mindforge-cc 8.1.0 → 8.2.0

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/impact-analyzer.js

@@ -0,0 +1,141 @@
+/**
+ * MindForge v6.0.0 — Context-Aware Dynamic Impact Analysis (CADIA)
+ * Calculates the 'Blast Radius' score of a proposed intent.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+class ImpactAnalyzer {
+  static CRITICAL_PATHS = [
+    '.env',
+    'id_rsa',
+    '*.pem',
+    'package-lock.json',
+    'yarn.lock',
+    'AUDIT.jsonl',
+    'STATE.md'
+  ];
+
+  static SENSITIVE_NAMESPACES = [
+    '.mindforge',
+    'bin/',
+    'config/',
+    '.agent/',
+    'security/'
+  ];
+
+  static ACTION_SCORES = {
+    'READ': 1,
+    'WRITE': 5,
+    'DELETE': 10,
+    'EXECUTE': 15,
+    'GRANT': 20
+  };
+
+  // Cache for session-based entropy tracking
+  static sessionState = new Map();
+
+  /**
+   * [CADIA] Scores an intent based on architectural influence, session entropy, and trust tiers.
+   * Score Range: 0 - 100
+   */
+  static analyze(intent, context = {}) {
+    const { action, target, namespace } = intent;
+    const { sessionId = 'default', trustTier = 0, currentGoal = '' } = context;
+
+    // 1. Critical Path Protection (Hardened)
+    const isCritical = this.CRITICAL_PATHS.some(cp => 
+      (target && (target.endsWith(cp) || target.includes(`/${cp}`)))
+    );
+
+    if (isCritical && (action === 'WRITE' || action === 'DELETE')) {
+      return 100; // Automatic CRITICAL block
+    }
+
+    let score = this.ACTION_SCORES[action] || 5;
+    
+    // 2. [NEW] Architectural Influence Engine (x2.5 multiplier)
+    if (this.isArchitecturallySignificant(target)) {
+      score *= 2.5; 
+    }
+
+    // 3. Sensitive Namespace Multiplier (x4.0 multiplier)
+    const isSensitive = this.SENSITIVE_NAMESPACES.some(ns => 
+      (target && target.includes(ns)) || (namespace && namespace.includes(ns))
+    );
+
+    if (isSensitive) {
+      score *= 4.0; 
+    }
+
+    // 4. [NEW] Session Entropy Tracker (+15 penalty)
+    const sessCount = (this.sessionState.get(sessionId) || 0) + 1;
+    this.sessionState.set(sessionId, sessCount);
+    
+    if (sessCount > 5) {
+      score += (sessCount - 5) * 15; 
+    }
+
+    // 5. [NEW] Goal-to-Path Alignment (+40 penalty)
+    if (currentGoal && !this.isGoalAligned(target, currentGoal)) {
+      score += 40; 
+    }
+
+    // 6. [NEW] ZTAI-Trust Scaling (Risk buffer)
+    const trustBuffer = trustTier * 10;
+    score = Math.max(0, score - trustBuffer);
+
+    // 7. Recursive Depth Scale
+    if (target && target.split('/').length > 5) {
+      score *= 1.25; 
+    }
+
+    return Math.min(Math.round(score), 100);
+  }
+
+
+  /**
+   * Identifies files with high architectural side-effects.
+   */
+  static isArchitecturallySignificant(filePath) {
+    if (!filePath) return false;
+    const highWeightDirs = ['bin/governance', 'bin/engine', 'bin/models', '.mindforge/intelligence'];
+    const highWeightFiles = ['package.json', 'sdk/nexus-core.js', 'bin/mindforge-cli.js'];
+    
+    return highWeightDirs.some(d => filePath.includes(d)) || 
+           highWeightFiles.some(f => filePath.endsWith(f));
+  }
+
+  /**
+   * Checks if the target path semantically aligns with the current active goal/phase.
+   */
+  static isGoalAligned(filePath, currentGoal) {
+    if (!currentGoal || !filePath) return true; // Default to neutral if no goal set
+    
+    // Simple heuristic: Does the goal mention the file or directory?
+    const normalizedGoal = currentGoal.toLowerCase();
+    const normalizedPath = filePath.toLowerCase();
+    
+    // Extract domain (e.g., 'auth', 'ui', 'api')
+    const domain = normalizedPath.split('/')[0];
+    
+    return normalizedGoal.includes(domain) || 
+           normalizedGoal.includes(path.basename(normalizedPath, path.extname(normalizedPath)));
+  }
+
+  static getRiskTier(score) {
+    if (score < 25) return 'LOW';
+    if (score < 50) return 'MEDIUM';
+    if (score < 75) return 'HIGH';
+    return 'CRITICAL';
+  }
+
+  static resetSession(sessionId) {
+    this.sessionState.delete(sessionId);
+  }
+}
+
+module.exports = ImpactAnalyzer;
+

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/policies/critical-data.json

@@ -0,0 +1 @@
+{"id":"pol_critical_001","effect":"PERMIT","max_impact":100,"conditions":{"resource":"STATE.md"}}

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/policies/default-policies.jsonl

@@ -0,0 +1,33 @@
+{
+  "id": "policy_enforce_tier_3_security",
+  "version": "1.0.0",
+  "effect": "DENY",
+  "description": "Agents with Tier < 3 cannot modify security or governance files.",
+  "conditions": {
+    "resource": "*/security/*,*/governance/*",
+    "min_tier": 3
+  }
+}
+<!-- slide -->
+{
+  "id": "policy_permit_developer_src",
+  "version": "1.0.0",
+  "effect": "PERMIT",
+  "description": "Developer agents can write to src and tests.",
+  "conditions": {
+    "action": "write_file",
+    "resource": "*/src/*,*/tests/*",
+    "min_tier": 2
+  }
+}
+<!-- slide -->
+{
+  "id": "policy_permit_global_sync_lead",
+  "version": "1.0.0",
+  "effect": "PERMIT",
+  "description": "Lead Architects can push to the Federated Intelligence Mesh.",
+  "conditions": {
+    "action": "federated_sync_push",
+    "min_tier": 3
+  }
+}

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/policy-engine.js

@@ -0,0 +1,210 @@
+/**
+ * MindForge v6.0.0 — Agentic Policy Orchestrator (APO) Engine
+ * Evaluates agent intents against organizational security policies with CADIA integration.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const ImpactAnalyzer = require('./impact-analyzer');
+const policyGate = require('./policy-gate-hardened');
+
+class PolicyEngine {
+  constructor(config = {}) {
+    this.policiesDir = config.policiesDir || path.join(__dirname, 'policies');
+    this.planningDir = config.planningDir || path.join(process.cwd(), '.planning');
+    this.auditLogPath = path.join(this.planningDir, 'RISK-AUDIT.jsonl');
+    this.ensurePoliciesDir();
+  }
+
+  ensurePoliciesDir() {
+    if (!fs.existsSync(this.policiesDir)) {
+      fs.mkdirSync(this.policiesDir, { recursive: true });
+    }
+  }
+
+  /**
+   * Evaluates an agent's intent against all active policies using CADIA.
+   */
+  async evaluate(intent) {
+    const requestId = `pol_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`;
+    const sessionId = intent.sessionId || 'default_session';
+    const currentGoal = this.getCurrentGoal();
+    
+    console.log(`[APO-EVAL] [${requestId}] Evaluating intent: ${intent.action} on ${intent.resource} by ${intent.did}`);
+
+    // Pillar II (v6.0.0): CADIA Dynamic Impact Scoring
+    let impactScore = 100;
+    let riskTier = 'UNKNOWN';
+
+    try {
+      impactScore = ImpactAnalyzer.analyze({
+        action: intent.action,
+        target: intent.resource,
+        namespace: intent.namespace
+      }, {
+        sessionId,
+        trustTier: intent.tier || 0,
+        currentGoal
+      });
+      riskTier = ImpactAnalyzer.getRiskTier(impactScore);
+      console.log(`[APO-BLAST] [${requestId}] Calculated Blast Radius: ${impactScore}/100 [Tier: ${riskTier}]`);
+    } catch (err) {
+      console.error(`[APO-ERR] [${requestId}] Impact analysis failed. Defaulting to high-impact restriction.`, err);
+    }
+
+    const policies = this.loadPolicies();
+    let verdict = { verdict: 'DENY', reason: 'No matching PERMIT policy found (Implicit Deny)', requestId };
+
+    // 1. Check for explicit DENY rules (High-Priority)
+    for (const policy of policies) {
+      if (policy.effect === 'DENY' && this.matches(policy, intent)) {
+        verdict = { verdict: 'DENY', reason: `Violation: ${policy.description || policy.id}`, requestId };
+        this.logAudit(intent, impactScore, verdict);
+        return verdict;
+      }
+    }
+
+    // 2. Pillar II (v6.0.0): Dynamic Blast Radius Enforcement with Tier 3 Bypass
+    for (const policy of policies) {
+      if (this.matches(policy, intent)) {
+        if (policy.max_impact && impactScore >= policy.max_impact) {
+          
+          // [PQAS] v7: Hardened Biometric Bypass for Risk > 95
+          if (impactScore > 95) {
+            const gateResult = await policyGate.evaluateBypass(intent, impactScore);
+            if (gateResult.status === 'WAIT_FOR_BIOMETRIC') {
+              verdict = { 
+                verdict: 'DENY', 
+                reason: gateResult.reason, 
+                requestId,
+                status: 'WAIT_FOR_BIOMETRIC',
+                challenge_id: gateResult.challenge_id
+              };
+              this.logAudit(intent, impactScore, verdict);
+              return verdict;
+            }
+            console.log(`[PQAS-GATE] [${requestId}] Biometric signature verified. Proceeding with high-risk mutation.`);
+            verdict = { verdict: 'PERMIT', reason: `Authorized via Biometric Bypass [${gateResult.signature || 'WEB-AUTHN-DEX'}]`, requestId };
+            this.logAudit(intent, impactScore, verdict);
+            return verdict;
+          }
+
+          // [ENTERPRISE] Tier 3 Reasoning/PQ Proof Bypass
+          if (intent.tier >= 3 && (intent.reasoning_proof || intent.pq_proof)) {
+             const quantumCrypto = require('./quantum-crypto');
+             const isProofValid = intent.pq_proof ? 
+                quantumCrypto.verifyZKProof(intent.pq_proof, intent.id) : true;
+
+             if (isProofValid) {
+                console.log(`[APO-BYPASS] [${requestId}] Tier 3 'Sovereign Proof' verified (${intent.pq_proof ? 'ZK-PQ' : 'Standard'}). Overriding Blast Radius limit.`);
+                // Continue to permit check
+             } else {
+                verdict = { verdict: 'DENY', reason: 'Invalid or Malformed ZK-Proof detected.', requestId };
+                this.logAudit(intent, impactScore, verdict);
+                return verdict;
+             }
+          } else {
+            verdict = { 
+              verdict: 'DENY', 
+              reason: `Dynamic Blast Radius Violation: Intent impact (${impactScore}) exceeds policy limit (${policy.max_impact}). ${intent.tier < 3 ? 'Upgrade to Tier 3 for bypass.' : 'Provide Sovereign Proof.'}`, 
+              requestId 
+            };
+            this.logAudit(intent, impactScore, verdict);
+            return verdict;
+          }
+        }
+      }
+    }
+
+    // 3. Check for explicit PERMIT rules
+    for (const policy of policies) {
+      if (policy.effect === 'PERMIT' && this.matches(policy, intent)) {
+        verdict = { verdict: 'PERMIT', reason: `Authorized by ${policy.id}`, requestId };
+        this.logAudit(intent, impactScore, verdict);
+        return verdict;
+      }
+    }
+
+    this.logAudit(intent, impactScore, verdict);
+    return verdict;
+  }
+
+  getCurrentGoal() {
+    const statePath = path.join(this.planningDir, 'STATE.md');
+    if (!fs.existsSync(statePath)) return '';
+    try {
+      const content = fs.readFileSync(statePath, 'utf8');
+      const match = content.match(/## Current phase\n(.*?)\n/);
+      return match ? match[1].trim() : '';
+    } catch {
+      return '';
+    }
+  }
+
+  logAudit(intent, impactScore, verdict) {
+    const entry = JSON.stringify({
+      timestamp: new Date().toISOString(),
+      requestId: verdict.requestId,
+      did: intent.did,
+      tier: intent.tier,
+      action: intent.action,
+      resource: intent.resource,
+      impactScore,
+      verdict: verdict.verdict,
+      reason: verdict.reason
+    }) + '\n';
+    
+    fs.appendFileSync(this.auditLogPath, entry); 
+  }
+
+  loadPolicies() {
+    if (!fs.existsSync(this.policiesDir)) return [];
+    
+    return fs.readdirSync(this.policiesDir)
+      .filter(f => f.endsWith('.json'))
+      .map(f => {
+        try {
+          const content = fs.readFileSync(path.join(this.policiesDir, f), 'utf8');
+          return JSON.parse(content);
+        } catch (err) {
+          console.error(`[APO-ERROR] Failed to parse policy ${f}:`, err.message);
+          return null;
+        }
+      })
+      .filter(Boolean);
+  }
+
+  matches(policy, intent) {
+    const { conditions } = policy;
+    if (!conditions) return true;
+
+    if (conditions.did && !this.globMatch(conditions.did, intent.did)) return false;
+    if (conditions.action && !this.globMatch(conditions.action, intent.action)) return false;
+    if (conditions.resource && !this.globMatch(conditions.resource, intent.resource)) return false;
+    if (conditions.min_tier && (intent.tier || 0) < conditions.min_tier) return false;
+
+    return true;
+  }
+
+  /**
+   * Simple glob matching for policy conditions.
+   * Supports '*' (any string) and '?' (any character).
+   */
+  globMatch(pattern, text) {
+    if (!pattern || !text) return false;
+    if (pattern === '*') return true;
+    
+    // Escape regex characters but keep * and ?
+    const regexStr = pattern
+      .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+      .replace(/\*/g, '.*')
+      .replace(/\?/g, '.');
+      
+    const regex = new RegExp(`^${regexStr}$`, 'i');
+    return regex.test(text);
+  }
+}
+
+module.exports = PolicyEngine;
+

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/policy-gate-hardened.js

@@ -0,0 +1,59 @@
+/**
+ * MindForge v8 — Orbital Governance (Pillar XVIII)
+ * Component: Hardened Policy Gate (Final Evolution)
+ * 
+ * Enforces hardware-attested bypasses for high-impact system mutations.
+ */
+'use strict';
+
+const orbitalGuardian = require('../engine/orbital-guardian');
+const configManager = require('../governance/config-manager');
+
+class PolicyGateHardened {
+  constructor() {
+    // bypasses.json deprecated in favor of orbital.attestations table (v8)
+    this.criticalThreshold = configManager.get('governance.critical_drift_threshold', 95); 
+  }
+
+  /**
+   * Evaluates if an intent requires hardware-bound attestation.
+   */
+  async evaluateBypass(intent, impactScore) {
+    if (impactScore <= this.criticalThreshold) {
+      return { status: 'ALLOWED', reason: 'Impact within standard threshold' };
+    }
+
+    console.log(`[ORBITAL-GATE] Impact Score ${impactScore} requires Hardware Attestation`);
+
+    // 1. Check SQLite via OrbitalGuardian (Unified v8 persistence)
+    const attestation = await orbitalGuardian.verify(intent.requestId);
+    
+    if (attestation.verified) {
+      return { 
+        status: 'ALLOWED', 
+        reason: 'Hardware Attestation Verified via Enclave', 
+        attestation_id: attestation.id,
+        timestamp: attestation.timestamp
+      };
+    }
+
+    // 2. Trigger Orbital Challenge
+    return { 
+      status: 'WAIT_FOR_ORBITAL', 
+      reason: 'Hardware/Biometric attestation required for orbital-tier mutation',
+      challenge_id: `orb_${Math.random().toString(36).substr(2, 6)}`,
+      impact: impactScore
+    };
+  }
+
+  /**
+   * Records a hardware-attested approval.
+   */
+  async recordBypass(requestId, did, signature_blob = 'MOCK_HARDWARE_SIGN_v8') {
+    const report = await orbitalGuardian.attest(requestId, did, signature_blob);
+    console.log(`[ORBITAL-GATE] Recorded Hardware Approval for Request: ${requestId}`);
+    return report;
+  }
+}
+
+module.exports = new PolicyGateHardened();

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/quantum-crypto.js

@@ -0,0 +1,111 @@
+/**
+ * MindForge v7 — Post-Quantum Agentic Security (PQAS)
+ * Simulated Lattice-Based Cryptography (Dilithium-5 / Kyber-1024)
+ */
+'use strict';
+
+const crypto = require('node:crypto');
+const configManager = require('./config-manager');
+
+class QuantumCrypto {
+  constructor() {
+    this.providerId = configManager.get('security.provider', 'simulated-lattice');
+    this.pqasEnabled = configManager.get('security.pqas_enabled', true);
+  }
+
+  /**
+   * Returns the current active crypto provider.
+   */
+  getProvider() {
+    // In v7, this would resolve to a real provider like 'oqs-provider.js'
+    return {
+      id: this.providerId,
+      pqas_enabled: this.pqasEnabled,
+      algorithm: 'Dilithium-5'
+    };
+  }
+
+  /**
+   * Generates a key pair using the configured PQ provider.
+   */
+  async generateLatticeKeyPair() {
+    if (!this.pqasEnabled) throw new Error('PQAS is disabled in configuration.');
+
+    // Simulate high-entropy lattice seeds
+    const seed = crypto.randomBytes(64).toString('hex');
+    const publicKey = `mfq7_dilithium5_pub_${crypto.randomBytes(32).toString('hex')}`;
+    const privateKey = `mfq7_dilithium5_priv_${crypto.randomBytes(64).toString('hex')}`;
+    
+    return {
+      publicKey,
+      privateKey,
+      algorithm: this.getProvider().algorithm,
+      version: 'v7.0.0-PQAS',
+      provider: this.providerId
+    };
+  }
+
+  /**
+   * Signs data using simulated Dilithium-5.
+   */
+  async signPQ(data, privateKey) {
+    if (!this.pqasEnabled) throw new Error('PQAS is disabled.');
+    if (!privateKey.startsWith('mfq7_dilithium5_priv_')) {
+      throw new Error('Invalid Post-Quantum private key format.');
+    }
+
+    // Simulate the lattice-based signature overhead
+    const hash = crypto.createHash('sha3-512').update(data).digest('hex');
+    const salt = crypto.randomBytes(16).toString('hex');
+    
+    // Dilithium signatures are significantly larger than Ed25519
+    const simulatedSignature = `pqas_sig_d5_${Buffer.from(hash + salt).toString('base64')}_${crypto.randomBytes(128).toString('base64')}`;
+    
+    return simulatedSignature;
+  }
+
+  /**
+   * Verifies a Dilithium-5 signature using constant-time comparison simulation.
+   */
+  verifyPQ(data, signature, publicKey) {
+    if (!publicKey.startsWith('mfq7_dilithium5_pub_')) return false;
+    if (!signature.startsWith('pqas_sig_d5_')) return false;
+
+    try {
+      const parts = signature.split('_');
+      const blob = Buffer.from(parts[3], 'base64').toString('utf8');
+      const hashInSig = blob.slice(0, 128); 
+      
+      const actualHash = crypto.createHash('sha3-512').update(data).digest('hex');
+      
+      // Use timing-safe comparison to prevent side-channel leaks
+      return crypto.timingSafeEqual(Buffer.from(hashInSig), Buffer.from(actualHash));
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Generates a simulated ZK-Proof of policy adherence.
+   * This mimics a SNARK where the agent proves it ran the PolicyEngine rules.
+   */
+  generateZKProof(intent, result) {
+    const proofPayload = JSON.stringify({
+      intent: intent.id,
+      verdict: result.verdict,
+      timestamp: Date.now(),
+      entropy: crypto.randomBytes(16).toString('hex')
+    });
+
+    const hash = crypto.createHash('sha256').update(proofPayload).digest('hex');
+    return `zkp_v1_${hash}_${crypto.randomBytes(32).toString('base64')}`;
+  }
+
+  verifyZKProof(proof, intentId) {
+    if (!proof.startsWith('zkp_v1_')) return false;
+    // Real verification would check the Merkle root of the execution trace
+    return true; // Simulated success
+  }
+}
+
+module.exports = new QuantumCrypto();

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/rbac-manager.js

@@ -0,0 +1,109 @@
+/**
+ * MindForge v5 — Agentic RBAC Manager
+ * Maps Agent DIDs to specific project roles and granular permissions.
+ */
+'use strict';
+
+const fs    = require('node:fs');
+const path  = require('node:path');
+const ztai  = require('./ztai-manager');
+
+class RBACManager {
+  constructor(config = {}) {
+    this.rolesPath = config.rolesPath || path.join(process.cwd(), '.planning/AGENT-ROLES.json');
+    this.defaultRoles = {
+      'did:mindforge:planner': ['lead-architect', 'resource-optimizer'],
+      'did:mindforge:executor': ['developer', 'test-automator'],
+      'did:mindforge:reviewer': ['security-auditor', 'compliance-checker'],
+      'did:mindforge:researcher': ['knowledge-detective'],
+      'did:mindforge:tool': ['system-operator']
+    };
+  }
+
+  /**
+   * Gets the roles assigned to a specific agent DID.
+   * @param {string} did 
+   */
+  getRoles(did) {
+    const roles = this.loadRoles();
+    // Return explicit roles OR default roles based on persona-matched DIDs
+    const explicit = roles[did];
+    if (explicit) return explicit;
+
+    // Default mapping (regex for persona-based DIDs)
+    for (const [pattern, defaultRoles] of Object.entries(this.defaultRoles)) {
+      if (did.includes(pattern)) return defaultRoles;
+    }
+
+    return ['guest-agent'];
+  }
+
+  /**
+   * [HARDEN] Dynamically binds roles based on ZTAI trust tiers if no explicit role exists.
+   * Ensures high-trust agents automatically get architect-level visibility.
+   */
+  async getRolesByTier(did) {
+    const manager = new ztai();
+    const identity = await manager.getIdentity();
+    const explicit = this.getRoles(did);
+
+    if (identity.tier >= 3) {
+      return [...new Set([...explicit, 'lead-architect'])];
+    }
+    if (identity.tier >= 2) {
+      return [...new Set([...explicit, 'developer'])];
+    }
+    return explicit;
+  }
+
+  loadRoles() {
+    if (!fs.existsSync(this.rolesPath)) return {};
+    try {
+      return JSON.parse(fs.readFileSync(this.rolesPath, 'utf8'));
+    } catch {
+      return {};
+    }
+  }
+
+  /**
+   * Assigns a role to an agent.
+   */
+  assignRole(did, roles) {
+    const current = this.loadRoles();
+    current[did] = Array.isArray(roles) ? roles : [roles];
+    fs.writeFileSync(this.rolesPath, JSON.stringify(current, null, 2));
+    console.log(`[RBAC] Assigned roles [${roles}] to agent ${did}`);
+  }
+
+  /**
+   * Revokes all roles for an agent.
+   */
+  revokeRoles(did) {
+    const current = this.loadRoles();
+    delete current[did];
+    fs.writeFileSync(this.rolesPath, JSON.stringify(current, null, 2));
+  }
+
+  /**
+   * Checks if an agent has a specific permission based on their roles.
+   * @param {string} did 
+   * @param {string} permission 
+   */
+  hasPermission(did, permission) {
+    const roles = this.getRoles(did);
+    const PERMISSION_MAP = {
+      'lead-architect': ['write_architecture', 'approve_adr', 'global_sync_push'],
+      'developer':      ['write_src', 'read_src', 'execute_tests'],
+      'security-auditor': ['read_security', 'write_audit_log', 'block_execution'],
+      'system-operator': ['write_bin', 'modify_infrastructure'],
+      'guest-agent':     ['read_src']
+    };
+
+    for (const role of roles) {
+      if (PERMISSION_MAP[role]?.includes(permission)) return true;
+    }
+    return false;
+  }
+}
+
+module.exports = RBACManager;