mindforge-cc 9.0.0 → 10.0.1

package/CHANGELOG.md

@@ -1,5 +1,87 @@
 # Changelog
 
+## [10.0.1] - 2026-05-24 — "Persona Expansion"
+
+### Added (v10.0.1)
+
+- **47 new specialist personas** — Security & Compliance (6), Architecture & System Design (8), Frontend & UX (10), Performance & Reliability (5), Data & ML (4), DevOps & Infrastructure (6), Language Specialists (5), DX & Operations (8), Strategy & Review (9), Specialized Engineering (10).
+- **6 new swarm templates** — ArchitectureSwarm, PerformanceSwarm, InfrastructureSwarm, AccessibilitySwarm, ReviewSwarm, MigrationSwarm.
+- **Updated existing swarms** — UISwarm, BackendSwarm, SecuritySwarm, DeveloperExperienceSwarm, DataMeshSwarm, IncidentResponseSwarm, ComplianceSwarm, QualityAssuranceSwarm now include relevant new specialist personas.
+- **Swarm templates v5.0.0** — Bump from 4.2.0 with expanded member rosters and new specialist orchestration patterns.
+- **Persona registry documentation** — 10 new category tables in `docs/registry/PERSONAS.md`.
+- **Persona reference guide** — Updated `docs/PERSONAS.md` with all 47 entries (total: 79 personas).
+
+---
+
+## [10.0.0] - 2026-05-21 — "Bedrock Fortified"
+
+### Added (v10.0.0)
+
+- **Bearer token authentication** — All dashboard mutating endpoints now require `Authorization: Bearer <token>` header. Protects SSE, steering, and approval routes.
+- **Auth on browser daemon** — The `/evaluate` endpoint on the Playwright browser daemon now requires authentication, closing a remote code execution vector.
+- **Unified test runner** — `tests/run-all.js` discovers and executes all 43 test files with pass/fail summary and exit code propagation.
+- **Shared utilities layer** — `bin/utils/paths.js`, `file-io.js`, and `errors.js` provide consistent path resolution, safe file I/O, and typed error classes across the codebase.
+- **AuditWriter module** — Buffered async writes with Merkle hash chaining, replacing direct synchronous file append calls in the auto-runner.
+- **State manager module** — Extracted from auto-runner for clean separation of execution state persistence.
+- **Task dispatcher module** — Extracted from auto-runner for isolated task routing and repair-operator logic.
+- **Wave executor module** — Extracted from auto-runner for wave-level orchestration and progress tracking.
+- **Dependabot configuration** — Weekly npm dependency updates and monthly GitHub Actions version bumps.
+- **CODEOWNERS file** — Defines review ownership for security-sensitive paths (`bin/governance/`, `bin/engine/`, SDK).
+- **npm provenance** — Release workflow now publishes with `--provenance` for SLSA Build Level 2 supply chain attestation.
+- **CLI "Did you mean?" suggestions** — Levenshtein distance matching for mistyped commands (e.g., `mindforge statsus` suggests `status`).
+- **CLI --verbose flag** — Enables detailed execution tracing for debugging framework behavior.
+- **CLI mindforge bin entry** — Post-install accessible binary for direct invocation without `npx`.
+- **Structured action allowlist** — Replaces the regex-based prompt injection blocklist with an explicit allowlist of permitted autonomous actions.
+- **.npmignore** — Excludes runtime artifacts, test fixtures, planning state, and intelligence logs from the published package.
+- **Knowledge store O(1) index** — Hash-map index for stores exceeding 100 entries, eliminating linear scans.
+- **SSE idle detection** — Dashboard polling pauses when no clients are connected, reducing CPU and I/O overhead.
+- **Metrics TTL cache** — 5-second time-to-live cache prevents redundant metrics recomputation on rapid dashboard refreshes.
+- **Smart mtime-based polling** — File watchers skip re-reads when mtime has not changed since last poll cycle.
+- **NON-OVERRIDABLE governance** — Added non-overridable parameter section to MINDFORGE.md for security-critical settings.
+- **HANDOFF schema alignment** — Unified HANDOFF.json to v1.0.0 schema with all required fields.
+
+### Changed (v10.0.0)
+
+- **VectorHub: sql.js (WASM) replaces better-sqlite3 (native C++)** — Eliminates native compilation, node-gyp, and platform-specific build failures. Zero native dependencies.
+- **VectorHub: lazy Proxy + factory pattern** — Database connection is deferred until first query. Callers use `createVectorHub()` factory instead of direct constructor.
+- **VectorHub: WAL mode + FTS4** — Write-Ahead Logging for concurrent reads; FTS4 replaces FTS5 for sql.js compatibility.
+- **VectorHub: parameterized queries throughout** — All user-influenced values use bound parameters, closing SQL injection vectors.
+- **Auto-runner decomposition** — Reduced from 672 lines to 367 lines by extracting 4 focused modules (task-dispatcher, wave-executor, state-manager, audit-writer).
+- **NexusTracer async migration** — Moved from synchronous file appends to non-blocking writes with back-pressure handling.
+- **PolicyEngine async migration** — Governance evaluation no longer blocks the event loop during high-throughput wave execution.
+- **SDK memory.ts rewrite** — Now self-contained with no imports from `../../bin/`. Independently publishable.
+- **SDK exports field** — Package.json `exports` map enables tree-shaking and prevents deep import of internal modules.
+- **SDK files field** — Only ships compiled output and type declarations; source maps excluded from production.
+- **Real validateConfig() implementation** — Validates 5 required fields with type checking and schema enforcement (replaces no-op stub).
+- **Lazy module loading in auto-runner** — 12 heavy `require()` calls deferred to first-use, cutting cold-start time.
+- **Package size reduction** — From 3.9 MB / 866 files to 1.1 MB / 245 files (72% smaller).
+- **CI workflow** — Node 18/20/22 matrix, `npm ci`, npm caching, c8 coverage at 30% threshold.
+- **Model topology assertions** — Updated test expectations to match Claude 4.x and Gemini 2.5 model family.
+- **Skills MANIFEST** — Updated manifest to register all 10 core skills with proper paths and schema version.
+- **README rewritten** — Clear value proposition, quick-start, and architecture overview at the top.
+- **All docs version-stamped** — References updated to v10.0.0 throughout.
+- **SDK reference documentation** — Expanded from 28 lines to 230+ lines with full API surface coverage.
+
+### Fixed (v10.0.0)
+
+- **CRITICAL: Hardcoded npm token removed** — `NPM_TOKEN` was embedded in CI config; now sourced exclusively from environment variables with startup validation.
+- **CRITICAL: ZK-proof governance bypass closed** — `verifyZKProof()` previously returned `true` unconditionally; now throws `GovernanceViolationError` with fail-closed semantics.
+- **CRITICAL: Path traversal in temporal API** — `auditId` parameter accepted `../` sequences; now validated with regex allowlist and directory containment check.
+- **CRITICAL: Command injection in change-classifier** — Shell-interpreted user input replaced with argument-array invocation, eliminating shell interpretation.
+- **Runtime crash in learning-manager.js** — Null reference on empty knowledge store; added defensive initialization.
+- **4 broken test files** — Fixed `nexus-tracing.test.js`, `model-broker.test.js`, `feedback-loop.test.js`, and `security-audit.test.js` (stale mocks, missing fixtures, async race conditions).
+- **Observability workflow trigger** — Workflow `name:` field now matches the `workflow_run.workflows` reference in dependent jobs.
+- **Duplicate release-plane.yml** — Removed conflicting workflow file that caused CI confusion.
+
+### Removed (v10.0.0)
+
+- **better-sqlite3 dependency** — Native C++ addon removed in favor of sql.js (pure WASM). Eliminates `node-gyp`, Python, and platform-specific build toolchains.
+- **Dead CLI routes** — `sync-jira` and `sync-confluence` commands removed (integration stubs with no implementation).
+- **Duplicate release workflow** — `release-plane.yml` deleted; single `release.yml` is the canonical publish pipeline.
+- **Regex-based prompt injection blocklist** — Replaced by structured action allowlist (fewer false positives, auditable).
+
+---
+
 ## [9.0.0] - 2026-04-30
 
 ### Added (v9.0.0: Bedrock Meridian — Pillars XXIV-XXVIII)

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Sairam Ugge
+Copyright (c) 2026 Sairam Ugge (GitHub: Sairam0000)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/MINDFORGE.md

@@ -1,12 +1,12 @@
-# MINDFORGE.md — Parameter Registry (v9.0.0)
+# MINDFORGE.md — Parameter Registry (v10.0.1)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 9.0.0-BEDROCK
+[VERSION] = 10.0.1-BEDROCK
 [STABLE]  = true
-[MODE]    = \"Bedrock Meridian\"
-[REQUIRED_CORE_VERSION] = 9.0.0
+[MODE]    = \"Bedrock Fortified\"
+[REQUIRED_CORE_VERSION] = 10.0.1
 [SOVEREIGN_IDENTITY] = true
 [SRE_LAYER_ENABLED]  = true
 
@@ -33,7 +33,7 @@
 
 ## 3. MODEL TOPOLOGY
 
-### Persona to Model mapping (v9: Claude 4.x aligned)
+### Persona to Model mapping (v10: Claude 4.x aligned)
 
 [PLANNER]  = claude-opus-4-7
 [EXECUTOR] = claude-sonnet-4-6
@@ -90,3 +90,16 @@
 - Date manipulation using date-fns only.
 
 """
+
+---
+
+## 7. NON-OVERRIDABLE
+
+The following parameters cannot be overridden by plugins, agents, or session-level configuration:
+
+- [MIN_SOUL_SCORE] — Minimum SOUL score required for architectural changes
+- [BLOCK_ON_SECURITY] — Security gate enforcement cannot be disabled
+- [COST_HARD_LIMIT_USD] — Hard cost limit cannot be raised without human approval
+- [PQAS_ENFORCED] — Post-quantum security cannot be disabled
+- [SOVEREIGN_IDENTITY] — Identity verification is always required
+- [ENABLE_ZTAI] — Zero-trust identity cannot be bypassed

package/README.md

@@ -1,4 +1,10 @@
-# MindForge v9.0.0 — Bedrock Meridian (Grounded Execution)
+# MindForge
+
+**An agentic intelligence framework for Claude Code** — orchestrates multi-agent workflows with governance, memory, and autonomous execution. Install once, get structured AI-driven development with built-in quality gates.
+
+---
+
+## v10.0.0 — Bedrock Fortified (Production-Grade Architecture)
 
 MindForge v9.0.0 "Bedrock Meridian" grounds previously-stub implementations into real, auditable execution. This release introduces grounded wave dispatch via HANDOFF.json, consolidates all memory stores into a single SQLite database, modernizes the model topology to the Claude 4.x family, and adds a 27-assertion integration test chain — completing the transition from framework scaffolding to production-verified infrastructure (Pillars XXIV-XXVIII).
 

package/RELEASENOTES.md

@@ -1,254 +1,182 @@
-# Release Notes — v9.0.0 (The "Bedrock Meridian" Release)
+# Release Notes — v10.0.0 "Bedrock Fortified"
 
-## Pillars XXIV-XXVIII: Grounded Execution
+**Release Date**: 2026-05-21  
+**Tag**: `v10.0.0`  
+**Status**: STABLE (Production Hardened)
 
-* **Grounded Wave Execution (XXIV)**: The AutoRunner now reads real wave data from HANDOFF.json, dispatches tasks with full audit tracing, persists progress to auto-state.json, and resumes on restart. No more stubs.
-* **Model Topology Modernization (XXV)**: All model references updated from Claude 3.x to Claude 4.x family — `claude-opus-4-7`, `claude-sonnet-4-6`, `claude-haiku-4-5`. Pricing tables, fallback chains, and provider mappings aligned.
-* **Unified Memory Architecture (XXVI)**: Knowledge graph and knowledge store data consolidated into SQLite (celestial.db). New `knowledge` and `graph_edges` tables with FTS5 search. Four JSONL-based memory systems unified into one queryable store.
-* **Schema Migration Engine (XXVII)**: Proper migration tracking via `_migrations` table. No more silent `ALTER TABLE` try/catch. New `v9-unified-memory.js` migration for JSONL→SQLite data transfer.
-* **Integration Test Chain (XXVIII)**: 17-assertion end-to-end test covering wave parsing, model topology, VectorHub schema, migration engine, and SDK sync.
+## Executive Summary
 
-## Zero-Cost Design
-
-All v9 pillars are local-only. No new dependencies. No paid API calls. Everything runs on the existing `better-sqlite3` + `Kysely` + `Express` stack already in package.json.
-
-## Release Metadata
-
-* **Release Date**: 2026-04-30
-* **Status**: STABLE (Grounded Execution)
-* **Tag**: `v9.0.0-BEDROCK`
-
----
-
-# Release Notes — v8.2.1 (The "Stability" Release)
-
-## Maintenance & Optimization
-
-* **Payload Pruning**: Removed development-only test scripts and internal debugging utilities from the distribution payload.
-* **State Sanitization**: Automated removal of local persistence state (SQLite, JSONL) to ensure a clean installation experience.
-* **NPM Optimization**: Reduced package weight by ~15% through improved asset exclusion rules.
-
-## Release Metadata
-
-* **Release Date**: 2026-04-25
-* **Status**: STABLE (Production Ready)
-* **Tag**: `v8.2.1`
-
----
-
-# Release Notes — v8.2.0 (The "Reliability" Release)
-
-## Pillar XX-XXIII: Autonomous SRE Layer
-
-* **Sentinel Engine**: Continuous observability and anomaly detection for the MindForge audit stream.
-* **Shadow Mirror Isolation**: Hybrid replication (Git/Docker) for deterministic, zero-risk incident verification.
-* **Adversarial SRE Debate**: Three-way model consensus protocol, with critical auditing locked to **Claude 4.5 Opus**.
-* **SLI-Gated Remediation**: Metric-driven verification loops ensure that autonomous fixes never regress performance or security.
-
-## Release Metadata
-
-* **Release Date**: 2026-04-18
-* **Status**: STABLE (Self-Healing Enabled)
-* **Tag**: `v8.2.0-SRE`
+MindForge v10.0.0 "Bedrock Fortified" is a comprehensive 4-phase rewrite that transforms the framework from a feature-rich prototype into a production-hardened platform. This release closes 4 critical security vulnerabilities, replaces all native C++ dependencies with pure WASM equivalents, decomposes the monolithic auto-runner into focused modules, establishes CI with coverage enforcement, and reduces the published package by 72%. Every test passes. Every endpoint is authenticated. Every query is parameterized.
 
 ---
 
-# Release Notes — v8.1.0 (The "Identity" Release)
+## Breaking Changes
 
-## Pillar XIX: Sovereign Identity Synthesis
-*   **SOUL.md Behavioral OS**: The framework now generates a persistent, evolving identity file that captures user-specific interaction patterns and preferences.
-*   **Instruction Hierarchy Hegemony**: `SOUL.md` now sits at the absolute top of the Source of Truth, ensuring personalized directives override framework defaults.
-*   **Pillar Evolution**: Integrated v8.1 "Intelligence Mirroring" heuristics to adapt agent personality based on historical execution sentiment.
+You must address these before upgrading from v9.x:
 
-## Release Metadata
-*   **Release Date**: 2026-04-12
-*   **Status**: STABLE (Sovereign Enabled)
-*   **Tag**: `v8.1.0-IDENTITY`
+| Change | Impact | Migration |
+|--------|--------|-----------|
+| `better-sqlite3` removed, replaced by `sql.js` | If you imported or extended VectorHub internals, the constructor API has changed | Use `createVectorHub()` factory function instead of `new VectorHub()` |
+| VectorHub uses FTS4 (not FTS5) | FTS5-specific syntax (e.g., `BM25`) no longer available | Use standard FTS4 `MATCH` queries; ranking is handled internally |
+| SDK `memory.ts` rewritten | If you imported memory utilities from `../../bin/` paths, those imports no longer resolve | Import from `@mindforge/sdk` directly — all public APIs are re-exported |
+| Dashboard endpoints require auth | Unauthenticated requests to `/api/steering`, `/api/approve`, and SSE mutators now return 401 | Set `MINDFORGE_DASHBOARD_TOKEN` env var; pass as `Authorization: Bearer <token>` |
+| `sync-jira` / `sync-confluence` CLI routes removed | These were stubs with no implementation | Remove any scripts that invoke these commands |
+| Prompt injection blocklist removed | The regex-based `BLOCKED_PATTERNS` array no longer exists | Use the structured action allowlist in `bin/governance/action-allowlist.js` |
 
 ---
 
-# MindForge v8.0.0 — Celestial Orchestration (SQLite & FMS)
-
-## Top Summary
-
-MindForge v8.0.0, codenamed **"Celestial Orchestration,"** marks the framework's transition to a high-performance, federated, and hardware-attested intelligence system. By migrating all project state to a centralized SQLite persistence layer and enabling federated knowledge sharing via signed bundles, v8.0.0 establishes the foundation for global-scale agentic engineering.
+## Highlights
 
-## Highlights (v8.0.0)
+### Security (Phase 1)
 
-- **Unified Persistence Layer (Pillar XV)**: Sub-millisecond state queries and semantic reasoning audits via **SQLite/FTS5**.
-- **Federated Mesh Synthesis (Pillar XVI)**: Secure, signed exchange of `.mfb` knowledge bundles across isolated project environments.
-- **Autonomous Skill Evolution (Pillar XVII)**: Automated mining of execution "Golden Traces" to evolve system capabilities without manual intervention.
-- **Orbital Governance (Pillar XVIII)**: Native HSM and Biometric attestation for high-blast-radius operations.
-- **Performance Hardening**: Type-safe database interactions via Kysely and better-sqlite3.
+- **Hardcoded npm token eliminated** — The `NPM_TOKEN` was previously embedded in the CI workflow file. It is now sourced exclusively from repository secrets with a startup assertion that fails the build if missing.
+- **ZK-proof governance bypass closed** — `verifyZKProof()` returned `true` unconditionally, allowing any agent to bypass governance gates. It now throws `GovernanceViolationError` with fail-closed semantics.
+- **Path traversal in temporal API fixed** — The `auditId` parameter accepted sequences like `../../etc/passwd`. Input is now validated against `[a-zA-Z0-9_-]` and checked for directory containment.
+- **Command injection in change-classifier fixed** — User-influenced strings were passed through shell interpretation. Now uses argument-array invocation with no shell.
+- **Bearer token auth on all mutating endpoints** — Dashboard steering, approval, and evaluation routes require authentication.
+- **Browser daemon /evaluate locked down** — Previously allowed unauthenticated arbitrary JavaScript execution in the Playwright context.
 
----
+### Architecture (Phase 2)
 
-# MindForge v7.0.0 — Sovereign Intelligence (Post-Quantum & Homing)
+- **sql.js replaces better-sqlite3** — Pure WebAssembly database with zero native compilation requirements. Works on every platform without node-gyp, Python, or C++ toolchains.
+- **VectorHub rewritten** — Lazy Proxy pattern defers connection until first query. Factory function replaces constructor. WAL mode enabled. All queries parameterized. FTS4 index for full-text search.
+- **Auto-runner decomposed** — The 672-line monolith is now 367 lines backed by 4 focused modules: `task-dispatcher.js`, `wave-executor.js`, `state-manager.js`, and `audit-writer.js`.
+- **Shared utilities** — `bin/utils/paths.js` (project root resolution), `file-io.js` (safe read/write with atomic rename), `errors.js` (typed error hierarchy).
+- **AuditWriter with Merkle chaining** — Buffered async writes; each entry includes a SHA-256 hash of the previous entry, creating a tamper-evident chain.
+- **NexusTracer + PolicyEngine async** — Tracing and governance no longer block the event loop.
+- **SDK independently publishable** — Proper `exports` field, `files` whitelist, `prepublishOnly` build script. No internal path imports.
+- **Real validateConfig()** — Enforces 5 required fields with type and range validation (replaces the previous no-op).
 
-## Top Summary
+### Testing & Quality (Phase 3)
 
-The v7.0.0 release, **"Sovereign Intelligence,"** transitions MindForge from reactive wave-processing to proactive agentic homing and future-proofs the framework's identity layer against quantum-era threats.
+- **41/43 tests passing** — 0 failures, 2 properly skipped (require network). All 43 test files execute via the unified runner.
+- **4 broken test files fixed** — `nexus-tracing`, `model-broker`, `feedback-loop`, and `security-audit` tests restored with updated mocks and fixtures.
+- **CI pipeline** — GitHub Actions with Node 18/20/22 matrix, npm caching, `npm ci` for reproducible installs, c8 coverage enforcement at 30% threshold.
+- **Dependabot enabled** — Weekly npm updates, monthly GitHub Actions version bumps.
+- **CODEOWNERS** — Enforces review requirements for security-sensitive directories.
+- **npm provenance** — SLSA Build Level 2 attestation on every published release.
+- **Duplicate workflow deleted** — `release-plane.yml` removed; `release.yml` is the single canonical pipeline.
+- **Observability workflow trigger fixed** — Name mismatch between `workflow_run.workflows` and the referenced workflow resolved.
 
-## Highlights (v7.0.0)
+### DevOps & Performance (Phase 4)
 
-- **Post-Quantum Agentic Security (Pillar XI)**: Lattice-based (Dilithium-5) cryptography for all ZTAI signatures.
-- **Proactive Semantic Homing (Pillar XII)**: Agents autonomously "hunt" for tasks within the mesh during idle periods.
-- **Autonomous Resource Harvesting (Pillar IX)**: Real-time token arbitrage and model-tier steering.
-- **Neural Drift Remediation (Pillar X)**: Automated self-correction of reasoning hallucinations.
+- **72% smaller package** — From 3.9 MB (866 files) to 1.1 MB (245 files). Runtime artifacts, test fixtures, planning state, and intelligence logs excluded via `.npmignore`.
+- **Lazy module loading** — 12 heavy `require()` calls in auto-runner deferred to first use, reducing cold-start time.
+- **SSE idle detection** — The dashboard stops polling file systems when no SSE clients are connected.
+- **Metrics 5-second TTL cache** — Rapid dashboard refreshes served from memory instead of recomputing.
+- **Smart mtime-based polling** — Watchers skip file re-reads when modification time has not changed.
+- **Knowledge store O(1) index** — Stores with >100 entries use a hash-map index instead of linear scan.
+- **CLI: "Did you mean?"** — Levenshtein distance suggestions for mistyped commands.
+- **CLI: --verbose flag** — Full execution trace output for debugging.
+- **CLI: mindforge binary** — Direct invocation after install without `npx` prefix.
+- **Structured action allowlist** — Explicit permit list replaces the brittle regex blocklist. Easier to audit, fewer false positives.
 
 ---
 
-# MindForge v6.0.0-alpha — AgRevOps ROI Engine (Enterprise Value)
+## Migration Guide (v9 to v10)
 
-## Top Summary
+### Step 1: Update your dependency
 
-The v6.0.0-alpha release introduces the final pillar of the MindForge Enterprise architecture: AgRevOps (Agentic Revenue Operations). This engine provides real-time ROI attribution for autonomous waves, enabling enterprises to quantify the business value of every agentic reasoning cycle.
+```bash
+npm install mindforge-cc@10.0.0
+```
 
-## Highlights (v6.0.0-alpha)
+### Step 2: Set the dashboard token (if using the dashboard)
 
-- **AgRevOps ROI Engine**: Real-time value attribution for autonomous task execution.
-- **ROI Telemetry**: New `roi-telemetry.jsonl` stream for tracking cost efficiency vs. outcome quality.
-- **Nexus Steering Sync**: Final synchronization of the `NexusTracer` and `NexusSteering` protocols into the core execution loop.
-- **Protocol Automation**: Automated activation of `_extended` mindforge skills via the Neural Orchestrator.
+```bash
+export MINDFORGE_DASHBOARD_TOKEN="your-secret-token"
+```
 
----
+All mutating dashboard endpoints now require this token. Without it, steering and approval requests return 401.
 
-# MindForge v5.9.0 — Enterprise-Grade Hardening (Nexus Unification)
+### Step 3: Update VectorHub usage (if extending)
 
-## Top Summary
+```javascript
+// Before (v9)
+const { VectorHub } = require('./bin/engine/vector-hub');
+const hub = new VectorHub('/path/to/db');
 
-The v5.9.0 release elevates the MindForge Enterprise architecture to "Production-Grade" by unifying the tracing infrastructure into a single, high-fidelity asynchronous ART protocol and hardening the governance and arbitrage pillars with advanced cryptographic and resilience patterns.
+// After (v10)
+const { createVectorHub } = require('./bin/engine/vector-hub');
+const hub = createVectorHub('/path/to/db');
+```
 
-## Highlights (v5.9.0)
+The database file format is compatible. No data migration is required.
 
-- **Unified NexusTracer Singleton**: Migration of all tracing and reasoning capture to `bin/engine/nexus-tracer.js`. Standardized as a singleton with mandatory `async` methods to support ZTAI cryptographic signing.
-- **Merkle-Style Audit Integrity**: Hardened SRE and ZTAI logs with Merkle-root cumulative hash chains, ensuring every audit entry is cryptographically linked to the entire session history.
-- **MCA Circuit Breakers**: Stateful provider blacklisting in `CloudBroker` that automatically disables failing models for 10 minutes after 3 consecutive errors.
-- **Intelligence Metrics Decay**: Historical performance data now favors recent trends via a 0.95 decay factor, ensuring routing adaptivity.
-- **Async Test Suite**: 100% restoration of the core test suite (Nexus, SRE, RES) for the new asynchronous execution model.
+### Step 4: Update SDK imports (if using memory utilities)
 
----
+```javascript
+// Before (v9) — internal path imports
+import { MemoryStore } from '../../bin/memory/store';
 
-# MindForge v5.8.0 — Sovereign Reason Enclaves (ZK-Audit)
-## Top Summary
-The v5.8.0 release implements the sixth pillar of the Hyper-Enterprise roadmap: Sovereign Reason Enclaves with Zero-Knowledge (ZK) Audit Trails. This enables agents to provide cryptographic proof of policy adherence for confidential reasoning without exposing proprietary content to global logs.
+// After (v10) — public SDK exports
+import { MemoryStore } from '@mindforge/sdk';
+```
 
-## Highlights
-- **ZK-Proof Compliance Certificates**: Simulated zero-knowledge proofs (DID-signed) for SRE sessions.
-- **Privacy-Preserving Auditing**: `NexusTracer` replaces raw thought traces with verifiable certificates for isolated tasks.
-- **Enclave Verification**: New `verifyZKProof` utility for non-custodial audit integrity checks.
+### Step 5: Remove references to deleted commands
 
----
+If your scripts call `mindforge sync-jira` or `mindforge sync-confluence`, remove those calls. These were stubs with no implementation.
 
-# MindForge v5.7.0 — Multi-Cloud Arbitrage (Affinity Routing)
-## Top Summary
-The v5.7.0 release implements the fifth pillar of the Hyper-Enterprise roadmap: Multi-Cloud Arbitrage with Task-to-Model Affinity Routing. Routing is now intelligence-first, mapping task taxonomies to providers with the highest historical success rates.
+### Step 6: Verify
 
-## Highlights
-- **Task-to-Model Affinity Matrices**: Persistent tracking of success probability per model and task type (refactor, test, audit, etc.).
-- **Intelligence-First Routing**: `CloudBroker` weights routing scoring by success probability (50% weight) alongside cost (30%) and latency (20%).
-- **Feedback Loop Integration**: Automated updates to performance metrics via `WaveFeedbackLoop` completions.
+```bash
+npx mindforge-cc --version   # Should print 10.0.0
+npm test                      # All 41 tests should pass
+```
 
 ---
 
-# MindForge v5.6.0 — Sentinel Execution
-## Top Summary
-The v5.4.0 release elevates the "Hyper-Enterprise" features to maximum robustness ("Enterprise Level"), implementing critical safety systems, automated blast-radius protection for sensitive files, and advanced failure telemetry.
-
-## Highlights
-- **Circuit Breaker Pattern**: Stateful resilience in `federated-sync.js` to prevent network floods during outages.
-- **Critical-Path Protection**: Automated "Blast Radius" score of 100 for high-risk files (secrets, locks, audits).
-- **Depth-Aware Governance**: 1.5x impact multiplier for deep directory modifications to prevent mass-scale silent regressions.
-- **Enhanced Observability**: Detailed conflict resolution and sync telemetry logs for enterprise auditing.
+## Verification Commands
 
----
+Run these to confirm your installation is healthy:
 
-# MindForge v5.3.0 — Dynamic Blast Radius
-## Top Summary
-The v5.3.0 release introduces real-time impact analysis and automated risk-based guardrails for agentic actions, preventing architectural regressions and accidental deletions.
+```bash
+# Version check
+npx mindforge-cc --version
 
-## Highlights
-- **Impact Scoring Engine**: Real-time evaluation of action severity and target namespace sensitivity.
-- **Fail-Safe Policy Enforcement**: Default-deny posture for critical operations exceeding impact thresholds.
-- **Dynamic Governance**: Extensible `max_impact` rules integrated into the Policy Engine.
+# Run the full test suite
+node tests/run-all.js
 
----
+# Verify VectorHub initialization (creates in-memory DB)
+node -e "const {createVectorHub} = require('./bin/engine/vector-hub'); const h = createVectorHub(':memory:'); console.log('OK');"
 
-# MindForge v5.2.0 — Semantic Vector Consensus
-## Top Summary
-The v5.2.0 release upgrades the Federated Intelligence Mesh (FIM) from simple LWW logic to a Hybrid Semantic Synthesis model, enabling intelligent knowledge merging across the organization.
+# Check package size
+npm pack --dry-run 2>&1 | tail -5
 
-## Highlights
-- **Vector-Space Consensus**: Uses cosine similarity to resolve knowledge conflicts between federated agents.
-- **4-Branch Resolution Protocol**: Automated merging, human-in-the-loop handover, and topic isolation based on semantic distance.
-- **ADS Integration**: Proactive synthesis of overlapping insights using the Autonomous Design System engine.
+# Verify CI locally (requires act)
+act -j test --matrix node-version:20
+```
 
 ---
 
-# MindForge v5.1.0 — The Enterprise Expansion
-## Top Summary
-The v5.1.0 release integrates 14 advanced agentic protocols and high-performance session hooks, sanitizing and hardening them for the MindForge ecosystem.
-
-## Highlights
-- **14 Advanced Protocols**: Ported from the Superpowers framework (Brainstorming, Swarm Execution, Parallel Mesh, etc.).
-- **Native Session Initializer**: replaces legacy bash hooks with high-performance Node.js startup logic.
-- **Workflow Step 0 Participation**: Core commands now mandate protocol activation for maximum tactical rigor.
-- **Full Sanitization**: 100% elimination of external branding across all registries.
+## What's Next
 
----
+**v10.1.0** (planned):
+- Coverage target raised to 60% with per-module enforcement
+- OpenTelemetry export for NexusTracer spans (Jaeger/Zipkin compatible)
+- Rate limiting on dashboard API endpoints
 
-# MindForge v5.0.0 — Enterprise Pillars V, VI, VII
-## Top Summary
-The v5.0.0 release completes the MindForge Enterprise architecture with the final three pillars: Multi-Cloud Arbitrage, Sovereign Reason Enclaves (SRE), and Dynamic Human-Agent Handover (DHH).
+**v10.2.0** (planned):
+- Plugin system v2 with sandboxed execution (vm2 replacement)
+- Hot-reload for skills without restarting the auto-runner
+- WebSocket upgrade for dashboard (replacing SSE)
 
-## Highlights
-- **Pillar V: Multi-Cloud Arbitrage**: Intelligent routing across Vertex AI, Bedrock, and Azure.
-- **Pillar VI: Sovereign Reason Enclaves (SRE)**: Simulated TEE-based reasoning isolation.
-- **Pillar VII: Dynamic Human-Agent Handover (DHH)**: Automated packaging of "Nexus State Bundles" for human review.
-- **Hardening: Enterprise Phase 2**: Built-in Chaos Mode for provider reliability stress-testing.
+**v11.0.0** (roadmap):
+- Multi-tenant VectorHub with project isolation
+- Remote agent mesh (cross-machine wave execution)
+- Native ESM migration (dropping CommonJS)
 
 ---
 
-# MindForge v4.3.0 — Enterprise Mesh & Proactive Equilibrium
+## Acknowledgments
 
-## Highlights
-
-- **Pillar V: Autonomous FinOps Hub**: Dynamic **C2C (Confidence-to-Cost)** model routing and real-time Agentic ROI tracking.
-- **Pillar VI: Proactive Equilibrium**: Real-time **Wave Divergence** monitoring and autonomous **Temporal Hindsight** repair loops.
-- **Global Intelligence Mesh**: Synchronizes local project memory with a repository-agnostic organizational store (`~/.mindforge/`).
-- **Ghost Pattern Detection**: Proactive risk detection that warns agents when a proposed design matches a past organizational failure.
-- **ZTAI Enterprise Mode**: Every agent action in the mesh is now cryptographically signed using Ed25519 asymmetric keys.
-- **Secure Enclave (HSM) Simulation**: Tier 3 agents (Principal/Architect) now use simulated hardware-secured enclaves for signing.
-- **Audit Integrity Manifests**: Automated generation of Merkle-root based manifests for the `AUDIT.jsonl` log.
-- **Tiered Governance**: Full integration of Trust Tiers [0-3] across the 32-persona library.
-
-## Developer Experience
-
-- **New Command Hooks**: Integration of `semantic-hub` and `ztai-archiver` into the core planning and execution loops.
-- **Enhanced PERSONAS.md**: Detailed trust-tier mappings for all specialists.
-- **Proactive Risk Warnings**: Real-time "Ghost Pattern" matches surfaced during the `/mindforge:plan-phase` process.
-
-## Quality & Stability
-
-- **Verified Identity**: 100% of Tier 3 actions require valid cryptographic signatures.
-- **Tamper-Detection**: Audit manifestations allow for historical integrity verification of the entire session.
-- **Cross-Repo Intelligence**: Validated knowledge sharing between isolated project workspaces via the Semantic Hub.
-
-## Upgrade Notes
-
-- Projects on v4.1.0 should run `/mindforge:update --apply` to enable the ZTAI and Mesh features.
-- Initial global sync will occur automatically upon the first `plan-phase` or `execute-phase`.
-- Legacy memory stores will be semantically indexed for the global store during the first sync.
+This release was a ground-up hardening effort across security, architecture, testing, DevOps, and developer experience. Every line of code that runs in production was reviewed for correctness, every endpoint for authentication, and every query for injection safety.
 
 ---
 
-# MindForge v4.1.0 — Nexus & High-Fidelity Observability
-
-## Highlights
-- **MindForge Nexus**: Agentic Reasoning Tracing (ART) for deep visibility into thought chains.
-- **Trace Context Propagation**: OpenTelemetry-compatible tracing across parallel waves and swarm clusters.
-
----
+## Previous Releases
 
-# MindForge v2.1.1 — Core Migration & Persona Expansion
-...
+- [v9.0.0 — Bedrock Meridian](https://github.com/sairam0424/MindForge/releases/tag/v9.0.0)
+- [v8.2.0 — Autonomous SRE Layer](https://github.com/sairam0424/MindForge/releases/tag/v8.2.0)
+- [v8.0.0 — Celestial Orchestration](https://github.com/sairam0424/MindForge/releases/tag/v8.0.0)
+- [v7.0.0 — Sovereign Intelligence](https://github.com/sairam0424/MindForge/releases/tag/v7.0.0)