mindforge-cc 11.9.2 → 11.9.4

package/SECURITY.md

@@ -1,6 +1,6 @@
 # Security Policy
 
-> **Current version:** 11.9.0 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
+> **Current version:** 11.9.4 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
 
 ## Supported Versions
 
@@ -66,7 +66,9 @@ We follow responsible disclosure practices. We will credit reporters in the rele
 
 ### Audit & Integrity
 
-- **Merkle-chain audit log** — Every entry in `AUDIT.jsonl` includes a SHA-256 hash of the previous entry. Tampering with any historical entry breaks the chain, making modifications detectable.
+- **Hash-chained audit log (SHA-256 back-links)** — Every entry in `AUDIT.jsonl` carries the SHA-256
+  hash of the previous entry. Not a Merkle tree: there is no hash tree and no inclusion proof, so
+  "Merkle" was the wrong word for it. What it detects, and does not, is measured below.
 - **AuditWriter with buffered writes** — Atomic append operations prevent partial writes from corrupting the log.
 - **Log rotation with archival** — AUDIT.jsonl auto-archives beyond 5000 lines with gzip compression, preventing unbounded disk growth.
 - **npm provenance** — Published packages include SLSA Build Level 2 attestation via `--provenance`, proving the package was built from the stated source commit in CI.
@@ -143,7 +145,24 @@ For security questions that are not vulnerability reports, open a GitHub Discuss
 Tier-3 trust in v11.x uses **in-process key simulation** (`bin/governance/ztai-manager.js` `SecureEnclaveProvider`). Key material resides in the Node.js heap — it is NOT hardware-isolated. A real TPM/HSM provider is planned for v12.x. **Do not use Tier-3 trust for production credential workflows in v11.x.**
 
 ## Audit Log Tamper Evidence
-The Merkle chain (`bin/governance/audit-hash.js`) provides tamper-evidence for content and ordering but does not prevent replay of identical entries. Restrict OS-level write access to `.planning/AUDIT.jsonl` to prevent replay attacks.
+The hash chain (`bin/governance/audit-hash.js`) is real and independently verifiable — `node
+bin/verify-audit.js` recomputes it and exits 1 on a break. Measured on a 200-entry chain taken from
+the head of a live log:
+
+| Attack | Detected? | Evidence |
+|---|---|---|
+| Mutate a middle entry | **YES** | `BROKEN at entry 79: hash mismatch (entry mutated)`, exit 1 |
+| Delete a middle entry | **YES** | `BROKEN at entry 79: previous_hash mismatch`, exit 1 |
+| **Truncate the tail** | **NO** | 40 entries removed from the end → `audit chain valid: 160 entries`, **exit 0** |
+| Replay identical entries | **NO** | the chain constrains content and ordering, not multiplicity |
+
+The truncation gap is inherent to a bare hash chain: each entry commits to its predecessor, so a
+prefix of a valid chain is itself a valid chain. Closing it needs a commitment to LENGTH — an external
+anchor, a signed length attestation, or a witnessed head — none of which ships today.
+
+So the accurate claim is **"detects mutation and mid-file deletion"**, not "immutable" or
+"non-repudiable". Restrict OS-level write access to `.planning/AUDIT.jsonl`; the chain does not
+substitute for filesystem permissions.
 
 ## Agent Dispatch (spawn mode)
 `bin/spawn-agent.js` spawn mode exits with an error in v11.x — real agent dispatch is not yet implemented at the shell level. Use Claude Code slash commands (`/mindforge:auto`, `/mindforge:next`) to dispatch agents.

package/bin/autonomous/auto-runner.js

@@ -117,6 +117,12 @@ class AutoRunner {
     this.phase = String(options.phase);
     this.isHeadless = options.headless || false;
     this.isPaused = false;
+    // Optional async function(task) that performs the actual work for one task. When absent,
+    // executeWave() aborts the wave rather than writing task_completed entries for work that would
+    // not run — see the comment there. Deliberately NOT defaulted to a no-op: bin/autonomous/
+    // wave-executor.js:133 defaults its own `executor` to `async () => {}`, and a silent no-op
+    // default is exactly how a wave came to report every task fulfilled while dispatching nothing.
+    this.taskExecutor = typeof options.taskExecutor === 'function' ? options.taskExecutor : null;
 
     // Paths
     const planningDir = path.join(process.cwd(), '.planning');
@@ -306,10 +312,30 @@ class AutoRunner {
   runPreFlight() {
     console.log('🔍 Running pre-flight checks...');
 
-    // UC-01: fail closed on version drift before any wave executes
+    // UC-01: fail closed on version drift before any wave executes.
+    //
+    // The root MUST be MindForge's own install root, NOT process.cwd(). This check compares
+    // package.json against .mindforge/config.json, sdk/package.json and MINDFORGE.md — all
+    // MindForge's own manifests. Pointed at a consumer's cwd it takes THEIR application
+    // version as canonical and reports MindForge's own config as drift. Measured, with an app
+    // at 1.0.0 and MindForge at 11.9.2:
+    //   [".mindforge/config.json declares 11.9.2 but canonical (package.json) is 1.0.0"]
+    // and a consumer with no package.json at all fails closed on a missing canonical. Only a
+    // project whose app version coincidentally equalled MindForge's would have passed.
+    //
+    // This has never fired in a shipped build, because nothing constructs AutoRunner today
+    // (verified: no `new AutoRunner` anywhere in bin/; the only requirer is
+    // tests/wave-timeout-rollback.test.js, for the pure helpers). It is a landmine that arms
+    // the moment the runner is wired — which DEL-02 proposes doing — so it is disarmed here
+    // rather than left for whoever wires it to find in the field.
+    //
+    // __dirname/../.. is MindForge's root in both layouts: <repo> from a checkout, and
+    // <project>/node_modules/mindforge-cc when installed. In the installed shape
+    // .mindforge/config.json is absent (the installer writes that into the CONSUMER project),
+    // which reads as null and is SKIPPED rather than counted as drift — verified.
     try {
       const { assertVersionConsistency } = require('../utils/version-check');
-      assertVersionConsistency(process.cwd());
+      assertVersionConsistency(path.resolve(__dirname, '..', '..'));
     } catch (e) {
       throw new Error(`[pre-flight] ${e.message}`);
     }
@@ -357,6 +383,40 @@ class AutoRunner {
 
     console.log(`\n⚡ Wave ${waveNum}/${this.waves.length}: ${pending.length} tasks (concurrency: ${maxConcurrency})`);
     if (idcStatus.action === 'UPGRADE_MIR') console.log(`  [IDC-ACTIVE] MIR Override: ${idcStatus.new_mir}`);
+
+    // REFUSE TO FABRICATE. The task body below used to be, in full:
+    //
+    //     try {
+    //       this.writeAudit({ event: 'task_started',   ... });
+    //       this.writeAudit({ event: 'task_completed', ... duration_ms: Date.now() - taskStart });
+    //       this.completedTasks.add(task.id);
+    //
+    // Nothing between the two writes. No dispatch. So every task was recorded as completed with a
+    // duration of ~0ms, the catch block was unreachable because nothing could throw, and the
+    // hash-chained audit log — the one component of this project that is genuinely production-grade
+    // and independently verifiable — became a tamper-evident record of statements that were false.
+    // A verifiable false record is worse than no record: it survives verify-audit and carries the
+    // authority of the chain.
+    //
+    // Measured before this change: task_completed = 0 in the live 3056-entry chain, and no module
+    // under bin/ requires auto-runner (every repo-wide match is a comment, a test, or an
+    // "extracted from" note). So the defect was LATENT — the code would have lied the first time
+    // anything invoked it, and nothing had. That is why this is a refusal rather than a cleanup:
+    // there is no contamination to repair, only a trap to disarm.
+    //
+    // A wave with no executor now writes ONE honest entry and throws, instead of N false ones.
+    if (typeof this.taskExecutor !== 'function') {
+      this.writeAudit({
+        event: 'wave_aborted', phase: this.phase, wave: waveNum, task_count: pending.length,
+        reason: 'no task executor is wired, so no task can run. Refusing to write task_completed '
+          + 'entries for work that would not be performed — see auto-runner.executeWave.',
+      });
+      throw new Error(
+        `Wave ${waveNum} cannot execute: no task executor wired. Pass { taskExecutor } to the `
+        + 'AutoRunner constructor, or drive waves through bin/autonomous/wave-executor.js. '
+        + 'Refusing to record completions for work that would not run.');
+    }
+
     this.writeAudit({ event: 'wave_started', phase: this.phase, wave: waveNum, task_count: pending.length });
 
     const semaphore = new Semaphore(maxConcurrency);
@@ -368,6 +428,9 @@ class AutoRunner {
         console.log(`  → Task: ${task.name || task.id}`);
         try {
           this.writeAudit({ event: 'task_started', phase: this.phase, wave: waveNum, task_id: task.id, task_name: task.name || task.id });
+          // The dispatch that was missing. Its absence is what made the catch below unreachable and
+          // every duration_ms ~0; task_completed is now written only after real work returns.
+          await this.taskExecutor(task);
           this.writeAudit({ event: 'task_completed', phase: this.phase, wave: waveNum, task_id: task.id, task_name: task.name || task.id, duration_ms: Date.now() - taskStart });
           this.completedTasks.add(task.id);
           return { taskId: task.id, status: 'fulfilled' };

package/bin/change-classifier.js

@@ -9,16 +9,55 @@
 const { execSync, execFileSync } = require('child_process');
 const fs = require('fs');
 
+// Matched with String.prototype.startsWith against repo-relative diff paths.
+//
+// Two groups, because this file SHIPS (package.json files[] includes bin/) and therefore runs
+// against two different trees:
+//
+//   (a) CONSUMER paths — a project that installed MindForge. Measured against MindForge's own
+//       tree these match ZERO tracked files, which is correct: they describe the consumer's
+//       layout, not the framework's. Do not remove them.
+//   (b) FRAMEWORK paths — MindForge's OWN trust surface, which control-plane.yml classifies on
+//       every push and PR to this repo. These were absent, so the detector protected the five
+//       markdown files under .mindforge/governance/ while leaving the 15 executable modules
+//       under bin/governance/ — the audit hasher, the verifier, RBAC, the policy engine and
+//       approve.js itself — unclassified. Editing the prose ABOUT governance tripped Tier 3;
+//       editing the code that enforces it did not.
 const SENSITIVE_PATHS = [
+  // (a) consumer-project layout
   'auth/',
   'payment/',
   'security/',
+  // (b) MindForge's own trust surface
+  'bin/governance/',        // audit-hash, audit-verifier, rbac, policy-engine, approve
+  'bin/security/',          // trust-gate-hook and friends — NOT matched by 'security/'
+  'bin/hooks/',             // instinct-capture-hook, context-monitor
+  'bin/models/',
+  '.agent/hooks/',          // the hook dispatcher the installer copies
+  '.claude/settings.json',  // hook registration
+  '.agent/settings.json',
+  '.planning/approvals/',   // the approval records themselves
   '.github/workflows/',
-  '.mindforge/governance/',
-  'bin/models/'
+  '.mindforge/governance/'
 ];
 
+// Scanned against the DIFF CONTENT, so security-critical code in an innocuously-named file still
+// reaches Tier 3 — that is the stated purpose of "Signal B" in
+// .mindforge/governance/change-classifier.md.
+//
+// The doc lists 19 patterns; measured, only 6 of them were detected. The second group below was
+// specified and absent: argon2 (a password hasher), the jose signing pair, paypal.,
+// createCipheriv/createDecipheriv and crypto.subtle (cipher construction), encrypt(/decrypt(,
+// role.*permission and hasPermission (authorization), and SET ROLE / GRANT (SQL privilege
+// changes). tests/governance.test.js pins every documented pattern against the live set, so the
+// doc and this array cannot drift apart again.
+//
+// Adding them cost nothing measurable: over the last 40 commits they caught ZERO additional
+// changes, because anything they would flag was already Tier 3 by path or by one of the broad
+// substring patterns above. So this closes a documented gap without moving the Tier-3 rate, which
+// sat at 50% (path OR pattern) before and after.
 const SENSITIVE_PATTERNS = [
+  // broad substring signals
   /jwt/i,
   /bcrypt/i,
   /stripe/i,
@@ -26,18 +65,89 @@ const SENSITIVE_PATTERNS = [
   /password/i,
   /secret/i,
   /token/i,
-  /PII/
+  /PII/,
+  // the specified-but-missing set
+  /argon2/i,
+  /jose\.(sign|verify)/i,
+  /paypal\./i,
+  /createCipheriv/,
+  /createDecipheriv/,
+  /crypto\.subtle/,
+  /\bencrypt\(/,
+  /\bdecrypt\(/,
+  /role.*permission/i,
+  /hasPermission/,
+  /\bSET ROLE\b/i,
+  /\bGRANT\b/
 ];
 
+/** True if `rev` resolves to an object in this clone (false on a shallow/partial fetch). */
+function revExists(rev) {
+  try {
+    execFileSync('git', ['rev-parse', '--verify', '--quiet', `${rev}^{commit}`], { stdio: 'pipe' });
+    return true;
+  } catch { return false; }
+}
+
+/** The pre-push tip GitHub reports for a push event, or '' if unavailable. */
+function pushBefore() {
+  if (process.env.MINDFORGE_PUSH_BEFORE) return process.env.MINDFORGE_PUSH_BEFORE;
+  // Read the event payload rather than requiring the workflow to thread a variable through.
+  // A fix that depends on someone remembering `env: BEFORE: ${{ github.event.before }}` is a
+  // fix that silently reverts the first time a workflow is copied.
+  const p = process.env.GITHUB_EVENT_PATH;
+  if (!p || !fs.existsSync(p)) return '';
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')).before || ''; } catch { return ''; }
+}
+
+/**
+ * Resolve the commit range to classify.
+ *
+ * A push is a RANGE, not a commit. The old code used HEAD~1..HEAD whenever GITHUB_BASE_REF was
+ * unset, so on a push it inspected only the tip. Measured: two commits where the first adds
+ * auth/login.js with a hardcoded password and the second is docs-only classify as TIER=1 on a
+ * push and TIER=3 as a PR — the sensitive file rides in completely unclassified. control-plane.yml
+ * triggers on `push: [main, develop]`, and this repo has allow_rebase_merge enabled, so the
+ * multi-commit push is the normal case, not an edge case.
+ *
+ * @returns {{range:string, how:string}}
+ * @throws {Error} with .failClosed when a CI push range cannot be resolved.
+ */
+function resolveRange() {
+  // Pull request: three-dot diffs against the MERGE-BASE, so a branch that is merely behind
+  // its base does not pick up base-only changes. (Two-dot here caused Tier-3 false positives.)
+  if (process.env.GITHUB_BASE_REF) {
+    return { range: `origin/${process.env.GITHUB_BASE_REF}...HEAD`, how: 'pull_request' };
+  }
+
+  const inCiPush = process.env.GITHUB_EVENT_NAME === 'push';
+  if (inCiPush) {
+    const before = pushBefore();
+    const isBranchCreation = /^0{40}$/.test(before);
+    if (before && !isBranchCreation && revExists(before)) {
+      return { range: `${before}..HEAD`, how: 'push' };
+    }
+    // Fail CLOSED. Every remaining case genuinely cannot be scoped: a new branch has no prior
+    // tip, and a shallow clone cannot reach `before`. Falling back to HEAD~1 here is what let
+    // a sensitive commit ride in behind a benign tip.
+    const why = isBranchCreation ? 'branch creation (before is all-zeros)'
+      : !before ? 'no `before` in the push event payload'
+        : `\`before\` (${before.slice(0, 12)}) is not present in this clone — shallow fetch?`;
+    const err = new Error(`cannot scope the push range: ${why}`);
+    err.failClosed = true;
+    throw err;
+  }
+
+  // Local invocation (`mindforge classify`). HEAD~1..HEAD is a developer convenience, not a
+  // gate, and must never be reached in CI — the branch above owns every CI push.
+  return { range: 'HEAD~1..HEAD', how: 'local' };
+}
+
 function classify() {
   try {
-    // Get list of changed files compared to origin/<base> or HEAD~1.
-    // Three-dot (...) diffs against the MERGE-BASE, so on a PR branch that is behind its base
-    // we see ONLY this branch's own changes — not unrelated commits already on the base.
-    // (Two-dot here caused Tier-3 false positives by pulling in base-only changes.)
-    const base = process.env.GITHUB_BASE_REF ? `origin/${process.env.GITHUB_BASE_REF}` : 'HEAD~1';
-    const range = process.env.GITHUB_BASE_REF ? `${base}...HEAD` : `${base}..HEAD`;
+    const { range, how } = resolveRange();
     const diffFiles = execFileSync('git', ['diff', '--name-only', range], { encoding: 'utf8' }).split('\n').filter(Boolean);
+    if (process.env.MINDFORGE_CLASSIFY_DEBUG) console.error(`[classify] ${how}: ${range} (${diffFiles.length} file(s))`);
 
     // Test and documentation files are excluded from the sensitive-PATTERN scan below: a test
     // asserting on "password"/key patterns, or a doc mentioning secrets, is not a sensitive
@@ -50,10 +160,16 @@ function classify() {
     let reasons = [];
 
     // 1. Path-based detection (Tier 3)
-    const matchedPath = diffFiles.find(file => SENSITIVE_PATHS.some(p => file.startsWith(p)));
-    if (matchedPath) {
+    // Reports EVERY matched path, not just the first. `find` short-circuited, so a change
+    // touching both .github/workflows/ and bin/governance/ was attributed only to the workflow —
+    // which made the CI log unable to show that the newly-added framework paths were doing any
+    // work, and hid the more interesting of the two matches from the reviewer.
+    const matchedPaths = diffFiles.filter(file => SENSITIVE_PATHS.some(p => file.startsWith(p)));
+    if (matchedPaths.length) {
       tier = 3;
-      reasons.push(`Sensitive path modified: ${matchedPath}`);
+      const shown = matchedPaths.slice(0, 5).join(', ');
+      const more = matchedPaths.length > 5 ? ` (+${matchedPaths.length - 5} more)` : '';
+      reasons.push(`Sensitive path${matchedPaths.length > 1 ? 's' : ''} modified: ${shown}${more}`);
     }
 
     // 2. Pattern-based detection in diff (Tier 3) — non-test/doc files only
@@ -94,13 +210,32 @@ function classify() {
 
     return tier;
   } catch (err) {
-    console.error(`❌ Classification failed: ${err.message}`);
-    // Default to Tier 3 for safety if classification fails
+    // Fail closed: an unscopeable change is treated as maximum risk. Emit the SAME
+    // TIER=/REASONS= lines as the success path so every consumer — the workflow's stdout
+    // parsing, GITHUB_OUTPUT, and a human reading the log — sees tier 3 rather than nothing.
+    // Previously only GITHUB_OUTPUT was written, so anything reading stdout saw no tier at all.
+    const reason = err.failClosed
+      ? `Fail-closed: ${err.message}`
+      : `Fail-closed: classification error — ${err.message}`;
+    console.log('TIER=3');
+    console.log(`REASONS=${reason}`);
+    console.error(`❌ Classification could not be scoped — defaulting to Tier 3. ${err.message}`);
+    if (process.env.GITHUB_ACTIONS) {
+      console.error(`::error title=Change classification failed closed::${reason}`);
+    }
     if (process.env.GITHUB_OUTPUT) {
       fs.appendFileSync(process.env.GITHUB_OUTPUT, 'tier=3\n');
     }
-    process.exit(0); // Don't fail the pipeline yet, let the gate handle it
+    // Exit 0 deliberately: this step's contract is to REPORT a tier, and the downstream gate
+    // is what blocks. Exiting non-zero here would fail the job before the gate can annotate
+    // why. That contract is only honest while a gate actually consumes tier 3 — see
+    // tests/change-classifier.test.js, which pins that the tier-3 consumer exists.
+    return 3;
   }
 }
 
-classify();
+module.exports = { classify, resolveRange, revExists, pushBefore, SENSITIVE_PATHS, SENSITIVE_PATTERNS };
+
+// Behind a require.main guard so tests can import the pure pieces without triggering a run.
+// bin/mindforge-cli.js:51 spawns this file as a script, which still executes normally.
+if (require.main === module) classify();

package/bin/dashboard/api-router.js

@@ -7,7 +7,6 @@
 const path    = require('path');
 const fs      = require('fs');
 const Metrics = require('./metrics-aggregator');
-const Approval = require('./approval-handler');
 const SSE     = require('./sse-bridge');
 const { sendServerError } = require('./error-response');
 
@@ -64,7 +63,24 @@ function register(app) {
     }
   });
 
-  // ── Approvals ───────────────────────────────────────────────────────────────
+  // ── Approvals (read-only) ───────────────────────────────────────────────────
+  // Returns the approval records that exist, each with its verified integrity state.
+  //
+  // `POST /api/approve/:id` was REMOVED. It implemented a pending-request -> decide workflow
+  // that nothing in MindForge has ever produced: bin/governance/approve.js records an
+  // already-made decision, and no code path anywhere writes a request awaiting one. The endpoint
+  // was unreachable six independent ways — it required a 36-char UUID id while the writer emits
+  // `MF-AUTH-<base36>`, required `status: 'pending'` which no producer writes, and looked for
+  // `APPROVAL-*.json` while the writer emits `approval-*.json`; the reader returned an object
+  // where the frontend expected an array; and the UI rendered `phase`, `plan` and `summary`,
+  // none of which any producer has ever written. It was speculative UI against a schema that
+  // never existed, not a flow with a bug.
+  //
+  // Disclosure note: requireAuth exempts GET, so this body is unauthenticated. That is
+  // proportionate here — the server binds to 127.0.0.1 only (ADR-017) as a single-operator
+  // tool, and the fields returned are the operator's own git-committed records. It is a
+  // different case from LEAK-01 (revops-api.js), which concerned error messages leaking
+  // filesystem paths the operator never chose to expose.
   app.get('/api/approvals', (req, res) => {
     try {
       res.json(Metrics.getApprovals());
@@ -73,42 +89,6 @@ function register(app) {
     }
   });
 
-  app.post('/api/approve/:id', (req, res) => {
-    try {
-      const { id }                  = req.params;
-      const { decision, comment }   = req.body || {};
-
-      if (!decision) {
-        return res.status(400).json({ error: 'Missing "decision" field (approve|reject)' });
-      }
-
-      // SECURITY (v11.5.1): do NOT trust a client-supplied `approver` for the
-      // recorded identity — it is forgeable and would let any caller write a
-      // false approval audit trail (e.g. resolved_by: 'admin'). requireAuth
-      // (server.js) proves the caller holds the owner-only dashboard token but
-      // exposes no named principal, so we attribute the action to a FIXED
-      // trusted actor. (A future RBAC pass can map a Bearer token -> DID and
-      // record the real principal; until then, never echo req.body.approver.)
-      const approver = 'dashboard-authenticated';
-
-      const result = Approval.processDecision(id, decision, comment, approver);
-
-      if (!result.success) {
-        return res.status(400).json(result);
-      }
-
-      // Broadcast approval event to all SSE clients
-      SSE.broadcast(
-        decision === 'approve' ? 'approval:resolved' : 'approval:resolved',
-        { approval_id: id, decision, message: result.message }
-      );
-
-      res.json(result);
-    } catch (err) {
-      sendServerError(res, 'POST /api/approve/:id', err, 'Failed to record approval decision');
-    }
-  });
-
   // ── Team activity ───────────────────────────────────────────────────────────
   app.get('/api/team', (req, res) => {
     try {