mindforge-cc 8.2.0 → 9.0.0

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/impact-analyzer.js

@@ -1,141 +0,0 @@
-/**
- * MindForge v6.0.0 — Context-Aware Dynamic Impact Analysis (CADIA)
- * Calculates the 'Blast Radius' score of a proposed intent.
- */
-'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-class ImpactAnalyzer {
-  static CRITICAL_PATHS = [
-    '.env',
-    'id_rsa',
-    '*.pem',
-    'package-lock.json',
-    'yarn.lock',
-    'AUDIT.jsonl',
-    'STATE.md'
-  ];
-
-  static SENSITIVE_NAMESPACES = [
-    '.mindforge',
-    'bin/',
-    'config/',
-    '.agent/',
-    'security/'
-  ];
-
-  static ACTION_SCORES = {
-    'READ': 1,
-    'WRITE': 5,
-    'DELETE': 10,
-    'EXECUTE': 15,
-    'GRANT': 20
-  };
-
-  // Cache for session-based entropy tracking
-  static sessionState = new Map();
-
-  /**
-   * [CADIA] Scores an intent based on architectural influence, session entropy, and trust tiers.
-   * Score Range: 0 - 100
-   */
-  static analyze(intent, context = {}) {
-    const { action, target, namespace } = intent;
-    const { sessionId = 'default', trustTier = 0, currentGoal = '' } = context;
-
-    // 1. Critical Path Protection (Hardened)
-    const isCritical = this.CRITICAL_PATHS.some(cp => 
-      (target && (target.endsWith(cp) || target.includes(`/${cp}`)))
-    );
-
-    if (isCritical && (action === 'WRITE' || action === 'DELETE')) {
-      return 100; // Automatic CRITICAL block
-    }
-
-    let score = this.ACTION_SCORES[action] || 5;
-    
-    // 2. [NEW] Architectural Influence Engine (x2.5 multiplier)
-    if (this.isArchitecturallySignificant(target)) {
-      score *= 2.5; 
-    }
-
-    // 3. Sensitive Namespace Multiplier (x4.0 multiplier)
-    const isSensitive = this.SENSITIVE_NAMESPACES.some(ns => 
-      (target && target.includes(ns)) || (namespace && namespace.includes(ns))
-    );
-
-    if (isSensitive) {
-      score *= 4.0; 
-    }
-
-    // 4. [NEW] Session Entropy Tracker (+15 penalty)
-    const sessCount = (this.sessionState.get(sessionId) || 0) + 1;
-    this.sessionState.set(sessionId, sessCount);
-    
-    if (sessCount > 5) {
-      score += (sessCount - 5) * 15; 
-    }
-
-    // 5. [NEW] Goal-to-Path Alignment (+40 penalty)
-    if (currentGoal && !this.isGoalAligned(target, currentGoal)) {
-      score += 40; 
-    }
-
-    // 6. [NEW] ZTAI-Trust Scaling (Risk buffer)
-    const trustBuffer = trustTier * 10;
-    score = Math.max(0, score - trustBuffer);
-
-    // 7. Recursive Depth Scale
-    if (target && target.split('/').length > 5) {
-      score *= 1.25; 
-    }
-
-    return Math.min(Math.round(score), 100);
-  }
-
-
-  /**
-   * Identifies files with high architectural side-effects.
-   */
-  static isArchitecturallySignificant(filePath) {
-    if (!filePath) return false;
-    const highWeightDirs = ['bin/governance', 'bin/engine', 'bin/models', '.mindforge/intelligence'];
-    const highWeightFiles = ['package.json', 'sdk/nexus-core.js', 'bin/mindforge-cli.js'];
-    
-    return highWeightDirs.some(d => filePath.includes(d)) || 
-           highWeightFiles.some(f => filePath.endsWith(f));
-  }
-
-  /**
-   * Checks if the target path semantically aligns with the current active goal/phase.
-   */
-  static isGoalAligned(filePath, currentGoal) {
-    if (!currentGoal || !filePath) return true; // Default to neutral if no goal set
-    
-    // Simple heuristic: Does the goal mention the file or directory?
-    const normalizedGoal = currentGoal.toLowerCase();
-    const normalizedPath = filePath.toLowerCase();
-    
-    // Extract domain (e.g., 'auth', 'ui', 'api')
-    const domain = normalizedPath.split('/')[0];
-    
-    return normalizedGoal.includes(domain) || 
-           normalizedGoal.includes(path.basename(normalizedPath, path.extname(normalizedPath)));
-  }
-
-  static getRiskTier(score) {
-    if (score < 25) return 'LOW';
-    if (score < 50) return 'MEDIUM';
-    if (score < 75) return 'HIGH';
-    return 'CRITICAL';
-  }
-
-  static resetSession(sessionId) {
-    this.sessionState.delete(sessionId);
-  }
-}
-
-module.exports = ImpactAnalyzer;
-

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/policies/critical-data.json

@@ -1 +0,0 @@
-{"id":"pol_critical_001","effect":"PERMIT","max_impact":100,"conditions":{"resource":"STATE.md"}}

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/policies/default-policies.jsonl

@@ -1,33 +0,0 @@
-{
-  "id": "policy_enforce_tier_3_security",
-  "version": "1.0.0",
-  "effect": "DENY",
-  "description": "Agents with Tier < 3 cannot modify security or governance files.",
-  "conditions": {
-    "resource": "*/security/*,*/governance/*",
-    "min_tier": 3
-  }
-}
-<!-- slide -->
-{
-  "id": "policy_permit_developer_src",
-  "version": "1.0.0",
-  "effect": "PERMIT",
-  "description": "Developer agents can write to src and tests.",
-  "conditions": {
-    "action": "write_file",
-    "resource": "*/src/*,*/tests/*",
-    "min_tier": 2
-  }
-}
-<!-- slide -->
-{
-  "id": "policy_permit_global_sync_lead",
-  "version": "1.0.0",
-  "effect": "PERMIT",
-  "description": "Lead Architects can push to the Federated Intelligence Mesh.",
-  "conditions": {
-    "action": "federated_sync_push",
-    "min_tier": 3
-  }
-}

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/policy-engine.js

@@ -1,210 +0,0 @@
-/**
- * MindForge v6.0.0 — Agentic Policy Orchestrator (APO) Engine
- * Evaluates agent intents against organizational security policies with CADIA integration.
- */
-'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-const ImpactAnalyzer = require('./impact-analyzer');
-const policyGate = require('./policy-gate-hardened');
-
-class PolicyEngine {
-  constructor(config = {}) {
-    this.policiesDir = config.policiesDir || path.join(__dirname, 'policies');
-    this.planningDir = config.planningDir || path.join(process.cwd(), '.planning');
-    this.auditLogPath = path.join(this.planningDir, 'RISK-AUDIT.jsonl');
-    this.ensurePoliciesDir();
-  }
-
-  ensurePoliciesDir() {
-    if (!fs.existsSync(this.policiesDir)) {
-      fs.mkdirSync(this.policiesDir, { recursive: true });
-    }
-  }
-
-  /**
-   * Evaluates an agent's intent against all active policies using CADIA.
-   */
-  async evaluate(intent) {
-    const requestId = `pol_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`;
-    const sessionId = intent.sessionId || 'default_session';
-    const currentGoal = this.getCurrentGoal();
-    
-    console.log(`[APO-EVAL] [${requestId}] Evaluating intent: ${intent.action} on ${intent.resource} by ${intent.did}`);
-
-    // Pillar II (v6.0.0): CADIA Dynamic Impact Scoring
-    let impactScore = 100;
-    let riskTier = 'UNKNOWN';
-
-    try {
-      impactScore = ImpactAnalyzer.analyze({
-        action: intent.action,
-        target: intent.resource,
-        namespace: intent.namespace
-      }, {
-        sessionId,
-        trustTier: intent.tier || 0,
-        currentGoal
-      });
-      riskTier = ImpactAnalyzer.getRiskTier(impactScore);
-      console.log(`[APO-BLAST] [${requestId}] Calculated Blast Radius: ${impactScore}/100 [Tier: ${riskTier}]`);
-    } catch (err) {
-      console.error(`[APO-ERR] [${requestId}] Impact analysis failed. Defaulting to high-impact restriction.`, err);
-    }
-
-    const policies = this.loadPolicies();
-    let verdict = { verdict: 'DENY', reason: 'No matching PERMIT policy found (Implicit Deny)', requestId };
-
-    // 1. Check for explicit DENY rules (High-Priority)
-    for (const policy of policies) {
-      if (policy.effect === 'DENY' && this.matches(policy, intent)) {
-        verdict = { verdict: 'DENY', reason: `Violation: ${policy.description || policy.id}`, requestId };
-        this.logAudit(intent, impactScore, verdict);
-        return verdict;
-      }
-    }
-
-    // 2. Pillar II (v6.0.0): Dynamic Blast Radius Enforcement with Tier 3 Bypass
-    for (const policy of policies) {
-      if (this.matches(policy, intent)) {
-        if (policy.max_impact && impactScore >= policy.max_impact) {
-          
-          // [PQAS] v7: Hardened Biometric Bypass for Risk > 95
-          if (impactScore > 95) {
-            const gateResult = await policyGate.evaluateBypass(intent, impactScore);
-            if (gateResult.status === 'WAIT_FOR_BIOMETRIC') {
-              verdict = { 
-                verdict: 'DENY', 
-                reason: gateResult.reason, 
-                requestId,
-                status: 'WAIT_FOR_BIOMETRIC',
-                challenge_id: gateResult.challenge_id
-              };
-              this.logAudit(intent, impactScore, verdict);
-              return verdict;
-            }
-            console.log(`[PQAS-GATE] [${requestId}] Biometric signature verified. Proceeding with high-risk mutation.`);
-            verdict = { verdict: 'PERMIT', reason: `Authorized via Biometric Bypass [${gateResult.signature || 'WEB-AUTHN-DEX'}]`, requestId };
-            this.logAudit(intent, impactScore, verdict);
-            return verdict;
-          }
-
-          // [ENTERPRISE] Tier 3 Reasoning/PQ Proof Bypass
-          if (intent.tier >= 3 && (intent.reasoning_proof || intent.pq_proof)) {
-             const quantumCrypto = require('./quantum-crypto');
-             const isProofValid = intent.pq_proof ? 
-                quantumCrypto.verifyZKProof(intent.pq_proof, intent.id) : true;
-
-             if (isProofValid) {
-                console.log(`[APO-BYPASS] [${requestId}] Tier 3 'Sovereign Proof' verified (${intent.pq_proof ? 'ZK-PQ' : 'Standard'}). Overriding Blast Radius limit.`);
-                // Continue to permit check
-             } else {
-                verdict = { verdict: 'DENY', reason: 'Invalid or Malformed ZK-Proof detected.', requestId };
-                this.logAudit(intent, impactScore, verdict);
-                return verdict;
-             }
-          } else {
-            verdict = { 
-              verdict: 'DENY', 
-              reason: `Dynamic Blast Radius Violation: Intent impact (${impactScore}) exceeds policy limit (${policy.max_impact}). ${intent.tier < 3 ? 'Upgrade to Tier 3 for bypass.' : 'Provide Sovereign Proof.'}`, 
-              requestId 
-            };
-            this.logAudit(intent, impactScore, verdict);
-            return verdict;
-          }
-        }
-      }
-    }
-
-    // 3. Check for explicit PERMIT rules
-    for (const policy of policies) {
-      if (policy.effect === 'PERMIT' && this.matches(policy, intent)) {
-        verdict = { verdict: 'PERMIT', reason: `Authorized by ${policy.id}`, requestId };
-        this.logAudit(intent, impactScore, verdict);
-        return verdict;
-      }
-    }
-
-    this.logAudit(intent, impactScore, verdict);
-    return verdict;
-  }
-
-  getCurrentGoal() {
-    const statePath = path.join(this.planningDir, 'STATE.md');
-    if (!fs.existsSync(statePath)) return '';
-    try {
-      const content = fs.readFileSync(statePath, 'utf8');
-      const match = content.match(/## Current phase\n(.*?)\n/);
-      return match ? match[1].trim() : '';
-    } catch {
-      return '';
-    }
-  }
-
-  logAudit(intent, impactScore, verdict) {
-    const entry = JSON.stringify({
-      timestamp: new Date().toISOString(),
-      requestId: verdict.requestId,
-      did: intent.did,
-      tier: intent.tier,
-      action: intent.action,
-      resource: intent.resource,
-      impactScore,
-      verdict: verdict.verdict,
-      reason: verdict.reason
-    }) + '\n';
-    
-    fs.appendFileSync(this.auditLogPath, entry); 
-  }
-
-  loadPolicies() {
-    if (!fs.existsSync(this.policiesDir)) return [];
-    
-    return fs.readdirSync(this.policiesDir)
-      .filter(f => f.endsWith('.json'))
-      .map(f => {
-        try {
-          const content = fs.readFileSync(path.join(this.policiesDir, f), 'utf8');
-          return JSON.parse(content);
-        } catch (err) {
-          console.error(`[APO-ERROR] Failed to parse policy ${f}:`, err.message);
-          return null;
-        }
-      })
-      .filter(Boolean);
-  }
-
-  matches(policy, intent) {
-    const { conditions } = policy;
-    if (!conditions) return true;
-
-    if (conditions.did && !this.globMatch(conditions.did, intent.did)) return false;
-    if (conditions.action && !this.globMatch(conditions.action, intent.action)) return false;
-    if (conditions.resource && !this.globMatch(conditions.resource, intent.resource)) return false;
-    if (conditions.min_tier && (intent.tier || 0) < conditions.min_tier) return false;
-
-    return true;
-  }
-
-  /**
-   * Simple glob matching for policy conditions.
-   * Supports '*' (any string) and '?' (any character).
-   */
-  globMatch(pattern, text) {
-    if (!pattern || !text) return false;
-    if (pattern === '*') return true;
-    
-    // Escape regex characters but keep * and ?
-    const regexStr = pattern
-      .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-      .replace(/\*/g, '.*')
-      .replace(/\?/g, '.');
-      
-    const regex = new RegExp(`^${regexStr}$`, 'i');
-    return regex.test(text);
-  }
-}
-
-module.exports = PolicyEngine;
-

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/policy-gate-hardened.js

@@ -1,59 +0,0 @@
-/**
- * MindForge v8 — Orbital Governance (Pillar XVIII)
- * Component: Hardened Policy Gate (Final Evolution)
- * 
- * Enforces hardware-attested bypasses for high-impact system mutations.
- */
-'use strict';
-
-const orbitalGuardian = require('../engine/orbital-guardian');
-const configManager = require('../governance/config-manager');
-
-class PolicyGateHardened {
-  constructor() {
-    // bypasses.json deprecated in favor of orbital.attestations table (v8)
-    this.criticalThreshold = configManager.get('governance.critical_drift_threshold', 95); 
-  }
-
-  /**
-   * Evaluates if an intent requires hardware-bound attestation.
-   */
-  async evaluateBypass(intent, impactScore) {
-    if (impactScore <= this.criticalThreshold) {
-      return { status: 'ALLOWED', reason: 'Impact within standard threshold' };
-    }
-
-    console.log(`[ORBITAL-GATE] Impact Score ${impactScore} requires Hardware Attestation`);
-
-    // 1. Check SQLite via OrbitalGuardian (Unified v8 persistence)
-    const attestation = await orbitalGuardian.verify(intent.requestId);
-    
-    if (attestation.verified) {
-      return { 
-        status: 'ALLOWED', 
-        reason: 'Hardware Attestation Verified via Enclave', 
-        attestation_id: attestation.id,
-        timestamp: attestation.timestamp
-      };
-    }
-
-    // 2. Trigger Orbital Challenge
-    return { 
-      status: 'WAIT_FOR_ORBITAL', 
-      reason: 'Hardware/Biometric attestation required for orbital-tier mutation',
-      challenge_id: `orb_${Math.random().toString(36).substr(2, 6)}`,
-      impact: impactScore
-    };
-  }
-
-  /**
-   * Records a hardware-attested approval.
-   */
-  async recordBypass(requestId, did, signature_blob = 'MOCK_HARDWARE_SIGN_v8') {
-    const report = await orbitalGuardian.attest(requestId, did, signature_blob);
-    console.log(`[ORBITAL-GATE] Recorded Hardware Approval for Request: ${requestId}`);
-    return report;
-  }
-}
-
-module.exports = new PolicyGateHardened();

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/quantum-crypto.js

@@ -1,111 +0,0 @@
-/**
- * MindForge v7 — Post-Quantum Agentic Security (PQAS)
- * Simulated Lattice-Based Cryptography (Dilithium-5 / Kyber-1024)
- */
-'use strict';
-
-const crypto = require('node:crypto');
-const configManager = require('./config-manager');
-
-class QuantumCrypto {
-  constructor() {
-    this.providerId = configManager.get('security.provider', 'simulated-lattice');
-    this.pqasEnabled = configManager.get('security.pqas_enabled', true);
-  }
-
-  /**
-   * Returns the current active crypto provider.
-   */
-  getProvider() {
-    // In v7, this would resolve to a real provider like 'oqs-provider.js'
-    return {
-      id: this.providerId,
-      pqas_enabled: this.pqasEnabled,
-      algorithm: 'Dilithium-5'
-    };
-  }
-
-  /**
-   * Generates a key pair using the configured PQ provider.
-   */
-  async generateLatticeKeyPair() {
-    if (!this.pqasEnabled) throw new Error('PQAS is disabled in configuration.');
-
-    // Simulate high-entropy lattice seeds
-    const seed = crypto.randomBytes(64).toString('hex');
-    const publicKey = `mfq7_dilithium5_pub_${crypto.randomBytes(32).toString('hex')}`;
-    const privateKey = `mfq7_dilithium5_priv_${crypto.randomBytes(64).toString('hex')}`;
-    
-    return {
-      publicKey,
-      privateKey,
-      algorithm: this.getProvider().algorithm,
-      version: 'v7.0.0-PQAS',
-      provider: this.providerId
-    };
-  }
-
-  /**
-   * Signs data using simulated Dilithium-5.
-   */
-  async signPQ(data, privateKey) {
-    if (!this.pqasEnabled) throw new Error('PQAS is disabled.');
-    if (!privateKey.startsWith('mfq7_dilithium5_priv_')) {
-      throw new Error('Invalid Post-Quantum private key format.');
-    }
-
-    // Simulate the lattice-based signature overhead
-    const hash = crypto.createHash('sha3-512').update(data).digest('hex');
-    const salt = crypto.randomBytes(16).toString('hex');
-    
-    // Dilithium signatures are significantly larger than Ed25519
-    const simulatedSignature = `pqas_sig_d5_${Buffer.from(hash + salt).toString('base64')}_${crypto.randomBytes(128).toString('base64')}`;
-    
-    return simulatedSignature;
-  }
-
-  /**
-   * Verifies a Dilithium-5 signature using constant-time comparison simulation.
-   */
-  verifyPQ(data, signature, publicKey) {
-    if (!publicKey.startsWith('mfq7_dilithium5_pub_')) return false;
-    if (!signature.startsWith('pqas_sig_d5_')) return false;
-
-    try {
-      const parts = signature.split('_');
-      const blob = Buffer.from(parts[3], 'base64').toString('utf8');
-      const hashInSig = blob.slice(0, 128); 
-      
-      const actualHash = crypto.createHash('sha3-512').update(data).digest('hex');
-      
-      // Use timing-safe comparison to prevent side-channel leaks
-      return crypto.timingSafeEqual(Buffer.from(hashInSig), Buffer.from(actualHash));
-    } catch {
-      return false;
-    }
-  }
-
-  /**
-   * Generates a simulated ZK-Proof of policy adherence.
-   * This mimics a SNARK where the agent proves it ran the PolicyEngine rules.
-   */
-  generateZKProof(intent, result) {
-    const proofPayload = JSON.stringify({
-      intent: intent.id,
-      verdict: result.verdict,
-      timestamp: Date.now(),
-      entropy: crypto.randomBytes(16).toString('hex')
-    });
-
-    const hash = crypto.createHash('sha256').update(proofPayload).digest('hex');
-    return `zkp_v1_${hash}_${crypto.randomBytes(32).toString('base64')}`;
-  }
-
-  verifyZKProof(proof, intentId) {
-    if (!proof.startsWith('zkp_v1_')) return false;
-    // Real verification would check the Merkle root of the execution trace
-    return true; // Simulated success
-  }
-}
-
-module.exports = new QuantumCrypto();

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/rbac-manager.js

@@ -1,109 +0,0 @@
-/**
- * MindForge v5 — Agentic RBAC Manager
- * Maps Agent DIDs to specific project roles and granular permissions.
- */
-'use strict';
-
-const fs    = require('node:fs');
-const path  = require('node:path');
-const ztai  = require('./ztai-manager');
-
-class RBACManager {
-  constructor(config = {}) {
-    this.rolesPath = config.rolesPath || path.join(process.cwd(), '.planning/AGENT-ROLES.json');
-    this.defaultRoles = {
-      'did:mindforge:planner': ['lead-architect', 'resource-optimizer'],
-      'did:mindforge:executor': ['developer', 'test-automator'],
-      'did:mindforge:reviewer': ['security-auditor', 'compliance-checker'],
-      'did:mindforge:researcher': ['knowledge-detective'],
-      'did:mindforge:tool': ['system-operator']
-    };
-  }
-
-  /**
-   * Gets the roles assigned to a specific agent DID.
-   * @param {string} did 
-   */
-  getRoles(did) {
-    const roles = this.loadRoles();
-    // Return explicit roles OR default roles based on persona-matched DIDs
-    const explicit = roles[did];
-    if (explicit) return explicit;
-
-    // Default mapping (regex for persona-based DIDs)
-    for (const [pattern, defaultRoles] of Object.entries(this.defaultRoles)) {
-      if (did.includes(pattern)) return defaultRoles;
-    }
-
-    return ['guest-agent'];
-  }
-
-  /**
-   * [HARDEN] Dynamically binds roles based on ZTAI trust tiers if no explicit role exists.
-   * Ensures high-trust agents automatically get architect-level visibility.
-   */
-  async getRolesByTier(did) {
-    const manager = new ztai();
-    const identity = await manager.getIdentity();
-    const explicit = this.getRoles(did);
-
-    if (identity.tier >= 3) {
-      return [...new Set([...explicit, 'lead-architect'])];
-    }
-    if (identity.tier >= 2) {
-      return [...new Set([...explicit, 'developer'])];
-    }
-    return explicit;
-  }
-
-  loadRoles() {
-    if (!fs.existsSync(this.rolesPath)) return {};
-    try {
-      return JSON.parse(fs.readFileSync(this.rolesPath, 'utf8'));
-    } catch {
-      return {};
-    }
-  }
-
-  /**
-   * Assigns a role to an agent.
-   */
-  assignRole(did, roles) {
-    const current = this.loadRoles();
-    current[did] = Array.isArray(roles) ? roles : [roles];
-    fs.writeFileSync(this.rolesPath, JSON.stringify(current, null, 2));
-    console.log(`[RBAC] Assigned roles [${roles}] to agent ${did}`);
-  }
-
-  /**
-   * Revokes all roles for an agent.
-   */
-  revokeRoles(did) {
-    const current = this.loadRoles();
-    delete current[did];
-    fs.writeFileSync(this.rolesPath, JSON.stringify(current, null, 2));
-  }
-
-  /**
-   * Checks if an agent has a specific permission based on their roles.
-   * @param {string} did 
-   * @param {string} permission 
-   */
-  hasPermission(did, permission) {
-    const roles = this.getRoles(did);
-    const PERMISSION_MAP = {
-      'lead-architect': ['write_architecture', 'approve_adr', 'global_sync_push'],
-      'developer':      ['write_src', 'read_src', 'execute_tests'],
-      'security-auditor': ['read_security', 'write_audit_log', 'block_execution'],
-      'system-operator': ['write_bin', 'modify_infrastructure'],
-      'guest-agent':     ['read_src']
-    };
-
-    for (const role of roles) {
-      if (PERMISSION_MAP[role]?.includes(permission)) return true;
-    }
-    return false;
-  }
-}
-
-module.exports = RBACManager;