mindforge-cc 11.9.4 → 11.9.6

package/.mindforge/config.json

@@ -1,5 +1,5 @@
 {
-  "version": "11.9.4",
+  "version": "11.9.6",
   "environment": "development",
   "governance": {
     "drift_threshold": 0.75,

package/CHANGELOG.md

@@ -1,6 +1,242 @@
 # Changelog
 
-## [11.9.4] — 2026-08-22 — Delivery: the gates register, the tarball matches its tag, three packages attested
+## [11.9.6] — 2026-09-20 — The docs stop overselling what the code discloses about itself
+
+Patch release. No new features — this is the release-readiness pass before pointing real
+users at the project for the first time, and it found the same pattern one more time:
+code that honestly labels its own simulated/dormant parts, sitting under docs that hadn't
+caught up. Every fix below was hand-verified against the live source or a real command
+run, not carried over from a prior audit's prose.
+
+### Fixed
+
+**Two real, reproducible bugs**
+
+- **`/mindforge:learn` crashed on every skill that scored high enough to register.**
+  `bin/skills-builder/learn-cli.js` called `skill-registrar.js`'s `register()` with two
+  positional string arguments (`skillPath`, `'project'`); `register()` destructures a
+  single options object, so every call threw inside it, silently swallowed by the CLI's
+  generic catch. A validly-generated `SKILL.md` never reached `MANIFEST.md`, and the CLI
+  reported a bare `❌ Error`. Fixed the call site to pass `{ skillName, skillPath, tier,
+  qualityScore, sourceType, source }`, matching `register()`'s real signature.
+
+- **`bin/browser/browser-daemon.js` printed its own bearer token to stdout** (captured
+  verbatim into the persistent `.planning/browser-daemon.log` by `daemon-manager.js`),
+  and gated only `/evaluate` — `/navigate`, `/click`, `/type`, and `/screenshot` had no
+  auth check at all. The idle-timeout path also called `process.exit(0)` directly,
+  bypassing the token-file cleanup in `shutdown()`. Fixed all three: the startup log now
+  prints only the token's file path, the auth check runs once before dispatch and covers
+  every route but `/status`, and the idle path calls the real `shutdown()`.
+
+**A test with a blind spot for the exact bug it exists to catch**
+
+- `tests/sdk-exports.test.js` guards against any tracked file instructing
+  `require('@mindforge/sdk')` — the unpublished, wrong package name (`sdk/package.json`
+  publishes as `mindforge-sdk`). Its scan used `git ls-files -z '*.md' '*.ts'`, which
+  cannot match `.js` files — so it did not, and could not, catch the live occurrence in
+  `examples/sdk-integration/index.js`. Fixed both: the import, and the pathspec (now also
+  `*.js`/`*.mjs`/`*.cjs`, with `tests/` added to the same "records, not instructions"
+  allowlist as `changelogs/`, since this file's own `WRONG` string literal would otherwise
+  self-flag).
+
+**A dashboard that rendered success while showing nothing**
+
+- Three more panels in `bin/dashboard/frontend/app.js` read response fields their real
+  backing functions in `metrics-aggregator.js` have never produced — the same bug class
+  already fixed once for the avg-quality tile, left unaddressed here. `refreshMemory()`
+  read `data.graph`/`data.count`; the real shape is `{ entries, total }`. `refreshTeam()`
+  called `.map()` on the whole response object; the real shape is `{ active, conflicts }`
+  with `email`/`last_seen`/`current_task` fields, not `user`/`action`/`timestamp`.
+  `drawCharts()` read `state.costs`/`state.quality`, fields `/api/metrics` never returns;
+  the real per-session series is `state.sessions[].cost_usd` /
+  `state.sessions[].quality_score`. All three failed silently behind an empty `catch`, so
+  the panels looked idle rather than broken. Fixed to read the real shapes.
+
+**Two shipped documents that stated the opposite of the code**
+
+- `SECURITY.md` claimed `AUDIT.jsonl` "auto-archives beyond 5000 lines with gzip
+  compression" — that rotation mechanism was removed in an earlier release specifically
+  because truncating the file broke the hash chain (it orphans `previous_hash` pointers to
+  archived entries). The log grows unbounded by design; the doc now says so.
+- `docs/security/SECURITY.md` had drifted into a second, independent copy of this policy
+  with a `5.x.x`/`4.x.x`/`< 4.0.0` support table — years behind the real `11.x` line the
+  root `/SECURITY.md` (the canonical file) documents. Replaced with a pointer to the root
+  file so this can't re-drift.
+
+**A stale Homebrew formula**
+
+- `Formula/mindforge.rb` was pinned to `11.9.3` (url, sha256, and the version-assertion
+  test) — two releases behind, so `brew install mindforge` installed an old build with
+  none of 11.9.4/11.9.5's fixes. Re-pinned to the real published `11.9.5` tarball with its
+  actual sha256 (fetched and hashed directly, not carried over). This is the same drift
+  class the project has hit twice before (11.9.2 shipped with this file and `Dockerfile`
+  four releases behind); `Formula/mindforge.rb` will lag one release again until
+  `node scripts/sync-version.js --fetch-sha` runs after this version publishes — expected,
+  not a regression.
+
+### Changed — a documentation honesty pass
+
+The following describe MindForge's own PQAS (post-quantum crypto), ZTAI (Zero-Trust
+Agentic Identity), and "Pillar"-numbered subsystems as live, unconditional security
+guarantees. They are not: `bin/governance/quantum-crypto.js` and
+`bin/governance/ztai-manager.js` self-label these SIMULATED and gate them off the live
+trust path by default (`SECURITY_TIER_3_SIMULATED = true`), and `SwarmController` /
+`PersonaFactory` / `WaveExecutor` are role names in markdown specs with no backing file —
+a distinction this repo's own `.claude/CLAUDE.md` already draws, just not everywhere yet.
+Rewrote each to match the same "measured, not asserted" tone already used in
+`docs/faq.md` and `docs/troubleshooting.md` and the root README's *What is actually
+enforced* section:
+
+`docs/usp-features.md`, `CODEBASE-MAP.md`, `docs/architecture/README.md`,
+`docs/CAPABILITIES-MANIFEST.md`, `docs/governance-guide.md`,
+`docs/MIND-FORGE-REFERENCE-V6.md`, `docs/INTELLIGENCE-MESH.md`, `docs/PERSONAS.md`,
+`docs/security/threat-model.md`, `docs/security/penetration-test-results.md` (the latter
+two now banner-marked as scoped to an earlier, materially smaller predecessor system, not
+a current assessment — no new pentest content was fabricated to replace them).
+
+**Six reference docs (`docs/registry/*.md`) were stuck at v11.3.1** (six releases behind)
+with command/skill/persona/subagent counts off by 2–9x against the live filesystem, and
+listed 14+ slash commands with no backing file (`/mindforge:quantum-verify`,
+`/mindforge:hindsight`, `/mindforge:harvest`, `/mindforge:self-heal`,
+`/mindforge:swarm-execution`, `/mindforge:identity`, and others) — each individually
+re-verified against `.claude/commands/mindforge/` before being removed or reworded.
+Updated all six to the real, live-verified counts (221 commands, 232+123 skills, 217
+personas, 164 subagents) and pointed each at `docs/commands-reference.md` as the
+canonical source, so staleness here is lower-stakes going forward.
+
+Also corrected: `docs/plugin-installation.md` and `docs/reference(s)/commands.md` (stale
+hand-typed counts), `docs/References/{decimal-phase-calculation,git-integration,
+git-planning-commit}.md` (wrong CLI path — real tool is `.agent/bin/mindforge-tools.cjs`,
+not `.agent/mindforge/bin/...`), `docs/References/model-profile-resolution.md` (dead
+`@`-include path), and a fabricated `"Claude 4.5 Opus"` model-name literal in two docs
+(no such string exists anywhere in `bin/`) replaced with the real "highest-capability
+tier configured" language. Deleted two orphaned scratch files that were never real
+documentation: `docs/testing-current-version.md` (a pre-release scratch file hardcoding
+a personal machine path) and `docs/commands-skills/DISCOVERED_SKILLS.md` (stale output
+from an unrelated external tool referencing a directory that doesn't exist in this repo).
+
+### Changed — discoverability
+
+- Root `README.md`: npm-version/downloads/license/Node-version badges, an "at a glance"
+  capability summary with real counts, and jump links to the existing sections.
+- `package.json`: `description` rewritten from marketing language ("Sovereign Agentic
+  Intelligence Framework... Production-Hardened... (v11)") to concrete, keyword-bearing
+  text; added `ai-agents`, `llm-tools`, `developer-tools`, `mcp-server` to `keywords`.
+
+### Verified
+
+- `npm test`: 137 passed, 0 failed, 3 env-dependent skips (`browser.test.js`,
+  `browser-daemon-auth-live.test.js`, `sre-integration.test.js` — all three require a
+  Chromium daemon/display or git worktree support this sandbox does not have). Verified
+  clean through the real pre-commit hook, not just a standalone run.
+- `node scripts/sync-version.js`: 27 channels synced; `Formula/mindforge.rb` correctly
+  deferred (tarball doesn't exist yet); `plugins/mindforge/.claude-plugin/plugin.json` and
+  `plugins/mindforge/mcp/dist/index.js` rebuilt.
+
+## [11.9.5] — 2026-08-22 — The release path can no longer strand itself, and the SDK ships
+
+Patch release, and the shortest one in a while. It exists because 11.9.4 published two
+packages and then failed on the third, and that failure took the release page and the
+`stable` dist-tag with it. Both causes are fixed here, and one of them is the reason this
+release is worth cutting rather than waiting: **`mindforge-sdk` publishes for the first
+time in seven versions, with provenance.**
+
+### Fixed
+
+**A publish that cannot finish the release it started**
+
+- **`sdk/package.json` had no `repository` field.** npm's provenance verification compares
+  that field against the attestation **server-side, at PUT** — so the publish was rejected
+  with `422 Unprocessable Entity … "repository.url" is ""` *after* `mindforge-cc` and
+  `mindforge-mcp-server` had already published irreversibly. `npm publish --dry-run` does
+  not perform that comparison, and nothing in this repository read `repository` at all: all
+  six preflight gates passed on a manifest the registry was guaranteed to reject. The field
+  is added, matching the spelling the other two packages use.
+
+- **`scripts/ci/verify-provenance-metadata.js` makes that failure reachable before the
+  point of no return.** It runs in the release **preflight** job, ahead of every publish,
+  and it does not carry a list of packages: it discovers them from the workflow — every
+  step whose `run` contains both `npm publish` and `--provenance`, resolved through its
+  `working-directory` — so a fourth package is covered without editing the gate.
+  Discovering zero targets is a hard failure rather than a pass, on the principle that a
+  check which examined nothing must not report success.
+
+  Verified the only way that means anything: run against a git worktree at tag `v11.9.4` —
+  the exact tree that the registry rejected — it exits 1 and names `sdk/package.json` and
+  the missing field. It would have stopped that release before anything reached npm.
+
+- **The release steps were ordered so that an optional package could strand the release.**
+  The SDK publish sat *before* `Create GitHub Release` and the `stable` dist-tag move.
+  A failing step fails the job, so both were skipped — which is precisely the harm the
+  placement comment claimed to prevent. The same mode had already fired on **v11.5.1** and
+  **v11.8.3** from the MCP publish; v11.9.4 was its third occurrence.
+
+  Reordered to: `Publish to npm` → `Create GitHub Release` → `stable` dist-tag →
+  `mcp-server` → `sdk`. The rule now encoded in `tests/action-pinning.test.js`: **no step
+  whose failure leaves no residue may be able to skip a step that finishes an irreversible
+  one.** That test previously asserted the opposite and had to be inverted in the same
+  commit — because `Run Full Test Suite` is the release job's first step, a reorder shipped
+  alone would have failed the release at its own gate.
+
+  The two finishers carry guards on their own inputs rather than a bare `!cancelled()`,
+  which would publish a release with a 0-byte body and an unmatched `.tgz` glob when
+  `Build Package` fails — the `bodyBytes=0` defect already seen on v11.9.0, .1 and .2. And
+  deliberately not `continue-on-error`: a tolerated failure makes the run conclude
+  **green**, which is the blindness that let the SDK sit seven versions behind, unattested,
+  with nothing noticing.
+
+**Prose surfaces that shipped stale twice running**
+
+- `bin/utils/readiness-gate.js` scored `RELEASENOTES.md` on `fileExists` while its
+  changelog sibling three lines away checked that the version appeared *in* the file. That
+  asymmetry is why the immutable 11.9.3 tarball's README said "Latest release v11.9.2" and
+  the immutable 11.9.4 tarball shipped with no 11.9.4 entry at all — while `README.md`
+  offers that file as the human-readable route to the BREAKING notes. Both are now checked,
+  anchored rather than by substring (`includes('11.9.4')` is also satisfied by
+  `## v11.9.40`).
+
+  **Policy change, stated plainly:** every release from here needs a `RELEASENOTES.md`
+  entry. Six published 11.x versions do not have one, so that file has been curated rather
+  than exhaustive; the gate only ever looks for the version being released, so those gaps
+  are unaffected.
+
+- README's `## Latest release` is deliberately gated by a **test** rather than written by
+  `sync-version.js`. Auto-bumping the version token onto the previous release's paragraph
+  produces the right number attached to the wrong description — a better-disguised
+  falsehood than a visibly stale one.
+
+- `docs/sdk-reference.md` offered `npx mindforge-cc@stable` as a way to get the SDK
+  "as part of the framework". Measured false: the published package declares exactly
+  `express` and `sql.js` and ships no `sdk/` directory. Removed.
+
+### Added
+
+- **`mindforge-sdk` is published, with provenance** — its first release since 11.8.0 and
+  its first ever attested one. This is not cosmetic. Everything fixed in the SDK across
+  11.8.1–11.9.4 reached nobody, including the one that matters most:
+  `WebSocketEventStream` scheduled a reconnect with `setTimeout(() => this.connect(), …)`
+  and nothing handled the returned promise, so a failed reconnect was an unhandled
+  rejection — fatal under Node's default mode, **terminating the caller's process**. Every
+  consumer on 11.8.0 still has that. (#191)
+
+- `npm run provenance:check` — the gate above, runnable offline.
+
+### Notes for operators
+
+- 11.9.4 is complete but was finished by hand: its GitHub Release was created at the
+  existing tag from the registry's own tarball (verified against `dist.integrity` and both
+  attestation bundles' subject digests), and the `v11.9.4` tag was deliberately **not**
+  moved, because two published packages' provenance attests to the commit it names.
+- The `stable` dist-tag lagged at 11.9.3 between the two releases. Because the dist-tag
+  step now runs *ahead* of both additive publishes, this release moves it forward even if a
+  package publish fails again.
+- Still outstanding, and requiring repository settings rather than code: there is no `v*`
+  **tag ruleset** restricting who may create the ref that triggers publishing, and
+  `NPM_TOKEN` remains a long-lived repository secret with no GitHub environment in front of
+  it. Create the environment *first* — adding `environment:` while none exists publishes
+  exactly as before while looking like a gate.
+
+## [11.9.4] — 2026-08-22 — Delivery: the gates register, the tarball matches its tag
 
 Patch release. 11.9.3 argued that an instrument must not report success while doing
 nothing. 11.9.4 is what an adversarial audit of the **published** 11.9.3 artifact found
@@ -71,13 +307,36 @@ not from reading the repository. That distinction is the whole content of this r
   exactly this reason, and the manifest's entire content is the sync record *for that
   already-excluded file*. (#225)
 
-- **`mindforge-sdk` is published again, with provenance.** It sat at **11.8.0** on npm
-  while `sync-version.js` kept `sdk/package.json` at canonical — seven releases of
-  disagreement (11.8.1 through 11.9.3, none published) that nothing detected, because
-  `version:check` verifies the tracked file and not what the registry serves. It was also
-  the only one of the three packages with **no attestation**. The release workflow now
-  publishes it with `--provenance`, after the two proven publishes and before the GitHub
-  Release, so the newest step cannot cost the others their artifacts.
+- **`mindforge-sdk` was NOT published in this release. It remains at 11.8.0.** This entry
+  originally claimed it shipped with provenance; that claim was false and is corrected here
+  rather than quietly deleted, because a release arguing for measured claims does not get to
+  misstate a supply-chain property.
+
+  What happened: the SDK sat at **11.8.0** on npm while `sync-version.js` kept
+  `sdk/package.json` at canonical — seven releases of disagreement (11.8.1 through 11.9.3,
+  none published) that nothing detected, because `version:check` verifies the tracked file
+  and not what the registry serves. It was also the only one of the three packages with **no
+  attestation**. A publish step was added for it, and the registry rejected it:
+
+  ```
+  npm error 422 Unprocessable Entity - PUT https://registry.npmjs.org/mindforge-sdk
+    Error verifying sigstore provenance bundle: Failed to validate repository information:
+    package.json: "repository.url" is "", expected to match
+    "https://github.com/sairam0424/MindForge" from provenance
+  ```
+
+  `sdk/package.json` carried no `repository` field. The other two packages both do, which is
+  exactly why they published and it did not. That field is validated **registry-side at PUT**,
+  after two irreversible publishes have already succeeded — `npm publish --dry-run` does not
+  check it and neither did any gate here. Both are fixed for 11.9.5: the field, and an offline
+  preflight gate that refuses to reach a publish without it.
+
+  The step was also badly placed. It ran **before** `Create GitHub Release` and the `stable`
+  dist-tag move, so its failure skipped both — which is the precise harm the placement comment
+  claimed to prevent. `mindforge-cc@11.9.4` and `mindforge-mcp-server@11.9.4` published
+  correctly with provenance attesting commit 353e8d41; the release page and the `stable` tag
+  were completed by hand afterwards. The finishing steps now run ahead of the additive
+  publishes, so no optional package can strand a release again.
 
 - **The Homebrew formula carries the real 11.9.3 digest.** Verified against an independent
   measurement rather than the tool's own output, and explicitly confirmed not to be the

package/MINDFORGE.md

@@ -1,9 +1,9 @@
-# MINDFORGE.md — Parameter Registry (v11.9.4)
+# MINDFORGE.md — Parameter Registry (v11.9.6)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.9.4
+[VERSION] = 11.9.6
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
 [REQUIRED_CORE_VERSION] = 11.9.1

package/README.md

@@ -1,19 +1,39 @@
 # MindForge
 
+[![npm version](https://img.shields.io/npm/v/mindforge-cc.svg)](https://www.npmjs.com/package/mindforge-cc)
+[![npm downloads](https://img.shields.io/npm/dm/mindforge-cc.svg)](https://www.npmjs.com/package/mindforge-cc)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![Node >=18](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](package.json)
+
 **An agentic intelligence framework for Claude Code** — orchestrates multi-agent workflows with governance, memory, and autonomous execution. Production-hardened with true parallelism, streaming SDK, and zero-trust security. Install once, get structured AI-driven development with built-in quality gates.
 
+**At a glance:** 221 slash commands · 355 skills (232 auto-triggered + 123 explicit) · 218 personas · 164 installable subagents · 35 pre-built multi-agent dynamic workflows · a tamper-evident audit hash-chain · cost-aware routing across Anthropic/OpenAI/Gemini/Bedrock/Ollama · a local-first knowledge graph on zero-native-dependency SQLite (sql.js) · a live Express+SSE dashboard. Ships as an npm package, a Claude Code plugin, and an MCP server.
+
+**Jump to:** [Latest release](#latest-release) · [What is actually enforced](#what-is-actually-enforced) · [Install](#install) · [Quick start](#quick-start-new-project) · [Documentation](#documentation) · [Core workflow](#core-workflow) · [Dynamic workflows](#dynamic-workflow-library)
+
 ---
 
 ## Latest release
 
-**v11.9.3** (2026-08-21) — Honesty: gates that can fail, commands that run, a release path that is
-checked. Twenty-one fixes sharing one defect — an instrument reporting success while doing nothing:
-a self-install that printed "skipping" and overwrote 149 tracked files, 11 of 27 routed CLI verbs
-dying on `MODULE_NOT_FOUND` in a real install, `--fetch-sha` hashing npm's 404 body into the Homebrew
-formula, no version channel covering any document a user receives, and a publish path no check ever
-touched. **Contains behaviour changes under a patch bump** — several fixed bugs whose correct
-behaviour differs from what shipped. See the BREAKING section in
-[CHANGELOG.md](./CHANGELOG.md), or [RELEASENOTES.md](./RELEASENOTES.md) for human-readable notes.
+**v11.9.6** (2026-09-20) — The docs stop overselling what the code discloses about itself.
+The release-readiness pass before pointing real, external users at the project: fixed a
+crash in `/mindforge:learn` (wrong argument shape into `skill-registrar.js`), a token-leak
+and inconsistent auth in the browser daemon, three dashboard panels that silently rendered
+nothing, a stale Homebrew formula, and a long-running pattern of docs describing
+PQAS/ZTAI/"Pillar"-numbered subsystems as live security guarantees when the code that
+implements them already self-labels them simulated and off-by-default. No new features.
+See [RELEASENOTES.md](./RELEASENOTES.md) for the human-readable summary, or
+[CHANGELOG.md](./CHANGELOG.md) for the complete, file-by-file list.
+
+The previous release, **v11.9.5**, fixed a release pipeline that could strand itself
+mid-publish and shipped `mindforge-sdk` for the first time since 11.8.0, with provenance.
+**v11.9.4**, before that, is where the hook gates started actually registering: 11.9.3
+shipped the code and then declined to run it on essentially every project. Measured against
+the published tarballs — 11.9.3: **11 hook scripts installed, 0 registered**; 11.9.4:
+**8 registered, 3 deny-class verified blocking**. That **behaviour change under a patch
+bump** still applies — the installer writes `.claude/settings.json` where it previously
+declined, merging append-only and backing up first. See the BREAKING section in
+[CHANGELOG.md](./CHANGELOG.md).
 
 ---
 
@@ -22,8 +42,9 @@ behaviour differs from what shipped. See the BREAKING section in
 Read this before the install instructions. MindForge ships a large corpus of agent
 instructions — commands, skills, personas, protocols — and those are advisory: they work by
 being in the model's context, and a model can decline them. The parts that would *block* an
-action are hooks. Through 11.9.2 **no channel registered them**; as of 11.9.3 both channels
-register and execute them **on Claude Code**, and nowhere else.
+action are hooks. Through 11.9.2 **no channel registered them.** 11.9.3 added the registration code
+but it declined to run on almost every project, so in practice nothing was enforced there either.
+**As of 11.9.4** both channels register and execute them **on Claude Code**, and nowhere else.
 
 | Capability | Plugin channel | `npx` channel |
 |---|---|---|
@@ -145,7 +166,7 @@ Full verification walkthrough: [docs/quick-verify.md](docs/quick-verify.md).
 - **Audit events:** [docs/References/audit-events.md](docs/References/audit-events.md)
 - **Upgrade guide:** [docs/upgrade.md](docs/upgrade.md)
 - **Workflow atlas:** [docs/workflow-atlas.md](docs/workflow-atlas.md)
-- **Security:** [docs/security/SECURITY.md](docs/security/SECURITY.md) (MindForge never stores credentials in files)
+- **Security:** [SECURITY.md](SECURITY.md) (credentials are read from env vars and never committed to the repository)
 - **Threat model:** [docs/security/threat-model.md](docs/security/threat-model.md)
 - **Architecture:** [docs/architecture/README.md](docs/architecture/README.md)
 - **Contributing:** [docs/contributing/CONTRIBUTING.md](docs/contributing/CONTRIBUTING.md)

package/RELEASENOTES.md

@@ -1,5 +1,172 @@
 # Release Notes
 
+## v11.9.6 — 2026-09-20 — The docs stop overselling what the code discloses about itself
+
+### Why this release exists
+
+This is the readiness pass before pointing real, external users at the project for the
+first time. No new features — it fixes two reproducible bugs, three dashboard panels that
+silently rendered nothing, one stale security policy and one stale Homebrew formula, and a
+long-running pattern where docs described PQAS/ZTAI/"Pillar"-numbered subsystems as live
+security guarantees when the code that implements them (`bin/governance/quantum-crypto.js`,
+`bin/governance/ztai-manager.js`) already self-labels them simulated and off-by-default.
+
+### The user-visible part
+
+**`/mindforge:learn` works again.** It crashed on every skill that scored well enough to
+auto-register — `skill-registrar.js`'s `register()` was called with the wrong argument
+shape, so the CLI printed a bare `❌ Error` and nothing ever reached `MANIFEST.md`.
+
+**The browser daemon no longer leaks its own auth token, and now actually checks it.**
+`/navigate`, `/click`, `/type`, and `/screenshot` had zero authentication before this —
+only `/evaluate` did. The startup log used to print the raw token to stdout (captured into
+a plaintext, non-gitignored log file); now it only prints where the token file lives.
+
+**Three dashboard panels (Memory, Team, and the cost/quality charts) were reading response
+fields the backing API has never produced**, so they rendered as permanently empty with no
+error. They now read the real shapes.
+
+**If you use Homebrew:** `brew install mindforge` was pinned two releases behind
+(`11.9.3`) and is now current. It will lag one release again after this one ships — that's
+expected; the formula can't point at a tarball that doesn't exist yet.
+
+### The documentation part
+
+Six reference docs (`docs/registry/*.md`) were frozen at v11.3.1 with command/skill/
+persona counts off by 2–9x and 14+ slash commands listed that don't exist. `usp-features.md`,
+`CODEBASE-MAP.md`, `docs/architecture/README.md`, and several other pages described
+post-quantum crypto and Zero-Trust Agentic Identity as unconditional, shipped security
+rather than the explicitly-simulated, opt-in-gated features they are in the actual code.
+All rewritten to match the same measured tone the README's *What is actually enforced*
+section and `docs/faq.md`/`docs/troubleshooting.md` already used. Two orphaned scratch
+files that were never real documentation were removed.
+
+See [CHANGELOG.md](./CHANGELOG.md) for the complete, file-by-file list.
+
+## v11.9.5 — 2026-08-22 — The release path can no longer strand itself, and the SDK ships
+
+### Why this release exists
+
+11.9.4 published two packages and then failed on the third, and that failure took the release
+page and the `stable` dist-tag with it:
+
+```
+success  Publish to npm                        <- mindforge-cc@11.9.4        (irreversible)
+success  Publish standalone MCP server to npm  <- mindforge-mcp-server@11.9.4 (irreversible)
+failure  Publish the SDK to npm                <- 422: "repository.url" is ""
+skipped  Create GitHub Release
+skipped  Point the stable dist-tag at this release
+```
+
+Two causes, both fixed here.
+
+**The metadata was only ever validated by the registry.** `sdk/package.json` had no
+`repository` field, and npm compares that field against the attestation **server-side at PUT**.
+`npm publish --dry-run` does not check it and nothing here read `repository` at all — so all six
+preflight gates passed on a manifest guaranteed to be rejected. There is now an offline gate in
+*preflight*, ahead of every publish, that discovers the provenance-publishing packages from the
+workflow itself. Run against a worktree at tag `v11.9.4` — the tree the registry rejected — it
+exits 1 and names the file. It would have stopped that release.
+
+**The step order let an optional package strand the release.** The SDK publish sat before the
+release page and the dist-tag move, so its failure skipped both. The same mode had already fired
+on v11.5.1 and v11.8.3. Reordered so the steps that *finish* a release run ahead of any additive
+package publish — which means this release moves `stable` forward even if a package fails again.
+
+### The user-visible part
+
+**`mindforge-sdk` publishes for the first time since 11.8.0, and for the first time with
+provenance.** Everything fixed in the SDK across 11.8.1–11.9.4 had reached nobody, including
+this: `WebSocketEventStream` scheduled a reconnect and nothing handled the returned promise, so
+a failed reconnect was an unhandled rejection — fatal under Node's default mode, **terminating
+the caller's process**. Every consumer on 11.8.0 still has that.
+
+### Also fixed
+
+- `bin/utils/readiness-gate.js` scored `RELEASENOTES.md` on existence while its changelog sibling
+  checked the version was *in* the file. That asymmetry is why both prose surfaces shipped stale
+  in 11.9.3 and again in 11.9.4. Both are now checked, anchored rather than by substring.
+  **Policy change:** every release from here needs an entry in this file.
+- `docs/sdk-reference.md` claimed `npx mindforge-cc@stable` installs the SDK "as part of the
+  framework". Measured false — the published package declares exactly `express` and `sql.js` and
+  ships no `sdk/`. Removed.
+
+### Note on 11.9.4
+
+It is complete, but was finished by hand: its GitHub Release was created at the existing tag from
+the registry's own tarball, verified against `dist.integrity` and both attestation bundles'
+subject digests. The `v11.9.4` tag was deliberately **not** moved, because two published
+packages' provenance attests to the commit it names.
+
+## v11.9.4 — 2026-08-22 — Delivery: the gates register, the tarball matches its tag
+
+### The headline
+
+**11.9.3 shipped the hook-registration code and then declined to run it.** The installer skipped
+whenever any ancestor directory contained a `.claude`. On a machine that has ever run Claude Code
+that means `~/.claude`, so essentially every install copied the enforcement in and wired none of it.
+
+Measured against the published tarballs in a confined sandbox, with `~/.claude` as the only ancestor:
+
+```
+11.9.3:  11 hook scripts installed, 0 registered, no settings.json written
+11.9.4:   8 registered, preflight executed 7 of 8, 3 deny-class verified blocking
+```
+
+The reason the installer printed was wrong three separate ways:
+
+1. `~/.claude/settings.json` is the **user tier**, applied in addition to the project tier. Its
+   existence says nothing about whether a project file is read — so the condition that suppressed
+   the gates was satisfied by an ordinary laptop.
+2. For a real project ancestor the claim is false too: that file is not read either. Proved with a
+   marker hook two levels up that never fired across a dozen tool calls. Skipping did not deliver
+   the gates elsewhere; it delivered them nowhere.
+3. The git-boundary guard was dead code, which is why the walk reached `$HOME` at all.
+
+It now warns and registers anyway. A registration that turns out inert costs nothing; a skip is
+guaranteed inert.
+
+### ⚠️ Behaviour change under a patch bump
+
+The installer now writes `.claude/settings.json` on projects where it previously declined — for most
+users, **0 registered hooks becomes 8**, three of which can block a tool call. It merges append-only
+into any existing file, backs the previous one up under `.mindforge/backups/`, and records exactly
+what it did in `.mindforge/hook-registration.json`.
+
+A registered hook is only *live* if the harness has been **restarted** (hooks are snapshotted at
+session start), the project is **trusted** in the harness, and `CLAUDE_PROJECT_DIR` is set with
+`node` on the hook PATH. See *Hooks are installed but nothing is blocked* in
+`docs/troubleshooting.md`.
+
+### Fixes
+
+- The installer's only failure-path pointer led nowhere: it said "see `docs/troubleshooting.md`",
+  where the word *hook* appeared **0** times. That section now exists.
+- The published tarball was not reproducible from its own tag. `.mindforge/memory/sync-manifest.json`
+  — gitignored, written at runtime — was **1 of 1979** shipped files not tracked at `v11.9.3`, so
+  provenance attested to a tree containing a file the repository does not contain.
+- The README understated the product: it still said **no channel registers hooks** and that the
+  plugin dispatcher crashes on every fire. Measured: 14 of 14 plugin path tokens resolve and two
+  deny-class hooks return exit 2. A document that under-claims a security capability is the same
+  defect as one that over-claims it.
+- Defects an 8-agent audit found in the *published* 11.9.3: an empty release page, a shipped CI
+  snippet telling users to `npx` a package we do not own, and a version-source gate that missed a
+  live defect twice.
+- The Homebrew formula carries the real 11.9.3 digest, verified against an independent measurement.
+
+### Known issue in this release
+
+**`mindforge-sdk` did not publish and remains at 11.8.0.** A publish step was added for it and the
+registry rejected it with 422: `sdk/package.json` carried no `repository` field, which npm's
+provenance verification validates **server-side at publish time** — `npm publish --dry-run` does not
+check it, and no gate here did either.
+
+Worse, the step was placed *before* the release-page and dist-tag steps, so its failure skipped
+both. `mindforge-cc@11.9.4` and `mindforge-mcp-server@11.9.4` published correctly with provenance;
+the release page and the `stable` tag were completed by hand afterwards. Both causes are fixed for
+the next release: the missing field, an offline preflight gate that refuses to reach a publish
+without it, and a reordering so the steps that finish a release run ahead of any optional package.
+
 ## v11.9.3 — 2026-08-21 — Honesty: gates that can fail, commands that run, a release path that is checked
 
 ### What's New

package/SECURITY.md

@@ -1,6 +1,6 @@
 # Security Policy
 
-> **Current version:** 11.9.4 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
+> **Current version:** 11.9.6 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
 
 ## Supported Versions
 
@@ -70,7 +70,7 @@ We follow responsible disclosure practices. We will credit reporters in the rele
   hash of the previous entry. Not a Merkle tree: there is no hash tree and no inclusion proof, so
   "Merkle" was the wrong word for it. What it detects, and does not, is measured below.
 - **AuditWriter with buffered writes** — Atomic append operations prevent partial writes from corrupting the log.
-- **Log rotation with archival** — AUDIT.jsonl auto-archives beyond 5000 lines with gzip compression, preventing unbounded disk growth.
+- **Unbounded audit log, by design** — A prior AUDIT.jsonl rotation/archival mechanism (5000-line threshold, gzip) was removed: truncating the file broke the hash chain by orphaning `previous_hash` pointers to archived entries. AUDIT.jsonl now grows without bound; chain-aware compaction is a tracked future improvement, not yet shipped.
 - **npm provenance** — Published packages include SLSA Build Level 2 attestation via `--provenance`, proving the package was built from the stated source commit in CI.
 
 ### Input Validation & Injection Prevention