mindforge-cc 8.1.1 → 8.2.0

package/.mindforge/mirrors/mirror-sre-776a1cf9/tests/feedback-loop.test.js

@@ -0,0 +1,62 @@
+/**
+ * MindForge — WaveFeedbackLoop & TemporalHindsight Tests
+ */
+
+const WaveFeedbackLoop = require('../bin/engine/feedback-loop');
+const TemporalHindsight = require('../bin/engine/temporal-hindsight');
+
+async function runTests() {
+  const loop = new WaveFeedbackLoop();
+  const hindsight = new TemporalHindsight();
+  const testResults = [];
+
+  console.log('--- WaveFeedbackLoop: Divergence Tests ---');
+
+  // Test 1: Healthy Wave (0% Failure)
+  loop.reset();
+  for (let i = 0; i < 10; i++) loop.update({ status: 'completed' });
+  const healthyResult = loop.shouldTriggerHindsight();
+  testResults.push({ test: 'Healthy Wave (0% Fail) -> No trigger', status: !healthyResult.shouldPause ? 'PASS' : 'FAIL' });
+
+  // Test 2: Diverging Wave (30% Failure)
+  loop.reset();
+  for (let i = 0; i < 7; i++) loop.update({ status: 'completed' });
+  for (let i = 0; i < 3; i++) loop.update({ status: 'failed' });
+  const divergingResult = loop.shouldTriggerHindsight();
+  testResults.push({ test: 'Diverging Wave (30% Fail) -> Trigger', status: divergingResult.shouldPause ? 'PASS' : 'FAIL' });
+
+  // Test 3: High Skips (Divergence Check)
+  loop.reset();
+  for (let i = 0; i < 5; i++) loop.update({ status: 'completed' });
+  for (let i = 0; i < 5; i++) loop.update({ status: 'skipped' });
+  const skipDivergence = loop.calculateDivergence();
+  testResults.push({ test: 'High Skips (50% Skips) -> High Score', status: skipDivergence > 0.1 ? 'PASS' : 'FAIL' });
+
+  console.table(testResults);
+
+  // Test 4: Temporal Hindsight Analysis
+  console.log('\n--- Temporal Hindsight: Analysis Test ---');
+  const waveReport = {
+    failedTasks: [
+      { taskName: 'Task 01', error: 'Permission denied: /Users/sairam/Desktop' },
+      { taskName: 'Task 02', error: 'Permission denied' },
+    ],
+    divergence: 0.3,
+    phase: 4
+  };
+
+  const analysis = await hindsight.analyze(waveReport);
+  if (analysis.diagnosis.type === 'ENVIRONMENTAL') {
+    console.log('PASS: Correctly diagnosed ENVIRONMENTAL issue.');
+  } else {
+    console.log('FAIL: INCORRECT diagnosis: ' + analysis.diagnosis.type);
+  }
+
+  if (analysis.repairPlan.steps.length > 0) {
+    console.log('PASS: Repair plan generated.');
+  } else {
+    console.log('FAIL: Repair plan missing.');
+  }
+}
+
+runTests().catch(console.error);

package/.mindforge/mirrors/mirror-sre-776a1cf9/tests/governance/test-cadia-optimizer.js

@@ -0,0 +1,112 @@
+/**
+ * MindForge v6.0.0 — CADIA Governance Test Suite
+ * Automated verification for the Neural Blast Radius Optimizer.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const ImpactAnalyzer = require('../../bin/governance/impact-analyzer');
+const PolicyEngine = require('../../bin/governance/policy-engine');
+
+async function runTests() {
+  console.log('🚀 Starting CADIA Governance Verifier...\n');
+
+  // Setup temporary test policies
+  const testPoliciesDir = path.join(__dirname, 'test-policies');
+  if (!fs.existsSync(testPoliciesDir)) fs.mkdirSync(testPoliciesDir, { recursive: true });
+
+  const policy1 = {
+    'id': 'policy_enforce_tier_3_security',
+    'effect': 'DENY',
+    'description': 'Restricted tier agents cannot modify security/governance.',
+    'conditions': {
+      'resource': '*/security/*,*/governance/*',
+      'min_tier': 3
+    }
+  };
+
+  const policy2 = {
+    'id': 'policy_max_impact_tier_2',
+    'effect': 'PERMIT',
+    'conditions': {
+      'action': 'WRITE',
+      'resource': '*',
+      'min_tier': 2
+    },
+    'max_impact': 60
+  };
+
+  fs.writeFileSync(path.join(testPoliciesDir, 'deny-security.json'), JSON.stringify(policy1, null, 2));
+  fs.writeFileSync(path.join(testPoliciesDir, 'permit-t2.json'), JSON.stringify(policy2, null, 2));
+
+  const engine = new PolicyEngine({ policiesDir: testPoliciesDir });
+
+  const results = [];
+
+  // Scenario 1: Tier 1 Agent + Core File
+  console.log('--- SCENARIO 1: Tier 1 Agent + Core File ---');
+  const res1 = engine.evaluate({
+    did: 'agent-001',
+    tier: 1,
+    action: 'WRITE',
+    resource: 'bin/governance/impact-analyzer.js',
+    sessionId: 'session_rogue'
+  });
+  console.log(`Verdict: ${res1.verdict} | Reason: ${res1.reason}\n`);
+  results.push(res1.verdict === 'DENY');
+
+  // Scenario 2: Tier 3 Agent + Core File + Reasoning Bypass
+  console.log('--- SCENARIO 2: Tier 3 Agent + Core File + Reasoning Proof ---');
+  const res2 = engine.evaluate({
+    did: 'agent-senior',
+    tier: 3,
+    action: 'WRITE',
+    resource: 'bin/governance/impact-analyzer.js',
+    sessionId: 'session_authorized',
+    reasoning_proof: 'Urgent upgrade to CADIA v6 architecture.'
+  });
+  console.log(`Verdict: ${res2.verdict} | Reason: ${res2.reason}\n`);
+  results.push(res2.verdict === 'PERMIT');
+
+  // Scenario 3: Session Entropy Escalation
+  console.log('--- SCENARIO 3: Session Entropy Escalation (Tier 1) ---');
+  ImpactAnalyzer.resetSession('session_spam');
+  for (let i = 1; i <= 8; i++) {
+    const res = engine.evaluate({
+      did: 'agent-spam',
+      tier: 1, // Tier 1 has only 10 points of buffer
+      action: 'WRITE',
+      resource: `src/file_${i}.js`,
+      sessionId: 'session_spam'
+    });
+    console.log(`[File ${i}] Blast Radius: ${res.verdict === 'DENY' ? 'DENIED' : 'PERMITTED'} (${res.verdict})`);
+  }
+  console.log('');
+
+
+  // Scenario 4: Goal Alignment Check
+  console.log('--- SCENARIO 4: Goal Alignment Check ---');
+  // Reset session for alignment test
+  ImpactAnalyzer.resetSession('session_misaligned');
+  fs.writeFileSync(path.join(process.cwd(), '.planning', 'STATE.md'), 
+    '# State\n## Current phase\nRefactor UI Components\n');
+  
+  const resGoal = engine.evaluate({
+    did: 'agent-ui',
+    tier: 2,
+    action: 'WRITE',
+    resource: 'bin/governance/rbac-manager.js',
+    sessionId: 'session_misaligned'
+  });
+  console.log(`[Goal: UI] [Target: RBAC] Verdict: ${resGoal.verdict} | Reason: ${resGoal.reason}\n`);
+
+  results.push(resGoal.verdict === 'DENY');
+
+  // Final Audit Verification
+  console.log('--- FINAL AUDIT: RISK-AUDIT.jsonl Check ---');
+  const auditContent = fs.readFileSync(path.join(process.cwd(), '.planning', 'RISK-AUDIT.jsonl'), 'utf8');
+  console.log(`Total Audit Entries: ${auditContent.split('\n').filter(Boolean).length}`);
+}
+
+runTests().catch(console.error);

package/.mindforge/mirrors/mirror-sre-776a1cf9/tests/governance/test-policies/deny-security.json

@@ -0,0 +1,9 @@
+{
+  "id": "policy_enforce_tier_3_security",
+  "effect": "DENY",
+  "description": "Restricted tier agents cannot modify security/governance.",
+  "conditions": {
+    "resource": "*/security/*,*/governance/*",
+    "min_tier": 3
+  }
+}

package/.mindforge/mirrors/mirror-sre-776a1cf9/tests/governance/test-policies/permit-t2.json

@@ -0,0 +1,10 @@
+{
+  "id": "policy_max_impact_tier_2",
+  "effect": "PERMIT",
+  "conditions": {
+    "action": "WRITE",
+    "resource": "*",
+    "min_tier": 2
+  },
+  "max_impact": 60
+}

package/.mindforge/mirrors/mirror-sre-776a1cf9/tests/governance.test.js

@@ -0,0 +1,130 @@
+/**
+ * MindForge Day 4 — Governance Tests
+ * Run: node tests/governance.test.js
+ */
+
+const fs = require('fs');
+const assert = require('assert');
+
+let passed = 0;
+let failed = 0;
+
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`  ✅ ${name}`);
+    passed++;
+  } catch (err) {
+    console.error(`  ❌ ${name}`);
+    console.error(`     ${err.message}`);
+    failed++;
+  }
+}
+
+function read(file) {
+  return fs.readFileSync(file, 'utf8');
+}
+
+function classifyChange({ files, diff, recentHighSeverityFinding = false }) {
+  const fileSignals = /(auth\/|security\/|payment\/|billing\/|privacy\/|crypto\/|secrets\/|login\.ts|logout\.ts|token\.ts|password\.ts|credentials\.ts|session\.ts|oauth\.ts|jwt\.ts|hash\.ts|encrypt\.ts|stripe\.ts|payment\.ts|billing\.ts|pii\.ts|consent\.ts)/;
+  const codeSignals = /(bcrypt|argon2|jwt\.sign|jwt\.verify|jose\.sign|jose\.verify|stripe\.|paypal\.|createCipheriv|createDecipheriv|crypto\.subtle|hashPassword|verifyPassword|encrypt\(|decrypt\(|role.*permission|hasPermission|SET ROLE|GRANT)/;
+
+  if (files.some(file => fileSignals.test(file))) return 3;
+  if (codeSignals.test(diff)) return 3;
+  if (recentHighSeverityFinding) return 3;
+  if (files.length > 10) return 2;
+  return 1;
+}
+
+console.log('\nMindForge Day 4 — Governance Tests\n');
+
+console.log('Governance files:');
+
+[
+  '.mindforge/governance/change-classifier.md',
+  '.mindforge/governance/approval-workflow.md',
+  '.mindforge/governance/compliance-gates.md',
+  '.mindforge/governance/GOVERNANCE-CONFIG.md',
+  '.mindforge/team/multi-handoff.md',
+  '.mindforge/team/session-merger.md',
+  'docs/governance-guide.md',
+].forEach(file => {
+  test(`${file} exists`, () => assert.ok(fs.existsSync(file), `Missing ${file}`));
+});
+
+console.log('\nClassifier hardening:');
+
+test('tier 3 triggers on code pattern even in helper.ts', () => {
+  const tier = classifyChange({
+    files: ['src/utils/helper.ts'],
+    diff: '+ const token = jwt.sign(payload, secret);',
+  });
+  assert.strictEqual(tier, 3);
+});
+
+test('tier 3 triggers on audit-history escalation', () => {
+  const tier = classifyChange({
+    files: ['src/utils/helpers.ts'],
+    diff: '+ export const noop = true;',
+    recentHighSeverityFinding: true,
+  });
+  assert.strictEqual(tier, 3);
+});
+
+test('change classifier documents trigger points and code-content scanning', () => {
+  const content = read('.mindforge/governance/change-classifier.md');
+  assert.ok(content.includes('Before each plan executes'), 'Missing plan execution trigger');
+  assert.ok(content.includes('Code content patterns'), 'Missing code-content scanning section');
+  assert.ok(content.includes('jwt.sign'), 'Missing concrete Tier 3 code pattern');
+});
+
+console.log('\nApproval workflow and emergency handling:');
+
+test('approval workflow documents pending-only listing and rejection context carry-forward', () => {
+  const approve = read('.claude/commands/mindforge/approve.md');
+  const workflow = read('.mindforge/governance/approval-workflow.md');
+  assert.ok(approve.includes('status: pending'), 'Missing pending-only listing rule');
+  assert.ok(workflow.includes('rejection reason'), 'Missing rejection-reason carry-forward');
+});
+
+test('approve command requires explicit emergency flag and EMERGENCY_APPROVERS config', () => {
+  const approve = read('.claude/commands/mindforge/approve.md');
+  const config = read('.mindforge/org/integrations/INTEGRATIONS-CONFIG.md');
+  assert.ok(approve.includes('--emergency'), 'Missing emergency flag requirement');
+  assert.ok(config.includes('EMERGENCY_APPROVERS='), 'Missing EMERGENCY_APPROVERS');
+});
+
+test('approval workflow documents identity assurance limitation', () => {
+  const content = read('.mindforge/governance/approval-workflow.md');
+  assert.ok(content.includes('spoofable'), 'Missing identity limitation acknowledgement');
+  assert.ok(content.includes('IdP'), 'Missing stronger identity recommendation');
+});
+
+console.log('\nCompliance and team coordination:');
+
+test('gdpr gate runs independently of skill loading and checks retention policy', () => {
+  const content = read('.mindforge/governance/compliance-gates.md');
+  assert.ok(content.includes('independently of skill loading'), 'Missing skill-independent gate');
+  assert.ok(content.includes('retention'), 'Missing retention requirement');
+});
+
+test('multi-developer handoff documents stale detection after 4 hours', () => {
+  const content = read('.mindforge/team/multi-handoff.md');
+  assert.ok(content.includes('older than 4 hours'), 'Missing stale detection threshold');
+});
+
+test('session merger requires AUDIT entries to be committed with task commits', () => {
+  const content = read('.mindforge/team/session-merger.md');
+  assert.ok(content.includes('AUDIT'), 'Missing AUDIT merge guidance');
+  assert.ok(content.includes('committed'), 'Missing committed AUDIT guidance');
+});
+
+console.log(`\n${'─'.repeat(50)}`);
+console.log(`Results: ${passed} passed, ${failed} failed`);
+
+if (failed > 0) {
+  console.error(`\n❌ ${failed} test(s) failed.\n`);
+  process.exit(1);
+} else {
+  console.log('\n✅ All governance tests passed.\n');
+}

package/.mindforge/mirrors/mirror-sre-776a1cf9/tests/install.test.js

@@ -0,0 +1,209 @@
+/**
+ * MindForge installer smoke tests
+ * Run: node tests/install.test.js
+ */
+
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+let passed = 0;
+let failed = 0;
+
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`  ✅ ${name}`);
+    passed++;
+  } catch (err) {
+    console.error(`  ❌ ${name}`);
+    console.error(`     ${err.message}`);
+    failed++;
+  }
+}
+
+console.log('\nMindForge Core Installation & Structural Tests\n');
+
+// ── Directory structure tests ─────────────────────────────────────────────────
+console.log('Directories:');
+const dirs = [
+  '.claude/commands/mindforge',
+  '.agent/mindforge',
+  '.mindforge/personas',
+  '.mindforge/integrations',
+  '.mindforge/governance',
+  '.mindforge/team',
+  '.mindforge/org/integrations',
+  '.mindforge/skills/security-review',
+  '.mindforge/skills/code-quality',
+  '.mindforge/skills/api-design',
+  '.mindforge/skills/testing-standards',
+  '.mindforge/skills/documentation',
+  '.mindforge/org',
+  '.planning/decisions',
+  'bin',
+  'docs',
+  'tests',
+  '.planning/audit-archive',
+  '.planning/approvals',
+  '.planning/milestones',
+];
+dirs.forEach(d => test(d, () => assert.ok(fs.existsSync(d), `Missing: ${d}`)));
+
+// ── Required files tests ──────────────────────────────────────────────────────
+console.log('\nRequired files:');
+const files = [
+  '.claude/CLAUDE.md',
+  '.agent/CLAUDE.md',
+  '.claude/commands/mindforge/help.md',
+  '.claude/commands/mindforge/init-project.md',
+  '.claude/commands/mindforge/plan-phase.md',
+  '.claude/commands/mindforge/execute-phase.md',
+  '.claude/commands/mindforge/verify-phase.md',
+  '.claude/commands/mindforge/ship.md',
+  '.claude/commands/mindforge/audit.md',
+  '.claude/commands/mindforge/milestone.md',
+  '.claude/commands/mindforge/complete-milestone.md',
+  '.claude/commands/mindforge/approve.md',
+  '.claude/commands/mindforge/sync-jira.md',
+  '.claude/commands/mindforge/sync-confluence.md',
+  '.mindforge/personas/analyst.md',
+  '.mindforge/personas/architect.md',
+  '.mindforge/personas/developer.md',
+  '.mindforge/personas/qa-engineer.md',
+  '.mindforge/personas/security-reviewer.md',
+  '.mindforge/personas/tech-writer.md',
+  '.mindforge/personas/debug-specialist.md',
+  '.mindforge/personas/release-manager.md',
+  '.mindforge/skills/security-review/SKILL.md',
+  '.mindforge/skills/code-quality/SKILL.md',
+  '.mindforge/skills/api-design/SKILL.md',
+  '.mindforge/skills/testing-standards/SKILL.md',
+  '.mindforge/skills/documentation/SKILL.md',
+  '.mindforge/org/ORG.md',
+  '.mindforge/org/CONVENTIONS.md',
+  '.mindforge/org/SECURITY.md',
+  '.mindforge/org/TOOLS.md',
+  '.mindforge/integrations/connection-manager.md',
+  '.mindforge/integrations/jira.md',
+  '.mindforge/integrations/confluence.md',
+  '.mindforge/integrations/slack.md',
+  '.mindforge/integrations/github.md',
+  '.mindforge/integrations/gitlab.md',
+  '.mindforge/governance/change-classifier.md',
+  '.mindforge/governance/approval-workflow.md',
+  '.mindforge/governance/compliance-gates.md',
+  '.mindforge/governance/GOVERNANCE-CONFIG.md',
+  '.mindforge/team/multi-handoff.md',
+  '.mindforge/team/session-merger.md',
+  '.mindforge/org/integrations/INTEGRATIONS-CONFIG.md',
+  '.planning/STATE.md',
+  '.planning/HANDOFF.json',
+  '.planning/jira-sync.json',
+  '.planning/slack-threads.json',
+  'bin/install.js',
+  'package.json',
+  'README.md',
+  'docs/enterprise-setup.md',
+  'docs/governance-guide.md',
+];
+files.forEach(f => test(f, () => assert.ok(fs.existsSync(f), `Missing: ${f}`)));
+
+// ── Content tests ─────────────────────────────────────────────────────────────
+console.log('\nContent validation:');
+
+test('CLAUDE.md has session start protocol', () => {
+  const content = fs.readFileSync('.claude/CLAUDE.md', 'utf8');
+  assert.ok(content.includes('SESSION START PROTOCOL'), 'Missing session start protocol');
+  assert.ok(content.includes('PLAN-FIRST RULE'), 'Missing plan-first rule');
+  assert.ok(content.includes('Quality gates'), 'Missing quality gates');
+  assert.ok(content.includes('SECURITY AUTO-TRIGGER'), 'Missing security auto-trigger');
+  assert.ok(content.includes('/mindforge:audit'), 'Missing Day 4 command awareness');
+  assert.ok(content.includes('Tier 3'), 'Missing governance tier awareness');
+});
+
+test('CLAUDE.md and .agent/CLAUDE.md are identical', () => {
+  const claude = fs.readFileSync('.claude/CLAUDE.md', 'utf8');
+  const agent = fs.readFileSync('.agent/CLAUDE.md', 'utf8');
+  assert.strictEqual(claude, agent, '.claude/CLAUDE.md and .agent/CLAUDE.md differ');
+});
+
+test('All commands mirrored to .agent/mindforge/', () => {
+  const claudeCommands = fs.readdirSync('.claude/commands/mindforge/').sort();
+  const agentCommands = fs.readdirSync('.agent/mindforge/').sort();
+  assert.deepStrictEqual(claudeCommands, agentCommands, 'Command files differ between runtimes');
+});
+
+test('HANDOFF.json is valid JSON', () => {
+  const content = fs.readFileSync('.planning/HANDOFF.json', 'utf8');
+  const parsed = JSON.parse(content);
+  assert.ok(parsed.schema_version, 'Missing schema_version field');
+  assert.ok(parsed._warning, 'Missing _warning anti-secret field');
+});
+
+test('package.json has bin field', () => {
+  const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+  assert.ok(pkg.bin, 'Missing bin field');
+  assert.ok(pkg.bin['mindforge-cc'], 'Missing bin.mindforge-cc');
+  assert.ok(pkg.engines, 'Missing engines field');
+  assert.ok(pkg.engines.node, 'Missing engines.node');
+});
+
+test('All skill packs have frontmatter triggers', () => {
+  const skillDirs = fs.readdirSync('.mindforge/skills/');
+  skillDirs.forEach(dir => {
+    const skillPath = `.mindforge/skills/${dir}/SKILL.md`;
+    if (fs.existsSync(skillPath)) {
+      const content = fs.readFileSync(skillPath, 'utf8');
+      assert.ok(content.includes('triggers:'), `${skillPath} missing triggers frontmatter`);
+      assert.ok(content.includes('name:'), `${skillPath} missing name frontmatter`);
+    }
+  });
+});
+
+test('bin/install.js is executable and has no obvious syntax errors', () => {
+  const stat = fs.statSync('bin/install.js');
+  assert.ok(stat.size > 1000, 'bin/install.js is suspiciously small');
+  const content = fs.readFileSync('bin/install.js', 'utf8');
+  assert.ok(content.includes('#!/usr/bin/env node'), 'Missing shebang line');
+  assert.ok(content.includes('verifyInstall'), 'Missing install verification function');
+});
+
+test('No secrets in any committed file', () => {
+  const secretPatterns = [
+    /password\s*=\s*['"][^'"]{6,}/i,
+    /api[_-]?key\s*=\s*['"][^'"]{10,}/i,
+    /secret\s*=\s*['"][^'"]{8,}/i,
+    /-----BEGIN (RSA |EC |PRIVATE )?KEY-----/,
+    /sk-[a-zA-Z0-9]{20,}/,
+  ];
+
+  function scanDir(dir) {
+    if (dir.includes('node_modules') || dir.includes('.git')) return;
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    entries.forEach(entry => {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        scanDir(full);
+      } else if (entry.name.endsWith('.md') || entry.name.endsWith('.js') || entry.name.endsWith('.json')) {
+        const content = fs.readFileSync(full, 'utf8');
+        secretPatterns.forEach(pattern => {
+          assert.ok(!pattern.test(content), `Potential secret in ${full}`);
+        });
+      }
+    });
+  }
+
+  scanDir('.');
+});
+
+// ── Results ───────────────────────────────────────────────────────────────────
+console.log(`\n${'─'.repeat(50)}`);
+console.log(`Results: ${passed} passed, ${failed} failed`);
+
+if (failed > 0) {
+  console.error(`\n❌ ${failed} test(s) failed. Fix before pushing.\n`);
+  process.exit(1);
+} else {
+  console.log('\n✅ All tests passed. Foundation is solid.\n');
+}

package/.mindforge/mirrors/mirror-sre-776a1cf9/tests/integrations.test.js

@@ -0,0 +1,128 @@
+/**
+ * MindForge Enterprise Integration Integration Tests
+ * Run: node tests/integrations.test.js
+ */
+
+const fs = require('fs');
+const assert = require('assert');
+
+let passed = 0;
+let failed = 0;
+
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`  ✅ ${name}`);
+    passed++;
+  } catch (err) {
+    console.error(`  ❌ ${name}`);
+    console.error(`     ${err.message}`);
+    failed++;
+  }
+}
+
+function read(file) {
+  return fs.readFileSync(file, 'utf8');
+}
+
+console.log('\nMindForge Enterprise Integration Tests\n');
+
+console.log('Scaffold and config:');
+
+[
+  '.mindforge/integrations/connection-manager.md',
+  '.mindforge/integrations/jira.md',
+  '.mindforge/integrations/confluence.md',
+  '.mindforge/integrations/slack.md',
+  '.mindforge/integrations/github.md',
+  '.mindforge/integrations/gitlab.md',
+  '.mindforge/org/integrations/INTEGRATIONS-CONFIG.md',
+  '.planning/jira-sync.json',
+  '.planning/slack-threads.json',
+].forEach(file => {
+  test(`${file} exists`, () => assert.ok(fs.existsSync(file), `Missing ${file}`));
+});
+
+console.log('\nSecurity hardening:');
+
+test('integration config contains no token values', () => {
+  const content = read('.mindforge/org/integrations/INTEGRATIONS-CONFIG.md');
+  const forbidden = [/ghp_[a-zA-Z0-9]+/, /xoxb-[a-zA-Z0-9-]+/, /sk-[a-zA-Z0-9]+/, /API_TOKEN=\S+/];
+  forbidden.forEach(pattern => {
+    assert.ok(!pattern.test(content), `Potential token leaked in config: ${pattern}`);
+  });
+});
+
+test('connection manager documents shell debug prohibition and curl verbose prohibition', () => {
+  const content = read('.mindforge/integrations/connection-manager.md');
+  assert.ok(content.includes('Debug mode prohibition'), 'Missing debug mode guidance');
+  assert.ok(content.includes('curl verbose mode prohibition'), 'Missing curl verbose guidance');
+  assert.ok(content.includes('set +x'), 'Missing explicit set +x guidance');
+});
+
+test('audit schema and audit command document archive rotation after 10000 lines', () => {
+  const schema = read('.mindforge/audit/AUDIT-SCHEMA.md');
+  const command = read('.claude/commands/mindforge/audit.md');
+  assert.ok(schema.includes('10,000 lines'), 'Missing audit rotation threshold in schema');
+  assert.ok(command.includes('10,000 lines'), 'Missing audit rotation threshold in command');
+});
+
+console.log('\nJira behaviour:');
+
+test('jira integration uses dynamic transition lookup instead of hardcoded IDs', () => {
+  const content = read('.mindforge/integrations/jira.md');
+  assert.ok(content.includes('Never hardcode transition IDs'), 'Missing dynamic lookup guidance');
+  assert.ok(content.includes('GET /rest/api/3/issue/{issueKey}/transitions'), 'Missing transitions lookup endpoint');
+  assert.ok(content.includes('transition_cache'), 'Missing transition cache guidance');
+});
+
+test('jira-sync.json includes anti-secret warning', () => {
+  const parsed = JSON.parse(read('.planning/jira-sync.json'));
+  assert.ok(parsed._warning, 'Missing _warning');
+  assert.ok(parsed._warning.toLowerCase().includes('credentials'), 'Warning should mention credentials');
+});
+
+test('jira integration documents backoff and second-429 stop behaviour', () => {
+  const content = read('.mindforge/integrations/jira.md');
+  assert.ok(content.includes('429'), 'Missing rate limit handling');
+  assert.ok(content.includes('retry once'), 'Missing retry-once guidance');
+});
+
+console.log('\nConfluence and Slack resilience:');
+
+test('confluence integration requires idempotent updates', () => {
+  const content = read('.mindforge/integrations/confluence.md');
+  assert.ok(content.includes('idempotent'), 'Missing idempotency guidance');
+  assert.ok(content.includes('Do not create duplicate pages'), 'Missing duplicate-page guidance');
+});
+
+test('slack thread schema is valid and guarded against token storage', () => {
+  const parsed = JSON.parse(read('.planning/slack-threads.json'));
+  assert.strictEqual(parsed.schema_version, '1.0.0');
+  assert.ok(parsed.threads && typeof parsed.threads === 'object', 'Missing threads object');
+  assert.ok(parsed._warning.toLowerCase().includes('tokens'), 'Warning should mention tokens');
+});
+
+test('slack integration handles invalid thread timestamps and undelivered critical alerts', () => {
+  const content = read('.mindforge/integrations/slack.md');
+  assert.ok(content.includes('clear that entry'), 'Missing invalid thread handling');
+  assert.ok(content.includes('Undelivered alerts'), 'Missing undelivered critical alert handling');
+});
+
+console.log('\nGitHub correctness:');
+
+test('github integration treats branch-protection 404 as non-fatal and checks branch diff before PR', () => {
+  const content = read('.mindforge/integrations/github.md');
+  assert.ok(content.includes('404'), 'Missing branch protection 404 handling');
+  assert.ok(content.includes('git log origin/${GITHUB_DEFAULT_BRANCH}..HEAD --oneline | wc -l'), 'Missing ahead-of-base check');
+});
+
+console.log(`\n${'─'.repeat(50)}`);
+console.log(`Results: ${passed} passed, ${failed} failed`);
+
+if (failed > 0) {
+  console.error(`\n❌ ${failed} test(s) failed.\n`);
+  process.exit(1);
+} else {
+  console.log('\n✅ All integration tests passed.\n');
+}