mindforge-cc 3.0.0 → 5.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.agent/CLAUDE.md +50 -545
- package/.claude/CLAUDE.md +50 -545
- package/.mindforge/audit/AUDIT-SCHEMA.md +20 -1
- package/.mindforge/engine/nexus-tracer.js +115 -0
- package/.mindforge/engine/persona-factory.md +45 -0
- package/.mindforge/engine/swarm-controller.md +59 -0
- package/.mindforge/engine/wave-executor.md +104 -54
- package/.mindforge/memory/pattern-library.jsonl +1 -2
- package/.mindforge/personas/swarm-templates.json +118 -0
- package/.planning/ROI.jsonl +2 -0
- package/CHANGELOG.md +133 -22
- package/MINDFORGE.md +75 -106
- package/README.md +71 -101
- package/RELEASENOTES.md +41 -24
- package/bin/autonomous/auto-runner.js +154 -4
- package/bin/autonomous/context-refactorer.js +64 -0
- package/bin/autonomous/steer.js +19 -1
- package/bin/autonomous/stuck-monitor.js +43 -0
- package/bin/engine/feedback-loop.js +71 -0
- package/bin/engine/handover-manager.js +69 -0
- package/bin/engine/nexus-tracer.js +215 -0
- package/bin/engine/sre-manager.js +63 -0
- package/bin/engine/temporal-hindsight.js +88 -0
- package/bin/governance/policies/default-policies.jsonl +33 -0
- package/bin/governance/policy-engine.js +106 -0
- package/bin/governance/rbac-manager.js +109 -0
- package/bin/governance/trust-verifier.js +81 -0
- package/bin/governance/ztai-archiver.js +104 -0
- package/bin/governance/ztai-manager.js +203 -0
- package/bin/memory/eis-client.js +95 -0
- package/bin/memory/federated-sync.js +127 -0
- package/bin/memory/ghost-pattern-detector.js +69 -0
- package/bin/memory/knowledge-graph.js +37 -0
- package/bin/memory/semantic-hub.js +104 -0
- package/bin/models/cloud-broker.js +83 -0
- package/bin/models/finops-hub.js +79 -0
- package/bin/models/model-broker.js +129 -0
- package/bin/skill-validator.js +41 -0
- package/docs/INTELLIGENCE-MESH.md +35 -0
- package/docs/PERSONAS.md +63 -0
- package/docs/{references → References}/audit-events.md +6 -0
- package/docs/architecture/NEXUS-DASHBOARD.md +35 -0
- package/docs/architecture/PAR-ZTS-SURVEY.md +43 -0
- package/docs/architecture/README.md +31 -64
- package/docs/architecture/V4-SWARM-MESH.md +77 -0
- package/docs/architecture/V5-ENTERPRISE.md +113 -0
- package/docs/feature-dashboard.md +6 -1
- package/docs/governance-guide.md +47 -23
- package/docs/security/SECURITY.md +20 -7
- package/docs/security/ZTAI-OVERVIEW.md +37 -0
- package/docs/user-guide.md +29 -3
- package/docs/usp-features.md +79 -5
- package/package.json +1 -1
- /package/docs/{context → Context}/Master-Context.md +0 -0
- /package/docs/{references → References}/checkpoints.md +0 -0
- /package/docs/{references → References}/commands.md +0 -0
- /package/docs/{references → References}/config-reference.md +0 -0
- /package/docs/{references → References}/continuation-format.md +0 -0
- /package/docs/{references → References}/decimal-phase-calculation.md +0 -0
- /package/docs/{references → References}/git-integration.md +0 -0
- /package/docs/{references → References}/git-planning-commit.md +0 -0
- /package/docs/{references → References}/model-profile-resolution.md +0 -0
- /package/docs/{references → References}/model-profiles.md +0 -0
- /package/docs/{references → References}/phase-argument-parsing.md +0 -0
- /package/docs/{references → References}/planning-config.md +0 -0
- /package/docs/{references → References}/questioning.md +0 -0
- /package/docs/{references → References}/sdk-api.md +0 -0
- /package/docs/{references → References}/skills-api.md +0 -0
- /package/docs/{references → References}/tdd.md +0 -0
- /package/docs/{references → References}/ui-brand.md +0 -0
- /package/docs/{references → References}/user-profiling.md +0 -0
- /package/docs/{references → References}/verification-patterns.md +0 -0
- /package/docs/{references → References}/workstream-flag.md +0 -0
- /package/docs/{templates → Templates}/Agents/CLAUDE-MD.md +0 -0
- /package/docs/{templates → Templates}/Agents/COPILOT-INSTRUCTIONS.md +0 -0
- /package/docs/{templates → Templates}/Agents/DEBUGGER-PROMPT.md +0 -0
- /package/docs/{templates → Templates}/Agents/PLANNER-PROMPT.md +0 -0
- /package/docs/{templates/codebase → Templates/Codebase}/architecture.md +0 -0
- /package/docs/{templates/codebase → Templates/Codebase}/concerns.md +0 -0
- /package/docs/{templates/codebase → Templates/Codebase}/conventions.md +0 -0
- /package/docs/{templates/codebase → Templates/Codebase}/integrations.md +0 -0
- /package/docs/{templates/codebase → Templates/Codebase}/stack.md +0 -0
- /package/docs/{templates/codebase → Templates/Codebase}/structure.md +0 -0
- /package/docs/{templates/codebase → Templates/Codebase}/testing.md +0 -0
- /package/docs/{templates → Templates}/Execution/CONTINUE-HERE.md +0 -0
- /package/docs/{templates → Templates}/Execution/DISCUSSION-LOG.md +0 -0
- /package/docs/{templates → Templates}/Execution/PHASE-PROMPT.md +0 -0
- /package/docs/{templates → Templates}/Execution/STATE.md +0 -0
- /package/docs/{templates → Templates}/Execution/SUMMARY-COMPLEX.md +0 -0
- /package/docs/{templates → Templates}/Execution/SUMMARY-MINIMAL.md +0 -0
- /package/docs/{templates → Templates}/Execution/SUMMARY-STANDARD.md +0 -0
- /package/docs/{templates → Templates}/Execution/SUMMARY.md +0 -0
- /package/docs/{templates → Templates}/Profile/DEV-PREFERENCES.md +0 -0
- /package/docs/{templates → Templates}/Profile/USER-PROFILE.md +0 -0
- /package/docs/{templates → Templates}/Profile/USER-SETUP.md +0 -0
- /package/docs/{templates → Templates}/Project/DISCOVERY.md +0 -0
- /package/docs/{templates → Templates}/Project/MILESTONE-ARCHIVE.md +0 -0
- /package/docs/{templates → Templates}/Project/MILESTONE.md +0 -0
- /package/docs/{templates → Templates}/Project/PROJECT.md +0 -0
- /package/docs/{templates → Templates}/Project/REQUIREMENTS.md +0 -0
- /package/docs/{templates → Templates}/Project/RETROSPECTIVE.md +0 -0
- /package/docs/{templates → Templates}/Project/ROADMAP.md +0 -0
- /package/docs/{templates → Templates}/Quality/DEBUG.md +0 -0
- /package/docs/{templates → Templates}/Quality/UAT.md +0 -0
- /package/docs/{templates → Templates}/Quality/UI-SPEC.md +0 -0
- /package/docs/{templates → Templates}/Quality/VALIDATION.md +0 -0
- /package/docs/{templates → Templates}/Quality/VERIFICATION-REPORT.md +0 -0
- /package/docs/{templates/research → Templates/Research}/ARCHITECTURE.md +0 -0
- /package/docs/{templates/research → Templates/Research}/FEATURES.md +0 -0
- /package/docs/{templates/research → Templates/Research}/PITFALLS.md +0 -0
- /package/docs/{templates/research → Templates/Research}/STACK.md +0 -0
- /package/docs/{templates/research → Templates/Research}/SUMMARY.md +0 -0
- /package/docs/{templates → Templates}/System/CONFIG.json +0 -0
- /package/docs/{templates → Templates}/System/CONTEXT.md +0 -0
|
@@ -0,0 +1,113 @@
|
|
|
1
|
+
# MindForge v5 Architecture: The Enterprise Beast
|
|
2
|
+
|
|
3
|
+
MindForge v5.0.0 is the definitive enterprise-grade evolution of the agentic framework. This major version introduces distributed intelligence and absolute governance via a zero-trust policy-as-code layer.
|
|
4
|
+
|
|
5
|
+
## Core Pillars (v5.0.0)
|
|
6
|
+
|
|
7
|
+
### Pillar I: Federated Intelligence Mesh (FIM)
|
|
8
|
+
|
|
9
|
+
The FIM transitions MindForge from local knowledge silos to a shared organizational intelligence mesh.
|
|
10
|
+
|
|
11
|
+
- **Distributed Sync (LWW)**: Cross-node synchronization using Last-Write-Wins (LWW) conflict resolution with cryptographic versioning.
|
|
12
|
+
- **Delta Pull Protocol**: Intelligent synchronization that only retrieves new insights since the last successful sync, minimizing bandwidth and latency.
|
|
13
|
+
- **Enterprise Intelligence Service (EIS)**: A high-availability central hub for sharing high-confidence agentic findings across the entire enterprise.
|
|
14
|
+
- **ZTAI-Signed Provenance**: Every piece of knowledge in the mesh is cryptographically tied to the DID of the agent that generated it.
|
|
15
|
+
|
|
16
|
+
### Pillar II: Agentic Policy Orchestrator (APO)
|
|
17
|
+
|
|
18
|
+
The APO provides a non-bypassable governance layer that evaluates every autonomous wave against organizational security policies.
|
|
19
|
+
|
|
20
|
+
- **Policy-as-Code (PaC)**: Security rules are defined in declarative JSON/YAML schemas, enabling version-controlled governance.
|
|
21
|
+
- **Real-Time Intent Interception**: The `AutoRunner` intercepts swarm intents (Action, Resource, DID, Tier) before execution.
|
|
22
|
+
- **Dynamic RBAC Mapping**: Automatically assigns project roles based on an agent's **Zero-Trust Agentic Identity (ZTAI)** trust tier.
|
|
23
|
+
- **Fail-Safe Governance**: "Default Deny" posture for sensitive operations (API key access, infra modification, etc.).
|
|
24
|
+
|
|
25
|
+
### Pillar III: Predictive Agentic Reliability (PAR)
|
|
26
|
+
|
|
27
|
+
The PAR layer addresses reasoning decay and execution drifting in long-running autonomous sessions.
|
|
28
|
+
|
|
29
|
+
- **Loop Detection (S03/S04)**: Advanced `StuckMonitor` patterns for Semantic Mirroring and Infinite Decomposition.
|
|
30
|
+
- **Context Density Refactorer**: Proactive context summarization and handoff when reasoning-to-action density falls below 30%.
|
|
31
|
+
- **C2C Arbitrage**: Confidence-to-Cost (C2C) threshold gating to prevent low-value autonomous drifts.
|
|
32
|
+
- **Self-Healing Reasoning**: Automated triggering of "hindsight injection" when stuck patterns are detected.
|
|
33
|
+
|
|
34
|
+
### Pillar IV: Supply Chain Trust (ZTS)
|
|
35
|
+
|
|
36
|
+
The ZTS layer ensures the integrity of the agentic supply chain, from the models used to the skills executed.
|
|
37
|
+
|
|
38
|
+
- **Agentic SBOM**: Automated `MANIFEST.sbom.json` generation tracking every model and skill signature in the reasoning chain.
|
|
39
|
+
- **7-Dimension Certification (7D)**: Weighted scoring system (Schema, Triggers, Security, Clarity, etc.) for skill validation.
|
|
40
|
+
- **Enterprise-Grade Enforcement**: Strict `--enterprise` mode requirement for 7.0/10.0 minimum certification score.
|
|
41
|
+
- **Skill Telemetry**: Real-time auditing of skill performance and reliability metrics.
|
|
42
|
+
|
|
43
|
+
---
|
|
44
|
+
|
|
45
|
+
### Pillar V: Multi-Cloud Arbitrage & Hedging
|
|
46
|
+
|
|
47
|
+
The Multi-Cloud layer ensures absolute availability and cost-efficiency by dynamically load-balancing across multiple AI providers.
|
|
48
|
+
|
|
49
|
+
- **Dynamic Routing**: Real-time arbitrage across Vertex AI, AWS Bedrock, and Azure based on current latency and cost weights.
|
|
50
|
+
- **Provider Fallback Protocol**: Automated "Hedging" that migrates agent context to a secondary cloud provider (e.g., Anthropic to Google) if 5xx errors or high latencies are detected.
|
|
51
|
+
- **Chaos Mode (Beast Mode)**: Built-in reliability testing that simulates provider dropouts to verify the robustness of the fallback loops.
|
|
52
|
+
|
|
53
|
+
### Pillar VI: Sovereign Reason Enclaves (SRE)
|
|
54
|
+
|
|
55
|
+
SRE provides a "Confidential Computing" environment for the agent's internal thought process, protecting sensitive intellectual property.
|
|
56
|
+
|
|
57
|
+
- **TEE-Simulated Reasoning**: Tier 3 workloads execute reasoning traces in high-isolation simulated enclaves with zero-visibility to the global log.
|
|
58
|
+
- **Thought-Chain Sanitization**: Automatically redacts sensitive patterns (keys, credentials, PII) from the reasoning trace before persistent audit.
|
|
59
|
+
- **Enclave Multi-Tenancy**: Isolated reason-space per project wave, ensuring that cross-stream reasoning cannot leak state or logic.
|
|
60
|
+
|
|
61
|
+
### Pillar VII: Dynamic Human-Agent Handover (DHH)
|
|
62
|
+
|
|
63
|
+
DHH creates a seamless bridge between fully autonomous execution and high-precision human steering.
|
|
64
|
+
|
|
65
|
+
- **Nexus State Bundles**: Automated "Context Freeze" and packaging of memory, diffs, and reasoning traces when agent confidence drops below 60%.
|
|
66
|
+
- **Mid-Wave Steering**: In-flight steering injection into the `AutoRunner` loop, allowing humans to re-orient an active autonomous wave without restarts.
|
|
67
|
+
- **Confidence-to-Human Gating**: Proactive interruption of the autonomous stream for "Human-in-the-Loop" approval on sensitive T3 operations.
|
|
68
|
+
|
|
69
|
+
---
|
|
70
|
+
|
|
71
|
+
## Technical Components
|
|
72
|
+
|
|
73
|
+
### 🧠 Intelligence Mesh
|
|
74
|
+
|
|
75
|
+
| Component | Path | Description |
|
|
76
|
+
| :--- | :--- | :--- |
|
|
77
|
+
| **EIS Client** | `bin/memory/eis-client.js` | Hardened, ZTAI-signed mesh communicator. |
|
|
78
|
+
| **Fed-Sync** | `bin/memory/federated-sync.js` | Core delta-sync and conflict resolution logic. |
|
|
79
|
+
| **Graph Bridge** | `bin/memory/knowledge-graph.js` | Unified traversal for local and remote nodes. |
|
|
80
|
+
|
|
81
|
+
### 🛡️ Governance & Cloud Arbitrage
|
|
82
|
+
|
|
83
|
+
| Component | Path | Description |
|
|
84
|
+
| :--- | :--- | :--- |
|
|
85
|
+
| **Policy Engine** | `bin/governance/policy-engine.js` | Intent-based RBAC/ABAC evaluator. |
|
|
86
|
+
| **RBAC Manager** | `bin/governance/rbac-manager.js` | Tier-to-role binding and DID mapping. |
|
|
87
|
+
| **Cloud Broker** | `bin/models/cloud-broker.js` | Multi-cloud routing and arbitrage engine. |
|
|
88
|
+
| **Fallback Protocol** | `bin/models/model-broker.js` | Provider hedging and context migration logic. |
|
|
89
|
+
|
|
90
|
+
### ⚡ Reliability & Trust (PAR/ZTS/SRE/DHH)
|
|
91
|
+
|
|
92
|
+
| Component | Path | Description |
|
|
93
|
+
| :--- | :--- | :--- |
|
|
94
|
+
| **Stuck Monitor** | `bin/autonomous/stuck-monitor.js` | S03/S04 loop detection patterns. |
|
|
95
|
+
| **Refactorer** | `bin/autonomous/context-refactorer.js` | Context density and proactive summarization. |
|
|
96
|
+
| **SRE Manager** | `bin/engine/sre-manager.js` | Trusted execution enclave management. |
|
|
97
|
+
| **Handover Manager** | `bin/engine/handover-manager.js` | Nexus bundle creation and steering logic. |
|
|
98
|
+
| **SBOM Tracer** | `bin/engine/nexus-tracer.js` | SRE-aware audit logging and manifest generation. |
|
|
99
|
+
|
|
100
|
+
---
|
|
101
|
+
|
|
102
|
+
## Identity & Trust (ZTAI Interlocks)
|
|
103
|
+
|
|
104
|
+
MindForge v5 utilizes **Zero-Trust Agentic Identity (ZTAI)** as the root-of-trust for all enterprise operations.
|
|
105
|
+
|
|
106
|
+
1. **Identity Verification**: Agents prove their identity using Ed25519 signatures.
|
|
107
|
+
2. **Tier Escalation**: Tier 0-1 agents are limited to analytical tasks. Tier 2 agents gain implementation roles. Tier 3 agents (signed by HSM-secured identities) execute in **Sovereign Reason Enclaves**.
|
|
108
|
+
3. **Policy Binding**: Policies specifically reference `trust_tier` requirements for sensitive namespaces.
|
|
109
|
+
4. **Handover Thresholds**: Lower trust tiers trigger human-agent handover (DHH) earlier than senior T3 agents.
|
|
110
|
+
|
|
111
|
+
---
|
|
112
|
+
|
|
113
|
+
*For implementation details, refer to the [PAR & ZTS Survey](./PAR-ZTS-SURVEY.md) and [Governance Guide](../governance-guide.md).*
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# Feature: Real-time Dashboard (
|
|
1
|
+
# Feature: Real-time Dashboard (v4.1.0)
|
|
2
2
|
|
|
3
3
|
The MindForge Real-time Dashboard provides a high-fidelity, web-based control center for your agentic workflows. It leverages **Server-Sent Events (SSE)** to push live updates from your codebase directly to your browser with zero performance overhead.
|
|
4
4
|
|
|
@@ -33,6 +33,11 @@ Default access: `http://localhost:7339` (Strictly bound to `127.0.0.1` for secur
|
|
|
33
33
|
- **Persona Context**: See which agent personas are currently active.
|
|
34
34
|
- **Steerage Feed**: View steering instructions as they are applied.
|
|
35
35
|
|
|
36
|
+
### 5. MindForge Nexus (v4.1+)
|
|
37
|
+
- **ART Trace Explorer**: Drill down into hierarchical reasoning spans and thought chains.
|
|
38
|
+
- **Mesh Topology**: Visual graph of the active agentic mesh and specialist clusters.
|
|
39
|
+
- **Reasoning Heatmaps**: Identifying areas of adversarial disagreement and drift in real-time.
|
|
40
|
+
|
|
36
41
|
## 🛡 Hardened Security
|
|
37
42
|
- **Localhost Binding**: The server refuses connections from external IPs.
|
|
38
43
|
- **CORS Lock-down**: Only allows requests from the local control plane.
|
package/docs/governance-guide.md
CHANGED
|
@@ -1,23 +1,47 @@
|
|
|
1
|
-
# MindForge Governance Guide
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
governance work
|
|
6
|
-
|
|
7
|
-
##
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
- Tier
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
-
|
|
22
|
-
|
|
23
|
-
|
|
1
|
+
# MindForge Governance Guide (v5.0.0)
|
|
2
|
+
Absolute Control through Policy-as-Code (PaC)
|
|
3
|
+
|
|
4
|
+
## 1. Goal
|
|
5
|
+
MindForge v5.0.0 introduces a non-bypassable, intent-level governance layer. This guide explains how **Agentic Policy Orchestration (APO)** and **Zero-Trust Agentic Identity (ZTAI)** work together to secure the enterprise development lifecycle.
|
|
6
|
+
|
|
7
|
+
## 2. Agentic Policy Orchestrator (APO)
|
|
8
|
+
The APO is a decentralized governance engine that intercepts every autonomous intent before it is executed.
|
|
9
|
+
|
|
10
|
+
### A. Intent Interception
|
|
11
|
+
Before the `AutoRunner` begins a new execution wave, it extracts the acting agent's **Intent**:
|
|
12
|
+
- **DID**: The unique identity of the agent.
|
|
13
|
+
- **Action**: The operation being attempted (e.g., `process_phase_wave`, `modify_security_config`).
|
|
14
|
+
- **Resource**: The target of the action (e.g., specific directories, files, or API endpoints).
|
|
15
|
+
- **Tier**: The ZTAI Trust Tier assigned to the agent.
|
|
16
|
+
|
|
17
|
+
### B. Policy Evaluation
|
|
18
|
+
The `PolicyEngine` evaluates this intent against organizational **Policy-as-Code (PaC)** definitions (typically stored in `bin/governance/policies/`).
|
|
19
|
+
- **Permit**: The action is allowed and execution proceeds.
|
|
20
|
+
- **Deny**: The action is blocked, and the violation is logged to `AUDIT.jsonl`.
|
|
21
|
+
- **Escalate**: The action requires a higher-tier DID signature or explicit HITL (Human-in-the-Loop) approval.
|
|
22
|
+
|
|
23
|
+
## 3. Trust Tier Architecture (ZTAI Hardened)
|
|
24
|
+
V5.0.0 automatically maps ZTAI Trust Tiers to explicit project roles through the `RBACManager`.
|
|
25
|
+
|
|
26
|
+
| Tier | Role | Scope | Hardening |
|
|
27
|
+
| :--- | :--- | :--- | :--- |
|
|
28
|
+
| **0** | Informational | Research/Query only. | Read-only access to non-sensitive docs. |
|
|
29
|
+
| **1** | Implementation| Standard feature dev. | Write access to `/src`, `/tests`, `/bin/memory`. |
|
|
30
|
+
| **2** | Specialized | Security/DevOps Specialist. | Access to `/security`, `/infra`, and `/bin/governance`. |
|
|
31
|
+
| **3** | Principal | Lead Architect / Core Engine. | **HSM-Enclave Signing Required** for all engine modifications. |
|
|
32
|
+
|
|
33
|
+
## 4. Governance Workflow (V5)
|
|
34
|
+
1. **ZTAI Handshake**: Agent proves identity using Ed25519 signatures.
|
|
35
|
+
2. **Intent Pulse**: Agentic intent is broadcast to the policy interceptor.
|
|
36
|
+
3. **APO Evaluation**: Policy engine checks the intent against PaC rules.
|
|
37
|
+
4. **Role binding**: `RBACManager` grants or revokes permissions based on the active trust tier.
|
|
38
|
+
5. **Verified Wave**: Execution proceeds only if all policy gates are clear.
|
|
39
|
+
|
|
40
|
+
## 5. Enterprise Policies
|
|
41
|
+
MindForge v5 ships with default policies including:
|
|
42
|
+
- **`gate_tier_3_engine`**: Blocks all modifications to `bin/autonomous/` unless signed by a Tier 3 DID.
|
|
43
|
+
- **`protect_security_namespace`**: Limits access to `/security` and `/governance` to Tier 2+ specialists.
|
|
44
|
+
- **`mesh_integrity_lock`**: Ensures only high-confidence agents can push to the **Federated Intelligence Mesh**.
|
|
45
|
+
|
|
46
|
+
---
|
|
47
|
+
*Status: V5 "Beast" Mode Governance Implemented & Verified (2026-03-28)*
|
|
@@ -4,9 +4,9 @@
|
|
|
4
4
|
|
|
5
5
|
| Version | Security support |
|
|
6
6
|
|---|---|
|
|
7
|
-
|
|
|
8
|
-
|
|
|
9
|
-
| < 0.
|
|
7
|
+
| 5.x.x | ✅ Active — patches released for all severity levels |
|
|
8
|
+
| 4.x.x | ⚠️ Limited — critical fixes only |
|
|
9
|
+
| < 4.0.0 | ❌ No support |
|
|
10
10
|
|
|
11
11
|
## Reporting a vulnerability
|
|
12
12
|
|
|
@@ -29,14 +29,27 @@
|
|
|
29
29
|
- Crediting researchers in the security advisory (with their permission)
|
|
30
30
|
- Maintaining confidentiality until a fix is released
|
|
31
31
|
|
|
32
|
+
## ZTAI & Enclave Security (v5.0.0)
|
|
33
|
+
|
|
34
|
+
MindForge v5.0.0 enforces **Zero-Trust Agentic Identity (ZTAI)** and **Sovereign Reason Enclaves (SRE)** for all sensitive operations.
|
|
35
|
+
|
|
36
|
+
- **Asymmetric Signing**: All high-tier (T1-T3) agent actions are cryptographically signed using Ed25519.
|
|
37
|
+
- **Sovereign Reason Enclaves (SRE)**: Tier 3 principal agents execute reasoning in isolated TEE-simulated enclaves, ensuring that high-value architectural decisions and sensitive IP never leak to the persistent log.
|
|
38
|
+
- **Trace Sanitization**: In-enclave sanitization automatically redacts credentials and PII from reasoning traces before they reach the local filesystem.
|
|
39
|
+
- **Multi-Cloud Resilience**: The **Cloud Broker** provides automated failover and hedging across Vertex AI, Bedrock, and Azure to mitigate provider-side denial-of-service or outages.
|
|
40
|
+
- **Audit Non-Repudiation**: The `AUDIT.jsonl` log is finalized with **Merkle-root integrity manifests** to prevent tampering.
|
|
41
|
+
- **See also:** [ZTAI Overview](file:///Users/sairamugge/Desktop/MindForge/docs/security/ZTAI-OVERVIEW.md)
|
|
42
|
+
|
|
32
43
|
## Known security model limitations
|
|
33
44
|
|
|
34
45
|
See `docs/security/threat-model.md` for the full threat model.
|
|
35
46
|
|
|
36
47
|
Key acknowledged limitations:
|
|
37
|
-
1. Plugin permission model is advisory (not OS-enforced) — see TA7 in threat model
|
|
38
|
-
2. The SSE event stream is localhost-only but any local process can connect — see TA6
|
|
39
|
-
3.
|
|
40
|
-
4. Agent instruction injection via SKILL.md requires review beyond pattern matching — see TA1
|
|
48
|
+
1. Plugin permission model is advisory (not OS-enforced) — see TA7 in threat model.
|
|
49
|
+
2. The SSE event stream is localhost-only but any local process can connect — see TA6.
|
|
50
|
+
3. Cryptographic identity is local-first; remote anchor validation is a planned v4.5 feature.
|
|
51
|
+
4. Agent instruction injection via SKILL.md requires review beyond pattern matching — see TA1.
|
|
52
|
+
|
|
53
|
+
*Note: The previous limitation on approver identity (TA5) has been mitigated by the ZTAI DID-based signing model in v4.2.*
|
|
41
54
|
|
|
42
55
|
These are known trade-offs, not bugs. They are documented in ADR-020.
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
# Zero-Trust Agentic Identity (ZTAI) Overview
|
|
2
|
+
|
|
3
|
+
MindForge v4.2 introduces **ZTAI Beast Mode**, an enterprise-grade identity layer that ensures every agent action is cryptographically signed and non-repudiable.
|
|
4
|
+
|
|
5
|
+
## 1. Asymmetric Identity Model
|
|
6
|
+
Every MindForge persona in the 32+ agent library is assigned a unique asymmetric key pair (Ed25519) upon project initialization or agent spawning.
|
|
7
|
+
|
|
8
|
+
- **Private Key**: Stored securely in the local `.mindforge/identity` vault (never exposed).
|
|
9
|
+
- **Public Key / DID**: Represented as a **Decentralized Identifier (DID)** in the format `did:mf:<key-fingerprint>`.
|
|
10
|
+
|
|
11
|
+
## 2. Trust Tiers & Signing Requirements
|
|
12
|
+
MindForge enforces tiered signing based on the risk level of the persona's actions.
|
|
13
|
+
|
|
14
|
+
| Tier | Persona Examples | Signing Tech | Integrity Proof |
|
|
15
|
+
| :--- | :--- | :--- | :--- |
|
|
16
|
+
| **T0** | `mf-researcher`, `mf-query` | None | Audit log entry only. |
|
|
17
|
+
| **T1** | `mf-executor`, `mf-coder` | Ed25519 (Software) | Signed JSON payload. |
|
|
18
|
+
| **T2** | `security-auditor`, `ui-specialist` | Ed25519 (Software) | Signed Block + Peer Review. |
|
|
19
|
+
| **T3** | `mf-planner`, `system-architect` | **Secure Enclave (HSM)** | Enclave-attested signature. |
|
|
20
|
+
|
|
21
|
+
*Note: T3 agents utilize a simulated hardware-secured enclave (HSM) to ensure principal-level accountability.*
|
|
22
|
+
|
|
23
|
+
## 3. Non-Repudiable Audit Manifests
|
|
24
|
+
The `ZTAIArchiver` generates high-fidelity integrity proofs for the session history.
|
|
25
|
+
|
|
26
|
+
- **Merkle-Root Chain**: Every 50 audit entries trigger the generation of a Merkle-root.
|
|
27
|
+
- **Manifest Finalization**: The cumulative root of all audit entries is signed by the **Principal Agent (T3)**.
|
|
28
|
+
- **Tamper Detection**: Any modification to the `AUDIT.jsonl` file will invalidate the Merkle-proof, triggering an immediate security alert.
|
|
29
|
+
|
|
30
|
+
## 4. Key Provider Abstraction
|
|
31
|
+
The `ZTAIManager` uses a pluggable `KeyProvider` architecture:
|
|
32
|
+
- `FileSystemProvider`: Standard key storage for T1/T2 agents.
|
|
33
|
+
- `SecureEnclaveProvider`: Simulates hardware-backed signing for T3 agents.
|
|
34
|
+
- `KMSProvider` (Future): Integration with AWS/GCP/Azure Key Management Services.
|
|
35
|
+
|
|
36
|
+
## 5. Governance Integration
|
|
37
|
+
ZTAI identities are verified during the `/mindforge:verify-phase` and `/mindforge:ship` processes. High-tier changes will be BLOCKED if the cryptographic signatures are missing or invalid.
|
package/docs/user-guide.md
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# MindForge User Guide (
|
|
1
|
+
# MindForge User Guide (v5.0.0)
|
|
2
2
|
|
|
3
3
|
This guide gets you from install to productive, with the minimum needed to run MindForge in a real project. It assumes Node.js 18+.
|
|
4
4
|
|
|
@@ -152,7 +152,31 @@ MindForge v2.1.1 features automated PR creation and commit management.
|
|
|
152
152
|
|
|
153
153
|
---
|
|
154
154
|
|
|
155
|
-
## 12.
|
|
155
|
+
## 12. Enterprise Resilience & Governance (v5.0.0)
|
|
156
|
+
|
|
157
|
+
MindForge v5 introduces mission-critical resilience and sovereign reasoning for enterprise engineering.
|
|
158
|
+
|
|
159
|
+
### Multi-Cloud Arbitrage
|
|
160
|
+
MindForge automatically hedges against provider outages and optimizes for cost/latency.
|
|
161
|
+
```bash
|
|
162
|
+
/mindforge:settings --cloud-arbitrage on
|
|
163
|
+
```
|
|
164
|
+
|
|
165
|
+
### Sovereign Reason Enclaves (SRE)
|
|
166
|
+
Tier 3 (Principal) agents execute reasoning in isolated enclaves to protect sensitive IP.
|
|
167
|
+
```bash
|
|
168
|
+
/mindforge:agent --tier 3 # Automatically triggers SRE
|
|
169
|
+
```
|
|
170
|
+
|
|
171
|
+
### Dynamic Human-Agent Handover (DHH)
|
|
172
|
+
When autonomous confidence drops or a critical decision is reached, MindForge creates a **Nexus State Bundle** and requests human steering.
|
|
173
|
+
```bash
|
|
174
|
+
/mindforge:auto --handover 0.6 # Triggers handover at 60% confidence
|
|
175
|
+
```
|
|
176
|
+
|
|
177
|
+
---
|
|
178
|
+
|
|
179
|
+
## 13. Update & Maintenance
|
|
156
180
|
|
|
157
181
|
Keep your framework current with the latest personas and library updates:
|
|
158
182
|
|
|
@@ -162,8 +186,10 @@ Keep your framework current with the latest personas and library updates:
|
|
|
162
186
|
|
|
163
187
|
---
|
|
164
188
|
|
|
165
|
-
##
|
|
189
|
+
## 14. Reference & Support
|
|
166
190
|
|
|
191
|
+
- **Architecture**: `docs/architecture/V5-ENTERPRISE.md`
|
|
192
|
+
- **Governance**: `docs/governance-guide.md`
|
|
167
193
|
- **Commands**: `docs/commands-reference.md`
|
|
168
194
|
- **Personas**: `docs/PERSONAS.md`
|
|
169
195
|
- **Troubleshooting**: `docs/troubleshooting.md`
|
package/docs/usp-features.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
# MindForge
|
|
1
|
+
# MindForge v4.2.5 — Unique Selling Points, Features, and Best Practices (v4.2.5)
|
|
2
2
|
|
|
3
|
-
This document summarizes what makes MindForge
|
|
3
|
+
This document summarizes what makes MindForge v4.1.0 distinct, what features
|
|
4
4
|
are included in the official release, and how to use them effectively.
|
|
5
5
|
|
|
6
6
|
---
|
|
@@ -58,6 +58,21 @@ are included in the official release, and how to use them effectively.
|
|
|
58
58
|
16. **Temporal Vision (v3)**
|
|
59
59
|
- Full-fidelity history navigation, hindsight injection, and automated state repair across the execution wave.
|
|
60
60
|
|
|
61
|
+
17. **Dynamic Swarm Orchestration (v4)**
|
|
62
|
+
- Parallel "Agentic Mesh" with shared state (`SWARM-STATE.json`) and leader-led synthesis of specialist outcomes.
|
|
63
|
+
|
|
64
|
+
18. **Zero-Trust Agentic Identity "Beast Mode" (v4.2)**
|
|
65
|
+
- Non-repudiable audit trails signed by unique Decentralized Identifiers (DIDs) for every swarm action. Tier 3 agents use simulated **Secure Enclave (HSM)** signing.
|
|
66
|
+
|
|
67
|
+
19. **MindForge Nexus: Agentic Reasoning Tracing (v4.1)**
|
|
68
|
+
- High-fidelity **ART** spans embedded in the execution engine, providing deep visibility into agentic "thought chains" and parallel mesh reasoning.
|
|
69
|
+
|
|
70
|
+
20. **Global Intelligence Mesh (v4.2)**
|
|
71
|
+
- Cross-repository knowledge sharing via the **Semantic Hub**. Proactive **Ghost Pattern Detection** identifies and prevents repeating past organizational failures.
|
|
72
|
+
|
|
73
|
+
19. **MindForge Nexus: Agentic Reasoning Tracing (v4.1)**
|
|
74
|
+
- High-fidelity **ART** spans embedded in the execution engine, providing deep visibility into agentic "thought chains" and parallel mesh reasoning.
|
|
75
|
+
|
|
61
76
|
---
|
|
62
77
|
|
|
63
78
|
## Feature Set (v2.0.0)
|
|
@@ -247,6 +262,67 @@ preserving scope (local vs global).
|
|
|
247
262
|
|
|
248
263
|
---
|
|
249
264
|
|
|
265
|
+
### 21. Dynamic Swarm Mesh (v4)
|
|
266
|
+
**What it does:** Orchestrates parallel specialist clusters (e.g., Security, UI, Data) with automated state coordination.
|
|
267
|
+
|
|
268
|
+
**How to use:**
|
|
269
|
+
```bash
|
|
270
|
+
/mindforge:swarm spawn --template [NAME]
|
|
271
|
+
/mindforge:swarm status --mesh
|
|
272
|
+
```
|
|
273
|
+
|
|
274
|
+
---
|
|
275
|
+
|
|
276
|
+
### 22. ZTAI Governance & Beast Mode (v4.2)
|
|
277
|
+
**What it does:** Enforces cryptographic signing and trust-tier validation for all autonomous agent actions. Tier 3 agents utilize simulated Secure Enclaves for principal-level non-repudiation.
|
|
278
|
+
|
|
279
|
+
**How to use:**
|
|
280
|
+
```bash
|
|
281
|
+
/mindforge:identity verify [AGENT_ID]
|
|
282
|
+
/mindforge:identity sign --did
|
|
283
|
+
/mindforge:identity audit --manifest # Generates Merkle-root integrity proof
|
|
284
|
+
```
|
|
285
|
+
|
|
286
|
+
---
|
|
287
|
+
|
|
288
|
+
### 23. Global Intelligence Mesh (v4.2)
|
|
289
|
+
**What it does:** Synchronizes local repo memory with a global organizational store. Includes Ghost Pattern Detection to flag architectural anti-patterns from past failures.
|
|
290
|
+
|
|
291
|
+
**How to use:**
|
|
292
|
+
```bash
|
|
293
|
+
/mindforge:memory sync --global
|
|
294
|
+
/mindforge:memory status --mesh
|
|
295
|
+
/mindforge:plan-phase --detect-ghosts # Automated during planning
|
|
296
|
+
```
|
|
297
|
+
---
|
|
298
|
+
|
|
299
|
+
### 24. Autonomous FinOps Hub (v4.3)
|
|
300
|
+
**What it does:** Enterprise-grade economics engine that treats compute as a first-class resource. The `ModelBroker` utilizes a **Confidence-to-Cost (C2C)** engine to dynamically route tasks based on complexity and trust tier.
|
|
301
|
+
|
|
302
|
+
**How to use:**
|
|
303
|
+
```bash
|
|
304
|
+
/mindforge:finops status # View consumption and budget profile
|
|
305
|
+
/mindforge:costs --roi # Detailed Agentic ROI analysis
|
|
306
|
+
/mindforge:finops budget 500 # Set project-level budget ($500)
|
|
307
|
+
```
|
|
308
|
+
|
|
309
|
+
---
|
|
310
|
+
|
|
311
|
+
### 25. Proactive Equilibrium (Self-Healing) (v4.3)
|
|
312
|
+
**What it does:** Achieves autonomous reliability via a `WaveFeedbackLoop`. If execution divergence exceeds 20%, the system performs **Temporal Hindsight** analysis and automatically rewrites the plan to recover.
|
|
313
|
+
|
|
314
|
+
**How to use:**
|
|
315
|
+
- Automated: Triggers during `/mindforge:execute-phase` when divergence is detected.
|
|
316
|
+
- Manual: `/mindforge:temporal analyze` to run RCA on the last wave.
|
|
317
|
+
**What it does:** High-fidelity Agentic Reasoning Tracing (ART) for the agentic mesh. Logs spans, parent-trace IDs, and granular reasoning traces.
|
|
318
|
+
|
|
319
|
+
**How to use:**
|
|
320
|
+
- Automated: Every wave/task execution triggers Nexus Tracer spans.
|
|
321
|
+
- Manual: Query `.planning/AUDIT.jsonl` for `trace_id` and `span_id` chains.
|
|
322
|
+
- Dashboard: Real-time visualization of mesh traces and reasoning heatmaps.
|
|
323
|
+
|
|
324
|
+
---
|
|
325
|
+
|
|
250
326
|
### 15. SDK (TypeScript)
|
|
251
327
|
**What it does:** Programmatic access to health, audit log, event stream, and commands.
|
|
252
328
|
|
|
@@ -304,6 +380,4 @@ const report = await client.health();
|
|
|
304
380
|
---
|
|
305
381
|
|
|
306
382
|
## Summary
|
|
307
|
-
MindForge
|
|
308
|
-
single workflow engine that works across 6 major AI runtimes. Its core
|
|
309
|
-
value is consistent, repeatable quality in long‑running AI development sessions.
|
|
383
|
+
MindForge v4.3.0 combines governance, observability, and autonomous execution rigor with **enterprise-grade economics (FinOps)** and **self-healing reliability**. Its core value is providing a non-repudiable, cost-optimized, and resilient AI development engine for the most demanding software projects.
|
package/package.json
CHANGED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|