mindforge-cc 11.9.9 → 12.0.0

package/.agent/mindforge/agent.md

@@ -8,7 +8,7 @@ allowed-tools:
 ---
 
 <objective>
-Provide an on-demand mechanism to "spawn" any of the 13+ standardized MindForge personas. This allows the user to switch the AI assistant's context, role, and process to a specific specialized mode (e.g., Roadmapper, Security Reviewer, Analyst).
+Provide an on-demand mechanism to "spawn" any of the 216 standardized MindForge personas. This allows the user to switch the AI assistant's context, role, and process to a specific specialized mode (e.g., Roadmapper, Security Reviewer, Analyst).
 </objective>
 
 <execution_context>

package/.claude/commands/mindforge/agent.md

@@ -8,7 +8,7 @@ allowed-tools:
 ---
 
 <objective>
-Provide an on-demand mechanism to "spawn" any of the 13+ standardized MindForge personas. This allows the user to switch the AI assistant's context, role, and process to a specific specialized mode (e.g., Roadmapper, Security Reviewer, Analyst).
+Provide an on-demand mechanism to "spawn" any of the 216 standardized MindForge personas. This allows the user to switch the AI assistant's context, role, and process to a specific specialized mode (e.g., Roadmapper, Security Reviewer, Analyst).
 </objective>
 
 <execution_context>

package/.mindforge/config.json

@@ -1,5 +1,5 @@
 {
-  "version": "11.9.9",
+  "version": "12.0.0",
   "environment": "development",
   "governance": {
     "drift_threshold": 0.75,

package/.mindforge/dynamic-workflows/scripts/verification-loop.js

@@ -128,6 +128,9 @@ for (let round = 1; round <= maxRounds; round++) {
 }
 
 phase('Report');
+if (scoreHistory.length === 0) {
+  return { task, metric: metric || '(scorer-inferred)', finalArtifact: currentArtifact, scoreHistory: [], error: 'no-rounds-completed' };
+}
 const finalScore = scoreHistory.at(-1);
 log(`Final score: ${finalScore.score}/100 across ${scoreHistory.length} round(s)`);
 

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # Changelog
 
+## [12.0.0] — 2026-09-24 — First release aimed at real external users
+
+MindForge's first release deliberately cut for real external users, not
+just internal iteration. The major-version bump is a milestone marker for
+that shift, not a signal of a breaking API/behavior change — there is none
+in this release; every item below is a fix. It follows a second, independent
+8-agent audit (security/STRIDE, staff-engineer code review, deps+license,
+live production dry-run across all 6 supported runtimes, docs accuracy,
+re-verification of the prior release's deferred backlog, test-coverage gaps,
+and a full trace of the CI/CD release pipeline) run specifically to check
+whether v11.9.9 was actually ready for that shift. It wasn't yet: this
+release closes the 1 CRITICAL and 4 HIGH findings that audit surfaced, plus
+8 MEDIUM/LOW findings judged worth fixing before this exact cutover, all
+independently adversarially re-verified (10/10 confirmed, 0 refuted) before
+being fixed.
+
+### Fixed
+
+**CRITICAL**
+
+- `--global` install printed a fabricated "PAYLOAD MANIFEST" (216 personas,
+  122 skills, etc. "active") while writing none of them — the install
+  success banner counted the source package tree instead of what a global
+  install actually writes (entry file, commands, subagents only, by
+  design). Now prints an honest message describing exactly that.
+
+**HIGH**
+
+- `help.md`/`status.md`/`health.md`/`security-scan.md`'s honesty fixes from
+  11.9.9 didn't reach the install banner itself: it printed "Proactive
+  Semantic Intent Harvesting active" — unhedged — for a feature confirmed
+  to be a genuine no-op, one line below a properly-hedged PQAS claim.
+  Reworded to match. The banner's surrounding "Autonomous Enterprise
+  Agentic Ecosystem" / "Sovereign Intelligence" / "Autonomous Governance &
+  Self-Healing" marketing language, unbacked by anything the rest of the
+  project stands behind, is gone too.
+- `verification-loop.js` (one of the 8 dynamic-workflow scripts null-guarded
+  in 11.9.9) could still crash with an unhandled `TypeError` if its round
+  loop completed zero rounds before any guard ran. Fixed with the same
+  graceful-return shape its siblings already use.
+- Two real test-coverage gaps: nothing asserted the removed `godmode` skill
+  stays absent, or that `--minimal` actually ships 0 persona files. Both
+  covered now, each verified by deliberately breaking the real fix and
+  confirming the new test catches it.
+
+**MEDIUM**
+
+- `bin/security/trust-boundaries.js`'s deny-class gate missed the classic
+  "curl/wget a payload, chmod +x it, run it by path" dropper chain (no
+  interpreter keyword in the final step, so neither existing pattern
+  fired). Added a pattern for it.
+- `bin/governance/config-manager.js`'s `ConfigManager.set()` was vulnerable
+  to prototype pollution via a `__proto__`-shaped key — not reachable from
+  any shipped call site today, but a live, shared, mutable singleton.
+  Guarded, matching a pattern this codebase already uses elsewhere.
+- CodeQL flagged (high severity) an incomplete regex-escape in
+  `bin/utils/readiness-gate.js` once this release's own plugin-bundling fix
+  (below) exposed it to scanning for the first time — only literal dots
+  were escaped before building a `RegExp` from the package version string.
+  Fixed to escape every regex metacharacter.
+- Dependabot's unconstrained docker config silently shipped the Docker MCP
+  Catalog image on `node:25-bookworm-slim`, a non-LTS release. Reverted to
+  `node:22-bookworm-slim` (the CI test matrix's highest tested version) and
+  added an ignore rule blocking future Node major-version bumps of the base
+  image.
+- `docs/PERSONAS.md`'s "Enterprise Swarm Templates" table cited 16 of 25
+  persona names that don't exist — a doc artifact never regenerated after
+  `swarm-templates.json`'s own dangling-reference cleanup in 11.9.9.
+  Regenerated wholesale from the real file: all 49 templates, exact
+  leader/members/focus values.
+- The release workflow's "stable dist-tag" step has failed on 4 consecutive
+  real releases (11.9.6 through 11.9.9) for an identical, root-caused
+  reason: its retry budget (3 attempts × 5s) was an order of magnitude
+  short of npm's own stated multi-minute propagation window, even though
+  the underlying write always succeeded. Widened to 10 attempts × 15s.
+- `.agent/settings.json` was missing the `instinct-capture` hook
+  `.claude/settings.json` has had since before 11.9.0 — a tracked,
+  documented parity gap. Mirrored the registration and, for the first
+  time, bundled its dependency closure into the plugin distribution.
+- Three GitHub Actions hygiene items: an `${{ }}`-into-shell interpolation
+  inconsistency in `control-plane.yml`, an unused `contents: write` grant
+  in `auto-pr.yml`, and an unverified `gitleaks` binary download in
+  `secret-scan.yml` (now checksum-verified against the project's own
+  published `checksums.txt`).
+- Stale doc drift: `agent.md`'s "13+ personas" claim (two mirrors)
+  corrected to 216; `docs/registry/PERSONAS.md`'s 3-release-stale version
+  header and unhedged PQAS citation corrected.
+
 ## [11.9.9] — 2026-09-23 — Release-readiness audit: 5 CRITICAL + 9 HIGH findings fixed
 
 Patch release. An 8-agent audit workflow tested every MindForge surface (slash commands,

package/MINDFORGE.md

@@ -1,9 +1,9 @@
-# MINDFORGE.md — Parameter Registry (v11.9.9)
+# MINDFORGE.md — Parameter Registry (v12.0.0)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.9.9
+[VERSION] = 12.0.0
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
 [REQUIRED_CORE_VERSION] = 11.9.1

package/README.md

@@ -70,7 +70,7 @@ but it declined to run on almost every project, so in practice nothing was enfor
 
 What that means, measured rather than asserted:
 
-- **The `npx` channel generates the config it never used to ship.** `files[]` has 52 entries and
+- **The `npx` channel generates the config it never used to ship.** `files[]` has 53 entries and
   none of them contains `settings`, so no settings file is *published* — instead
   `bin/installer/hook-registration.js` writes one at install time, merging append-only into any
   file you already have. Measured on a confined install: **8 hooks registered** into
@@ -239,33 +239,37 @@ Full verification walkthrough: [docs/quick-verify.md](docs/quick-verify.md).
 
 ## Latest release
 
-**v11.9.9** (2026-09-23) — Release-readiness audit: 5 CRITICAL + 9 HIGH findings fixed. An
-8-agent audit workflow tested every surface (commands, skills, personas, subagents,
-dynamic workflows, CLI/MCP, live install/verify/health) as a release gate before pointing
-real external users at the project. Every finding was independently re-verified against
-live code before fixing, not trusted from the audit report alone. Five were ship-blocking:
-a real LLM jailbreak toolkit (`godmode`) shipping unconditionally in the package is gone;
-`help.md`/`status.md`/`health.md`/`security-scan.md` stop claiming PQAS/biometric/
-lattice-crypto verification is "active by default" when the code says the opposite;
-`--minimal` now actually skips the persona set instead of shipping all 218 files anyway; a
-"Sovereign Integrity Check" that called a CLI flag on a script with no CLI entrypoint (and
-so could never fail) is replaced with a real check; and a dead 4-line stub standing in for
-"232 auto-triggered skills" is now disclosed as what it is. Nine more: corrected CLI
-invocation docs, disclosed the marketplace's zero published packages, crash-guards on 8
-dynamic workflows, 32 unregistered skills added to the manifest, 3 personas granting
-tools that don't exist fixed, 11 dangling swarm-template references reconciled, `health`
-wired to a real integrity check, and a brand-new install's audit log no longer reporting a
-false "BROKEN" status. See [RELEASENOTES.md](./RELEASENOTES.md) or
-[CHANGELOG.md](./CHANGELOG.md).
+**v12.0.0** (2026-09-24) — First release aimed at real external users. The major-version
+bump marks that shift, not a breaking change — there isn't one; every item here is a fix.
+A second, independent 8-agent audit checked whether v11.9.9 actually cleared that bar
+(security/STRIDE, staff-engineer code review, deps+license, a live production dry-run
+across all 6 supported runtimes, docs accuracy, re-verification of the prior release's
+deferred backlog, test-coverage gaps, and a full trace of the release pipeline) and found
+1 CRITICAL + 4 HIGH issues still standing in the way. The CRITICAL: `--global` installs
+printed a fabricated banner claiming 216 personas/122 skills were "active" while writing
+none of them — now prints an honest description of what a global install actually writes.
+The four HIGH: an unhedged "active" claim for a confirmed no-op feature plus unearned
+"Autonomous Enterprise/Sovereign" marketing language in the install banner, both reworded;
+a dynamic-workflow script's own null-guard commit missed one crash-causing edge case, now
+covered; and two real test-coverage gaps (nothing guarded the removed `godmode` skill or
+the `--minimal` persona fix against regressing) are closed. Eight more, lower severity: a
+security dropper-chain pattern gap, a latent prototype-pollution path, a CodeQL-flagged
+regex-escape bug, a non-LTS Node base image that slipped in via Dependabot, a docs table
+citing 16 nonexistent personas, a release-pipeline step that's failed cosmetically on the
+last 4 releases, a cross-runtime hook-registration parity gap, and CI/doc hygiene fixes.
+See [RELEASENOTES.md](./RELEASENOTES.md) or [CHANGELOG.md](./CHANGELOG.md).
 
 <details>
 <summary><strong>Earlier releases</strong></summary>
 
-**v11.9.8** fixed two real bugs found by a literal, end-to-end README audit (113 claims
-checked, 98 held up): `--runtime claude,cursor` crashed the installer outright, and
-`--minimal` claimed "no persona library" but shipped all 216 anyway. The other twelve
-findings were documentation catching up to what the code actually does. The previous
-release, **v11.9.7**, fixed a version self-contradiction and a false "Enabled"
+**v11.9.9** ran the first release-readiness audit as a gate before pointing real external
+users at the project for the first time — 5 CRITICAL findings (including a shipped LLM
+jailbreak skill and a `--minimal` flag that shipped the full persona set anyway) and 9 HIGH
+findings, all fixed. **v11.9.8** fixed two real bugs found by a literal, end-to-end README
+audit (113 claims checked, 98 held up): `--runtime claude,cursor` crashed the installer
+outright, and `--minimal` claimed "no persona library" but shipped all 216 anyway. The
+other twelve findings were documentation catching up to what the code actually does. The
+release before that, **v11.9.7**, fixed a version self-contradiction and a false "Enabled"
 claim in the install banner, a dead `docs.mindforge.cc` link, and a persona-count doc
 regression (218 → back to the correct 216) introduced by v11.9.6's own honesty pass.
 **v11.9.6** was the release-readiness pass before pointing real, external users at the

package/RELEASENOTES.md

@@ -1,5 +1,41 @@
 # Release Notes
 
+## v12.0.0 — 2026-09-24 — First release aimed at real external users
+
+### Why this release exists
+
+This is the first MindForge release deliberately cut for real external users, not just
+internal iteration — the major-version bump marks that shift, not a breaking change (there
+isn't one; every item below is a fix). Ahead of it, a second independent 8-agent audit
+checked whether v11.9.9 actually cleared that bar: security/STRIDE review, a fresh
+staff-engineer code review, a dependency and license audit, a live production dry-run
+across all 6 supported runtimes, a docs-accuracy pass, re-verification of the prior
+release's deferred backlog, a test-coverage-gap sweep, and a full trace of the release
+pipeline itself. It found 1 CRITICAL and 4 HIGH issue still standing in the way, plus 8
+MEDIUM/LOW issues worth closing before this exact cutover — all adversarially re-verified
+(10/10 confirmed, 0 refuted) before being fixed.
+
+### The user-visible part
+
+**The one CRITICAL:** `--global` installs printed a fabricated success banner claiming 216
+personas and 122 skills were "active," when a global install writes none of them by
+design — now prints an honest description of what it actually writes.
+
+**Four HIGH fixes:** the install banner also claimed a "Proactive Semantic Intent
+Harvesting" feature was "active" when it's a confirmed no-op, and carried marketing
+language ("Autonomous Enterprise Agentic Ecosystem," "Sovereign Intelligence") this project
+doesn't otherwise stand behind — both reworded to match the honesty bar the rest of the
+docs already hold to. A dynamic-workflow script could still crash on an edge case its own
+null-guard commit missed. Two real test-coverage gaps (nothing guarded the removed
+`godmode` skill or the `--minimal` persona fix against regressing) are closed.
+
+**Eight more, lower severity:** a security dropper-chain pattern gap, a latent
+prototype-pollution path, a CodeQL-flagged incomplete regex escape, a non-LTS Node base
+image that slipped in via an unconstrained Dependabot config, a docs table citing 16
+personas that don't exist, a release-pipeline step that's failed cosmetically on the last 4
+releases, a cross-runtime hook-registration parity gap, and a handful of GitHub Actions and
+documentation hygiene fixes. Full list in [CHANGELOG.md](./CHANGELOG.md).
+
 ## v11.9.9 — 2026-09-23 — Release-readiness audit: 5 CRITICAL + 9 HIGH findings fixed
 
 ### Why this release exists

package/SECURITY.md

@@ -1,6 +1,6 @@
 # Security Policy
 
-> **Current version:** 11.9.9 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
+> **Current version:** 12.0.0 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
 
 ## Supported Versions
 

package/bin/governance/config-manager.js

@@ -54,10 +54,13 @@ class ConfigManager {
 
     for (let i = 0; i < keys.length - 1; i++) {
       const k = keys[i];
+      if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;
       if (!target[k]) target[k] = {};
       target = target[k];
     }
-    target[keys[keys.length - 1]] = value;
+    const lastKey = keys[keys.length - 1];
+    if (lastKey === '__proto__' || lastKey === 'constructor' || lastKey === 'prototype') return value;
+    target[lastKey] = value;
     
     this._save();
     return value;

package/bin/installer-core.js

@@ -1123,7 +1123,8 @@ async function install(runtime, scope, options = {}) {
       Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS): available in simulated/experimental '
         + 'mode (inactive by default — set experimental.pqc_demo=true to enable the simulated demo)'), 'info');
     }
-    Theme.printStatus(c.dim('  - Proactive Semantic Intent Harvesting active'), 'info');
+    Theme.printStatus(c.dim('  - Proactive Semantic Intent Harvesting: available in simulated/experimental '
+      + 'mode (the underlying scan/claim logic is not yet wired to run automatically)'), 'info');
 
     // bin/ utilities (remaining non-engine scripts)
     if (withUtils) {
@@ -1404,17 +1405,25 @@ async function run(args) {
   }
 
   if (!isUninstall) {
-    // collectManifestStats() counts the SOURCE tree, not what was written. For a normal install those
-    // coincide, so the panel is accidentally accurate. For a self-install nothing is copied, and the
-    // panel announced "ACTIONS 221 — Total autonomous commands deployed" and
-    // "Skill Packs (123 verified)" for a run that deployed and verified nothing: a summary of the
-    // repository presenting itself as an installation report. Gating it is the honest minimum. Making
+    // collectManifestStats() counts the SOURCE tree, not what was written. For a normal LOCAL install
+    // those coincide, so the panel is accidentally accurate. For a self-install nothing is copied, and
+    // for a GLOBAL install Section 2.1 (skills/hooks/personas/docs/memory/plugins) and Section 3
+    // (.mindforge/ engine, .planning/, bin/) never ran — both are gated `scope === 'local'` above — so
+    // the panel announced "Personas (216 active)" / "Skill Packs (122 verified)" / a full PAYLOAD
+    // MANIFEST for a run that deployed and verified none of them: a summary of the repository
+    // presenting itself as an installation report. Gating on scope too is the honest minimum. Making
     // the panel report MEASURED counts on every path is a larger change and is deliberately not
     // attempted here — it would need the install to return what it wrote.
-    if (isSelfInstall()) {
+    if (isSelfInstall() && scope === 'local') {
       Theme.printResolved(c.bold('Self-install complete — no framework files were written'));
       Theme.printStatus(c.dim('This repository IS the framework: its committed .claude/ and .agent/ '
         + 'trees are the source, so there was nothing to deploy.'), 'info');
+    } else if (scope !== 'local') {
+      Theme.printResolved(c.bold('Global install complete'));
+      Theme.printStatus(c.dim('A --global install writes only the entry file, slash commands, and '
+        + 'native subagents into your home directory. Skills, personas, hooks, and the .mindforge/ '
+        + 'framework engine are NOT part of a global install by design — run a --local install in a '
+        + 'project directory to get those.'), 'info');
     } else {
       const stats = collectManifestStats();
       Theme.printSuccessV2(runtime, scope, stats);

package/bin/security/trust-boundaries.js

@@ -199,6 +199,18 @@ function isHighImpact(command) {
 
     // ── #14 Power-state commands ────────────────────────────────────────────
     /\b(shutdown|reboot|halt|poweroff)\b/i,
+
+    // ── #16 Download -> chmod +x -> direct execution (dropper chain) ───────
+    // curl/wget fetches a payload, chmod +x makes it executable, then the
+    // SAME command line invokes it directly by path with no interpreter
+    // keyword in that final step — so neither #4 (pipe-to-shell) nor #5
+    // (interpreter + untrusted path) above ever see it. Requires all three
+    // in order: a curl/wget call, a chmod ... +x on that call's command
+    // segment, and a later bare invocation of an absolute, /tmp, /var/tmp,
+    // /dev/shm, or ~/-rooted path as its own command (introduced by a
+    // separator or the start of the line) — i.e. the path being run, not
+    // merely referenced as an argument (audit finding, pre-release review).
+    /\b(curl|wget)\b[\s\S]*?\bchmod\b[^;&|\n]*\+x\b[\s\S]*?(^|[;&|\n]\s*)(~\/|\/tmp\/|\/var\/tmp\/|\/dev\/shm\/|\/)\S+/i,
   ];
   return patterns.some(pattern => pattern.test(sanitized));
 }

package/bin/utils/readiness-gate.js

@@ -119,7 +119,7 @@ function releaseReadinessChecks(root) {
       label: 'RELEASENOTES.md present and has an entry for the current version',
       points: 2,
       pass: fileExists(root, 'RELEASENOTES.md') && Boolean(pkgVersion)
-        && new RegExp(`^## v${pkgVersion.replace(/\./g, '\\.')}(?![\\d.\\w-])`, 'm')
+        && new RegExp(`^## v${pkgVersion.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\d.\\w-])`, 'm')
           .test(safeRead(root, 'RELEASENOTES.md')),
       fix: `Add a "## v${pkgVersion || '?'}" section to RELEASENOTES.md. README.md links here as the human-readable route to the BREAKING notes, so releasing without one points readers at a file whose newest entry describes a different version.`,
     },

package/bin/wizard/theme.js

@@ -41,7 +41,7 @@ const Theme = {
     '╚═╝     ╚═╝╚═╝╚═╝  ╚═══╝╚═════╝ ╚═╝      ╚═════╝ ╚═╝  ╚═╝ ╚═════╝ ╚══════╝'
   ].join('\n'),
 
-  tagline: 'THE AUTONOMOUS ENTERPRISE AGENTIC ECOSYSTEM',
+  tagline: 'AI-NATIVE AGENTIC FRAMEWORK FOR CLAUDE CODE',
 
   /**
    * Print a styled header with BMad-style border flare
@@ -66,9 +66,8 @@ const Theme = {
     console.log(`  ${this.colors.dim('│')}  ${this.colors.bold('THE PLATFORM VISION:')}`);
     console.log(`  ${this.colors.dim('│')}    - Unified Enterprise Agentic Ecosystem`);
     console.log(`  ${this.colors.dim('│')}    - Modular Skills & Persona Architecture`);
-    // Added Sovereign Intelligence as a core pillar
-    console.log(`  ${this.colors.dim('│')}    - ${this.colors.magenta('Sovereign Intelligence')}: PQ-Safe & Proactive Swarms`);
-    console.log(`  ${this.colors.dim('│')}    - Autonomous Governance & Self-Healing`);
+    console.log(`  ${this.colors.dim('│')}    - ${this.colors.magenta('Post-Quantum Security')} (simulated) & Proactive Task Homing`);
+    console.log(`  ${this.colors.dim('│')}    - Governance, Audit, and Verification Gates`);
     console.log(`  ${this.colors.dim('│')}`);
     console.log(`  ${this.colors.dim('│')}  ${this.colors.yellow('🌟 100% FREE & OPEN SOURCE')}`);
     console.log(`  ${this.colors.dim('│')}    - No paywalls. No gated content.`);

package/changelogs/v12.0.0.md

@@ -0,0 +1,89 @@
+# Changelog
+
+## [12.0.0] — 2026-09-24 — First release aimed at real external users
+
+MindForge's first release deliberately cut for real external users, not
+just internal iteration. The major-version bump is a milestone marker for
+that shift, not a signal of a breaking API/behavior change — there is none
+in this release; every item below is a fix. It follows a second, independent
+8-agent audit (security/STRIDE, staff-engineer code review, deps+license,
+live production dry-run across all 6 supported runtimes, docs accuracy,
+re-verification of the prior release's deferred backlog, test-coverage gaps,
+and a full trace of the CI/CD release pipeline) run specifically to check
+whether v11.9.9 was actually ready for that shift. It wasn't yet: this
+release closes the 1 CRITICAL and 4 HIGH findings that audit surfaced, plus
+8 MEDIUM/LOW findings judged worth fixing before this exact cutover, all
+independently adversarially re-verified (10/10 confirmed, 0 refuted) before
+being fixed.
+
+### Fixed
+
+**CRITICAL**
+
+- `--global` install printed a fabricated "PAYLOAD MANIFEST" (216 personas,
+  122 skills, etc. "active") while writing none of them — the install
+  success banner counted the source package tree instead of what a global
+  install actually writes (entry file, commands, subagents only, by
+  design). Now prints an honest message describing exactly that.
+
+**HIGH**
+
+- `help.md`/`status.md`/`health.md`/`security-scan.md`'s honesty fixes from
+  11.9.9 didn't reach the install banner itself: it printed "Proactive
+  Semantic Intent Harvesting active" — unhedged — for a feature confirmed
+  to be a genuine no-op, one line below a properly-hedged PQAS claim.
+  Reworded to match. The banner's surrounding "Autonomous Enterprise
+  Agentic Ecosystem" / "Sovereign Intelligence" / "Autonomous Governance &
+  Self-Healing" marketing language, unbacked by anything the rest of the
+  project stands behind, is gone too.
+- `verification-loop.js` (one of the 8 dynamic-workflow scripts null-guarded
+  in 11.9.9) could still crash with an unhandled `TypeError` if its round
+  loop completed zero rounds before any guard ran. Fixed with the same
+  graceful-return shape its siblings already use.
+- Two real test-coverage gaps: nothing asserted the removed `godmode` skill
+  stays absent, or that `--minimal` actually ships 0 persona files. Both
+  covered now, each verified by deliberately breaking the real fix and
+  confirming the new test catches it.
+
+**MEDIUM**
+
+- `bin/security/trust-boundaries.js`'s deny-class gate missed the classic
+  "curl/wget a payload, chmod +x it, run it by path" dropper chain (no
+  interpreter keyword in the final step, so neither existing pattern
+  fired). Added a pattern for it.
+- `bin/governance/config-manager.js`'s `ConfigManager.set()` was vulnerable
+  to prototype pollution via a `__proto__`-shaped key — not reachable from
+  any shipped call site today, but a live, shared, mutable singleton.
+  Guarded, matching a pattern this codebase already uses elsewhere.
+- CodeQL flagged (high severity) an incomplete regex-escape in
+  `bin/utils/readiness-gate.js` once this release's own plugin-bundling fix
+  (below) exposed it to scanning for the first time — only literal dots
+  were escaped before building a `RegExp` from the package version string.
+  Fixed to escape every regex metacharacter.
+- Dependabot's unconstrained docker config silently shipped the Docker MCP
+  Catalog image on `node:25-bookworm-slim`, a non-LTS release. Reverted to
+  `node:22-bookworm-slim` (the CI test matrix's highest tested version) and
+  added an ignore rule blocking future Node major-version bumps of the base
+  image.
+- `docs/PERSONAS.md`'s "Enterprise Swarm Templates" table cited 16 of 25
+  persona names that don't exist — a doc artifact never regenerated after
+  `swarm-templates.json`'s own dangling-reference cleanup in 11.9.9.
+  Regenerated wholesale from the real file: all 49 templates, exact
+  leader/members/focus values.
+- The release workflow's "stable dist-tag" step has failed on 4 consecutive
+  real releases (11.9.6 through 11.9.9) for an identical, root-caused
+  reason: its retry budget (3 attempts × 5s) was an order of magnitude
+  short of npm's own stated multi-minute propagation window, even though
+  the underlying write always succeeded. Widened to 10 attempts × 15s.
+- `.agent/settings.json` was missing the `instinct-capture` hook
+  `.claude/settings.json` has had since before 11.9.0 — a tracked,
+  documented parity gap. Mirrored the registration and, for the first
+  time, bundled its dependency closure into the plugin distribution.
+- Three GitHub Actions hygiene items: an `${{ }}`-into-shell interpolation
+  inconsistency in `control-plane.yml`, an unused `contents: write` grant
+  in `auto-pr.yml`, and an unverified `gitleaks` binary download in
+  `secret-scan.yml` (now checksum-verified against the project's own
+  published `checksums.txt`).
+- Stale doc drift: `agent.md`'s "13+ personas" claim (two mirrors)
+  corrected to 216; `docs/registry/PERSONAS.md`'s 3-release-stale version
+  header and unhedged PQAS citation corrected.

package/docs/faq.md

@@ -1,4 +1,4 @@
-# MindForge FAQ (v11.9.9)
+# MindForge FAQ (v12.0.0)
 
 ## Is MindForge tied to Claude only?
 No. MindForge supports Claude Code and Antigravity. Install with `--claude`,
@@ -55,7 +55,7 @@ The `deep-research` workflow was removed before the v11.8.0 release (the superpo
 ## Version & Stability
 
 **Q: What version is current?**
-v11.9.9 — verify with `node bin/mindforge-cli.js --version`
+v12.0.0 — verify with `node bin/mindforge-cli.js --version`
 
 **Q: Was v11.9.0 production-stable?**
 At that release: yes, by the IQ200 deep-audit (258 discrete checks across 14 dimensions),

package/docs/getting-started.md

@@ -1,4 +1,4 @@
-# MindForge — Getting Started (v11.9.9)
+# MindForge — Getting Started (v12.0.0)
 
 This guide gets you from zero to a working MindForge project in under five minutes.
 
@@ -120,7 +120,7 @@ Or use slash commands: `/mindforge:wf-code-audit`
 ## Your First 5 Minutes with MindForge
 
 1. **Verify install:** `node bin/mindforge-cli.js health`
-2. **Check version:** `node bin/mindforge-cli.js --version` (should print `11.9.9`)
+2. **Check version:** `node bin/mindforge-cli.js --version` (should print `12.0.0`)
 3. **List workflows:** `node bin/mindforge-cli.js workflow list`
 4. **Run first slash command:** Open Claude Code → `/mindforge:status`
 5. **Onboard your codebase:** Open Claude Code → `/mindforge:wf-onboard-codebase`

package/docs/sdk-reference.md

@@ -14,11 +14,11 @@ import {
 } from 'mindforge-sdk';
 ```
 
-Current SDK version: `11.9.9`
+Current SDK version: `12.0.0`
 
 ---
 
-## SDK Exports (v11.9.9)
+## SDK Exports (v12.0.0)
 
 ```javascript
 const {
@@ -28,7 +28,7 @@ const {
   commands,               // Command registry
   batch,                  // Batch execution
   MindForgeMemory,        // Memory interface
-  VERSION                 // '11.9.9'
+  VERSION                 // '12.0.0'
 } = require('mindforge-sdk');
 // or: import { MindForgeClient, VERSION } from 'mindforge-sdk';
 ```

package/docs/troubleshooting.md

@@ -1,4 +1,4 @@
-# MindForge Troubleshooting (v11.9.9)
+# MindForge Troubleshooting (v12.0.0)
 
 This page lists common issues and fast fixes. If you get stuck, start with
 `/mindforge:health`.

package/docs/user-guide.md

@@ -1,8 +1,8 @@
-# MindForge User Guide (v11.9.9)
+# MindForge User Guide (v12.0.0)
 
 This guide gets you from install to productive, with the minimum needed to run MindForge in a real project.
 
-> **v11.9.9 Stats:** 35 workflows · 221 slash commands · 232 engine skills · 216 personas · 0 CVEs · 258/258 IQ200 checks passing
+> **v12.0.0 Stats:** 35 workflows · 221 slash commands · 232 engine skills · 216 personas · 0 CVEs · 258/258 IQ200 checks passing
 
 ## Prerequisites
 
@@ -49,7 +49,7 @@ mindforge health          # Verify project integrity
 mindforge security-scan   # Run security checks
 mindforge headless        # Run agent in non-interactive mode
 mindforge --verbose ...   # Enable verbose output for debugging
-mindforge --version       # Print installed version (e.g. 11.9.9) and exit 0
+mindforge --version       # Print installed version (e.g. 12.0.0) and exit 0
 ```
 
 Use `--verbose` (or `-v`) on any command for detailed diagnostic output. Use `--version` (or `-V`) to print the installed version and exit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindforge-cc",
-  "version": "11.9.9",
+  "version": "12.0.0",
   "description": "Agentic intelligence framework for Claude Code and Antigravity: slash commands, subagents, skills, hooks, governance, memory, and cost-aware model routing for AI-driven development.",
   "bin": {
     "mindforge-cc": "bin/install.js",
@@ -19,6 +19,7 @@
     ".mindforge/config.json",
     ".mindforge/imported-agents.jsonl",
     ".mindforge/engine/",
+    "!.mindforge/engine/instincts/instinct-store.jsonl",
     ".mindforge/manifests/",
     ".mindforge/schemas/",
     ".mindforge/personas/",