sinapse-ai 1.20.0 → 1.20.1

package/CHANGELOG.md

@@ -1,31 +1,22 @@
-## [1.20.0](https://github.com/caioimori/sinapse-ai/compare/v1.19.2...1.20.0) (2026-07-03)
-
-### Features
-
-* **cli:** spec/plan de 1ª classe + orchestrate no binário canônico + QA honesto no Windows ([#328](https://github.com/caioimori/sinapse-ai/issues/328)) ([6e55337](https://github.com/caioimori/sinapse-ai/commit/6e553373815c75e766fc4c1f002dcd8ae63b5fb6)), closes [S1/#321](https://github.com/S1/sinapse-ai/issues/321)
-* **installer:** motor de contexto ativo pós-install — .synapse/ no caminho canônico + models no template ([#334](https://github.com/caioimori/sinapse-ai/issues/334)) ([6dbe799](https://github.com/caioimori/sinapse-ai/commit/6dbe799fb0a9724bd53b07f0183d5f627c1cd14a))
-* **synapse:** dieta de contexto — Constitution completa só no 1º prompt + budgets honestos ([#323](https://github.com/caioimori/sinapse-ai/issues/323)) ([39b78e2](https://github.com/caioimori/sinapse-ai/commit/39b78e2c0e30746d433670764ec57e34c0691989))
+## [1.20.1](https://github.com/caioimori/sinapse-ai/compare/1.20.0...1.20.1) (2026-07-03)
 
 ### Bug Fixes
 
-* **cli:** binário canônico honesto — agents/ideate, uninstall hooksPath, PlanTracker, simulate stub ([#321](https://github.com/caioimori/sinapse-ai/issues/321)) ([19b4dd7](https://github.com/caioimori/sinapse-ai/commit/19b4dd7d6aab9a4abf5b1fde754646491ba04362))
-* **context:** dual-trigger de compactação + statusline re-significado pra era 1M ([#329](https://github.com/caioimori/sinapse-ai/issues/329)) ([18f8582](https://github.com/caioimori/sinapse-ai/commit/18f85821693c90792d7d1ffb74e4023319fdcbed))
-* **models:** registry na era Fable 5 + token-economy sem pin de versão ([#322](https://github.com/caioimori/sinapse-ai/issues/322)) ([b1d120c](https://github.com/caioimori/sinapse-ai/commit/b1d120cacf30f7fa9e45bc556d15a663f7c2e869))
-* **models:** varredura final de era — atlas sincronizado + squad mastery sem pins ([#326](https://github.com/caioimori/sinapse-ai/issues/326)) ([bbf4b9b](https://github.com/caioimori/sinapse-ai/commit/bbf4b9b29aac8bd06eb79cc45f7bbd94a198f4b8))
+* **security:** Onda A da triagem AF-20260703 — 4 fixes cirúrgicos ([#337](https://github.com/caioimori/sinapse-ai/issues/337)) ([39f3338](https://github.com/caioimori/sinapse-ai/commit/39f33384aea83df4f609c91eec1ef25acce30d29)), closes [#1](https://github.com/caioimori/sinapse-ai/issues/1) [524-#528](https://github.com/caioimori/524-/issues/528) [#332](https://github.com/caioimori/sinapse-ai/issues/332) [#511](https://github.com/caioimori/sinapse-ai/issues/511) [#32](https://github.com/caioimori/sinapse-ai/issues/32)
+* **security:** Onda B1 — TOCTOU na cadeia de confiança do instalador + git sem shell ([#340](https://github.com/caioimori/sinapse-ai/issues/340)) ([6f0a72b](https://github.com/caioimori/sinapse-ai/commit/6f0a72b89f8a72df741d5e7c94e89c2d3bd7bfd8)), closes [19/#20](https://github.com/19/sinapse-ai/issues/20) [15-#18](https://github.com/caioimori/15-/issues/18) [#22](https://github.com/caioimori/sinapse-ai/issues/22) [#507](https://github.com/caioimori/sinapse-ai/issues/507)
+* **security:** Onda B2 — escrita atômica em todo o caminho de instalação ([#341](https://github.com/caioimori/sinapse-ai/issues/341)) ([0c90216](https://github.com/caioimori/sinapse-ai/commit/0c9021628526ff7cf5ef3dcf41efae3dc629e20a))
 
 ### Documentation
 
-* **decisions:** executa DEC-02/DEC-05 + triagem de segurança na mesa de decisões ([#335](https://github.com/caioimori/sinapse-ai/issues/335)) ([108e6e2](https://github.com/caioimori/sinapse-ai/commit/108e6e2ff987190edf3dd214c2dd06c8748bf5ed))
-* **decisions:** mesa de decisões da Onda 2 — 5 pareceres de arquitetura + medições armadas ([#333](https://github.com/caioimori/sinapse-ai/issues/333)) ([d2d50c3](https://github.com/caioimori/sinapse-ai/commit/d2d50c3d78d23d5884ea00579d78e502c27bc2d6))
-* **honestidade:** Art. VIII escopado ao caminho real + status executável dos workflows ([#330](https://github.com/caioimori/sinapse-ai/issues/330)) ([c277ff8](https://github.com/caioimori/sinapse-ai/commit/c277ff81438330edf56b68975b081fe776d82419)), closes [agent-exit-hooks.js#onCommandComplete](https://github.com/caioimori/agent-exit-hooks.js/issues/onCommandComplete)
-* vitrine imediata honesta — CHANGELOG, user-guide revisado, limitação 1-story visível, ids por família ([#325](https://github.com/caioimori/sinapse-ai/issues/325)) ([ccd2f8b](https://github.com/caioimori/sinapse-ai/commit/ccd2f8b686fd16cc520838b3cb800ff44195b747)), closes [#318](https://github.com/caioimori/sinapse-ai/issues/318)
-* vitrine profunda honesta — guides no veredito híbrido + README com motor visível + relatório da auditoria ([#327](https://github.com/caioimori/sinapse-ai/issues/327)) ([67889e8](https://github.com/caioimori/sinapse-ai/commit/67889e8ddeed672da91a7612ea0171f9773dcb37))
+* **decisions:** registra Onda A de segurança executada (PR [#337](https://github.com/caioimori/sinapse-ai/issues/337)) ([#338](https://github.com/caioimori/sinapse-ai/issues/338)) ([c2dbe72](https://github.com/caioimori/sinapse-ai/commit/c2dbe72e2c686a9f2db01a85f4e02e444d4eea24))
+* **decisions:** registra Ondas B/C de segurança + rollout da ativação enxuta executados ([#343](https://github.com/caioimori/sinapse-ai/issues/343)) ([0500b56](https://github.com/caioimori/sinapse-ai/commit/0500b56411e44f25cb1729126a3de828ef3f251d))
 
 ### Maintenance
 
-* **agents:** piloto de ativação enxuta + 24 colisões de codinome resolvidas (27 renames) ([#332](https://github.com/caioimori/sinapse-ai/issues/332)) ([702a146](https://github.com/caioimori/sinapse-ai/commit/702a146d762f6a54644f6dd7b573d7c777c9dd41))
-* installer bilíngue (troubleshooting i18n) + init sem TTY não crasha ([#331](https://github.com/caioimori/sinapse-ai/issues/331)) ([d4434af](https://github.com/caioimori/sinapse-ai/commit/d4434afded0ee892625f80395989763e5dd393d4))
-* **install:** template CLAUDE.md fiel e enxuto + guard de codinome sem blind spot ([#324](https://github.com/caioimori/sinapse-ai/issues/324)) ([64b5868](https://github.com/caioimori/sinapse-ai/commit/64b586881589cd4dd814fc8c0112029ca7607f2c))
+* **agents:** rollout da ativação enxuta — pós-piloto aprovado por avaliação ([#342](https://github.com/caioimori/sinapse-ai/issues/342)) ([6815e51](https://github.com/caioimori/sinapse-ai/commit/6815e511e13fb1fa146f0a866d054073075c9212)), closes [#332](https://github.com/caioimori/sinapse-ai/issues/332)
+* **cleanup:** DEC-03 — remove cluster multi-story órfão + split DEC-02 ([#344](https://github.com/caioimori/sinapse-ai/issues/344)) ([359b2fa](https://github.com/caioimori/sinapse-ai/commit/359b2fa2e905eee9be30ea5cac2d7a8bb305a0bd))
+* **release:** sync da main pós-release v1.20.0 ([#336](https://github.com/caioimori/sinapse-ai/issues/336)) ([b3973f0](https://github.com/caioimori/sinapse-ai/commit/b3973f0223173ce570b9ae49878f2d278dc257f8)), closes [#277](https://github.com/caioimori/sinapse-ai/issues/277)
+* **security:** Onda C — higiene do code scanning + 5 fixes de qualidade em produção ([#339](https://github.com/caioimori/sinapse-ai/issues/339)) ([13ae8dd](https://github.com/caioimori/sinapse-ai/commit/13ae8ddd314d2ab923ab019b4e0994be4e1627a1)), closes [#515](https://github.com/caioimori/sinapse-ai/issues/515) [#2](https://github.com/caioimori/sinapse-ai/issues/2) [#409](https://github.com/caioimori/sinapse-ai/issues/409) [#226](https://github.com/caioimori/sinapse-ai/issues/226) [401/#402](https://github.com/401/sinapse-ai/issues/402) [#228](https://github.com/caioimori/sinapse-ai/issues/228)
 
 # Changelog
 
@@ -36,6 +27,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.20.0] — 2026-07-03 — 🧠 Ciclo Fable 5: dieta de contexto, spec/plan de 1ª classe, era de modelo sincronizada
+
+> Minor. Atualização segura via `npx sinapse-ai update`. Consolida o ciclo de upgrade Fable 5 (auditoria AF-20260702 → Onda 1 → Onda 2 → mesa de decisões): 15 PRs (#321–#335).
+
+### Features
+
+- **cli** — `sinapse spec` e `sinapse plan` como comandos de 1ª classe + `orchestrate` no binário canônico + QA honesto no Windows (`PASS_QA_SKIPPED`, exit 0) (#328)
+- **installer** — motor de contexto ativo pós-install: `.synapse/` criado no caminho canônico + models no template; 2º prompt em diante entrega ~−88% de contexto injetado (#334)
+- **synapse** — dieta de contexto: Constitution completa só no 1º prompt (−90,5%/turno) + budgets honestos (#323)
+
+### Bug Fixes
+
+- **cli** — binário canônico honesto: `agents`/`ideate` reais, uninstall de hooksPath, PlanTracker, simulate stub (#321)
+- **context** — dual-trigger de compactação (60% OU 165K) + statusline re-significado pra era 1M (#329)
+- **models** — registry na era Fable 5 (`active: claude-fable-5`) + token-economy sem pin de versão (#322); varredura final de era — atlas sincronizado + squad mastery sem pins (#326)
+
+### Documentation
+
+- **honestidade** — Art. VIII escopado ao caminho real + `docs/framework/workflow-engine-status.md` com status executável dos workflows (#330)
+- **vitrine** — guides públicos no veredito híbrido do motor + README com motor real (#327); docs de vitrine imediata da Onda 1 (#325)
+- **decisions** — mesa de decisões da Onda 2 (5 pareceres) (#333); execução DEC-02/DEC-05 + triagem de segurança (429 alertas, zero crítico-real) (#335)
+
+### Maintenance
+
+- **agents** — piloto de ativação enxuta + 24 colisões de codinome resolvidas (27 renames, reversíveis) (#332)
+- **installer** — bilíngue (troubleshooting i18n) + init sem TTY não crasha (#331)
+- **template** — CLAUDE.md enxuto + guard de codinomes (Nexus→Relay/Bulletin) (#324)
+
 ## [1.19.2] — 2026-07-01 — 🔒 Honestidade do gate (build vazio não passa) + aposta medida
 
 > Patch. Atualização segura via `npx sinapse-ai update`. Fecha o último furo de honestidade do motor achado ao medir a aposta de orquestração multi-story.

package/bin/commands/install.js

@@ -27,6 +27,7 @@ const {
   copyDirSync,
   rmDirSync,
   syncDirSync,
+  atomicWriteFileSync,
   toForwardSlash,
 } = require('../lib/fs-utils');
 const {
@@ -112,7 +113,7 @@ async function cmdInstallGlobal(opts = {}) {
     }
     if (!parseFailed) {
       settings.language = language === 'pt' ? 'portuguese' : 'english';
-      fs.writeFileSync(claudeSettingsPath, JSON.stringify(settings, null, 2) + '\n');
+      atomicWriteFileSync(claudeSettingsPath, JSON.stringify(settings, null, 2) + '\n');
     }
   } catch { /* non-critical */ }
 
@@ -587,7 +588,7 @@ function installFatalPhases({ squads, squadsDir, isUpsert, llmChoice, existing,
   if (isUpsert) {
     meta.updatedAt = nowIso;
   }
-  fs.writeFileSync(path.join(SINAPSE_HOME, 'metadata.json'), JSON.stringify(meta, null, 2));
+  atomicWriteFileSync(path.join(SINAPSE_HOME, 'metadata.json'), JSON.stringify(meta, null, 2));
 
   return { writtenAgents, totalAgents, totalDelta, squadsRefreshed, squadsAdded, meta };
 }
@@ -735,14 +736,14 @@ function createLauncher() {
 exec claude --add-dir "${sinapsePathForBash}" --agent sinapse-orqx "$@"
 `;
   const bashPath = path.join(BIN_DIR, 'sinapse');
-  fs.writeFileSync(bashPath, bashLauncher);
+  atomicWriteFileSync(bashPath, bashLauncher);
   try { fs.chmodSync(bashPath, 0o755); } catch { /* chmod is best-effort (no-op on non-POSIX) */ }
   logger.always(`  ${GREEN}OK${NC} ~/bin/sinapse`);
 
   // Windows CMD launcher
   if (IS_WIN) {
     const cmdLauncher = '@echo off\r\nclaude --add-dir "%USERPROFILE%\\.sinapse" --agent sinapse-orqx %*\r\n';
-    fs.writeFileSync(path.join(BIN_DIR, 'sinapse.cmd'), cmdLauncher);
+    atomicWriteFileSync(path.join(BIN_DIR, 'sinapse.cmd'), cmdLauncher);
     logger.always(`  ${GREEN}OK${NC} ~/bin/sinapse.cmd`);
   }
 }

package/bin/lib/command-generator.js

@@ -11,7 +11,7 @@ const path = require('path');
 
 const { SINAPSE_HOME, CLAUDE_COMMANDS_DIR, ROOT } = require('./constants');
 const { extractAgentMeta } = require('./squads');
-const { toForwardSlash } = require('./fs-utils');
+const { toForwardSlash, atomicWriteFileSync } = require('./fs-utils');
 
 // Framework "core" agents (developer, architect, quality-gate, devops, …) live
 // OUTSIDE the squads/ tree, under .sinapse-ai/development/agents/*.md. `scripts/
@@ -239,7 +239,7 @@ function regenerateAgentCommands(deps = {}) {
       const agentId = file.replace('.md', '');
       const meta = extractAgentMeta(path.join(agentsDir, file));
       const cmdContent = generateCommandMd(agentId, meta.name, meta.icon, squad.name, squadPath, file);
-      fs.writeFileSync(path.join(commandsDir, `${agentId}.md`), cmdContent);
+      atomicWriteFileSync(path.join(commandsDir, `${agentId}.md`), cmdContent);
       writtenAgents.add(file);
     }
   }
@@ -254,7 +254,7 @@ function regenerateAgentCommands(deps = {}) {
         const meta = extractAgentMeta(path.join(masterAgentsDir, file));
         const squadPath = `${sinapseBase}/sinapse`;
         const cmdContent = generateCommandMd(agentId, meta.name, meta.icon, 'sinapse', squadPath, file);
-        fs.writeFileSync(path.join(commandsDir, `${agentId}.md`), cmdContent);
+        atomicWriteFileSync(path.join(commandsDir, `${agentId}.md`), cmdContent);
         writtenAgents.add(file);
       }
     }
@@ -274,7 +274,7 @@ function regenerateAgentCommands(deps = {}) {
     for (const [id, personaFile] of masterEntryPoints) {
       const personaPath = `${masterSquadPath}/agents/${personaFile}`;
       const stub = generateMasterStub(id, personaPath, masterSquadPath, squads);
-      fs.writeFileSync(path.join(commandsDir, `${id}.md`), stub);
+      atomicWriteFileSync(path.join(commandsDir, `${id}.md`), stub);
       writtenAgents.add(`${id}.md`);
     }
   }

package/bin/lib/fs-utils.js

@@ -97,6 +97,23 @@ function syncDirSync(src, dest, delta = { added: 0, updated: 0, unchanged: 0, re
   return delta;
 }
 
+// atomicWriteFileSync — Onda B2 (AF-20260703): tmp+rename via the canonical
+// core util so a crash or concurrent reader never sees a torn config file.
+// Fail-open: if the util can't be loaded, fall back to a plain write (the
+// pre-hardening behavior) rather than breaking the installer.
+let _atomicWriteSync = null;
+try {
+  _atomicWriteSync = require('../../.sinapse-ai/core/synapse/utils/atomic-write').atomicWriteSync;
+} catch { /* fallback below */ }
+
+function atomicWriteFileSync(filePath, data, encoding = 'utf8') {
+  if (_atomicWriteSync) {
+    _atomicWriteSync(filePath, data, encoding);
+  } else {
+    fs.writeFileSync(filePath, data, encoding);
+  }
+}
+
 function toForwardSlash(p) {
   return p.replace(/\\/g, '/');
 }
@@ -112,6 +129,7 @@ module.exports = {
   copyDirSync,
   rmDirSync,
   syncDirSync,
+  atomicWriteFileSync,
   toForwardSlash,
   toPosixPath,
 };

package/bin/lib/setup-statusline.js

@@ -30,6 +30,7 @@
 const os = require('os');
 const path = require('path');
 const fse = require('fs-extra');
+const { atomicWriteFileSync } = require('./fs-utils');
 
 /**
  * Resolve the canonical source paths for the statusline templates.
@@ -182,7 +183,8 @@ async function setupStatusline(opts = {}) {
     }
 
     await fse.ensureDir(path.dirname(globalSettingsPath));
-    await fse.writeFile(globalSettingsPath, JSON.stringify(settings, null, 2), 'utf8');
+    // Atomic (tmp+rename): a crash mid-write must never leave a torn settings.json
+    atomicWriteFileSync(globalSettingsPath, JSON.stringify(settings, null, 2), 'utf8');
 
     result.installed = true;
     return result;

package/bin/modules/chrome-brain-installer.js

@@ -12,6 +12,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const { execSync } = require('child_process');
+const { atomicWriteFileSync } = require('../lib/fs-utils');
 
 // ============================================================================
 // Constants
@@ -134,7 +135,8 @@ function readJson(filePath) {
 function writeJson(filePath, data) {
   const dir = path.dirname(filePath);
   fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf8');
+  // Atomic (tmp+rename): these are user config files (settings.json, .mcp.json)
+  atomicWriteFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf8');
 }
 
 function mergeHooks(settingsPath, hookDefs) {
@@ -432,7 +434,7 @@ function createMinimalKB() {
   fs.mkdirSync(kbDir, { recursive: true });
   const kbPath = path.join(kbDir, 'chrome-brain.md');
   if (!fs.existsSync(kbPath)) {
-    fs.writeFileSync(kbPath, [
+    atomicWriteFileSync(kbPath, [
       '# Chrome Brain — Browser Automation Capability',
       '',
       '> Cross-squad capability for browser automation.',
@@ -462,7 +464,7 @@ function createMinimalKB() {
   // Create claude-in-chrome.md KB (Story 7.4.2)
   const cicKbPath = path.join(kbDir, 'claude-in-chrome.md');
   if (!fs.existsSync(cicKbPath)) {
-    fs.writeFileSync(cicKbPath, [
+    atomicWriteFileSync(cicKbPath, [
       '# claude-in-chrome — Chrome Extension for Visual Browser Interaction',
       '',
       '> Manual install required. This extension cannot be auto-installed via CLI.',

package/bin/modules/mcp-installer.js

@@ -18,6 +18,7 @@ const path = require('path');
 const { exec } = require('child_process');
 const { promisify } = require('util');
 const chalk = require('chalk');
+const { atomicWriteFileSync } = require('../lib/fs-utils');
 
 const execAsync = promisify(exec);
 
@@ -322,12 +323,8 @@ async function addMCPToConfig(mcpId, config, configPath) {
   // Add new MCP config
   mcpConfig.mcpServers[mcpId] = config;
 
-  // Write updated config
-  await fse.writeFile(
-    configPath,
-    JSON.stringify(mcpConfig, null, 2) + '\n',
-    'utf8',
-  );
+  // Write updated config — atomic (tmp+rename): .mcp.json must never be torn
+  atomicWriteFileSync(configPath, JSON.stringify(mcpConfig, null, 2) + '\n', 'utf8');
 }
 
 /**

package/bin/postinstall.js

@@ -45,6 +45,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { atomicWriteFileSync } = require('./lib/fs-utils');
 
 const PROJECT_ROOT = path.resolve(__dirname, '..');
 
@@ -161,7 +162,7 @@ function markFirstRunDone() {
     }
     const flag = firstRunFlag();
     if (!fs.existsSync(flag)) {
-      fs.writeFileSync(flag, `${new Date().toISOString()}\n`, 'utf8');
+      atomicWriteFileSync(flag, `${new Date().toISOString()}\n`, 'utf8');
     }
     return true;
   } catch {

package/bin/sinapse-init.js

@@ -24,7 +24,8 @@ const path = require('path');
 const fs = require('fs');
 const fse = require('fs-extra');
 const yaml = require('js-yaml');
-const { execSync, exec, spawn } = require('child_process');
+const { exec, spawn } = require('child_process');
+const { atomicWriteFileSync } = require('./lib/fs-utils');
 const { promisify } = require('util');
 const inquirer = require('inquirer');
 const chalk = require('chalk');
@@ -172,8 +173,8 @@ async function main() {
         author: '',
         license: 'ISC',
       };
-      // INS-2 Performance: Use async write instead of sync
-      await fse.writeFile(packageJsonPath, JSON.stringify(defaultPackage, null, 2));
+      // Atomic (tmp+rename): never leave a torn package.json
+      atomicWriteFileSync(packageJsonPath, JSON.stringify(defaultPackage, null, 2));
       console.log(chalk.green('✓') + ' package.json created');
     }
 
@@ -582,7 +583,8 @@ async function main() {
               const existing = await fse.readFile(targetRules, 'utf8');
               const incoming = await fse.readFile(sourceRules, 'utf8');
               const mergeResult = await markdownMerger.merge(existing, incoming);
-              await fse.writeFile(targetRules, mergeResult.content, 'utf8');
+              // Atomic (tmp+rename): merged user rules must never be half-written
+              atomicWriteFileSync(targetRules, mergeResult.content, 'utf8');
               console.log(
                 chalk.green('✓') +
                   ` ${ide.charAt(0).toUpperCase() + ide.slice(1)} rules merged (existing content preserved)`
@@ -830,7 +832,6 @@ See .sinapse-ai/user-guide.md for complete documentation.
   // INS-2 Performance: Add spinner for validation (AC9)
   const validationSpinner = ora('Validating installation integrity...').start();
 
-  let validationPassed = true;
   try {
     const { PostInstallValidator } = require('../packages/installer/src/installer/post-install-validator');
     const validator = new PostInstallValidator(context.projectRoot, context.frameworkLocation, {
@@ -851,7 +852,6 @@ See .sinapse-ai/user-guide.md for complete documentation.
       report.stats.missingFiles > 0 ||
       report.stats.corruptedFiles > 0
     ) {
-      validationPassed = false;
       validationSpinner.warn('Installation validation found issues:');
       console.log(chalk.dim(`   - Missing files: ${report.stats.missingFiles}`));
       console.log(chalk.dim(`   - Corrupted files: ${report.stats.corruptedFiles}`));
@@ -868,7 +868,6 @@ See .sinapse-ai/user-guide.md for complete documentation.
     // Log validation errors but don't fail installation
     // This allows installation to proceed even if validator module has issues
     // However, users should investigate validation errors manually
-    validationPassed = false;
     validationSpinner.warn('Post-installation validation encountered an error');
     console.log(chalk.dim(`   Error: ${validationError.message}`));
     if (process.env.DEBUG || process.env.SINAPSE_DEBUG) {
@@ -972,8 +971,8 @@ async function updateGitIgnore(mode, projectRoot) {
 
     if (!hasFrameworkSection) {
       gitignore += frameworkRules.join('\n');
-      // INS-2 Performance: Use async write
-      await fse.writeFile(gitignorePath, gitignore);
+      // Atomic (tmp+rename): appended .gitignore must never be half-written
+      atomicWriteFileSync(gitignorePath, gitignore);
     }
   }
 }

package/bin/sinapse.js

@@ -14,6 +14,7 @@ const { emitDeprecationWarning } = require('./utils/deprecation-warning');
 // Story onda2-p6 — shared, TTY-detection used by `init` to fall back to the
 // wizard's quiet/default path in non-interactive shells (see shouldRunInitQuiet below).
 const { detectInteractiveMode } = require('./lib/detection');
+const { atomicWriteFileSync } = require('./lib/fs-utils');
 
 // Story A.2 — unified logger. Levels: error/warn/info/debug.
 // Flags: --verbose, --debug, --quiet, --json. Default level: warn.
@@ -506,7 +507,8 @@ function cleanGitignore(gitignorePath) {
   }
 
   if (removedLines > 0) {
-    fs.writeFileSync(gitignorePath, newLines.join('\n'));
+    // Atomic (tmp+rename): never leave a half-written .gitignore
+    atomicWriteFileSync(gitignorePath, newLines.join('\n'));
     return { removed: true, lines: removedLines };
   }
   return { removed: false };

package/bin/utils/staged-secret-scan.js

@@ -50,7 +50,9 @@ const SCANNER_SELF_FILES = new Set([
   'bin/utils/staged-secret-scan.js',
   '.claude/hooks/secret-scanning.cjs',
 ]);
-const TEST_FILE_PATTERN = /(^|\/)(tests?|__tests__)\/|\.(test|spec)\.[cm]?[jt]s$/i;
+// Each alternative carries its own anchors (grouped explicitly) so neither
+// branch can accidentally match a substring of the other's context.
+const TEST_FILE_PATTERN = /((^|\/)(tests?|__tests__)\/)|(\.(test|spec)\.[cm]?[jt]s$)/i;
 
 function isScanExemptPath(filePath) {
   const norm = String(filePath).replace(/\\/g, '/');

package/docs/framework/atlas/OPERATING-ATLAS.md

@@ -3,7 +3,7 @@
 > Single, generated map of how the SINAPSE framework works: routing, models,
 > constitution, workflows, agents, squads. Regenerate with `sinapse atlas`.
 > Counts are read from disk (Article VII — always exact).
-> Generated: 2026-07-02T21:47:12.575Z
+> Generated: 2026-07-03T03:44:39.813Z
 
 **At a glance:** 17 squads · 172 agents
 (12 framework + 160 squad) ·

package/docs/framework/atlas/atlas-data.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-07-02T21:47:12.575Z",
+  "generatedAt": "2026-07-03T03:44:39.813Z",
   "counts": {
     "squads": 17,
     "agentsTotal": 172,
@@ -417,7 +417,7 @@
     {
       "id": "new-offer-launch",
       "name": "new-offer-launch",
-      "description": "Workflow completo para lançamento de nova oferta — do design à ativação comercial. Integra Mint (design), Edge (enablement), Cascade (demand gen), Vault (CRM),…",
+      "description": "Workflow completo para lançamento de nova oferta — do design à ativação comercial. Integra Mint (design), Edge (enablement), Cascade (demand gen), Rolodex (CRM…",
       "type": "",
       "source": "squad:squad-commercial",
       "file": "squads/squad-commercial/workflows/new-offer-launch.yaml",
@@ -435,7 +435,7 @@
     {
       "id": "revenue-forecasting-cycle",
       "name": "revenue-forecasting-cycle",
-      "description": "Ciclo mensal de forecasting de receita — coleta, análise, projeção e apresentação. Combina dados de pipeline (Vault), unit economics (Ledger), e expansion (Bon…",
+      "description": "Ciclo mensal de forecasting de receita — coleta, análise, projeção e apresentação. Combina dados de pipeline (Rolodex), unit economics (Turbine), e expansion (…",
       "type": "",
       "source": "squad:squad-commercial",
       "file": "squads/squad-commercial/workflows/revenue-forecasting-cycle.yaml",
@@ -1138,7 +1138,7 @@
     },
     {
       "id": "animation-interpreter",
-      "persona": "Lens",
+      "persona": "Decoder",
       "title": "Animation Intent Interpreter",
       "role": "Animation Intent Interpreter",
       "squad": "squad-animations",
@@ -1291,7 +1291,7 @@
     },
     {
       "id": "squad-brand",
-      "persona": "Flux",
+      "persona": "Ripple",
       "title": "Motion & VFX Designer",
       "role": "Motion & VFX Designer — linguagem de movimento, animacoes, video graphics e animation library",
       "squad": "squad-brand",
@@ -1948,7 +1948,7 @@
     },
     {
       "id": "cro-persuasion",
-      "persona": "Convert",
+      "persona": "Sway",
       "title": "CRO & Persuasion Specialist",
       "role": "CRO & Persuasion Specialist",
       "squad": "squad-design",
@@ -1975,7 +1975,7 @@
     },
     {
       "id": "dx-accessibility-specialist",
-      "persona": "Beacon",
+      "persona": "Aperture",
       "title": "Accessibility & Inclusive Design Expert",
       "role": "Accessibility & Inclusive Design Expert",
       "squad": "squad-design",
@@ -1984,7 +1984,7 @@
     },
     {
       "id": "dx-design-system-architect",
-      "persona": "Stratum",
+      "persona": "Lattice",
       "title": "Design System & Token Architecture Specialist",
       "role": "Design System & Token Architecture Specialist",
       "squad": "squad-design",
@@ -2002,7 +2002,7 @@
     },
     {
       "id": "dx-interaction-designer",
-      "persona": "Kinetic",
+      "persona": "Gesture",
       "title": "Interaction Design & Motion Systems Specialist",
       "role": "Interaction Design & Motion Systems Specialist",
       "squad": "squad-design",
@@ -2011,7 +2011,7 @@
     },
     {
       "id": "dx-performance-engineer",
-      "persona": "Apex",
+      "persona": "Velocity",
       "title": "Web Performance Optimization Specialist",
       "role": "Web Performance Optimization Specialist",
       "squad": "squad-design",
@@ -2020,7 +2020,7 @@
     },
     {
       "id": "dx-ui-designer",
-      "persona": "Canvas",
+      "persona": "Palette",
       "title": "UI Design & Visual Systems Specialist",
       "role": "UI Design & Visual Systems Specialist",
       "squad": "squad-design",
@@ -2029,7 +2029,7 @@
     },
     {
       "id": "dx-ux-strategist",
-      "persona": "Compass",
+      "persona": "Vantage",
       "title": "UX Strategy & Research Lead",
       "role": "UX Strategy & Research Lead",
       "squad": "squad-design",
@@ -2038,7 +2038,7 @@
     },
     {
       "id": "platform-aesthetic-director",
-      "persona": "Vertex",
+      "persona": "Hue",
       "title": "Platform Aesthetic Director",
       "role": "Platform Aesthetic Director",
       "squad": "squad-design",
@@ -2110,7 +2110,7 @@
     },
     {
       "id": "forecast-strategist",
-      "persona": "Horizon",
+      "persona": "Runway",
       "title": "Forecast Strategist",
       "role": "Forecast Strategist",
       "squad": "squad-finance",
@@ -2119,7 +2119,7 @@
     },
     {
       "id": "pricing-strategist",
-      "persona": "Mint",
+      "persona": "Markup",
       "title": "Pricing Strategist",
       "role": "Pricing Strategist",
       "squad": "squad-finance",
@@ -2209,7 +2209,7 @@
     },
     {
       "id": "campaign-analyst",
-      "persona": "Pulse",
+      "persona": "Cadence",
       "title": "Campaign Analyst",
       "role": "Campaign Analyst",
       "squad": "squad-paidmedia",
@@ -2227,7 +2227,7 @@
     },
     {
       "id": "cro-specialist",
-      "persona": "Convert",
+      "persona": "Uplift",
       "title": "CRO Specialist",
       "role": "CRO Specialist",
       "squad": "squad-paidmedia",
@@ -2245,7 +2245,7 @@
     },
     {
       "id": "meta-ads-specialist",
-      "persona": "Signal",
+      "persona": "Reach",
       "title": "Meta Ads Specialist",
       "role": "Meta Ads Specialist",
       "squad": "squad-paidmedia",
@@ -2272,7 +2272,7 @@
     },
     {
       "id": "pm-creative-performance-analyst",
-      "persona": "Lens",
+      "persona": "Focal",
       "title": "Creative Performance Analyst",
       "role": "Creative Performance Analyst",
       "squad": "squad-paidmedia",
@@ -2353,7 +2353,7 @@
     },
     {
       "id": "audience-intelligence",
-      "persona": "Pulse",
+      "persona": "Empath",
       "title": "Audience Intelligence Empath",
       "role": "Audience Intelligence Empath",
       "squad": "squad-research",
@@ -2371,7 +2371,7 @@
     },
     {
       "id": "data-synthesizer",
-      "persona": "Loom",
+      "persona": "Braid",
       "title": "Data Synthesis Weaver",
       "role": "Data Synthesis Weaver",
       "squad": "squad-research",
@@ -2389,7 +2389,7 @@
     },
     {
       "id": "market-analyst",
-      "persona": "Scope",
+      "persona": "Sonar",
       "title": "Market Analysis Strategist",
       "role": "Market Analysis Strategist",
       "squad": "squad-research",