for), the shipped-doc
+  phantom-command gate, the CLI-verb gate, the authority-doc `.js` gate, the
+  version-channel round trips, and assertions that the release preflight itself cannot
+  be silently removed.
+
+### Notes for operators
+
+- `npm run version:check` is the offline drift check. A bump is finished only when
+  `sync-version.js` exits 0 — if it prints `🔨 REQUIRE A BUILD`, run the three commands
+  it names and commit both regenerated files.
+- Releases are now gated on being tagged from `main`. One residual, inherent to
+  tag-triggered workflows: a tag push resolves the workflow from the TAGGED ref, so a
+  tag placed on a commit predating this release runs that commit's workflow and is
+  ungated.
+
+## [11.9.2] — 2026-08-16 — Correctness: audit-chain integrity, dashboard crash policy, secret scanning
+
+Patch release. No new features. Correctness work closing defects found by a
+multi-agent audit of v11.9.1, plus the regression suites that keep them closed.
+Contains a breaking change to the dashboard HTTP surface — see BREAKING below.
+
+### BREAKING
+
+Shipped under a PATCH bump. The break is confined to the dashboard's own HTTP
+surface, which binds to 127.0.0.1 only — but if you script against it, read this.
+
+- **Dashboard error responses changed shape.** `detail` is removed from 5 endpoints and
+  raw errno strings from 10 more; `correlation_id` is added to 15; a malformed request
+  body now returns `application/json` instead of express's `text/html` error page.
+  Anything parsing `detail` must correlate on the logged `correlation_id` instead. This
+  was deliberate — those fields leaked absolute filesystem paths, and therefore the
+  operator's username and home directory, into an unauthenticated response body
+  (`requireAuth` exempts GET).
+- **The dashboard now EXITS on an unhandled rejection or uncaught exception** where
+  11.9.1 logged and continued. If you supervise the process, expect restarts where you
+  previously saw a logged error. Rationale in the Fixed section below: log-and-continue
+  held client sockets open until the client timed out, and had made `shutdown()` swallow
+  a throwing token unlink and keep serving the authenticated mutation API after SIGTERM.
+- **`node bin/validate-config.js` and `mindforge security-scan` can now fail.** They
+  previously reported `MINDFORGE.md valid — 0 settings configured` and exited 0 on every
+  input. If you run either in CI, a genuinely invalid registry will now red-line where it
+  used to pass. Note this reaches **fresh installs and `--force` reinstalls only** — the
+  installer does not overwrite an existing `.mindforge/MINDFORGE-SCHEMA.json`, so a plain
+  upgrade keeps the old permissive schema.
+
+### Fixed
+
+- **`security-scan` could not fail.** `bin/validate-config.js` and
+  `bin/models/model-router.js` each parsed `MINDFORGE.md` with a plain `KEY=value` regex, but
+  the registry declares its 43 parameters as bracketed `[KEY] = value`. Every schema property
+  resolved to `undefined` and short-circuited, so the command reported
+  `MINDFORGE.md valid — 0 settings configured` and exited 0 on any input. The schema also had
+  no `required` key at all. Both parsers now share `bin/utils/mindforge-params.js`, which also
+  accepts the legacy plain form (`examples/starter-project/MINDFORGE.md` ships 28 such lines),
+  and the schema declares real `required`/`recommended` sets.
+  **Behaviour change for consumers:** three CI gates go from unfailable to failable —
+  `.github/workflows/mindforge-ci.yml:38`, `.gitlab-ci-mindforge.yml:12`, and
+  `.github/workflows/control-plane.yml:100`. If one red-lines on a valid value, the schema
+  bound is wrong; do not "fix" it by editing `MINDFORGE.md`. Model routing is unchanged —
+  30 persona x tier combinations resolve identically.
+- **Trace retrieval returned nothing usable.** Queries were wrapped as a single FTS phrase, so
+  any query containing one absent term scored zero; and `traces_search` was keyed on `trace_id`
+  rather than the primary key, so each span's DELETE evicted the previous span and only the last
+  span per trace stayed searchable — 2,270 of 5,117 content-bearing traces, 44.4%, unsearchable.
+  Queries are now tokenised, OR-joined and ranked by tf-idf (`matchinfo('pcnx')`); the index is
+  re-keyed and rebuilt losslessly from the base table. `bin/eval/eval-harness.js` and its golden
+  set had zero callers and are now reachable as `npm run eval:retrieval`, with the baseline
+  committed: mean recall@10 0.6417, nDCG 0.5698 over 519 documents.
+- **The cost ledger reported two totals for one concept.** `sum(cost_usd)` was $13.73 while
+  `sum(total_cost_usd)` was $0.00, and `tests/dashboard.test.js` wrote the reader's field name,
+  so the mismatch tested green. `bin/models/usage-record.js` is now the single definition of the
+  ledger path, record shape, per-entry cost and day bucket. The configured `ledger_path` pointed
+  at `token-ledger.jsonl`, a file that has never existed; that ghost filename had spread to 17
+  places across 13 files and is now absent. The dashboard cost tile no longer renders `$0.00`
+  on a 500 — it had no `res.ok` check, and because errors return well-formed JSON the catch
+  never fired, making an outage indistinguishable from zero spend.
+  A maintainer tool, `scripts/purge-synthetic-usage.js`, removes fixture rows: dry-run by
+  default, backs up first, idempotent, and aborts leaving the ledger untouched if the rewrite
+  fails. It is run from a repository checkout — `scripts/` is not in the published tarball, so
+  installed consumers do not have it.
+- **Audit hash chain could fork under concurrent writers.** `bin/autonomous/audit-writer.js`
+  read the chain head and appended with no mutual exclusion, and cached the head in-process
+  indefinitely — so once a second process appended, the first kept chaining from a superseded
+  hash. Added `bin/utils/file-lock.js` (a fail-closed advisory lock promoted from
+  `bin/learning/instinct-cli.js`, deliberately NOT from `.agent/bin/lib/state.cjs`, which
+  writes anyway when the lock cannot be taken) held across read-head-through-fsync, and made
+  the cached head carry the file size that witnesses it is still the tail. 8 concurrent
+  appenders went from 199 broken links + 4 forks per 200 entries to 0. A lock alone was
+  measured insufficient — it still left 2 breaks and 1 fork, because the stale cache is a
+  second, independent defect.
+- **Knowledge-graph edge updates were lost under concurrency.** `deprecateEdge`,
+  `reinforceEdge` and `applyDecay` in `bin/memory/knowledge-graph.js` each did
+  `readAllEdges()` -> mutate -> append with no lock, and `addEdge` appended unserialised
+  against them. Measured at HEAD over 4 runs of 8 processes x 20 `reinforceEdge` calls:
+  93-129 of 160 increments lost, final `traversal_count` 31-67 instead of 160. All four
+  write paths now hold the `graph-edges.jsonl` lock across read-through-append; the same
+  probe then loses 0 of 160 in every run, with no lock-acquisition failures.
+- `bin/governance/policy-engine.js`: `logAudit`'s un-awaited audit write now has a
+  `.catch()` — a lock-contention failure is reported at the decision site instead of
+  escaping as an unhandled rejection.
+- `bin/hooks/instinct-capture-hook.js` appended to the instinct store without the lock that
+  `instinct-cli`'s prune/import rewrite holds, so a hook append landing in that window was
+  clobbered by the rename. It now takes the same lock.
+- `tests/v7-sovereign-security.test.js`: `new PolicyEngine()` no longer defaults
+  `planningDir` to `process.cwd()`, which appended test verdicts to the operator's real
+  `.planning/RISK-AUDIT.jsonl`.
+- Packaging: `package.json` files[] now excludes `**/*.lock` so a lockfile orphaned by a
+  hard kill cannot leak into the npm tarball (verified: without the negation, a
+  `.mindforge/memory/graph-edges.jsonl.lock` does ship).
+
+- **Audit-chain forgery via un-awaited rollback.** `HindsightInjector.inject` called
+  the async `TemporalHub.rollbackTo` without `await`, so its rejection escaped the
+  surrounding `try/catch` while execution continued: a failed rollback still fsync'd a
+  hash-chained `hindsight_injected` entry and flipped `auto-state.json` to
+  `awaiting_regeneration` for something that never happened. The log gained a
+  cryptographically valid record of a non-event, and `verify-audit` reported the chain
+  valid — valid and wrong.
+- **CLI `defaultArgs` were replaced by user arguments, not prepended.** `mindforge
+  health <anything>` lost `--check` and fell through to `installer-core`'s real
+  `install()` with `force: true`. Now prepended.
+- **`_verifyMetadata` compared UTF-16 code units, not bytes**, so a 64-unit / 65-byte
+  `integrity` still threw `RangeError` — and the caller degraded that throw into
+  "proceeding without integrity check" and restored the snapshot anyway. Read and
+  verify are now separate stages; only a genuinely absent `SNAPSHOT-META.json` reaches
+  the tolerant path.
+- **Dashboard `RevOpsAPI` was required but never mounted**, so `/api/revops/overview`
+  404'd while the AgRevOps panels and docs described it as live. Even mounted it threw:
+  `getAuditEntries()` returns `{entries,total,limit,offset}` and three engines call
+  `.filter()` on it.
+- **Dashboard leaked error internals to clients.** `err.message` reached response
+  bodies from 14 sites (`api-router.js` ×10, `temporal-api.js` ×3, `revops-api.js` ×1);
+  for fs-sourced errors that string carries absolute paths, disclosing the operator's
+  username and home directory. All sites now log server-side and return a generic
+  message plus a `correlation_id`, behind a 4-arg terminal handler that stops express
+  rendering `err.stack` when `NODE_ENV !== 'production'`.
+- **Test runner discovery was a flat `readdirSync`**, so any suite in a subdirectory was
+  invisible. Now a recursive walk that prunes `tmp-*` / `node_modules` / dot
+  directories — directories only, never files.
+- Three orphan files removed: one truncated `.planning/AUDIT.jsonl` to zero, one
+  overwrote `.planning/STATE.md`, one called a function absent from `bin/`. Recursion
+  made the `STATE.md` clobberer reachable by a single in-place rename; the other two
+  were unreachable by the runner at any depth. **The claim in `5177225`'s message that
+  all three were newly armed by recursion is correct for one of the three and
+  over-attributed for the other two.**
+- Three relocated demos kept one-level-up requires after moving a directory deeper, so
+  all three exited 1; corrected to `../../bin/`.
+
+### Changed
+
+- **`mindforge audit-skill`, `register-skill`, `install-skill` and `record-learning` no
+  longer carry `defaultArgs`.** Prepending turned them from inert into live state
+  writers: `audit-skill <name> <ver> <tier>` appended a hash-chained
+  `{event:'skill_installed', validation_passed:true}` entry for a skill that does not
+  exist, and `register-skill` wrote a malformed row above the table header of
+  `.mindforge/org/skills/MANIFEST.md`, which ships in the tarball. Bare invocations now
+  print usage and exit 0 without reaching those writers, as at v11.9.1.
+- **`subagent` is a first-class command.** Prepending `spawn` shadowed `spawn-agent`'s
+  `subagent` mode, whose documented route was `mindforge spawn subagent <name>`.
+- **The dashboard now exits on an unhandled rejection instead of logging and
+  continuing.** An escaped rejection is the only reliable signal that an async call was
+  left un-awaited, and express 4.22.1 does not route async handler rejections to error
+  middleware — log-and-continue held the client socket open until the client gave up
+  (2.5s, 4s and 8s clients all timed out) versus a ~15ms reset on exit. Symmetric with
+  `uncaughtException`, whose log-and-continue form had made `shutdown()` swallow a
+  throwing token unlink and keep serving the token-authenticated mutation API **after
+  SIGTERM**, with the bearer token still on disk and valid in memory.
+- **Dashboard error responses changed shape.** `detail` is removed from 5 endpoints,
+  raw errno strings from 10 more, `correlation_id` is added to 15, and a malformed
+  request body now returns `application/json` rather than express's `text/html` error
+  page. Anything parsing `detail` must correlate on the logged id instead.
+
+### Added
+
+- **Secret scanning enforced at three layers**: `.gitleaks.toml`, a `.husky/pre-commit`
+  gate that fails loudly when gitleaks is absent rather than skipping, and
+  `.github/workflows/secret-scan.yml` scanning full history. `scripts/ci/verify-secret-scan.sh`
+  self-tests the scanner — it distinguishes "scanned clean" from "scanned and found"
+  from "did not scan", because gitleaks exits 1 for both a finding and a failed config
+  load, and writes no report in the latter case.
+
+### Tests
+
+- Suite totals for this release: **105 files, 103 pass, 2 environment-dependent skips**
+  (`browser`, `sre-integration`). Eight new suites across the release:
+  `temporal-integrity`, `dashboard-error-leak`, `dashboard-crash-guards`,
+  `dashboard-wiring`, `cli-router`, `mindforge-params`, `file-lock`, `retrieval-fts`.
+- **Four suites could not report failure and now can.** `v8-persistence`,
+  `v8-skill-evolution` and `v8-orbital-governance` ended `finally { process.exit(0) }`, and
+  `v7-pillar-integration` had zero assertions with a premium-model gate that named two models
+  absent from the registry for several releases. `npm test` is the only quality step before
+  `npm publish`, and the runner gates on child exit codes, so a blind suite blinded the publish
+  gate. Verified by injected failure rather than inspection.
+  `dashboard-wiring` derives the expected router set
+  from `server.js`'s own requires, so adding a router without mounting it fails.
+  `cli-router` runs against a mirror-root sandbox under `os.tmpdir()` — required, not
+  tidiness: the case that proves audit forgery is prevented would otherwise forge an
+  entry into the real chain on every run. `revops-roi.test.js` had 0 assertions and
+  could not fail; it now has 6.
+
+### Not fixed — deferred to v12
+
+- **No hook is registered in any consumer install.** The installer copies 9 hook
+  scripts into `<runtime>/hooks/`, but nothing writes `.claude/settings.json` and it is
+  absent from `package.json` `files[]`. Verified by installing the tarball into a
+  scratch project. Every gate this release hardens is inert until that lands.
+- **`requireAuth` exempts GET and OPTIONS**, so every read route — including
+  `/api/audit`, which serves the hash-chained audit log — is credential-free to any
+  local process. Mutations are protected. This is a threat-model decision, not a patch.
+- **`audit-skill audit <name> <ver> <tier>`** — the explicit form — still reaches a
+  writer that performs no existence check and hardcodes `validation_passed: true`. Only
+  the bare invocation is closed.
+- **Snapshot integrity is not an authenticity control.** `HMAC_KEY` is a literal in
+  shipped source, the HMAC covers only the metadata object so file **contents** are
+  unsigned (editing a file inside a signed snapshot leaves the signature valid), and
+  deleting `SNAPSHOT-META.json` bypasses verification entirely.
+- `cwd: ROOT` in the CLI, which resolves consumer state inside `node_modules`.
+- `security-scan` cannot fail: its parser expects `KEY=value` while `MINDFORGE.md` uses
+  `[KEY] = value`, so it always reports 0 settings and exits 0.
+- Version drift in six publishable manifests (`Formula/mindforge.rb`, `Dockerfile`,
+  `mcp-server/server.json`, `mcp-server/src/index.ts`, the plugin manifest and the
+  marketplace entry) is untouched here — none is gated, and the Formula pins a tarball
+  sha256 that cannot exist before publish.
+
 ## [11.9.1] — 2026-07-29 — Packaging Fix: Restore Missing Workflow Commands
 
 ### Fixed

package/MINDFORGE.md

@@ -1,9 +1,9 @@
-# MINDFORGE.md — Parameter Registry (v11.9.1)
+# MINDFORGE.md — Parameter Registry (v11.9.3)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.9.1
+[VERSION] = 11.9.3
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
 [REQUIRED_CORE_VERSION] = 11.9.1
@@ -98,8 +98,15 @@
 The following parameters cannot be overridden by plugins, agents, or session-level configuration:
 
 - [MIN_SOUL_SCORE] — Minimum SOUL score required for architectural changes
-- [BLOCK_ON_SECURITY] — Security gate enforcement cannot be disabled
-- [COST_HARD_LIMIT_USD] — Hard cost limit cannot be raised without human approval
+- [BLOCK_ON_SECURITY] — DECLARED, UNREAD. `git grep -l BLOCK_ON_SECURITY -- bin/` returns nothing:
+  no code reads this key, so it changes no behaviour and deleting it fails no validation (the schema
+  lists it as `recommended`, not `required`). What actually blocks a config-weakening edit is the
+  `mindforge-config-protection` hook, which is deny-class and fails closed — see SECURITY.md.
+- [COST_HARD_LIMIT_USD] — **enforced as of 11.9.3** (COST-02). `bin/models/cost-tracker.js` `preflight()` reads this key, adds the call estimate to today's ledger spend, and throws `COST_LIMIT_REACHED`; `bin/models/model-client.js` re-throws it, so the model call is refused. Non-overridable means a plugin or session cannot raise the number — it does not mean a cap always exists: `0`, or the key being absent, legally disables the cap, because an upgrade never rewrites an existing MINDFORGE.md (`bin/installer-core.js:706`) and the schema lists this key as `recommended`, not `required`. A present-but-unreadable value (e.g. `= none`) is a hard config fault — `preflight()` throws `COST_LIMIT_MISCONFIGURED` instead of running uncapped
 - [BLOCK_ON_SECURITY] is non-overridable; PQAS itself is simulated/experimental (inactive by default) and is NOT a non-overridable guarantee — do not rely on it as an enforced control
-- [SOVEREIGN_IDENTITY] — Identity verification is always required
-- [ENABLE_ZTAI] — Zero-trust identity cannot be bypassed
+- [SOVEREIGN_IDENTITY] — DECLARED, UNREAD. No reader in `bin/`. No identity is verified as a result
+  of this key being set.
+- [ENABLE_ZTAI] — DECLARED, UNREAD, and the feature it gates is inactive. No reader in `bin/`;
+  measured on a live 3116-entry AUDIT.jsonl, 0 entries carry a `signature` or `did`. "Cannot be
+  bypassed" overstates a switch that is not wired to anything — see docs/security/ZTAI-OVERVIEW.md,
+  which now leads with a status banner.