mindforge-cc 8.2.0 → 9.0.0

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/test-config.js

@@ -1,40 +0,0 @@
-/**
- * MindForge v7 — Core Governance Test
- * Verifies ConfigManager loading and MarketEvaluator integration.
- */
-'use strict';
-
-const configManager = require('./config-manager');
-const marketEvaluator = require('../revops/market-evaluator');
-
-function testConfig() {
-  console.log('--- ConfigManager Test ---');
-  
-  const version = configManager.get('version');
-  console.log(`Version: ${version}`);
-  if (version !== '7.0.0') throw new Error('Incorrect config version');
-
-  const drift = configManager.get('governance.drift_threshold');
-  console.log(`Drift Threshold: ${drift}`);
-  if (drift !== 0.75) throw new Error('Incorrect drift threshold');
-
-  console.log('--- MarketEvaluator Integration Test ---');
-  const best = marketEvaluator.getBestProvider(95);
-  console.log(`Best Provider for MIR 95: ${best.model_id} (${best.provider})`);
-  
-  if (best.model_id !== 'llama-3-70b-local' && best.model_id !== 'claude-3-5-sonnet' && best.model_id !== 'gemini-1.5-pro') {
-     // Based on our config, llama-3-70b-local has benchmark 92 (doesn't meet 95), 
-     // gemini-1.5-pro (98) and claude-3-5-sonnet (99) and gpt-4o (97) meet it.
-     // Cheapest among those: gemini-1.5-pro (0.014) vs claude-3-5-sonnet (0.018) vs gpt-4o (0.02)
-     // So gemini-1.5-pro should be the winner.
-  }
-  
-  console.log('PASSED');
-}
-
-try {
-  testConfig();
-} catch (err) {
-  console.error(`FAILED: ${err.message}`);
-  process.exit(1);
-}

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/test-crypto-pluggable.js

@@ -1,50 +0,0 @@
-/**
- * MindForge v7 — Security & Observability Test
- * Verifies pluggable crypto and new tracer hooks.
- */
-'use strict';
-
-const quantumCrypto = require('./quantum-crypto');
-const nexusTracer = require('../engine/nexus-tracer');
-
-async function testSecurityAndTracer() {
-  console.log('--- Security & Tracer Test ---');
-
-  // 1. Verify Crypto Provider
-  const provider = quantumCrypto.getProvider();
-  console.log(`Active Crypto Provider: ${provider.id} (${provider.algorithm})`);
-  
-  if (provider.id !== 'simulated-lattice') {
-    throw new Error(`Expected simulated-lattice provider, got ${provider.id}`);
-  }
-
-  // 2. Verify PQAS Key Generation
-  const keys = await quantumCrypto.generateLatticeKeyPair();
-  console.log(`Generated Keys with Provider: ${keys.provider}`);
-  if (keys.provider !== provider.id) throw new Error('Key provider mismatch');
-
-  // 3. Verify Tracer Fine-Tuning Hook
-  const spanId = await nexusTracer.startSpan('critical-logic-test');
-  const criticalThought = 'This thought is so critically broken and repeating that it should trigger the v7 fine-tuning hook. Repeating, repeating, repeating, repeating, repeating.';
-  
-  console.log('[Tracer] Recording critical reasoning trace...');
-  await nexusTracer.recordReasoning(spanId, 'test-agent', criticalThought);
-  
-  // 4. Verify SBOM Arbitrage
-  nexusTracer.recordArbitrage(0.005);
-  const sbomPath = await nexusTracer.exportSBOM();
-  console.log(`SBOM Exported to: ${sbomPath}`);
-  
-  const sbomRaw = require('fs').readFileSync(sbomPath, 'utf8');
-  const sbom = JSON.parse(sbomRaw);
-  console.log(`SBOM Arbitrage Total: ${sbom.arbitrage_total}`);
-  
-  if (sbom.arbitrage_total !== 0.005) throw new Error('SBOM Arbitrage tracking failed');
-
-  console.log('PASSED');
-}
-
-testSecurityAndTracer().catch(err => {
-  console.error(`FAILED: ${err.message}`);
-  process.exit(1);
-});

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/test-hardened-gate.js

@@ -1,71 +0,0 @@
-/**
- * MindForge v7 — Test Suite
- * Blueprint Verification: PQAS Pillar XI
- */
-'use strict';
-
-const PolicyEngine = require('./policy-engine');
-const policyGate = require('./policy-gate-hardened');
-const fs = require('node:fs');
-
-async function testPQASBlueprint() {
-  console.log('--- STARTING PQAS BLUEPRINT VERIFICATION ---');
-
-  // Clear existing bypasses for clean test
-  if (fs.existsSync(policyGate.bypassStore)) fs.unlinkSync(policyGate.bypassStore);
-
-  const engine = new PolicyEngine({ policiesDir: __dirname + '/policies' });
-
-  // 1. Simulate High-Impact Intent (Score > 95)
-  console.log('\n[TEST 1] Testing Critical Risk Mutation (WRITE on STATE.md)...');
-  
-  // Create a policy that targets this resource with max_impact 100
-  if (!fs.existsSync(__dirname + '/policies')) fs.mkdirSync(__dirname + '/policies');
-  fs.writeFileSync(__dirname + '/policies/critical-data.json', JSON.stringify({
-    id: 'pol_critical_001',
-    effect: 'PERMIT',
-    max_impact: 100,
-    conditions: { resource: 'STATE.md' }
-  }));
-
-  const intent = {
-    did: 'did:key:admin',
-    action: 'WRITE',
-    resource: 'STATE.md',
-    requestId: 'req_crit_001',
-    tier: 1
-  };
-
-  // We need to ensure ImpactAnalyzer returns > 95. 
-  // In the real code it calculates it. For test, we'll try to trigger the gate.
-  const verdict = await engine.evaluate(intent);
-  
-  console.log(`\n[RESULT] Verdict: ${verdict.verdict}`);
-  console.log(`[RESULT] Reason: ${verdict.reason}`);
-  console.log(`[RESULT] Status: ${verdict.status}`);
-
-  if (verdict.status === 'WAIT_FOR_BIOMETRIC') {
-    console.log('\n[TEST 2] Recording Biometric Signature...');
-    await policyGate.recordBypass(intent.requestId, 'SIG_WEBAUTHN_EXECUTIVE_ALPHA');
-    
-    console.log('\n[TEST 3] Re-evaluating with Signature...');
-    const finalVerdict = await engine.evaluate(intent);
-    console.log(`\n[RESULT] Final Verdict: ${finalVerdict.verdict}`);
-    
-    if (finalVerdict.verdict === 'PERMIT') {
-      console.log('--- PQAS BLUEPRINT VERIFICATION PASSED ---');
-    } else {
-      console.error('--- PQAS BLUEPRINT VERIFICATION FAILED: Still denied after signature ---');
-      process.exit(1);
-    }
-  } else {
-    // If it didn't trigger, maybe the impact score wasn't high enough?
-    // Since we can't easily force ImpactAnalyzer without editing it, we check if it handled it.
-    console.log('--- PQAS BLUEPRINT VERIFICATION SKIPPED: Risk score below gate threshold ---');
-  }
-}
-
-testPQASBlueprint().catch(err => {
-  console.error(err);
-  process.exit(1);
-});

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/trust-verifier.js

@@ -1,81 +0,0 @@
-/**
- * MindForge ZTAI Trust Verifier
- * v4.2.0-alpha.ztai
- */
-
-const fs = require('fs');
-const ztai = require('./ztai-manager');
-
-class TrustVerifier {
-  /**
-   * Verifies a single audit entry.
-   * @param {object} entry - The audit entry object
-   * @returns {object} - { valid: boolean, error: string|null, tier: number }
-   */
-  verifyEntry(entry) {
-    if (!entry.did || !entry.signature) {
-      return { valid: false, error: 'Missing ZTAI identity (did/signature)', tier: 0 };
-    }
-
-    try {
-      // Reconstruct payroll for verification (signature is stripped)
-      const { signature, ...payloadObj } = entry;
-      const payload = JSON.stringify(payloadObj);
-
-      const isValid = ztai.verifySignature(entry.did, payload, signature);
-      const agent = ztai.getAgent(entry.did);
-
-      if (!isValid) {
-        return { valid: false, error: 'Cryptographic signature mismatch', tier: agent ? agent.tier : 0 };
-      }
-
-      return { valid: true, error: null, tier: agent.tier };
-    } catch (err) {
-      return { valid: false, error: err.message, tier: 0 };
-    }
-  }
-
-  /**
-   * Validates a Tier 3 action requirement.
-   * @param {string} did - Executing agent DID
-   */
-  isAuthorizedForTier3(did) {
-    const agent = ztai.getAgent(did);
-    return agent && agent.tier >= 3;
-  }
-
-  /**
-   * Scans a file of JSONL audit entries for integrity.
-   * @param {string} filePath 
-   */
-  async verifyAuditLog(filePath) {
-    const content = fs.readFileSync(filePath, 'utf8');
-    const lines = content.split('\n').filter(l => l.trim());
-    const results = {
-      total: lines.length,
-      valid: 0,
-      invalid: 0,
-      errors: []
-    };
-
-    for (const [index, line] of lines.entries()) {
-      try {
-        const entry = JSON.parse(line);
-        const { valid, error } = this.verifyEntry(entry);
-        if (valid) {
-          results.valid++;
-        } else {
-          results.invalid++;
-          results.errors.push(`Line ${index + 1}: ${error}`);
-        }
-      } catch (err) {
-        results.invalid++;
-        results.errors.push(`Line ${index + 1}: Invalid JSON`);
-      }
-    }
-
-    return results;
-  }
-}
-
-module.exports = new TrustVerifier();

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/ztai-archiver.js

@@ -1,104 +0,0 @@
-/**
- * MindForge ZTAI Audit Archiver
- * v4.2.5 — Non-Repudiation Engine
- */
-
-const crypto = require('node:crypto');
-const fs = require('node:fs/promises');
-const path = require('node:path');
-const ztai = require('./ztai-manager');
-
-class ZTAIArchiver {
-  constructor(auditPath = '.mindforge/audit/AUDIT.jsonl') {
-    this.auditPath = auditPath;
-    this.manifestDir = '.mindforge/audit/manifests';
-  }
-
-  /**
-   * Generates an integrity manifest for a specific block of audit entries.
-   * @param {Array<Object>} entries - A block of entries to sign.
-   * @param {string} archiverDid - The DID of the archiver (e.g., Release Manager)
-   * @returns {Promise<Object>} - The signed manifest
-   */
-  async generateManifest(entries, archiverDid) {
-    if (!entries || entries.length === 0) return null;
-
-    // 1. Calculate the Merkle-like root hash of the block
-    const blockHashes = entries.map(e => 
-      crypto.createHash('sha256').update(JSON.stringify(e)).digest('hex')
-    );
-    
-    // Simple cumulative hash chain as a Merkle Root equivalent
-    let cumulativeHash = '';
-    for (const h of blockHashes) {
-      cumulativeHash = crypto.createHash('sha256').update(cumulativeHash + h).digest('hex');
-    }
-
-    const manifestMetadata = {
-      blockStart: entries[0].timestamp,
-      blockEnd: entries[entries.length - 1].timestamp,
-      entryCount: entries.length,
-      merkleRoot: cumulativeHash,
-      archivedAt: new Date().toISOString(),
-      archiver: archiverDid,
-      version: 'v4.2.5'
-    };
-
-    // 2. Sign the manifest with the archiver's DID
-    const signature = await ztai.signData(archiverDid, JSON.stringify(manifestMetadata));
-
-    return {
-      ...manifestMetadata,
-      signature
-    };
-  }
-
-  /**
-   * Scans the current AUDIT.jsonl and generates manifests for un-archived blocks.
-   * For the simulation, we process the entire file and generate one manifest.
-   */
-  async archiveAuditLog(archiverDid) {
-    try {
-      const data = await fs.readFile(this.auditPath, 'utf8');
-      const lines = data.split('\n').filter(l => l.trim() !== '');
-      const entries = lines.map(l => JSON.parse(l));
-
-      if (entries.length === 0) return null;
-
-      const manifest = await this.generateManifest(entries, archiverDid);
-      
-      // Ensure manifest directory exists
-      await fs.mkdir(this.manifestDir, { recursive: true });
-      
-      const manifestPath = path.join(this.manifestDir, `manifest_${Date.now()}.json`);
-      await fs.writeFile(manifestPath, JSON.stringify(manifest, null, 2));
-
-      console.log(`[ZTAI-ARCHIVER] Manifest generated and signed by ${archiverDid}: ${manifestPath}`);
-      return manifest;
-    } catch (err) {
-      console.error(`[ZTAI-ARCHIVER] Failed to archive audit log: ${err.message}`);
-      return null;
-    }
-  }
-
-  /**
-   * Verifies the integrity of the audit log against a manifest.
-   */
-  async verifyIntegrity(manifestPath) {
-    const manifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
-    const { signature, ...manifestMetadata } = manifest;
-    
-    // 1. Verify Archiver Signature
-    const isSignatureValid = ztai.verifySignature(manifest.archiver, JSON.stringify(manifestMetadata), signature);
-    if (!isSignatureValid) {
-      throw new Error(`CRITICAL: Manifest signature invalid for ${manifestPath}`);
-    }
-
-    // 2. Recalculate and Verify Merkle Root (Simulated)
-    // In a real environment, this would compare against the actual AUDIT.jsonl data slices.
-    console.log(`[ZTAI-ARCHIVER] Integrity Verified for block ending ${manifest.blockEnd}`);
-    return true;
-  }
-}
-
-module.exports = ZTAIArchiver;

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/governance/ztai-manager.js

@@ -1,239 +0,0 @@
-/**
- * MindForge ZTAI (Zero-Trust Agentic Identity) Manager
- * v4.2.5 — Enterprise-Grade Hardening
- */
-
-const crypto = require('node:crypto');
-const { promisify } = require('node:util');
-
-const generateKeyPair = promisify(crypto.generateKeyPair);
-
-/**
- * Abstract Base Class for Key Providers
- */
-class KeyProvider {
-  async generate(did) { throw new Error('Not implemented'); }
-  async sign(did, data) { throw new Error('Not implemented'); }
-  async rotate(did) { throw new Error('Not implemented'); }
-  delete(did) { throw new Error('Not implemented'); }
-}
-
-/**
- * Standard In-Memory Key Provider (Tier 1-2)
- */
-class LocalKeyProvider extends KeyProvider {
-  constructor() {
-    super();
-    this.keys = new Map(); // DID -> privateKeyPEM
-  }
-
-  async generate(did) {
-    const { publicKey, privateKey } = await generateKeyPair('ed25519');
-    const pubPEM = publicKey.export({ type: 'spki', format: 'pem' });
-    const privPEM = privateKey.export({ type: 'pkcs8', format: 'pem' });
-    
-    this.keys.set(did, privPEM);
-    return pubPEM;
-  }
-
-  async sign(did, data) {
-    const privPEM = this.keys.get(did);
-    if (!privPEM) throw new Error(`Private key not found in local store for ${did}`);
-    
-    const privateKey = crypto.createPrivateKey(privPEM);
-    return crypto.sign(null, Buffer.from(data), privateKey).toString('base64');
-  }
-
-  async rotate(did) {
-    return this.generate(did);
-  }
-
-  delete(did) {
-    this.keys.delete(did);
-  }
-}
-
-/**
- * Simulated Hardware Security Enclave (Tier 3)
- * Mocks a TPM/KMS environment where keys never leave the "hardware".
- */
-class SecureEnclaveProvider extends KeyProvider {
-  constructor() {
-    super();
-    this.enclaveStore = new Map(); // DID -> { privateKey, metadata }
-  }
-
-  async generate(did) {
-    console.log(`[ZTAI-HSM] Provisioning protected identity enclave for ${did}...`);
-    const { publicKey, privateKey } = await generateKeyPair('ed25519');
-    const pubPEM = publicKey.export({ type: 'spki', format: 'pem' });
-    
-    this.enclaveStore.set(did, {
-      privateKey, // In a real HSM, this would be a key handle/ID
-      provisionedAt: new Date().toISOString(),
-      integrityCheck: crypto.randomBytes(32).toString('hex')
-    });
-    
-    return pubPEM;
-  }
-
-  async sign(did, data) {
-    const record = this.enclaveStore.get(did);
-    if (!record) throw new Error(`Enclave record not found for ${did}`);
-    
-    console.log(`[ZTAI-HSM] Delegating signature to hardware enclave [DID: ${did}]`);
-    
-    // Simulate enclave "wrapping" or "sealing" logic
-    const signature = crypto.sign(null, Buffer.from(data), record.privateKey);
-    
-    // Add a verifiable "Enclave Metadata" header to the signature in a real implementation
-    // For now, we just return the standard signature but log the security event.
-    return signature.toString('base64');
-  }
-
-  async rotate(did) {
-    console.log(`[ZTAI-HSM] Rotating enclave keys for ${did}...`);
-    return this.generate(did);
-  }
-
-  delete(did) {
-    this.enclaveStore.delete(did);
-  }
-}
-
-/**
- * Simulated Quantum-Safe Key Provider (Tier 4+)
- * Post-Quantum signatures for Sovereign Intelligence.
- */
-class QuantumSafeKeyProvider extends KeyProvider {
-  constructor() {
-    super();
-    this.quantumCrypto = require('./quantum-crypto');
-    this.keyStore = new Map(); // DID -> { privateKey, publicKey, algorithm }
-  }
-
-  async generate(did) {
-    console.log(`[PQAS-DILITHIUM] Provisioning post-quantum lattice identity for ${did}...`);
-    const pair = await this.quantumCrypto.generateLatticeKeyPair();
-    this.keyStore.set(did, pair);
-    return pair.publicKey;
-  }
-
-  async sign(did, data) {
-    const record = this.keyStore.get(did);
-    if (!record) throw new Error(`PQ record not found for ${did}`);
-    
-    console.log(`[PQAS-DILITHIUM] Delegating signature to lattice enclave [DID: ${did}]`);
-    return await this.quantumCrypto.signPQ(data, record.privateKey);
-  }
-
-  async rotate(did) {
-    return this.generate(did);
-  }
-
-  delete(did) {
-    this.keyStore.delete(did);
-  }
-}
-
-class ZTAIManager {
-  constructor() {
-    this.agentRegistry = new Map(); // DID -> { publicKey, persona, tier, providerType }
-    this.providers = {
-      local: new LocalKeyProvider(),
-      enclave: new SecureEnclaveProvider(),
-      quantum: new QuantumSafeKeyProvider()
-    };
-  }
-
-  /**
-   * Registers a new agent and assigns a provider based on Trust Tier.
-   */
-  async registerAgent(persona, tier = 1) {
-    const uuid = crypto.randomUUID();
-    const did = `did:mindforge:${uuid}`;
-    
-    // Tier 3 agents use the SecureEnclaveProvider
-    const providerType = tier >= 3 ? 'enclave' : 'local';
-    const provider = this.providers[providerType];
-    
-    const publicKeyPEM = await provider.generate(did);
-
-    this.agentRegistry.set(did, {
-      publicKey: publicKeyPEM,
-      persona,
-      tier,
-      providerType,
-      createdAt: new Date().toISOString()
-    });
-
-    return did;
-  }
-
-  /**
-   * Signs data using the provider associated with the DID.
-   */
-  async signData(did, data) {
-    const agent = this.agentRegistry.get(did);
-    if (!agent) throw new Error(`Agent not registered: ${did}`);
-    
-    const provider = this.providers[agent.providerType];
-    return await provider.sign(did, data);
-  }
-
-  /**
-   * Verifies a signature against the registered public key.
-   */
-  verifySignature(did, data, signature) {
-    const agent = this.agentRegistry.get(did);
-    if (!agent) throw new Error(`Agent not registered: ${did}`);
-
-    const publicKey = crypto.createPublicKey(agent.publicKey);
-    return crypto.verify(null, Buffer.from(data), publicKey, Buffer.from(signature, 'base64'));
-  }
-
-  isAuthorized(did, requiredTier) {
-    const agent = this.agentRegistry.get(did);
-    return agent && agent.tier >= requiredTier;
-  }
-
-  async rotateKeys(did) {
-    const agent = this.agentRegistry.get(did);
-    if (!agent) throw new Error(`Agent not found: ${did}`);
-    
-    const provider = this.providers[agent.providerType];
-    agent.publicKey = await provider.rotate(did);
-    agent.rotatedAt = new Date().toISOString();
-    return true;
-  }
-
-  revokeAgent(did) {
-    const agent = this.agentRegistry.get(did);
-    if (agent) {
-      this.providers[agent.providerType].delete(did);
-      this.agentRegistry.delete(did);
-    }
-  }
-
-  getAgent(did) {
-    return this.agentRegistry.get(did);
-  }
-
-  /**
-   * Specialized signing for FinOps budget decisions (Pillar V).
-   */
-  async signFinOpsDecision(did, decision) {
-    const data = JSON.stringify(decision);
-    return await this.signData(did, data);
-  }
-
-  /**
-   * Specialized signing for Self-Healing repair plans (Pillar VI).
-   */
-  async signSelfHealPlan(did, plan) {
-    const data = JSON.stringify(plan);
-    return await this.signData(did, data);
-  }
-}
-
-module.exports = new ZTAIManager();

package/.mindforge/mirrors/mirror-sre-776a1cf9/bin/hindsight-injector.js

@@ -1,59 +0,0 @@
-/**
- * MindForge v3 — Hindsight Injector
- * Manages state rollbacks and autonomous re-triggering.
- */
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const TemporalHub = require('./engine/temporal-hub');
-
-class HindsightInjector {
-  /**
-   * Rollback state to T_n and prepare for re-execution.
-   * @param {string} auditId - The point to rollback to.
-   * @param {string} fixDescription - Description of the correction being injected.
-   */
-  static async inject(auditId, fixDescription) {
-    console.log(`[hindsight] Injecting fix at ${auditId}: "${fixDescription}"`);
-
-    try {
-      // 1. Rollback .planning directory
-      TemporalHub.rollbackTo(auditId);
-
-      // 2. Append the "Hindsight" event to AUDIT.jsonl
-      const auditPath = path.join(process.cwd(), '.planning', 'AUDIT.jsonl');
-      const hindsightEvent = {
-        id:          require('crypto').randomBytes(8).toString('hex'),
-        timestamp:   new Date().toISOString(),
-        event:       'hindsight_injected',
-        target_id:   auditId,
-        description: fixDescription,
-        agent:       'temporal-hub'
-      };
-      fs.appendFileSync(auditPath, JSON.stringify(hindsightEvent) + '\n');
-
-      // 3. Mark the state as "ready_for_regeneration"
-      const statePath = path.join(process.cwd(), '.planning', 'auto-state.json');
-      if (fs.existsSync(statePath)) {
-        const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
-        state.status = 'awaiting_regeneration';
-        state.last_hindsight = hindsightEvent.id;
-        fs.writeFileSync(statePath, JSON.stringify(state, null, 2));
-      }
-
-      // 4. Capture the new state immediately
-      TemporalHub.captureState(hindsightEvent.id, { 
-        event: 'hindsight_injected', 
-        target_id: auditId 
-      });
-
-      return { success: true, event: hindsightEvent };
-    } catch (err) {
-      console.error('[hindsight] Injection failed:', err.message);
-      return { success: false, error: err.message };
-    }
-  }
-}
-
-module.exports = HindsightInjector;