mishkan-harness 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Y4NN777
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,205 @@
+<div align="center">
+
+# מִשְׁכָּן · MISHKAN
+
+**A virtual software-engineering organisation that lives inside Claude Code.**
+
+*Run a complex SDLC with AI as a disciplined, multi-agent team — design, spec,
+architecture, security, build, review, and docs — instead of a single chat.*
+
+</div>
+
+---
+
+MISHKAN (*"dwelling place"* — the place where the work resides) turns Claude Code
+into a standing engineering org: **45 specialist agents** across **six teams**, led
+by a PM and a CTO, sharing one research pipeline and one growing knowledge graph.
+Quality and security aren't *requested* of the model — they're **enforced by the
+environment**: path-scoped rules, pre-write security hooks, and generation kept
+structurally separate from review.
+
+It's personal, opinionated infrastructure built around one engineer's standards —
+and shared openly for anyone who wants to try working this way. To make it yours,
+replace one file (your profile) and re-sync; nothing else hardcodes the author.
+
+> **Status:** early and evolving. Used daily, not yet battle-hardened for everyone.
+> The agent fleet, rules, hooks, and installer are complete; the Cognee knowledge
+> graph is opt-in (bring up a local container) and some integration points are
+> marked as such below.
+
+---
+
+## Why
+
+Most "AI coding" is one model in one chat doing everything at once — generating,
+judging its own output, skipping the spec, drifting scope. MISHKAN refuses that:
+
+- **Sequence before code.** PRD → SRS → Contract → Architecture → Threat model →
+  Modeling → implementation. Agents won't jump to code without the upstream artifacts.
+- **Generation ≠ evaluation.** The agent that writes is never the agent that reviews.
+  QA and reporters are structurally separate roles.
+- **Deterministic guardrails.** Secrets, injection, unsafe deserialization, disabled
+  TLS, `:latest` tags, weak hashing — blocked by a hook *before* the write lands,
+  not flagged after.
+- **Security & dependencies are first-class**, not an afterthought audit.
+- **It learns.** Resolved research and decisions become nodes in a knowledge graph
+  (Cognee) that grows through use.
+
+## The teams
+
+Two orchestrators route everything: **Nehemiah** (PM — scope, delivery, sprint
+state) and **Bezalel** (CTO — architecture, standards, quality bar). Beneath them,
+six teams, each `Lead → Specialists → QA → Reporter`:
+
+| Team | Hebrew | Domain |
+|------|--------|--------|
+| **Chosheb** | *cunning work* | Design & UX |
+| **Panim** | *face* | Frontend |
+| **Yasad** | *foundation* | Backend & data |
+| **Mishmar** | *guard* | Security (cross-cutting) |
+| **Migdal** | *tower* | Infrastructure & ops |
+| **Sefer** | *scroll* | Documentation (pull-based) |
+
+A shared **research pipeline** (Jakin → Ezra → Caleb → Shaphan → Shemaiah →
+Baruch) is invokable by any agent that hits an unknown — clarify, formulate,
+research, summarise, evaluate, report — and every call is logged. Names and their
+biblical sources: [`docs/design/MISHKAN_agent_aliases.md`](docs/design/MISHKAN_agent_aliases.md).
+
+## Install
+
+Requires Claude Code and Node ≥ 18. The installer has **zero npm dependencies**.
+
+```bash
+npx mishkan-harness install      # or: node bin/mishkan.js install  (from a clone)
+```
+
+Idempotent and non-destructive: it copies the harness into `~/.claude/mishkan`,
+symlinks agents/skills/commands for discovery, places a user-level `CLAUDE.md` and
+standards rule **only if absent**, and merges its hooks into `settings.json`
+without touching your existing hooks. Paths resolve from your home directory at
+install time — nothing machine-specific is baked in.
+
+```bash
+npx mishkan-harness status                # what's installed
+npx mishkan-harness uninstall             # remove harness; keep your CLAUDE.md & rules
+npx mishkan-harness uninstall --purge     # also remove the user-level rule
+```
+
+## A first session
+
+1. Run `claude` anywhere. You're talking to **Nehemiah** and **Bezalel** in
+   *exploration mode* — free conversation, no ceremony.
+2. Think out loud. When intent is clear, run **`/mishkan-init`** to scaffold the
+   project: the spec chain, `docs/`, a seeded knowledge graph, and Sprint S0.
+3. Work the sprint. Every write is security-scanned; QA evaluates; reporters collect.
+4. **`/sprint-close`** at a milestone. **`/mishkan-resume`** next session restores
+   state and open blockers.
+
+### Commands
+
+| Command | Does |
+|---|---|
+| `/mishkan-init` | Scaffold a project; begin Sprint S0 |
+| `/mishkan-resume` | Restore sprint state + blockers |
+| `/sprint-close` | Reporters → aggregate → docs pull → graph promote |
+| `/dep-audit` | Cross-project dependency & supply-chain audit |
+| `/promote` | Promote knowledge by blast radius |
+| `/sefer-pull` | Trigger a documentation pull |
+
+## Make it yours
+
+The harness serves the engineer described in
+[`docs/engineer/profile.md`](docs/engineer/profile.md) — the single, replaceable
+source of truth. Swap in your own (keep the section structure), then:
+
+```bash
+~/.claude/mishkan/scripts/sync-profile.sh
+```
+
+That refreshes the runtime copy and audits references. **Seraiah** (the docs
+org-layer agent) owns re-deriving anything drawn from it. See
+[`docs/engineer/README.md`](docs/engineer/README.md).
+
+## Dependency & supply-chain
+
+- **Before adopting any package** — the `dependency-vetting` skill drives the
+  research pipeline through OSV/NVD CVEs, maintenance health, typosquatting, and
+  provenance, then gives a go/no-go.
+- **Across every project you own** — `/dep-audit` inventories all repos under your
+  workspace (discovery-based, no hardcoded paths), aggregates shared CVEs and
+  version drift, and produces a coordinated, vetted update plan.
+
+## Knowledge graph (optional)
+
+MISHKAN uses [Cognee](https://docs.cognee.ai) as the knowledge graph that grows as
+you work. Cognee core is a Python library; the harness consumes it through the
+**`cognee-mcp`** server. Optional at first run — agents work without it; only
+persistence is deferred. Run the **cognee-quickstart** skill for guided setup, or
+the hardened Docker deployment under `~/.claude/mishkan/cognee/` (HTTP transport,
+port 7777):
+
+```bash
+cd ~/.claude/mishkan/cognee
+cp .env.example .env          # set LLM_API_KEY + COGNEE_MCP_REF (pinned), SOPS-managed
+docker compose -f docker-compose.yml -f docker-compose.hardening.yml up -d --build
+nc -z localhost 7777 && echo up
+~/.claude/mishkan/scripts/seed-curated-library.sh      # 96 curated references
+```
+
+Agents reach it via each project's `.mcp.json` (seeded by `/mishkan-init`): the
+default is HTTP transport to `http://localhost:7777/mcp`, with a zero-container
+stdio alternative included. The deployment follows the infra rules — built from a
+pinned `Dockerfile` (no `:latest`), SOPS secrets, hardening overlay on every
+recreate, `127.0.0.1`-bound. Pin `COGNEE_MCP_REF` to a release and confirm details
+against [Cognee's docs](https://docs.cognee.ai/cognee-mcp/mcp-local-setup).
+Full guide: [`payload/mishkan/cognee/README.md`](payload/mishkan/cognee/README.md).
+
+## Token & context management
+
+MISHKAN doesn't replace Claude's context handling — it **shapes the inputs** so
+the model's native behaviour works in your favour. Five mechanisms, each riding a
+Claude/Claude Code primitive:
+
+- **Prompt caching** — agents are ordered *static role/standards/rules first,
+  dynamic task last*, so the stable prefix caches and you pay full price only for
+  what changes.
+- **Subagent isolation** — heavy work runs in disposable child windows; only
+  summaries return, so the main thread stays lean (and disabling auto-compaction
+  stays low-risk).
+- **Tight tool grants** & **path-scoped rules** — agents carry only the tool
+  schemas and rules relevant to the file in hand.
+- **Cognee offloading** — full artifacts live in the graph; context holds
+  summaries.
+
+Model tiering is the complementary cost axis (`config/model-routing.yaml`): Opus
+for orchestration/leads, Sonnet for anything that writes code, Haiku for
+evaluate/collect/advise.
+
+→ Full operational detail, the cost model, and honest gaps:
+[`docs/design/MISHKAN_token_optimisation.md`](docs/design/MISHKAN_token_optimisation.md).
+
+## Repository layout
+
+```
+bin/mishkan.js              installer (dependency-free)
+payload/                    what gets installed into ~/.claude
+  mishkan/                    agents, skills, rules, hooks, commands, templates, config, scripts, ontology
+  user/                       user-level CLAUDE.md + standards rule (placed if absent)
+  install/                    hook fragment merged into settings.json
+docs/
+  engineer/                   the canonical, replaceable engineer profile
+  design/
+    MISHKAN_harness_design.md       architecture (5 layers, 6 teams, knowledge model)
+    MISHKAN_agent_aliases.md        the 45 agents and their sources
+    MISHKAN_decisions.md            locked build decisions
+    MISHKAN_ontology.md             Cognee graph schema
+    MISHKAN_token_optimisation.md   how context/token use leverages Claude primitives
+```
+
+## License
+
+MIT — use it, fork it, make it serve your own engineering.
+
+---
+
+Built by **`>_theY4NN`** · [github.com/Y4NN777](https://github.com/Y4NN777)

package/bin/mishkan.js

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+// MISHKAN installer — dependency-free (Node >=18, built-ins only).
+// Commands: install | uninstall | status
+//
+// Portability by design: every path is resolved from os.homedir() at runtime.
+// No machine-specific paths are baked in. Idempotent: re-running install updates
+// in place. Never clobbers user-edited files (CLAUDE.md, rules, real agents).
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync,
+         copyFileSync, lstatSync, readlinkSync, symlinkSync, rmSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PKG = join(HERE, "..");
+const HOME = homedir();
+const CLAUDE = join(HOME, ".claude");
+const MISHKAN = join(CLAUDE, "mishkan");
+const STAMP = join(MISHKAN, ".install-stamp");
+
+const log = (...a) => console.log("mishkan:", ...a);
+const warn = (...a) => console.warn("mishkan: WARN", ...a);
+
+function ensureDir(d) { mkdirSync(d, { recursive: true }); }
+
+function copyDir(src, dst, skip = new Set()) {
+  ensureDir(dst);
+  for (const entry of readdirSync(src, { withFileTypes: true })) {
+    if (skip.has(entry.name)) continue;
+    const s = join(src, entry.name), d = join(dst, entry.name);
+    if (entry.isDirectory()) copyDir(s, d, skip);
+    else if (entry.isFile()) copyFileSync(s, d);
+  }
+}
+
+// Symlink every entry of mishkanSub into claudeSub as a relative link.
+// Skip names that already exist as a NON-symlink real file (preserve user's).
+function linkInto(mishkanSub, claudeSub, dirEntries = false) {
+  ensureDir(claudeSub);
+  const srcDir = join(MISHKAN, mishkanSub);
+  if (!existsSync(srcDir)) return { linked: 0, skipped: 0 };
+  let linked = 0, skipped = 0;
+  for (const entry of readdirSync(srcDir, { withFileTypes: true })) {
+    const isDir = entry.isDirectory();
+    if (dirEntries !== isDir) continue;           // dirs for skills, files for agents/commands
+    if (!dirEntries && !entry.name.endsWith(".md")) continue;
+    const linkPath = join(claudeSub, entry.name);
+    const target = relative(claudeSub, join(srcDir, entry.name));
+    if (existsSync(linkPath) || isSymlink(linkPath)) {
+      if (isSymlink(linkPath)) { rmSync(linkPath); }
+      else { warn(`real file exists, not overwriting: ${tilde(linkPath)}`); skipped++; continue; }
+    }
+    symlinkSync(target, linkPath);
+    linked++;
+  }
+  return { linked, skipped };
+}
+
+function isSymlink(p) { try { return lstatSync(p).isSymbolicLink(); } catch { return false; } }
+function tilde(p) { return p.replace(HOME, "~"); }
+
+// Merge the hook fragment into settings.json, resolving {{MISHKAN}} and
+// preserving any existing hooks (dedupe by exact command string).
+function mergeHooks() {
+  const fragPath = join(PKG, "payload", "install", "settings.hooks.json");
+  const frag = JSON.parse(readFileSync(fragPath, "utf8"));
+  const settingsPath = join(CLAUDE, "settings.json");
+  let settings = {};
+  if (existsSync(settingsPath)) {
+    try { settings = JSON.parse(readFileSync(settingsPath, "utf8")); }
+    catch { warn("settings.json is not valid JSON; writing a backup and starting fresh hooks block");
+            copyFileSync(settingsPath, settingsPath + ".mishkan-bak"); }
+  }
+  settings.hooks ||= {};
+  const resolve = (s) => s.replaceAll("{{MISHKAN}}", MISHKAN);
+  const has = (arr, cmd) => arr.some(e => (e.hooks || []).some(h => h.command === cmd));
+  for (const [event, entries] of Object.entries(frag.hooks)) {
+    settings.hooks[event] ||= [];
+    for (const entry of entries) {
+      const resolvedHooks = entry.hooks.map(h => ({ ...h, command: resolve(h.command) }));
+      // append into an existing matcher block if same matcher, else push new
+      const existing = settings.hooks[event].find(e => (e.matcher || "") === (entry.matcher || ""));
+      const targetArr = existing ? existing.hooks : null;
+      if (existing) {
+        for (const h of resolvedHooks) if (!targetArr.some(x => x.command === h.command)) targetArr.push(h);
+      } else if (!has(settings.hooks[event], resolvedHooks[0]?.command)) {
+        settings.hooks[event].push({ matcher: entry.matcher || "", hooks: resolvedHooks });
+      }
+    }
+  }
+  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+}
+
+function removeHooks() {
+  const settingsPath = join(CLAUDE, "settings.json");
+  if (!existsSync(settingsPath)) return;
+  let settings; try { settings = JSON.parse(readFileSync(settingsPath, "utf8")); } catch { return; }
+  if (!settings.hooks) return;
+  const isMishkan = (h) => (h.command || "").includes("/mishkan/hooks/");
+  for (const event of Object.keys(settings.hooks)) {
+    settings.hooks[event] = settings.hooks[event]
+      .map(e => ({ ...e, hooks: (e.hooks || []).filter(h => !isMishkan(h)) }))
+      .filter(e => (e.hooks || []).length > 0);
+    if (settings.hooks[event].length === 0) delete settings.hooks[event];
+  }
+  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+}
+
+function install() {
+  log(`installing into ${tilde(CLAUDE)} (home resolved at runtime)`);
+  ensureDir(CLAUDE);
+  // 1. payload/mishkan -> ~/.claude/mishkan
+  copyDir(join(PKG, "payload", "mishkan"), MISHKAN);
+  ensureDir(join(MISHKAN, "logs"));
+  ensureDir(join(MISHKAN, "cognee"));
+  // 2. engineer profile -> runtime. Prefer a real (gitignored) profile.md if the
+  // engineer made one; otherwise ship the sanitized example. Never overwrite an
+  // existing runtime profile the engineer may have edited in place.
+  const realProfile = join(PKG, "docs", "engineer", "profile.md");
+  const exampleProfile = join(PKG, "docs", "engineer", "profile.example.md");
+  const runtimeProfile = join(MISHKAN, "profile.md");
+  if (!existsSync(runtimeProfile)) {
+    const src = existsSync(realProfile) ? realProfile : exampleProfile;
+    if (existsSync(src)) copyFileSync(src, runtimeProfile);
+    if (src === exampleProfile) log("placed example profile — edit ~/.claude/mishkan/profile.md with your details");
+  } else {
+    log("preserved existing ~/.claude/mishkan/profile.md");
+  }
+  // 3. user-level files
+  ensureDir(join(CLAUDE, "rules"));
+  // y4nn-standards.md is the harness-maintained DEFAULT — always refreshed so
+  // updates flow. Customisation lives in engineer-standards.md instead.
+  copyFileSync(join(PKG, "payload", "user", "rules", "y4nn-standards.md"),
+               join(CLAUDE, "rules", "y4nn-standards.md"));
+  log("refreshed harness default ~/.claude/rules/y4nn-standards.md");
+  // engineer-standards.md is the USER's layer — placed once, never overwritten.
+  const engRule = join(CLAUDE, "rules", "engineer-standards.md");
+  if (!existsSync(engRule)) copyFileSync(join(PKG, "payload", "user", "rules", "engineer-standards.md"), engRule);
+  else log("preserved your ~/.claude/rules/engineer-standards.md");
+  // user CLAUDE.md — placed once, never overwritten.
+  const userClaude = join(CLAUDE, "CLAUDE.md");
+  if (!existsSync(userClaude)) copyFileSync(join(PKG, "payload", "user", "CLAUDE.md"), userClaude);
+  else log("preserved existing ~/.claude/CLAUDE.md");
+  // 4. symlinks for discovery
+  const a = linkInto("agents", join(CLAUDE, "agents"), false);
+  const s = linkInto("skills", join(CLAUDE, "skills"), true);
+  const c = linkInto("commands", join(CLAUDE, "commands"), false);
+  log(`linked agents=${a.linked} (skipped ${a.skipped}), skills=${s.linked}, commands=${c.linked}`);
+  // 5. hooks
+  mergeHooks();
+  log("hooks merged into settings.json (existing hooks preserved)");
+  // 6. stamp
+  const version = JSON.parse(readFileSync(join(PKG, "package.json"), "utf8")).version;
+  writeFileSync(STAMP, JSON.stringify({ version, installedAt: new Date().toISOString() }, null, 2) + "\n");
+  log(`installed v${version}. Run a Claude session and talk to Nehemiah, or /mishkan-init in a project.`);
+}
+
+function uninstall({ purge = false } = {}) {
+  // remove symlinks that point into mishkan
+  for (const [sub, dirEntries] of [["agents", false], ["commands", false], ["skills", true]]) {
+    const dir = join(CLAUDE, sub);
+    if (!existsSync(dir)) continue;
+    for (const name of readdirSync(dir)) {
+      const p = join(dir, name);
+      if (isSymlink(p)) {
+        let t; try { t = readlinkSync(p); } catch { continue; }
+        if (t.includes("mishkan/")) rmSync(p);
+      }
+    }
+  }
+  removeHooks();
+  if (existsSync(MISHKAN)) rmSync(MISHKAN, { recursive: true, force: true });
+  log("removed ~/.claude/mishkan, its symlinks, and its hooks.");
+  if (purge) {
+    // Remove the harness-maintained default; KEEP the user's engineer-standards
+    // and CLAUDE.md (their own work).
+    const def = join(CLAUDE, "rules", "y4nn-standards.md");
+    if (existsSync(def)) rmSync(def);
+    log("purged harness default y4nn-standards.md. Kept your engineer-standards.md and CLAUDE.md.");
+  } else {
+    log("kept user-level CLAUDE.md, y4nn-standards.md, and engineer-standards.md (use --purge to remove the default).");
+  }
+}
+
+function status() {
+  if (!existsSync(STAMP)) { log("not installed."); return; }
+  const st = JSON.parse(readFileSync(STAMP, "utf8"));
+  const count = (sub, dirEntries) => {
+    const dir = join(CLAUDE, sub); if (!existsSync(dir)) return 0;
+    return readdirSync(dir).filter(n => {
+      const p = join(dir, n); if (!isSymlink(p)) return false;
+      try { return readlinkSync(p).includes("mishkan/"); } catch { return false; }
+    }).length;
+  };
+  const settingsPath = join(CLAUDE, "settings.json");
+  let hooks = 0;
+  if (existsSync(settingsPath)) { try {
+    const s = JSON.parse(readFileSync(settingsPath, "utf8"));
+    for (const ev of Object.values(s.hooks || {})) for (const e of ev) for (const h of (e.hooks||[]))
+      if ((h.command||"").includes("/mishkan/hooks/")) hooks++;
+  } catch {} }
+  log(`installed v${st.version} (${st.installedAt})`);
+  log(`linked: agents=${count("agents")}, skills=${count("skills")}, commands=${count("commands")}, mishkan hooks=${hooks}`);
+  log(`runtime profile: ${existsSync(join(MISHKAN,"profile.md")) ? "present" : "MISSING"}`);
+  log(`cognee dir: ${existsSync(join(MISHKAN,"cognee")) ? "present (deploy the container to activate the graph)" : "missing"}`);
+}
+
+const cmd = process.argv[2];
+const flags = new Set(process.argv.slice(3));
+switch (cmd) {
+  case "install": install(); break;
+  case "uninstall": uninstall({ purge: flags.has("--purge") }); break;
+  case "status": status(); break;
+  default:
+    console.log(`MISHKAN harness installer
+Usage:
+  npx mishkan-harness install      Install/refresh into ~/.claude (idempotent)
+  npx mishkan-harness status       Show install state
+  npx mishkan-harness uninstall    Remove harness (keeps your CLAUDE.md & rules)
+  npx mishkan-harness uninstall --purge   Also remove user-level rule`);
+}

package/docs/design/MISHKAN_agent_aliases.md

@@ -0,0 +1,140 @@
+# MISHKAN — Agent Aliases
+## Complete Biblical Name Registry
+
+All names drawn from the Hebrew Bible (KJV). Every name is a real biblical
+figure with a documented source and a meaning matched to the agent's function.
+No stretching. No invented names.
+
+---
+
+## Naming Rules
+
+- Personal names for agents (biblical figures)
+- Hebrew words / places for teams (not people)
+- No name used twice
+- Meaning must match function — character OR role in scripture
+
+---
+
+## Orchestration
+
+| Alias | Functional Role | Source | Meaning & Why |
+|-------|----------------|--------|---------------|
+| **Nehemiah** | PM — scope, delivery, sprint state, user interface | Book of Nehemiah | "Yah comforts" — oversaw every builder, every section of the wall, reported to the king, managed people through opposition |
+| **Bezalel** | CTO — technical standards, architecture, quality bar | Exodus 31:2 | "In the shadow of God" — filled with wisdom, understanding and knowledge in all manner of workmanship; led all craftsmen |
+
+---
+
+## Research Pipeline
+
+| Alias | Functional Role | Source | Meaning & Why |
+|-------|----------------|--------|---------------|
+| **Jakin** | intent_clarificator | 1 Kings 7:21 | "He establishes" — one of the two bronze pillars at the entrance of Solomon's Temple; establishes the threshold before anything passes through |
+| **Ezra** | research_details_formulator | Book of Ezra 7:6 | "Help" — a ready scribe skilled in the law of Moses; formulated and structured the restoration plan with precision |
+| **Caleb** | contextual_web_researcher | Numbers 13:30 | "Faithful, wholehearted" — one of the two spies who went into Canaan and returned with an accurate, full, fearless report |
+| **Shaphan** | contextual_research_summarizer | 2 Kings 22:3-10 | Royal scribe who read and summarised the found Book of the Law to the king — compressed and delivered |
+| **Shemaiah** | contextual_research_results_evaluator | Nehemiah 6:10-13 | Prophet consulted to evaluate counsel — discerned true signal from false |
+| **Baruch** | research_reporter | Jeremiah 36:4 | "Blessed" — Jeremiah's scribe, wrote from his mouth and carried his words faithfully; the terminal carrier of the message |
+
+---
+
+## Chosheb — Design Team
+
+| Alias | Functional Role | Source | Meaning & Why |
+|-------|----------------|--------|---------------|
+| **Aholiab** | Team Lead | Exodus 31:6 | "Tent of the father" — Bezalel's appointed partner, led the design craftsmen, taught others, coordinated the handoff |
+| **Hiram** | senior_ui_design_and_prototype_implementation | 1 Kings 7:13-14 | "Exalted, noble" — the craftsman Solomon sent for; made all the beautiful visible things in the Temple, the pillars, the sea, the vessels |
+| **Deborah** | cognitive_and_emotional_ux_expert | Judges 4:4-5 | "Bee" — the prophetess who sat under her palm tree and people came to her for understanding; saw what others missed, guided with deep human insight |
+| **Elasah** | Team Reporter | Jeremiah 29:3 | "God has made" — carried Jeremiah's letter faithfully from Jerusalem to Babylon; the faithful carrier of structured output |
+
+---
+
+## Panim — Frontend Team
+
+| Alias | Functional Role | Source | Meaning & Why |
+|-------|----------------|--------|---------------|
+| **Huram** | Team Lead | 2 Chronicles 2:13 | "Noble, free-born" — Hiram's master craftsman sent to Solomon to lead all visible works; cunning in gold, silver, brass, stone, timber |
+| **Oholiab** | senior_frontend_engineer_frontend_design_system_expert | Exodus 35:34 | "Tent of the father" — taught all manner of work, keeper of patterns and standards across the craftsmen |
+| **Salma** | senior_frontend_developer | 1 Chronicles 2:51 | "Clothing, garment" — builder of Bethlehem; one who clothes and covers, the implementer of visible form |
+| **Obed** | smart_frontend_assets_feeder | Ruth 4:17 | "Serving, worshipping" — the faithful servant who supplies and sustains; named for his function of service |
+| **Asaph** | seo_accessibility_expert | 1 Chronicles 16:5 | "Collector, gatherer" — chief of David's musicians appointed to make the work heard and received by all the people; his role was to make things accessible |
+| **Jahaziel** | frontend_qa_engineer | 2 Chronicles 20:14 | "God sees" — stood in the congregation and spoke truth about what he observed; saw what others missed, evaluates without producing |
+| **Ahikam** | Team Reporter | 2 Kings 22:12 | "My brother has risen" — sent by the king to carry a message and return with a faithful report |
+
+---
+
+## Yasad — Backend Team
+
+| Alias | Functional Role | Source | Meaning & Why |
+|-------|----------------|--------|---------------|
+| **Zerubbabel** | Team Lead | Ezra 3:2, Haggai 1:1 | "Seed of Babylon" — the governor who led the rebuilding of the Temple foundation; his specific role was laying and overseeing the deep base |
+| **Zadok** | senior_software_engineer_design_system_master | 2 Samuel 8:17 | "Righteous" — the faithful high priest who kept the standards and patterns across generations; keeper of what must not change |
+| **Nathan** | senior_software_engineer_software_architecture_master | 2 Samuel 7:2 | "He gave" — the prophet who brought architectural vision to David; spoke truth about what should and should not be built |
+| **Hizkiah** | senior_backend_engineer_pure_backend_implementation | 2 Chronicles 31:13 | "Strength of Yah" — an overseer of dedicated, pure administrative work in Hezekiah's time; the one who does the direct labour |
+| **Shallum** | senior_backend_engineering_databases_expert | 2 Kings 15:10 | "Retribution, completeness" — one who maintains and seals; also a keeper of the vestry (2 Kings 22:14) — the keeper of what is stored |
+| **Uriah** | backend_qa_engineer | 2 Samuel 11, 23:39 | "Yah is my light" — the man of absolute integrity and strict adherence to standard; held the line even when pressured not to |
+| **Igal** | Team Reporter | Numbers 13:7 | "He redeems" — one of the twelve spies; returned and reported what he observed from his section |
+
+---
+
+## Mishmar — Security Team
+
+| Alias | Functional Role | Source | Meaning & Why |
+|-------|----------------|--------|---------------|
+| **Phinehas** | Team Lead | Numbers 25:7-8 | "Mouth of brass / serpent" — acted decisively to stop a breach; zealous for security, moved without hesitation when the boundary was crossed |
+| **Benaiah** | software_and_infrastructure_security_expert_devsecops | 2 Samuel 23:20 | "Yah has built" — commander of the guard, mighty man who went down into a pit on a snowy day to slay a lion; dealt with the hardest infrastructure-level threats |
+| **Joab** | web_mobile_desktop_security_expert | 2 Samuel 8:16 | "Yah is father" — commander of David's army across all fronts; the field general who covered all surface-level attack vectors |
+| **Ira** | code_security_ops | 2 Samuel 20:26 | "Watchful" — David's priest and a chief officer; one who keeps watch at the code level |
+| **Hushai** | software_security_advisor | 2 Samuel 15:37 | "Haste" — David's friend and strategic counsellor who gave wise advice to counter threats; the trusted advisor who outmanoeuvred the attacker |
+| **Maaseiah** | Team Reporter | Nehemiah 8:4 | "Work of Yah" — stood at Ezra's right hand during the reading of the law; carried the structured account faithfully |
+
+---
+
+## Migdal — Infrastructure Team
+
+| Alias | Functional Role | Source | Meaning & Why |
+|-------|----------------|--------|---------------|
+| **Eliashib** | Team Lead | Nehemiah 3:1 | "God restores" — the high priest who led the rebuilding of the Sheep Gate and the wall; the one who organises the foundational infrastructure work |
+| **Palal** | systems_engineer_os_virtualisation_networks | Nehemiah 3:25 | "Judge" — made repairs at the Angle, next to the tower; worked at the structural intersection point of the wall and the tower |
+| **Meshullam** | infrastructure_design_engineer | Nehemiah 3:4 | "Friend, allied" — repaired multiple sections; the one who designs connections between parts |
+| **Hanun** | devsecops_practitioner_support_ops | Nehemiah 3:13 | "Favoured" — repaired the Valley Gate with the men of Zanoah; covered a long section of the wall in support mode |
+| **Meremoth** | devops_engineer | Nehemiah 3:4 | "Heights, elevations" — repaired his section next to the Fish Gate; one who works at the delivery layer |
+| **Rehum** | infrastructure_health_and_security_advisor | Nehemiah 3:17 | "Compassionate" — a Levite who repaired; also the commander who wrote the letter of warning about Jerusalem's walls — he watches for risk and advises |
+| **Zaccur** | Team Reporter | Nehemiah 3:2 | "Remembered, mindful" — built next to the men of Jericho; one who keeps record, who is mindful of what happened |
+
+---
+
+## Sefer — Documentation Team
+
+| Alias | Functional Role | Source | Meaning & Why |
+|-------|----------------|--------|---------------|
+| **Jehoshaphat** | Team Lead | 2 Samuel 8:16 | "Yah has judged" — the first Recorder (mazkir) in David's court; cared for national archives, added current annals, brought weighty matters to the king |
+| **Seraiah** | organisation_layer_specialist | 2 Samuel 8:17 | "Yah has prevailed" — David's chief scribe; operated at the highest state level across the entire kingdom |
+| **Joah** | project_layer_specialist | 2 Kings 18:18, 2 Chronicles 34:8 | "Yah is brother" — recorder under Hezekiah and Josiah; documented the specific events and decisions of each reign |
+| **Shevna** | team_layer_specialist | 2 Kings 18:18, Isaiah 36:3 | "Youthful vigour" — the scribe present in direct negotiations; embedded with the teams, documents their specific outputs |
+| **Jehonathan** | knowledge_publication_specialist | 1 Chronicles 27:32 | "Yah has given" — David's uncle, explicitly "a counsellor, a wise man, and a scribe"; takes knowledge and makes it legible for others |
+| **Huldah** | Team Reporter | 2 Kings 22:14 | "Weasel" — the prophetess consulted when the Book of the Law was found; verified, interpreted and reported the meaning back to the king with authority |
+
+---
+
+## Name Conflict Check
+
+All 45 agents named. No conflicts.
+
+| Group | Count |
+|-------|------:|
+| Orchestration | 2 |
+| Research Pipeline | 6 |
+| Chosheb (Design) | 4 |
+| Panim (Frontend) | 7 |
+| Yasad (Backend) | 7 |
+| Mishmar (Security) | 6 |
+| Migdal (Infrastructure) | 7 |
+| Sefer (Documentation) | 6 |
+| **Total** | **45** |
+
+---
+
+*MISHKAN Agent Aliases — May 2026*
+*All names sourced from KJV Hebrew Bible. Personal names only for agents.*
+*Hebrew words/places for teams. No name used twice.*