mindforge-cc 8.1.0 → 8.2.0

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/ci/ci-mode.md

@@ -0,0 +1,179 @@
+# MindForge CI Mode
+
+## Purpose
+Enable MindForge to run in non-interactive CI/CD environments.
+CI mode is fully automated — no user prompts, no interactive approvals,
+no waiting for human input. All decisions are pre-configured.
+
+## Activating CI mode
+
+CI mode activates automatically when:
+1. `CI=true` environment variable is set (standard in GitHub Actions, GitLab CI, Jenkins)
+2. `MINDFORGE_CI=true` is explicitly set
+3. `process.stdin.isTTY === false` (piped or non-interactive shell)
+
+In CI mode:
+- All interactive prompts are skipped — pre-configured answers are used
+- Approval workflows use the CI approval policy (see below)
+- Progress output is structured JSON (parseable by CI log processors)
+- Exit codes communicate status (0 = success, 1 = failure)
+- Slack/GitHub notifications are sent as configured (integrations still work)
+
+## CI mode configuration
+
+Add to `MINDFORGE.md` for CI-specific settings:
+
+```
+## CI/CD configuration
+
+# Which phases to execute in CI (comma-separated phase numbers, or "all")
+CI_EXECUTE_PHASES=all
+
+# Auto-approve Tier 2 changes in CI (default: false — safer)
+CI_AUTO_APPROVE_TIER2=false
+
+# Block CI on MEDIUM security findings (default: false)
+CI_BLOCK_ON_MEDIUM_SECURITY=false
+
+# Run full security scan in CI (default: true)
+CI_SECURITY_SCAN=true
+
+# Skip human UAT in CI — only run automated verification (default: true)
+CI_SKIP_UAT=true
+
+# Fail CI if test coverage drops below this threshold
+CI_MIN_COVERAGE_PCT=80
+
+# Timeout for entire CI run in minutes (default: 60)
+CI_TIMEOUT_MINUTES=60
+
+# Output format for CI logs: json | text | github-annotations
+CI_OUTPUT_FORMAT=github-annotations
+```
+
+## CI approval policy
+
+Tier 1: always auto-approved (same as interactive mode)
+Tier 2: auto-approved IF `CI_AUTO_APPROVE_TIER2=true` in MINDFORGE.md
+         rejected (build fails) IF `CI_AUTO_APPROVE_TIER2=false`
+Tier 3: ALWAYS fails the build in CI — Tier 3 changes require human review.
+
+The CI build should never be the first time a Tier 3 change is seen.
+Engineers should get Tier 3 changes approved BEFORE pushing to CI.
+
+## CI output format
+
+### JSON format (`CI_OUTPUT_FORMAT=json`)
+```json
+{
+  "mindforge_version": "0.6.0",
+  "phase": 3,
+  "status": "running | success | failure | warning",
+  "timestamp": "ISO-8601",
+  "tasks_completed": 5,
+  "tasks_total": 8,
+  "current_task": "Plan 3-06: Implement auth middleware",
+  "gates": {
+    "secrets_clean": true,
+    "tests_passing": true,
+    "security_findings_critical": 0,
+    "security_findings_high": 0,
+    "coverage_pct": 84
+  },
+  "events": [
+    { "time": "ISO-8601", "type": "task_completed", "plan": "3-01", "commit": "abc1234" },
+    { "time": "ISO-8601", "type": "security_finding", "severity": "MEDIUM", "finding": "..." }
+  ]
+}
+```
+
+### GitHub Annotations format (`CI_OUTPUT_FORMAT=github-annotations`)
+```
+::group::MindForge Phase 3 Execution
+::notice::Task 3-01 completed: Create auth middleware [abc1234]
+::notice::Task 3-02 completed: Add JWT validation [def5678]
+::warning file=src/auth/session.ts,line=47::Medium security finding: Verbose error message exposes stack trace
+::notice::Phase 3 complete: 8/8 tasks, all tests passing
+::endgroup::
+```
+
+### Error output
+```
+::error::MindForge CI failed: Task 3-06 verify step failed
+::error file=src/api/users.ts,line=89::TypeScript error: Type 'string' is not assignable to 'number'
+::error::Quality gate failed: test coverage 68% (minimum: 80%)
+```
+
+## CI environment requirements
+
+```bash
+# Required environment variables for full CI functionality:
+ANTHROPIC_API_KEY=     # Claude API access (required for AI features)
+GITHUB_TOKEN=          # For PR creation and status checks
+JIRA_API_TOKEN=        # Optional — for Jira sync
+SLACK_BOT_TOKEN=       # Optional — for notifications
+```
+
+## CI timeout and exit codes
+
+**Exit code policy:**
+| Situation | Exit code | Meaning |
+|---|---|---|
+| All phases complete, gates passed | 0 | Success |
+| Quality gate failed | 1 | Hard failure — fix required |
+| Tier 2/3 governance block | 1 | Hard failure — approval required |
+| CI timeout reached | 0 | Soft stop — work saved, resume next run |
+| No MindForge project found | 1 | Configuration error |
+
+**Important:** GitHub Actions (and most CI systems) treat ANY non-zero exit code
+as failure. Exit code 2 does NOT mean "warning" in CI — it means failure.
+
+**Timeout handling (exit 0 with state preservation):**
+```bash
+# Set up timeout trap
+CI_TIMEOUT_SECONDS=$((${CI_TIMEOUT_MINUTES:-60} * 60))
+timeout_handler() {
+  echo "::warning::MindForge CI timeout reached after ${CI_TIMEOUT_MINUTES} minutes"
+  echo "::warning::Progress saved. Next CI run will resume from: $(cat .planning/HANDOFF.json | python3 -c 'import sys,json; print(json.load(sys.stdin).get("next_task","unknown"))')"
+
+  # Write resume info to GitHub Actions step summary
+  cat >> "${GITHUB_STEP_SUMMARY:-/dev/null}" << 'SUMMARY_EOF'
+## ⏱️ MindForge CI Timeout
+
+CI timeout reached. Progress has been saved.
+
+Next run will resume from:
+$(cat .planning/HANDOFF.json | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("next_task","unknown"))')
+
+Run the CI pipeline again to continue.
+SUMMARY_EOF
+
+  # Commit HANDOFF.json so next run can resume
+  git add .planning/HANDOFF.json .planning/STATE.md
+  git commit -m "ci: save MindForge progress on timeout [skip ci]" || true
+  git push origin HEAD || true
+
+  exit 0  # Exit 0 — timeout is not a failure
+}
+
+trap 'timeout_handler' TERM
+(sleep "${CI_TIMEOUT_SECONDS}"; kill -TERM $$) &
+TIMEOUT_PID=$!
+```
+
+## CI timeout and resource management
+
+```
+Default execution limits per CI run:
+  Maximum tasks per session: 25
+  Maximum parallel subagents: 5 (respect CI runner memory limits)
+  Task timeout: 10 minutes per task
+  Phase timeout: 45 minutes
+  Full CI timeout: 60 minutes
+
+On timeout:
+  1. Write current state to HANDOFF.json
+  2. Exit with code 0 (soft stop)
+  3. The next CI run resumes from HANDOFF.json
+  4. Report: "CI timeout reached. Run will resume from: [next_task]"
+```

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/ci/github-actions-adapter.md

@@ -0,0 +1,224 @@
+# MindForge — GitHub Actions Integration
+
+## Purpose
+Define the GitHub Actions workflow that integrates MindForge into CI/CD pipelines.
+
+## Workflow file: `.github/workflows/mindforge-ci.yml`
+
+```yaml
+name: MindForge CI
+
+on:
+  push:
+    branches: [ main, 'feat/**' ]
+  pull_request:
+    branches: [ main ]
+
+env:
+  CI: true
+  MINDFORGE_CI: true
+  NODE_VERSION: '20'
+
+jobs:
+  mindforge-health:
+    name: MindForge Health Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # Full history for git-based checks
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+
+      - name: Install MindForge
+        run: npx mindforge-cc@latest --claude --local
+
+      - name: Validate MINDFORGE.md
+        run: node bin/validate-config.js
+
+      - name: Run MindForge health check
+        run: |
+          # Health check in CI mode — outputs structured JSON
+          echo "::group::MindForge Health Report"
+          node -e "
+            // CI health check simulation
+            // In full implementation: calls mindforge health engine
+            const fs = require('fs');
+            const files = ['.planning/AUDIT.jsonl', '.planning/STATE.md', '.planning/HANDOFF.json'];
+            let allPresent = true;
+            files.forEach(f => {
+              if (!fs.existsSync(f)) {
+                console.log('::warning::Missing state file: ' + f);
+                allPresent = false;
+              }
+            });
+            console.log(allPresent ? '::notice::All state files present' : '::warning::Some state files missing');
+          "
+          echo "::endgroup::"
+
+  mindforge-security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    needs: mindforge-health
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: MindForge secret detection
+        run: |
+          echo "::group::Secret Detection"
+          # Secret patterns — exits non-zero if found
+          if grep -rE "(sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]+|xoxb-[a-zA-Z0-9-]+)" \
+            --include="*.ts" --include="*.js" --include="*.json" \
+            --exclude-dir=node_modules --exclude-dir=.git \
+            . 2>/dev/null; then
+            echo "::error::Credentials detected in source files. Remove before merging."
+            exit 1
+          fi
+          echo "::notice::No credentials detected ✅"
+          echo "::endgroup::"
+
+      - name: Dependency audit
+        run: |
+          echo "::group::Dependency Audit"
+          npm audit --audit-level=high 2>&1 || {
+            echo "::error::High/critical vulnerabilities found. Run: npm audit fix"
+            exit 1
+          }
+          echo "::endgroup::"
+
+  mindforge-quality:
+    name: Code Quality Gates
+    runs-on: ubuntu-latest
+    needs: mindforge-health
+    env:
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npx tsc --noEmit 2>&1 | while read line; do
+          echo "::error::$line"
+          done
+
+      - name: Lint
+        run: npx eslint . --ext .ts,.tsx --max-warnings 0
+
+      - name: Test suite with coverage
+        run: npm test -- --coverage
+        env:
+          COVERAGE_THRESHOLD: 80
+
+      - name: Check coverage threshold
+        run: |
+          COVERAGE=$(cat coverage/coverage-summary.json 2>/dev/null | \
+            node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); \
+            console.log(Math.floor(d.total.lines.pct))" 2>/dev/null || echo "0")
+          MIN=${CI_MIN_COVERAGE_PCT:-80}
+          if [ "${COVERAGE}" -lt "${MIN}" ]; then
+            echo "::error::Coverage ${COVERAGE}% is below minimum ${MIN}%"
+            exit 1
+          fi
+          echo "::notice::Coverage: ${COVERAGE}% ✅"
+
+      - name: Check governance tier (Tier 3 blocks CI)
+        run: |
+          # Check if any pending Tier 3 approvals exist without approval
+          PENDING_T3=$(find .planning/approvals/ -name "*.json" 2>/dev/null | \
+            xargs grep -l '"tier": 3' 2>/dev/null | \
+            xargs grep -l '"status": "pending"' 2>/dev/null | wc -l)
+
+          if [ "${PENDING_T3}" -gt 0 ]; then
+            echo "::error title=Tier 3 Governance Block::${PENDING_T3} Tier 3 change(s) require compliance review."
+            echo "::error::Tier 3 changes (auth/payment/PII) cannot be auto-approved in CI."
+            echo "::error::To resolve: get human approval with /mindforge:approve [id], then push again."
+            cat >> "${GITHUB_STEP_SUMMARY}" << 'SUMMARY_EOF'
+## 🔴 Governance Block: Tier 3 Approval Required
+
+This PR contains changes that require compliance review (auth, payment, or PII handling).
+
+**Next steps:**
+1. Run `/mindforge:approve` to see pending approval requests
+2. Have your compliance officer approve with `/mindforge:approve [id]`
+3. Push again — CI will pass once the approval is recorded
+
+See `.planning/approvals/` for details.
+SUMMARY_EOF
+            exit 1
+          fi
+
+          echo "::notice::Governance check passed — no pending Tier 3 blocks ✅"
+
+  mindforge-ai-review:
+    name: AI Code Review
+    runs-on: ubuntu-latest
+    needs: [mindforge-security, mindforge-quality]
+    if: github.event_name == 'pull_request'
+    env:
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+
+      - name: Install MindForge
+        run: npx mindforge-cc@latest --claude --local
+
+      - name: Run AI PR Review
+        run: |
+          if [ -z "${ANTHROPIC_API_KEY}" ]; then
+            echo "::notice::ANTHROPIC_API_KEY not set — skipping AI review"
+            exit 0
+          fi
+
+          # Get the diff for this PR
+          git diff ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} > /tmp/pr.diff
+
+          # Run MindForge AI review (outputs GitHub annotations)
+          node -e "
+            // Placeholder for AI review execution
+            // In full implementation: calls Claude API via the pr-review engine
+            console.log('::notice::AI PR review completed — see review comment on PR');
+          "
+
+      - name: Post review as PR comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const review = fs.existsSync('/tmp/mindforge-review.md') ?
+              fs.readFileSync('/tmp/mindforge-review.md', 'utf8') :
+              '✅ MindForge AI review: no significant issues found.';
+
+            await github.rest.pulls.createReview({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+              body: review,
+              event: 'COMMENT'
+            });
+```

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/ci/gitlab-ci-adapter.md

@@ -0,0 +1,31 @@
+# MindForge — GitLab CI Integration
+
+## Purpose
+Define a GitLab CI template that runs MindForge in CI mode.
+
+## Example `.gitlab-ci.yml`
+
+```yaml
+stages:
+  - mindforge
+
+mindforge:
+  stage: mindforge
+  image: node:20
+  variables:
+    CI: "true"
+    MINDFORGE_CI: "true"
+  script:
+    - npx mindforge-cc@latest --claude --local
+    - node bin/validate-config.js
+    - node tests/ci-mode.test.js
+  artifacts:
+    when: always
+    paths:
+      - .planning/HANDOFF.json
+      - .planning/STATE.md
+```
+
+## Notes
+- Add secrets (ANTHROPIC_API_KEY, SLACK_BOT_TOKEN, etc.) to GitLab CI variables.
+- If CI times out, MindForge exits 0 and preserves HANDOFF.json for the next run.

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/ci/jenkins-adapter.md

@@ -0,0 +1,44 @@
+# MindForge — Jenkins Integration
+
+## Purpose
+Provide a Jenkins pipeline snippet for MindForge CI mode.
+
+## Example Jenkinsfile
+
+```groovy
+pipeline {
+  agent any
+  environment {
+    CI = 'true'
+    MINDFORGE_CI = 'true'
+    ANTHROPIC_API_KEY = credentials('anthropic-api-key')
+  }
+  stages {
+    stage('Install') {
+      steps {
+        sh 'npm ci'
+        sh 'npx mindforge-cc@latest --claude --local'
+      }
+    }
+    stage('Validate') {
+      steps {
+        sh 'node bin/validate-config.js'
+      }
+    }
+    stage('MindForge CI') {
+      steps {
+        sh 'node tests/ci-mode.test.js'
+      }
+    }
+  }
+  post {
+    always {
+      archiveArtifacts artifacts: '.planning/HANDOFF.json,.planning/STATE.md', fingerprint: true
+    }
+  }
+}
+```
+
+## Notes
+- Jenkins treats any non-zero exit code as failure, so timeouts should exit 0.
+- Use Jenkins credentials store for API keys.

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/config.json

@@ -0,0 +1,66 @@
+{
+  "version": "8.0.0",
+  "environment": "development",
+  "governance": {
+    "drift_threshold": 0.75,
+    "critical_drift_threshold": 0.5,
+    "res_threshold": 0.8,
+    "active_did": "did:mindforge:85a9b9dd-30fa-4f5d-a725-d7a4ac845c79"
+  },
+  "revops": {
+    "market_registry": {
+      "gemini-1.5-pro": {
+        "cost_input": 0.0035,
+        "cost_output": 0.0105,
+        "benchmark": 98,
+        "provider": "Google"
+      },
+      "claude-3-5-sonnet": {
+        "cost_input": 0.003,
+        "cost_output": 0.015,
+        "benchmark": 99,
+        "provider": "Anthropic"
+      },
+      "gpt-4o": {
+        "cost_input": 0.005,
+        "cost_output": 0.015,
+        "benchmark": 97,
+        "provider": "OpenAI"
+      },
+      "llama-3-70b-local": {
+        "cost_input": 0.0001,
+        "cost_output": 0.0001,
+        "benchmark": 92,
+        "provider": "Sovereign"
+      },
+      "gemini-1.5-flash": {
+        "cost_input": 0.0003,
+        "cost_output": 0.0003,
+        "benchmark": 85,
+        "provider": "Google"
+      },
+      "haiku-3": {
+        "cost_input": 0.0002,
+        "cost_output": 0.0004,
+        "benchmark": 82,
+        "provider": "Anthropic"
+      }
+    },
+    "default_baseline_model": "gpt-4o",
+    "premium_fallback_model": "claude-3-5-sonnet"
+  },
+  "security": {
+    "pqas_enabled": true,
+    "enclave_tier": 2,
+    "provider": "simulated-lattice"
+  },
+  "mesh": {
+    "node_id": "beta-node",
+    "peers": []
+  },
+  "ase": {
+    "min_success_count": 3,
+    "max_drift_threshold": 0.1,
+    "auto_verify": false
+  }
+}

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/dashboard/api-reference.md

@@ -0,0 +1,122 @@
+# MindForge Dashboard API Reference
+
+## Base URL: http://localhost:7339
+
+## GET /api/status
+Current execution state.
+```json
+{
+  "project_name": "saas-app",
+  "phase": 3,
+  "phase_description": "Authentication System",
+  "auto_mode": true,
+  "auto_status": "running|paused|escalated|idle",
+  "current_task": "Plan 3-05 — JWT middleware",
+  "wave_current": 2,
+  "wave_total": 3,
+  "tasks_completed": 5,
+  "tasks_total": 8,
+  "elapsed_ms": 1083000,
+  "node_repairs": 1,
+  "escalations": 0,
+  "last_commit": "abc1234",
+  "last_event_at": "ISO-8601"
+}
+```
+
+## GET /api/audit?limit=50&offset=0&event=task_completed
+Recent AUDIT.jsonl entries (newest first).
+Query params: limit (default 50, max 200), offset, event (filter by event type)
+
+## GET /api/metrics
+Session quality and cost summary.
+```json
+{
+  "sessions": [{ "id": "...", "quality_score": 0.87, "cost_usd": 0.42, "verify_pass_rate": 0.95 }],
+  "avg_quality": 0.85,
+  "avg_cost_usd": 0.38,
+  "security_findings": { "CRITICAL": 0, "HIGH": 2, "MEDIUM": 5, "LOW": 8 },
+  "node_repair_rate": 0.08
+}
+```
+
+## GET /api/approvals
+Pending governance approvals.
+```json
+{
+  "pending": [
+    {
+      "id": "uuid",
+      "tier": 2,
+      "phase": 3,
+      "plan": "04",
+      "description": "Add user RBAC model",
+      "requested_at": "ISO-8601",
+      "expires_at": "ISO-8601",
+      "hours_remaining": 21.3,
+      "diff_preview": "src/models/user.ts +48 lines..."
+    }
+  ],
+  "approved": [...],
+  "rejected": [...],
+  "expired": [...]
+}
+```
+
+## POST /api/approve/:id
+```json
+Request:  { "decision": "approve|reject", "comment": "optional", "approver": "email" }
+Response: { "success": true, "decision": "approve", "approval_id": "uuid" }
+```
+
+## GET /api/team
+Active developer activity.
+```json
+{
+  "active": [
+    { "email": "john@company.com", "current_task": "Plan 3-05", "last_seen_mins": 0 }
+  ],
+  "conflicts": [
+    { "file": "src/auth/session.ts", "developers": ["john@...", "jane@..."] }
+  ]
+}
+```
+
+## GET /api/memory?q=jwt&limit=10
+Knowledge base query.
+```json
+{
+  "entries": [
+    { "id": "kb-uuid", "type": "architectural_decision", "topic": "JWT tokens", "confidence": 0.90 }
+  ],
+  "total": 47
+}
+```
+
+## GET /api/costs?window=7d
+Cost summary from token-usage.jsonl.
+```json
+{
+  "total_usd": 3.84,
+  "today_usd": 1.21,
+  "by_model": { "claude-sonnet-4-6": 1.92, "gpt-4o": 0.98 },
+  "daily_limit_usd": 10.00,
+  "limit_used_pct": 12.1
+}
+```
+
+## POST /api/steer
+Inject steering guidance (requires auto mode running).
+```json
+Request:  { "instruction": "Use Redis for session storage", "priority": "normal" }
+Response: { "success": true, "queued": true }
+```
+
+## GET /events
+SSE stream. Events emitted:
+- `audit:new` — new AUDIT.jsonl entry
+- `status:update` — auto-state.json changed
+- `approval:new` — new approval request
+- `approval:resolved` — approval approved or rejected
+- `conflict:detected` — two developers touching same file
+- `ping` — keepalive every 15 seconds