monomind 1.9.16 → 1.10.0

package/.claude/skills/mastermind/secrets.md

@@ -0,0 +1,199 @@
+---
+name: mastermind-secrets
+description: Mastermind secrets — manage org-scoped API keys and secrets consumed by agents. Store, rotate, list, and audit secrets without exposing values in logs or state files.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Secrets
+
+This skill is invoked by `mastermind:secrets` or directly via `/mastermind:secrets`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block
+- `org_name`: org to manage secrets for
+- `action`: list | set | rotate | revoke | audit
+- `secret_name`: name/key of the secret (e.g. `OPENAI_API_KEY`, `SLACK_WEBHOOK`)
+- `secret_value`: value to store (only ever passed as env var reference, NEVER hardcoded)
+- `provider`: local | env | vault (default: local)
+- `caller`: command | master
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## SECURITY RULES (always enforced)
+
+- NEVER print secret values to stdout
+- NEVER store secret values in state files (store only masked references: `sk-ant-***...***`)
+- NEVER commit secrets to git
+- Secrets passed as `secret_value` MUST come from env vars (`$MY_KEY`), NOT inline strings
+
+---
+
+## Step 1 — Load Secrets Registry
+
+The secrets registry stores **metadata only** (name, provider, masked hint, rotation date):
+
+```bash
+secretsFile=".monomind/orgs/${org_name}-secrets.json"
+[ ! -f "$secretsFile" ] && echo '{"secrets":[]}' > "$secretsFile"
+```
+
+Actual secret values live in:
+- `local`: `.monomind/orgs/.secrets/<org_name>/<name>` (chmod 600, gitignored)
+- `env`: environment variable `ORG_<ORG_NAME_UPPER>_<SECRET_NAME_UPPER>`
+
+---
+
+## Step 2 — Execute Action
+
+### list (default)
+
+Show all registered secrets for this org (metadata only, masked values):
+
+```bash
+jq -r '
+  .secrets[] |
+  "[\(.name)]  provider=\(.provider)  hint=\(.masked_hint // "***")  set=\(.set_at // "unknown")  rotated=\(.rotated_at // "never")"
+' "$secretsFile" 2>/dev/null || echo "No secrets registered."
+```
+
+Render as:
+```
+SECRETS — org: <org_name>
+──────────────────────────────────────────────
+NAME                  PROVIDER   VALUE HINT       SET               ROTATED
+ANTHROPIC_API_KEY     local      sk-ant-***...    2 days ago        —
+SLACK_WEBHOOK         env        https://hooks    1 week ago        —
+GITHUB_TOKEN          local      ghp_***...       3 days ago        1 day ago
+```
+
+### set
+
+Store a secret value. Always source from env var:
+
+```bash
+# Validate secret_name (alphanumeric + underscore only)
+echo "$secret_name" | grep -qE '^[A-Z][A-Z0-9_]{0,63}$' || { echo "ERROR: secret_name must be uppercase letters, digits, underscores only."; exit 1; }
+
+# Create secure storage dir
+secretDir=".monomind/orgs/.secrets/${org_name}"
+mkdir -p "$secretDir"
+chmod 700 "$secretDir"
+
+# Write value from env var reference — NEVER inline
+if [ -z "${secret_value}" ]; then
+  echo "ERROR: Pass the secret value as an env var: secret_value=\$MY_VAR /mastermind:secrets --action set"
+  exit 1
+fi
+
+secretFile="${secretDir}/${secret_name}"
+printf '%s' "$secret_value" > "$secretFile"
+chmod 600 "$secretFile"
+
+# Store masked hint (first 6 chars + ***)
+hint="${secret_value:0:6}***...${secret_value: -3}"
+
+# Register in secrets metadata
+tmp="${secretsFile}.tmp"
+jq --arg name "$secret_name" \
+   --arg provider "${provider:-local}" \
+   --arg hint "$hint" \
+   --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+   '.secrets = [.secrets[] | select(.name != $name)] +
+    [{"name":$name,"provider":$provider,"masked_hint":$hint,"set_at":$ts}]' \
+   "$secretsFile" > "$tmp" && mv "$tmp" "$secretsFile"
+
+echo "Secret $secret_name stored (provider: ${provider:-local})"
+```
+
+Ensure `.monomind/orgs/.secrets/` is in `.gitignore`:
+```bash
+grep -q '.monomind/orgs/.secrets' .gitignore 2>/dev/null || echo '.monomind/orgs/.secrets/' >> .gitignore
+```
+
+### rotate
+
+Generate a new value from env var and update:
+
+```bash
+# Same as set but also records rotated_at
+tmp="${secretsFile}.tmp"
+jq --arg name "$secret_name" --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+   '.secrets = [.secrets[] | if .name == $name then .rotated_at = $ts | .set_at = $ts else . end]' \
+   "$secretsFile" > "$tmp" && mv "$tmp" "$secretsFile"
+# Then re-run the set logic above with new value
+```
+
+### revoke
+
+Remove secret value and registry entry:
+
+```bash
+rm -f ".monomind/orgs/.secrets/${org_name}/${secret_name}"
+tmp="${secretsFile}.tmp"
+jq --arg name "$secret_name" '.secrets = [.secrets[] | select(.name != $name)]' \
+   "$secretsFile" > "$tmp" && mv "$tmp" "$secretsFile"
+echo "Secret $secret_name revoked."
+```
+
+### audit
+
+Show which agents reference each secret in their adapter_config or responsibilities:
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+echo "=== SECRET USAGE AUDIT — org: $org_name ==="
+jq -r '.roles[] | "\(.id): \(.responsibilities | join(", "))"' "$orgFile" | \
+  while IFS=: read -r role resp; do
+    refs=$(jq -r '.secrets[].name' "$secretsFile" | while read -r sname; do
+      echo "$resp" | grep -q "$sname" && echo "    → $sname"
+    done)
+    [ -n "$refs" ] && echo "$role$refs"
+  done
+echo "(Audit checks responsibilities text only — review agent prompts manually for additional references)"
+```
+
+---
+
+## How Agents Access Secrets
+
+Agents spawned by the boss should read secrets via:
+
+```bash
+# Read from local storage (not env):
+secret=$(cat ".monomind/orgs/.secrets/${orgName}/${SECRET_NAME}" 2>/dev/null)
+[ -z "$secret" ] && secret="${!SECRET_NAME}"  # Fallback to env var
+
+# Use in API calls:
+curl -H "Authorization: Bearer $secret" ...
+```
+
+Never store secret values in memory namespace or state files.
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+secret_name: <name if applicable>
+secrets_count: <N>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/.claude/skills/mastermind/skills.md

@@ -0,0 +1,156 @@
+---
+name: mastermind-skills
+description: Mastermind skills — list, sync, and map skills available to org agents. Scans .claude/skills/ directory and shows which roles have access to which skill domains.
+type: domain-skill
+default_mode: auto
+---
+
+# Mastermind Skills
+
+This skill is invoked by `mastermind:skills` or directly via `/mastermind:skills`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org to inspect skills for (optional — shows all skills if omitted)
+- `action`: list | sync | map | enable | disable
+- `skill_name`: skill slug (required for enable/disable)
+- `role_id`: role to map skill to (optional)
+- `caller`: command | master
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Scan Skills Directory
+
+```bash
+skillsDir=".claude/skills"
+[ ! -d "$skillsDir" ] && { echo "ERROR: No .claude/skills/ directory found."; exit 1; }
+
+# List all skill files recursively
+allSkills=$(find "$skillsDir" -name "*.md" ! -name "_*" | sort)
+```
+
+---
+
+## Step 2 — Execute Action
+
+### list (default)
+
+Display all available skills with metadata:
+
+```bash
+echo "AVAILABLE SKILLS"
+echo "────────────────────────────────────────────────────────"
+printf "%-30s %-15s %-10s %s\n" "NAME" "TYPE" "MODE" "DESCRIPTION"
+echo "────────────────────────────────────────────────────────"
+
+for f in $allSkills; do
+  skillSlug=$(basename "$f" .md)
+  domain=$(dirname "$f" | sed "s|$skillsDir/||")
+  skillType=$(grep -m1 "^type:" "$f" 2>/dev/null | awk '{print $2}')
+  skillMode=$(grep -m1 "^default_mode:" "$f" 2>/dev/null | awk '{print $2}')
+  skillDesc=$(grep -m1 "^description:" "$f" 2>/dev/null | sed 's/^description: //' | cut -c1-60)
+  printf "%-30s %-15s %-10s %s\n" "${domain}:${skillSlug}" "${skillType:-skill}" "${skillMode:-auto}" "$skillDesc"
+done
+
+echo ""
+echo "Total: $(echo "$allSkills" | wc -l | tr -d ' ') skills"
+```
+
+### map
+
+Show which skills are mapped to each role in the org:
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '$org_name' not found."; exit 1; }
+
+echo "SKILL MAP — org: $org_name"
+echo "────────────────────────────────────────────────────────"
+
+jq -r '.roles[] | "[\(.id)] \(.title)  agent_type=\(.agent_type)"' "$orgFile" | while IFS= read -r line; do
+  echo "$line"
+  roleId=$(echo "$line" | grep -o '^\[[^]]*\]' | tr -d '[]')
+  # Show skills configured for this role
+  mappedSkills=$(jq -r --arg id "$roleId" \
+    '.roles[] | select(.id == $id) | .skills // [] | join(", ")' \
+    "$orgFile" 2>/dev/null)
+  if [ -n "$mappedSkills" ] && [ "$mappedSkills" != "null" ]; then
+    echo "  Skills: $mappedSkills"
+  else
+    echo "  Skills: (inherited from agent_type)"
+  fi
+  echo ""
+done
+```
+
+### sync
+
+Refresh the skill registry by re-scanning `.claude/skills/` and updating org config with available skill slugs:
+
+```bash
+skillsDir=".claude/skills"
+skillList=$(find "$skillsDir" -name "*.md" ! -name "_*" -exec basename {} .md \; | sort | jq -Rsc 'split("\n") | map(select(. != ""))')
+
+if [ -n "$org_name" ]; then
+  orgFile=".monomind/orgs/${org_name}.json"
+  tmp="${orgFile}.tmp"
+  jq --argjson skills "$skillList" '.available_skills = $skills' "$orgFile" > "$tmp" && mv "$tmp" "$orgFile"
+  echo "Synced $(echo "$skillList" | jq 'length') skills → org: $org_name"
+else
+  echo "Available skills:"
+  echo "$skillList" | jq -r '.[]'
+  echo ""
+  echo "Pass --org <name> to sync skills into a specific org config."
+fi
+```
+
+### enable / disable
+
+Add or remove a skill from a role's allowed list:
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '$org_name' not found."; exit 1; }
+[ -z "$skill_name" ] && { echo "ERROR: --skill-name required."; exit 1; }
+[ -z "$role_id" ] && { echo "ERROR: --role-id required for enable/disable."; exit 1; }
+
+tmp="${orgFile}.tmp"
+if [ "$action" = "enable" ]; then
+  jq --arg id "$role_id" --arg skill "$skill_name" \
+    '.roles = [.roles[] | if .id == $id then .skills = ((.skills // []) + [$skill] | unique) else . end]' \
+    "$orgFile" > "$tmp" && mv "$tmp" "$orgFile"
+  echo "Enabled skill '$skill_name' for role '$role_id'"
+else
+  jq --arg id "$role_id" --arg skill "$skill_name" \
+    '.roles = [.roles[] | if .id == $id then .skills = ((.skills // []) | map(select(. != $skill))) else . end]' \
+    "$orgFile" > "$tmp" && mv "$tmp" "$orgFile"
+  echo "Disabled skill '$skill_name' for role '$role_id'"
+fi
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name if provided>
+skills_found: <N>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/.claude/skills/mastermind/tasks.md

@@ -0,0 +1,149 @@
+---
+name: mastermind-tasks
+description: Mastermind tasks — view, create, assign, and move tasks on an org's task board. Supports parent-child chains, goal linkage, and status filtering.
+type: domain-skill
+default_mode: auto
+---
+
+# Mastermind Tasks
+
+This skill is invoked by `mastermind:tasks` or directly via `/mastermind:tasks`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block
+- `org_name`: org whose board to manage
+- `action`: list | create | assign | move | close | chain
+- `task_title`: title for create
+- `task_id`: card id for assign/move/close
+- `role_id`: role to assign the task to
+- `parent_id`: parent task id (for hierarchical task chains)
+- `goal_ref`: goal slug this task contributes to (links task to goal)
+- `status`: todo | doing | done (for move)
+- `caller`: command | master
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Org Config
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+board_id=$(jq -r '.board_id // empty' "$orgFile")
+todo_col=$(jq -r '.todo_col_id // empty' "$orgFile")
+doing_col=$(jq -r '.doing_col_id // empty' "$orgFile")
+done_col=$(jq -r '.done_col_id // empty' "$orgFile")
+
+[ -z "$board_id" ] && { echo "ERROR: org config missing board_id — run /mastermind:createorg to rebuild."; exit 1; }
+```
+
+---
+
+## Step 2 — Execute Action
+
+### list (default)
+
+Show all tasks grouped by column with role labels and parent chains:
+
+```bash
+echo "=== TODO ==="
+monotask card list $board_id --col $todo_col --json | jq -r '.[] | "[\(.id)] \(.title)  role=\(.labels // [] | map(select(startswith("role:"))) | .[0] // "unassigned")"'
+
+echo "=== DOING ==="
+monotask card list $board_id --col $doing_col --json | jq -r '.[] | "[\(.id)] \(.title)  role=\(.labels // [] | map(select(startswith("role:"))) | .[0] // "unassigned")"'
+
+echo "=== DONE ==="
+monotask card list $board_id --col $done_col --json | jq -r '.[] | "[\(.id)] \(.title)"'
+```
+
+Render as:
+```
+TASKS — org: <org_name>
+──────────────────────────────────────────────
+TODO (N)
+  [abc123] Write homepage copy          → role:content-writer
+  [def456]   └─ Draft hero section      → role:content-writer  (child of abc123)
+
+DOING (N)
+  [ghi789] Review brand guidelines      → role:reviewer
+
+DONE (N)
+  [jkl012] Research competitor sites
+```
+
+### create
+
+Create a task card and optionally link it to a parent or goal:
+
+```bash
+CARD_ID=$(monotask card create $board_id $todo_col "$task_title" --json | jq -r .id)
+[ -n "$role_id" ] && monotask card label add $board_id $CARD_ID "role:${role_id}"
+[ -n "$parent_id" ] && monotask card subtask add $board_id $CARD_ID $board_id $todo_col "$task_title" --json
+[ -n "$goal_ref" ] && monotask card label add $board_id $CARD_ID "goal:${goal_ref}"
+echo "Created task: $CARD_ID"
+```
+
+Emit `org:task:created` event to dashboard.
+
+### assign
+
+```bash
+[ -n "$role_id" ] && monotask card label add $board_id $task_id "role:${role_id}"
+echo "Assigned task $task_id to role $role_id"
+```
+
+### move
+
+```bash
+case "$status" in
+  todo)  col_target=$todo_col ;;
+  doing) col_target=$doing_col ;;
+  done)  col_target=$done_col ;;
+esac
+monotask card move $board_id $task_id $col_target
+echo "Moved task $task_id to $status"
+```
+
+Emit `org:task:moved` event.
+
+### chain
+
+Build a task chain (parent → child sequence) from a list of task titles:
+
+Parse `task_title` as newline-separated titles. Create each card in order, linking each as a prerequisite of the next:
+
+```bash
+prev_id=""
+while IFS= read -r title; do
+  CARD_ID=$(monotask card create $board_id $todo_col "$title" --json | jq -r .id)
+  [ -n "$role_id" ] && monotask card label add $board_id $CARD_ID "role:${role_id}"
+  [ -n "$prev_id" ] && monotask card prerequisite add $board_id $CARD_ID $board_id $prev_id
+  prev_id=$CARD_ID
+  echo "  Created: [$CARD_ID] $title"
+done <<< "$task_title"
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+task_id: <task_id if applicable>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/.claude/skills/mastermind/techport.md

@@ -67,7 +67,7 @@ HINT_TERMS="{focus_hint}"
 # If HINT_TERMS is empty or unset (no focus_hint provided), default to: core architecture skills commands hooks agents
 [ -z "$HINT_TERMS" ] && HINT_TERMS="core architecture skills commands hooks agents"
 HINT_PATTERN=$(echo "$HINT_TERMS" | tr ' ' '|')
-find /Users/morteza/Desktop/tools/monobrain/.claude -name "*.md" \
+find .claude -name "*.md" \
   | xargs grep -liE "$HINT_PATTERN" 2>/dev/null | head -20
 ```
 
@@ -78,7 +78,7 @@ find /Users/morteza/Desktop/tools/monobrain/.claude -name "*.md" \
 Extract the real conventions — not the stated ones — from the codebase itself:
 
 ```bash
-BASE=/Users/morteza/Desktop/tools/monobrain/packages/@monomind/cli/src
+BASE=packages/@monomind/cli/src
 
 # File name convention
 find "$BASE" -name "*.ts" | grep -v dist | sed 's|.*/||' | \
@@ -144,7 +144,7 @@ Domain vocab:       Agent, Memory, Swarm, Config, Node, Graph, Session, Task, Wo
 ### 0C — Dependency Direction Constraints
 
 ```bash
-BASE=/Users/morteza/Desktop/tools/monobrain/packages/@monomind/cli/src
+BASE=packages/@monomind/cli/src
 
 # Map import directions by directory layer
 for dir in types utils core commands services; do
@@ -161,7 +161,7 @@ Extract the implied layering from the import ratio. High `imported_by` → leaf/
 ### 0D — Build Monomind Vocabulary Name Set (for collision detection)
 
 ```bash
-grep -rhn "^export" /Users/morteza/Desktop/tools/monobrain/packages/@monomind/cli/src \
+grep -rhn "^export" packages/@monomind/cli/src \
   --include="*.ts" | grep -v dist | \
   grep -oE "(class|interface|function|const|type|enum) [A-Z][A-Za-z0-9]+" | awk '{print $2}' | sort -u \
   > /tmp/monomind_names.txt
@@ -655,7 +655,7 @@ else
 fi
 
 # 2. TypeScript validity
-cd /Users/morteza/Desktop/tools/monobrain && npx tsc --noEmit --project packages/@monomind/cli/tsconfig.json 2>&1 | tail -10
+npx tsc --noEmit --project packages/@monomind/cli/tsconfig.json 2>&1 | tail -10
 
 # 3. Convention spot check
 cat {written_file} | grep -E "^export class|^export interface|^export function" | head -20