mindforge-cc 9.0.0 → 10.0.0

package/.mindforge/monorepo/dependency-graph-builder.md

@@ -1,32 +0,0 @@
-# MindForge — Dependency Graph Builder
-
-## Purpose
-Build a dependency graph of packages in a monorepo to support topological
-ordering and affected package detection.
-
-## Input
-- `.planning/WORKSPACE-MANIFEST.json`
-- Each package's `package.json` dependencies
-
-## Output
-A directed graph where nodes are packages and edges represent internal
-package dependencies.
-
-Example:
-```
-@myapp/shared → @myapp/api
-@myapp/shared → @myapp/web
-@myapp/api    → @myapp/web
-```
-
-## Steps
-
-1. Load `WORKSPACE-MANIFEST.json`.
-2. For each package, read `dependencies` and `devDependencies`.
-3. Filter dependencies to only those that match workspace package names.
-4. Build adjacency list and compute topological order.
-5. Write to `.planning/WORKSPACE-MANIFEST.json` as `dependency_order`.
-
-## Failure modes
-- Cycles detected: stop, report cycle path, require manual resolution.
-- Missing package metadata: warn and skip.

package/.mindforge/monorepo/workspace-detector.md

@@ -1,129 +0,0 @@
-# MindForge — Monorepo Workspace Detector
-
-## Purpose
-Detect and understand monorepo structures (npm workspaces, pnpm workspaces,
-Nx, Turborepo, Lerna) so MindForge can plan and execute phases across
-multiple packages correctly.
-
-## Supported monorepo types
-
-| Type | Detection file | Package locations |
-|---|---|---|
-| npm workspaces | `package.json` with `"workspaces":` | Defined in workspaces array |
-| pnpm workspaces | `pnpm-workspace.yaml` | Defined in packages array |
-| Nx | `nx.json` | `apps/` and `libs/` |
-| Turborepo | `turbo.json` | `apps/` and `packages/` |
-| Lerna | `lerna.json` | Defined in packages array |
-| Yarn workspaces | `package.json` with `"workspaces":` | Same as npm |
-
-## Detection protocol
-
-```bash
-detect_workspace_type() {
-  local ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-
-  # Check in priority order
-  if [ -f "${ROOT}/nx.json" ]; then
-    echo "nx"
-  elif [ -f "${ROOT}/turbo.json" ]; then
-    echo "turborepo"
-  elif [ -f "${ROOT}/lerna.json" ]; then
-    echo "lerna"
-  elif [ -f "${ROOT}/pnpm-workspace.yaml" ]; then
-    echo "pnpm"
-  elif node -e "
-    const p = require('./package.json');
-    process.exit(p.workspaces ? 0 : 1)
-  " 2>/dev/null; then
-    echo "npm-workspaces"
-  else
-    echo "none"
-  fi
-}
-
-list_packages() {
-  local TYPE="$1"
-  case "${TYPE}" in
-    nx)
-      find apps/ libs/ -name "package.json" -not -path "*/node_modules/*" \
-        -exec dirname {} \; 2>/dev/null | sort
-      ;;
-    turborepo)
-      find apps/ packages/ -name "package.json" -not -path "*/node_modules/*" \
-        -exec dirname {} \; 2>/dev/null | sort
-      ;;
-    pnpm)
-      cat pnpm-workspace.yaml | grep "^  -" | sed "s/  - '//;s/'$//"
-      ;;
-    npm-workspaces|lerna)
-      node -e "
-        const p = require('./package.json');
-        const ws = p.workspaces || require('./lerna.json').packages || [];
-        ws.forEach(w => console.log(w.replace(/\/\*$/, '')));
-      " 2>/dev/null
-      ;;
-  esac
-}
-```
-
-## Package metadata extraction
-
-For each detected package, extract:
-```javascript
-{
-  "name": "package name from package.json",
-  "path": "relative path from monorepo root",
-  "type": "app | lib | shared | api | web | cli",
-  "dependencies": ["list of internal package dependencies"],
-  "scripts": {
-    "build": "build command",
-    "test": "test command",
-    "lint": "lint command"
-  },
-  "mindforge": {
-    "phase-scope": "global | package-specific",
-    "test-command": "override test command if needed",
-    "affected-by": ["list of packages that affect this one"]
-  }
-}
-```
-
-## Workspace manifest
-
-Write to `.planning/WORKSPACE-MANIFEST.json`:
-
-```json
-{
-  "schema_version": "1.0.0",
-  "workspace_type": "turborepo",
-  "root": "/path/to/project",
-  "packages": [
-    {
-      "name": "@myapp/api",
-      "path": "apps/api",
-      "type": "api",
-      "dependencies": ["@myapp/shared"],
-      "test_command": "npm test",
-      "build_command": "npm run build"
-    },
-    {
-      "name": "@myapp/web",
-      "path": "apps/web",
-      "type": "web",
-      "dependencies": ["@myapp/shared", "@myapp/ui"],
-      "test_command": "npm test",
-      "build_command": "npm run build"
-    },
-    {
-      "name": "@myapp/shared",
-      "path": "packages/shared",
-      "type": "lib",
-      "dependencies": [],
-      "test_command": "npm test",
-      "build_command": "npm run build"
-    }
-  ],
-  "dependency_order": ["@myapp/shared", "@myapp/api", "@myapp/web"],
-  "affected_packages": {}
-}
-```

package/.mindforge/org/CONVENTIONS.md

@@ -1,62 +0,0 @@
-# Coding Conventions — [ORG NAME]
-
-<!-- These conventions are loaded by every MindForge agent session -->
-<!-- Agents follow these exactly — be precise -->
-
-## Naming conventions
-| Element          | Convention      | Example                        |
-|------------------|-----------------|--------------------------------|
-| Variables        | camelCase        | `userProfile`                  |
-| Functions        | camelCase        | `getUserById`                  |
-| Classes          | PascalCase       | `UserService`                  |
-| Constants        | SCREAMING_SNAKE  | `MAX_LOGIN_ATTEMPTS`           |
-| File names       | kebab-case       | `user-service.ts`              |
-| DB tables        | snake_case plural| `user_profiles`                |
-| DB columns       | snake_case       | `created_at`                   |
-| API endpoints    | kebab-case       | `/user-profiles/{id}`          |
-| Env variables    | SCREAMING_SNAKE  | `DATABASE_URL`                 |
-
-## File structure
-```
-src/
-  features/          ← Feature-based organisation
-    auth/
-      auth.controller.ts
-      auth.service.ts
-      auth.repository.ts
-      auth.types.ts
-      auth.test.ts
-  shared/            ← Shared utilities and types
-  config/            ← Configuration and env validation
-```
-
-## Import order (enforced by linter)
-1. Node.js built-ins
-2. External packages
-3. Internal absolute imports
-4. Internal relative imports
-(Blank line between each group)
-
-## Commit message format (Conventional Commits)
-```
-type(scope): short description
-
-[optional body]
-
-[optional footer: BREAKING CHANGE or closes #issue]
-```
-Types: feat, fix, chore, docs, test, refactor, perf, security, build, ci
-
-## Forbidden patterns
-<!-- Agents will refuse to write code that contains these -->
-- No `var` — use `const` or `let`
-- No `any` type in TypeScript without a comment explaining why
-- No `as unknown as X` type casting without a comment
-- No default exports (use named exports)
-- No `console.log` in production code
-- No empty catch blocks
-- No direct database access from route handlers (use service layer)
-- No business logic in controllers/handlers (use service layer)
-- No hardcoded URLs — use config/environment variables
-- No synchronous file I/O in request handlers
-```

package/.mindforge/org/ORG.md

@@ -1,51 +0,0 @@
-# Organisation Context — [ORG NAME]
-
-<!-- Replace every [placeholder] with your organisation's actual values -->
-<!-- This file is loaded at the start of every MindForge session -->
-
-## Identity
-**Organisation:** [Your organisation name]
-**Mission:** [1-2 sentences: what you build and for whom]
-**Engineering team size:** [number]
-
-## Default tech stack
-| Layer          | Technology          | Version   | Notes                    |
-|----------------|---------------------|-----------|--------------------------|
-| Frontend       | [e.g. Next.js]      | [e.g. 14] | [why this choice]        |
-| Backend        | [e.g. FastAPI]      | [e.g. 0.111] |                       |
-| Database       | [e.g. PostgreSQL]   | [e.g. 16] |                          |
-| Cache          | [e.g. Redis]        | [e.g. 7]  |                          |
-| Infrastructure | [e.g. AWS]          | —         |                          |
-| CI/CD          | [e.g. GitHub Actions] | —       |                          |
-| Monitoring     | [e.g. Datadog]      | —         |                          |
-
-## Architecture defaults
-- API style: [REST / GraphQL / gRPC]
-- Auth: [e.g. JWT with refresh tokens via Supabase Auth]
-- ORM/DB access: [e.g. Prisma with PostgreSQL]
-- Testing framework: [e.g. Vitest + Testing Library]
-- Package manager: [npm / pnpm / yarn / uv]
-
-## Team conventions
-- Git branching: [e.g. Gitflow / trunk-based]
-- PR policy: [e.g. 2 approvals required, CI must pass before merge]
-- Code review: [e.g. Conventional Comments format]
-- Sprint length: [e.g. 2 weeks]
-- Definition of ready: [criteria for a story to enter a sprint]
-- Definition of done: [criteria for a story to be marked complete]
-
-## Enterprise tools
-- Issue tracker: [e.g. Jira — your-org.atlassian.net]
-- Wiki: [e.g. Confluence — your-org.atlassian.net/wiki]
-- Source control: [e.g. GitHub — github.com/your-org]
-- Messaging: [e.g. Slack — your-org.slack.com]
-- Secrets: [e.g. AWS Secrets Manager / HashiCorp Vault]
-
-## Compliance requirements
-<!-- Check all that apply -->
-- [ ] GDPR
-- [ ] HIPAA
-- [ ] SOC 2 Type II
-- [ ] PCI-DSS
-- [ ] ISO 27001
-- [ ] Other: [specify]

package/.mindforge/org/SECURITY.md

@@ -1,50 +0,0 @@
-# Security Policies — [ORG NAME]
-
-<!-- Loaded by MindForge Security Reviewer persona for every security-related task -->
-
-## Authentication standards
-- Passwords: bcrypt with cost factor ≥ 12, or argon2id
-- Tokens: cryptographically random, ≥ 32 bytes (use crypto.randomBytes)
-- JWT access tokens: 15-minute expiry maximum
-- JWT refresh tokens: 7-day expiry, stored in httpOnly, Secure, SameSite=Strict cookie
-- Session IDs: regenerate on any privilege change (login, role change)
-- MFA: required for all admin and privileged accounts
-
-## Authorisation standards
-- Deny by default — grant minimum required permissions
-- Verify permissions server-side on every request
-- Never trust client-sent role or permission claims
-- Log every authorisation failure: user ID, resource, timestamp, IP
-
-## Data protection
-- Encryption at rest: AES-256 for all PII and sensitive data
-- Encryption in transit: TLS 1.2 minimum, TLS 1.3 preferred
-- PII must never appear in application logs
-- Database backups encrypted at rest
-- Data retention policy: [specify your org's policy]
-
-## Secrets management
-- Zero secrets in source code — all via environment variables
-- All production secrets in [your secrets manager]
-- Rotate secrets immediately if exposure is suspected
-- Separate secrets per environment (dev/staging/prod never share)
-
-## Dependency policy
-- Audit new dependencies before adding: CVE check, licence check, maintenance status
-- `npm audit --audit-level=high` must pass in CI before merge
-- No packages with > 6 months without a commit (unless frozen intentionally)
-- Approved licences: MIT, Apache-2.0, BSD-2/3-Clause, ISC
-- Forbidden licences: GPL (without explicit legal approval), AGPL, SSPL
-
-## Incident response
-- P0 (active breach): notify [security contact] immediately, rotate all credentials
-- P1 (critical vulnerability): patch within 24 hours
-- P2 (high vulnerability): patch within 7 days
-- All incidents: postmortem required within 5 business days
-
-## Code review security checklist
-Before approving any PR touching auth, payments, or PII:
-- [ ] OWASP Top 10 reviewed (see security-reviewer.md persona)
-- [ ] No secrets in diff
-- [ ] Input validation on all user-controlled data
-- [ ] New dependencies CVE-scanned

package/.mindforge/org/TOOLS.md

@@ -1,53 +0,0 @@
-# Approved Tools & Libraries — [ORG NAME]
-
-<!-- Reference for all agents when making dependency and tooling decisions -->
-
-## Approved libraries (use these — do not use alternatives without approval)
-
-### Authentication & security
-| Purpose              | Library              | Version  | Notes                    |
-|----------------------|----------------------|----------|--------------------------|
-| Password hashing     | bcrypt               | ^5.1     | Cost factor 12 minimum   |
-| JWT                  | jose                 | ^5.0     | NOT jsonwebtoken (CJS issues) |
-| Crypto               | Node.js built-in     | —        | No third-party for basics |
-
-### HTTP & API
-| Purpose              | Library              | Version  | Notes                    |
-|----------------------|----------------------|----------|--------------------------|
-| HTTP server          | [e.g. Fastify]       | [^4.0]   |                          |
-| Validation           | [e.g. Zod]           | [^3.0]   |                          |
-| HTTP client          | [e.g. ky]            | [^1.0]   | Not axios                |
-
-### Database
-| Purpose              | Library              | Version  | Notes                    |
-|----------------------|----------------------|----------|--------------------------|
-| ORM                  | [e.g. Prisma]        | [^5.0]   |                          |
-| Migrations           | [included in ORM]    | —        |                          |
-
-### Testing
-| Purpose              | Library              | Version  | Notes                    |
-|----------------------|----------------------|----------|
-| Test runner          | [e.g. Vitest]        | [^1.0]   |                          |
-| Mocking              | [e.g. vitest mock]   | —        | Built-in preferred       |
-| E2E                  | [e.g. Playwright]    | [^1.40]  |                          |
-
-## Forbidden libraries (never use these)
-| Library              | Reason                              | Use instead            |
-|----------------------|-------------------------------------|------------------------|
-| jsonwebtoken         | CommonJS, maintenance concerns      | jose                   |
-| moment               | Large bundle, deprecated            | date-fns or Temporal   |
-| lodash               | Unnecessary in modern JS/TS         | Native array methods   |
-| request              | Deprecated                          | ky or fetch            |
-| node-uuid            | Deprecated                          | crypto.randomUUID()    |
-
-## MCP servers (for MindForge integrations)
-| Service              | URL                                 | Purpose                |
-|----------------------|-------------------------------------|------------------------|
-| [e.g. Jira]          | [mcp url]                           | Issue tracking         |
-| [e.g. Confluence]    | [mcp url]                           | Wiki                   |
-
-## CI/CD tool versions
-| Tool                 | Version  | Config file          |
-|----------------------|----------|----------------------|
-| Node.js              | 20 LTS   | .nvmrc               |
-| [package manager]    | [ver]    |                      |

package/.mindforge/org/integrations/INTEGRATIONS-CONFIG.md

@@ -1,58 +0,0 @@
-# MindForge Integrations Configuration
-# IMPORTANT: Never store API tokens, passwords, or private keys in this file.
-# Credentials belong in environment variables or a managed secrets service.
-
-## Jira Configuration
-JIRA_BASE_URL=https://your-org.atlassian.net
-JIRA_PROJECT_KEY=ENG
-JIRA_EPIC_LABEL=mindforge-phase
-JIRA_STORY_TYPE=Story
-JIRA_BUG_TYPE=Bug
-JIRA_STORY_POINTS_FIELD=story_points
-
-## Confluence Configuration
-CONFLUENCE_BASE_URL=https://your-org.atlassian.net/wiki
-CONFLUENCE_SPACE_KEY=ENG
-CONFLUENCE_ARCHITECTURE_PAGE_TITLE=MindForge Architecture
-CONFLUENCE_ADR_PARENT_PAGE_TITLE=Architecture Decision Records
-CONFLUENCE_PHASE_DOCS_PARENT_PAGE_TITLE=Sprint Documentation
-CONFLUENCE_AUTO_PUBLISH=false
-
-## Slack Configuration
-SLACK_CHANNEL_ID=C01234ABCDE
-SLACK_NOTIFY_ON=phase_complete,security_finding,approval_needed,blocker
-SLACK_MENTION_ON_CRITICAL=@oncall
-SLACK_USE_THREADS=true
-
-## Governance Configuration
-TIER2_APPROVERS=senior-engineer-1,senior-engineer-2,tech-lead
-TIER3_APPROVERS=security-officer,compliance-officer,cto
-EMERGENCY_APPROVERS=cto,vp-engineering
-TIER2_SLA_HOURS=24
-TIER3_SLA_HOURS=4
-TIER2_ESCALATE_AFTER_HOURS=48
-TIER3_ESCALATE_AFTER_HOURS=8
-TIER2_EXPIRY_HOURS=48
-TIER3_EXPIRY_HOURS=8
-ESCALATION_CONTACT=engineering-lead@your-org.com
-ESCALATION_SLACK_CHANNEL=C0ESCALATE
-
-## GitHub Configuration
-GITHUB_REPO=your-org/your-repo
-GITHUB_DEFAULT_BRANCH=main
-GITHUB_REQUIRED_REVIEWERS=2
-GITHUB_DEFAULT_REVIEWERS=senior-engineer-1,senior-engineer-2
-GITHUB_PR_TEMPLATE_PATH=.github/pull_request_template.md
-GITHUB_DRAFT_BY_DEFAULT=false
-
-## GitLab Configuration
-GITLAB_PROJECT_ID=
-GITLAB_DEFAULT_BRANCH=main
-GITLAB_DEFAULT_REVIEWERS=
-
-## Notification Preferences
-NOTIFY_PHASE_COMPLETE=true
-NOTIFY_SECURITY_CRITICAL=true
-NOTIFY_APPROVAL_NEEDED=true
-NOTIFY_MILESTONE_COMPLETE=true
-NOTIFY_BLOCKER_ADDED=true

package/.mindforge/org/skills/MANIFEST.md

@@ -1,15 +0,0 @@
-# MindForge Skills Manifest
-
-This file tracks all active, validated, and legacy skills within the MindForge ecosystem.
-
-## Core Multi-Agent Skills
-- [x] agency-agents-orchestrator (Tier 1)
-- [x] agency-senior-developer (Tier 1)
-- [x] agency-software-architect (Tier 1)
-
-## Enterprise Governance
-- [x] sovereign-integrity-checker (v6.2.0)
-- [x] proactive-intent-harvester (v6.2.0)
-
-## Knowledge Base
-- [ ] project-specific-knowledge

package/.mindforge/plugins/PLUGINS-MANIFEST.md

@@ -1,23 +0,0 @@
-# MindForge Plugins Manifest
-# Schema version: 1.0.0
-# This file is managed by /mindforge:plugins install|uninstall
-
-## Installed plugins
-
-| Name | Version | Status | Min MindForge | Permissions |
-|---|---|---|---|---|
-| (no plugins installed) | | | | |
-
-## Available plugins (public registry)
-
-Search: `npm search mindforge-plugin`
-Install: `/mindforge:plugins install [plugin-name]`
-
-## Plugin development
-
-To create a plugin: see `docs/contributing/plugin-authoring.md`
-To publish:        `npm publish --access public`
-To validate:       `node bin/validate-config.js --type plugin ./plugin.json`
-
-## Hooks registry
-(populated automatically when plugins with hooks are installed)

package/.mindforge/plugins/plugin-loader.md

@@ -1,93 +0,0 @@
-# MindForge Plugin System — Loader Protocol
-
-## Loading sequence (runs at session start)
-
-### Step 1 — Discover installed plugins
-```bash
-MANIFEST=".mindforge/plugins/PLUGINS-MANIFEST.md"
-[ -f "${MANIFEST}" ] || { echo "No plugins installed"; return; }
-
-# Extract plugin names from manifest table rows
-PLUGINS=$(grep "^| " "${MANIFEST}" | grep -v "^| Name" | grep -v "none" | \
-  awk -F'|' '{gsub(/[[:space:]]/, "", $2); print $2}' | grep -v '^$')
-```
-
-### Step 2 — Validate each installed plugin
-
-For each installed plugin directory at `.mindforge/plugins/[plugin-name]/`:
-
-1. **plugin.json exists and is valid JSON**
-2. **plugin_api_version compatibility**: read `plugin.json mindforge.plugin_api_version`
-   and verify it matches the current supported API version (`1.0.0`)
-3. **min_mindforge_version compatibility**: verify current MindForge version satisfies minimum
-4. **Injection guard**: run against all command, skill, and persona `.md` files in the plugin
-   - If injection patterns found: do NOT load. Log AUDIT entry, alert user
-5. **Level 1 + Level 2 validation**: for every `SKILL.md` in the plugin
-
-**Permission model note:** permissions are advisory, not OS‑enforced. They are
-declared for user trust decisions and logged in `AUDIT.jsonl`. Governance gates
-still apply to all plugin actions.
-
-### Step 3 — Load plugin components
-
-**Commands:**
-```bash
-# Detect currently installed built-in command names (dynamic, not hardcoded)
-get_reserved_command_names() {
-  ls ".claude/commands/mindforge/"*.md 2>/dev/null | \
-    xargs -I{} basename {} .md | \
-    sort
-}
-
-RESERVED_NAMES=$(get_reserved_command_names)
-
-for CMD_FILE in ".mindforge/plugins/[plugin]/commands/"*.md; do
-  CMD_NAME=$(basename "${CMD_FILE}" .md)
-
-  # Check for conflict with reserved names
-  if echo "${RESERVED_NAMES}" | grep -q "^${CMD_NAME}$"; then
-    FINAL_NAME="${PLUGIN_NAME}-${CMD_NAME}"
-    echo "  ⚠️  Command '${CMD_NAME}' conflicts with built-in — renaming to '${FINAL_NAME}'"
-  else
-    FINAL_NAME="${CMD_NAME}"
-  fi
-
-  cp "${CMD_FILE}" ".claude/commands/mindforge/${FINAL_NAME}.md"
-  cp "${CMD_FILE}" ".agent/mindforge/${FINAL_NAME}.md"
-done
-```
-
-**Skills:** Registered in MANIFEST.md under Tier 2 section (prefix: `[plugin-name]-`)
-
-**Personas:** Installed as `.mindforge/personas/[plugin-name]-[persona].md`
-
-**Hooks:** Registered in `.mindforge/plugins/hooks-registry.md`
-
-Hook execution order:
-- Multiple plugins with the same hook are executed in **PLUGINS-MANIFEST.md order**
-  (first installed, first executed)
-- Hook failures do not prevent other hooks from running
-
-### Step 4 — Report loaded plugins
-
-At session start, CLAUDE.md reads the loaded plugins list and reports:
-```
-Active plugins (2):
-  jira-advanced v1.0.0 — hooks: post_phase_complete
-  testing-playwright v0.9.0 — skills: playwright-e2e
-```
-
-If any plugin fails validation: skip it, report error, continue loading others.
-Never fail the session start because a plugin is invalid.
-
-### Step 5 — Write AUDIT entry for plugin load
-
-```json
-{
-  "event": "plugins_loaded",
-  "plugins": [
-    { "name": "mindforge-plugin-jira-advanced", "version": "1.0.0", "hooks": ["post_phase_complete"] }
-  ],
-  "failed": []
-}
-```

package/.mindforge/plugins/plugin-registry.md

@@ -1,44 +0,0 @@
-# MindForge Plugin Registry
-
-## Purpose
-Defines how MindForge discovers, validates, and installs third-party plugins
-from the npm ecosystem.
-
-## Naming convention
-Plugins must be published under the `mindforge-plugin-*` namespace.
-Format:
-- `mindforge-plugin-<category>-<name>`
-
-Examples:
-- `mindforge-plugin-jira-advanced`
-- `mindforge-plugin-testing-playwright`
-
-## Registry source
-The public npm registry is the default source. Private registries are supported
-via standard npm configuration (`.npmrc`) and environment variables.
-
-## Install flow (high level)
-1. Resolve package name and version (default: latest)
-2. Download tarball to a temp directory (mode 700)
-3. Validate structure and `plugin.json`
-4. Run injection guard on all `.md` files
-5. Copy into `.mindforge/plugins/<plugin-name>/`
-6. Append to `PLUGINS-MANIFEST.md`
-7. Log AUDIT event `plugin_installed`
-
-## Validation rules (summary)
-- `plugin.json` is required and must match schema in `plugin-schema.md`
-- Commands and skills must be listed in `plugin.json`
-- Any command name conflicts with built-ins must be renamed per `plugin-loader.md`
-- Plugins with `write_state: true` must be listed in `ELEVATED_PLUGINS`
-
-## Uninstall flow
-- Remove plugin directory
-- Remove manifest entry
-- Log AUDIT event `plugin_uninstalled`
-
-## Security posture
-Plugins are powerful. Treat them like VSCode extensions:
-- Install only from trusted sources
-- Review command content before enabling
-- Prefer version pinning in production environments

package/.mindforge/plugins/plugin-schema.md

@@ -1,68 +0,0 @@
-# MindForge Plugin System — Schema v1.0.0
-
-## Philosophy
-Plugins extend MindForge without modifying the core framework files.
-They are first-class citizens: versioned, validated, injection-guarded, and audited.
-
-## Package naming convention
-`mindforge-plugin-[category]-[name]`
-
-Examples:
-- `mindforge-plugin-jira-advanced`    — Advanced Jira sprint and velocity commands
-- `mindforge-plugin-testing-playwright` — Playwright E2E testing skill and commands
-- `mindforge-plugin-cloud-aws`        — AWS deployment patterns and runbooks
-- `mindforge-plugin-design-figma`     — Figma design review integration
-
-## What a plugin can provide
-
-| Component | Description | File location |
-|---|---|---|
-| Commands | New slash commands | `commands/[name].md` |
-| Skills | New skill packs | `skills/[name]/SKILL.md` |
-| Personas | New agent personas | `personas/[name].md` |
-| Hooks | Lifecycle event handlers | `hooks/[hook-name].md` |
-
-## `plugin.json` manifest (required in every plugin package)
-
-### Required fields
-- `name` (string) — package name
-- `version` (semver)
-- `mindforge_plugin_api_version` (string, must be `1.0.0` for v1.x.x)
-- `min_mindforge_version` (string)
-- `commands` (array of command file paths)
-- `skills` (array of SKILL.md paths)
-- `permissions` (object, see below)
-
-### Permissions — advisory model
-The permission system is advisory, not OS‑enforced. Permissions are:
-- **Declared** in `plugin.json` before installation
-- **Displayed** to the user for review at install time
-- **Recorded** in `AUDIT.jsonl` with plugin name as the agent field
-- **Enforced** through MindForge governance (plan‑first, audit, gates)
-
-The permission declaration is a statement of intent — it enables trust
-decisions, not OS‑level sandboxing.
-
-Example permissions object:
-```json
-\"permissions\": {
-  \"read_state\": true,
-  \"write_state\": false,
-  \"network\": false,
-  \"network_access\": false,
-  \"file_system_write\": false
-}
-```
-
-### Reserved command names (v1.0.0)
-These names are permanently reserved for MindForge built‑ins. If a plugin
-declares a command with one of these names, it must be renamed at install time:
-
-```
-help, init-project, plan-phase, execute-phase, verify-phase, ship,
-next, quick, status, debug, skills, review, security-scan, map-codebase,
-discuss-phase, audit, milestone, complete-milestone, approve, sync-jira,
-sync-confluence, health, retrospective, profile-team, metrics, init-org,
-install-skill, publish-skill, pr-review, workspace, benchmark, update,
-migrate, plugins, tokens, release
-```