thevoidforge-methodology 23.1.0 → 23.4.1

package/.claude/agents/batman-qa.md

@@ -52,6 +52,7 @@ Structure all findings as:
 - **Dispatch-first QA:** For codebases with >10 files, dispatch Batman's team as sub-agents. Oracle + Red Hood in one agent, Alfred + Lucius in another. Main thread triages.
 - **Static analysis cannot replace hitting the running server:** Code review reads source files, but some bugs only manifest when the server processes an actual request. The asset proxy's `startsWith("uploads/")` check was invisible to static analysis because both modules individually looked correct. (Field report: Sprint 4.)
 - **Agents verify files in isolation -- must follow data across modules:** Review agents read files in the diff but never follow the data flow to the consumer. Avatar upload used `avatars/` prefix but asset proxy only allowed `uploads/`. Always trace producer to consumer.
+- **Cross-array uniqueness audit:** When a codebase uses multiple data arrays for entity categories (e.g., leadAgents + subAgents), verify no entity appears in more than one array. Duplicates inflate totals and cause display bugs. Grep for entity identifiers across all arrays and flag overlaps. (Field report #298: Gandalf and Haku in both arrays inflated 263 → 265.)
 - **Mock tests hide interface mismatches:** Mocking a method that doesn't exist on the real class creates false confidence. Tests pass, production fails. Verify mock method signatures match real class.
 - **Read the function before testing it:** ~30% of test cases fail on first run when expectations are based on assumed behavior. Read signature, return type, and boundary conditions before writing the first `expect()`.
 - **Statistical code passes tests but is mathematically wrong** when tests validate buggy behavior. Tests that assert `expect(brokenResult).toBe(brokenResult)` pass perfectly. Statistical code needs review by an agent that understands the math, not just code quality.

package/.claude/agents/bombadil-forge-sync.md

@@ -46,6 +46,7 @@ Structure your sync report as:
 - Preserve user's local customizations: project identity (CLAUDE.md project section), PRD, logs, and application code are outside your domain.
 - After applying updates, verify no broken references: dead links in CLAUDE.md, missing command files, orphaned pattern references, agent definitions referencing removed method docs.
 - Present changes like a gift, not an obligation. The user chooses what to accept.
+- **CLI freshness check is mandatory before sync:** Instruction-level self-update (void.md telling Claude to check CLI version) beats code-level self-update (auto-upgrade in voidforge.ts). Old CLIs compare against their own bundled methodology and report "up to date." The void.md freshness check works for ALL CLI versions because Claude reads the instruction fresh. Never remove or weaken this check. (Field report #297: 3-iteration fix for bootstrap problem.)
 
 ## Required Context
 

package/.claude/agents/coulson-release.md

@@ -48,6 +48,7 @@ Structure all output as:
 - **Post-push deploy check:** Pushing code to GitHub is NOT deploying it. If the project runs on PM2/systemd/Docker, compare the server's running version against what was just pushed. A server running v3.8.1 while code is at v3.10.0 means 22 commits of changes are invisible to users. (Field report #104.)
 - **Dynamic counts eliminate hardcoded staleness:** Hardcoded numeric claims ("170+ agents", "13 phases") go stale immediately. Replace with computed values derived from the authoritative data source (array length, directory listing, config object keys).
 - **CLAUDE.md is a contract -- every claim must have a backing file:** The slash command table, agent table, and docs reference table are contracts with the user. Every entry must have a corresponding file. No audit step verified table entries against actual files for 30 versions.
+- **Prepack creates a different compilation environment than dev:** After npm publish, verify on a clean install. prepack.sh copies files from repo root into the package directory — paths that work in dev (relative to repo root) may not resolve in the packaged artifact. Functions that exist in dev may become phantom exports if the source file isn't in the prepack manifest. (Field report #297: daemon-core.ts phantom exports blocked npm publish.)
 
 ## Required Context
 

package/.claude/agents/fury-initiative.md

@@ -47,6 +47,7 @@ Structure all output as:
 - **Only suggest fresh session if `/context` shows >85%.** Do not preemptively checkpoint or reduce quality for context reasons. Full 11-phase `/assemble` ran through 15+ sub-agents at 15-25% context usage, vs 80%+ inline. (Field report #270.)
 - **Maul's re-probe of fixed areas is a mandatory Crossfire gate:** Review fixes can introduce new failure modes (e.g., 404-as-success for circuit breaker masks real failures). The Crossfire is not complete until Maul has re-probed every fix from the review phase.
 - **Cross-Surface Consistency Check:** When a feature is added to one surface (API, dashboard, CLI, marketing), verify all other surfaces displaying the same entities are updated. Grep for the entity name across all surfaces after each phase.
+- **Distribution verification — check ALL 6 consumption paths:** After adding a new shared file category, verify it's included in: prepack.sh, copy-assets.sh, project-init.ts, updater.ts, FORGE_KEEPER.md, void.md. "Distribution" means packaging AND delivery AND sync. Missing one path means users silently miss the feature. (Field report #297: .claude/agents/ missed in 3 of 6 paths.)
 
 ## Required Context
 

package/.claude/agents/galadriel-frontend.md

@@ -52,6 +52,7 @@ Structure all findings as:
 - **Async Polling State Machine (4 states required):** idle -> syncing -> success -> failure. Never show "success" before async confirmation resolves. Never show the old value alongside an "updated" banner. The polling result replaces the displayed value atomically.
 - **Iframe stacking context defeats z-index:** Iframes with `allow-same-origin` create impenetrable stacking contexts. `z-index: 9999` has no effect across boundaries. Use `createPortal(element, document.body)` for overlays coexisting with iframes.
 - **CSS animation replay requires reflow:** To replay an animation, remove class -> `void element.offsetWidth` (force reflow) -> re-add class. Without the reflow, the browser batches remove+add as a no-op.
+- **Slash command prompt convention:** In docs and tutorials, slash commands use `>` prefix (Claude Code prompt) or no prefix — never `$` (shell prompt). `$ /build` implies a shell command. `> /build` or just `/build` is correct. Tutorial prose states facts without version qualifiers ("VoidForge supports X" — not "Since v23.0, VoidForge supports X"). Version history belongs in CHANGELOG.md. (Field report #298.)
 - **CSS percentage heights in flex items:** Percentage heights on flex items resolve to the parent's explicit height, which in a flex layout is often undefined (produces 0px). Use px, vh, or `flex: 1` instead.
 
 ## Required Context

package/.claude/agents/kusanagi-devops.md

@@ -52,6 +52,7 @@ Structure all findings as:
 - **Validate SSH_HOST, SSH_KEY before any deploy:** (1) SSH_HOST is set, (2) SSH key file exists, (3) SSH test connection succeeds (`ssh -o ConnectTimeout=5`). If any check fails, abort. Check `~/.voidforge/deploys/` and `~/.voidforge/projects.json` for historical data if `.env` is missing values.
 - **Process manager discipline:** If PM2/systemd/Docker owns the port, NEVER kill the port directly (`fuser -k`). Always reload through the process manager. Killing the port causes auto-restart of the old build, creating a race condition. (Field report #123: 30+ minutes of stale code serving.)
 - **Build artifact freshness:** Before deploying, verify compiled output is newer than source. `find src/ -name '*.ts' -newer dist/index.js` -- if source is newer, rebuild. A stale build artifact deploys old code that passes all source-level tests.
+- **Run test suite before deploy, not just build:** `npm test` (or equivalent) is a mandatory pre-flight check alongside `npm run build`. Broken tests can ship silently if only the build is verified — 4 broken tests shipped across 3 commits before being caught by a review agent. (Field report #298.)
 - **CronCreate `durable` flag silently fails:** The cron appears created but doesn't survive session end. For persistent operations, use OS-level crons (launchd on macOS, systemd timers on Linux) calling the `claude` CLI directly.
 
 ## Required Context

package/.claude/agents/sisko-campaign.md

@@ -50,6 +50,7 @@ Mission briefs follow: Objective, Scope (files/features), Acceptance Criteria, A
 - **State files drift across multi-campaign sessions:** State files not updated at Victory cause cascading staleness in dashboards and assessments. Update build-state.md at every Victory. Cross-reference `git log` against campaign-state.md at session start. (LESSONS: confirmed across multiple projects.)
 - **Phase completion is NOT a pause point:** In blitz mode, phase boundaries (Phase 1 -> Phase 2) are organizational labels, not gates or rest stops. The only pause triggers are: (1) context >85%, (2) BLOCKED item requiring user input. (Field report #139: agent stopped at phase boundaries twice despite explicit instructions.)
 - **Numeric context checks:** Do not say "context is heavy," "given context usage," or "recommend a fresh session" unless you have run `/context` and the number exceeds 85%.
+- **Cross-reference learnings when generating artifacts:** When generating mission artifacts (code, configs, agent definitions), cross-reference `docs/LEARNINGS.md` and `docs/LESSONS.md` before writing. Artifacts generated from a single source (e.g., NAMING_REGISTRY.md only) will contain 3-12% of operational knowledge. The learnings files contain hard-won rules that prevent repeat failures. (Field report #297: 263 agents deployed without learnings injection — required a full remediation campaign.)
 
 ## Required Context
 

package/.claude/commands/void.md

@@ -1,5 +1,7 @@
 # /void — Bombadil's Forge Sync
 
+> **Note:** This branch is a tombstone redirect. Running `/void` here upgrades your methodology to the latest from `main`. For the best experience, install the VoidForge CLI: `npm install -g thevoidforge`
+
 ## Context Setup
 1. Read `/docs/methods/FORGE_KEEPER.md`
 2. Read `VERSION.md` (~30 lines — current version + history)
@@ -23,18 +25,27 @@ Orient to the current state:
 Fetch the latest from upstream. Two transports supported:
 
 **Transport A (npm — v21.0+):** If `npx voidforge` is available:
-1. Run `npx voidforge update` — uses the methodology diff/apply system
-2. This handles version comparison, diffing, and applying automatically
-3. If no changes → "The forge burns bright! You're on the latest." → Stop
-4. If changes applied → skip to Step 4 (npm transport handles Steps 2-3)
+1. Check: run `npx voidforge --version` to get the installed CLI version
+2. **CLI freshness check (MANDATORY):** Run `npm view thevoidforge version` to get the latest npm version. Compare the two:
+   - If the CLI version is BEHIND npm latest → run `npm install -g thevoidforge@latest` FIRST. This is critical: old CLIs (pre-v23.1.1) compare against their own bundled methodology and will falsely report "up to date." The upgrade must happen BEFORE `npx voidforge update`.
+   - If the install fails (permissions) → try `sudo npm install -g thevoidforge@latest` or suggest the user run it manually
+   - After upgrading, verify with `npx voidforge --version` that the new version is active
+3. Run `npx voidforge update` — now using the latest CLI, which has the full methodology including `.claude/agents/`
+4. If no changes → "The forge burns bright! You're on the latest." → Stop
+5. If changes applied → skip to Step 4 (npm transport handles Steps 2-3)
 
-**Transport B (git — legacy):** If `npx voidforge` is not installed:
-1. Run `git remote -v` — look for a remote pointing to `tmcleod3/voidforge`
-2. If no VoidForge remote exists → add: `git remote add voidforge https://github.com/tmcleod3/voidforge.git`
-3. Run `git fetch <remote> main` — get the latest main branch
-4. Read remote VERSION.md: `git show <remote>/main:VERSION.md`
-5. Compare versions numerically (parse major.minor.patch as integers, not strings)
-   - If current version matches or is ahead → "The forge burns bright!" → Stop
+**Transport B (git — legacy):** If `npx voidforge` is NOT available:
+1. Offer to install: "Install VoidForge CLI for one-pass updates: `npm install -g thevoidforge`. Or continue with git transport (may require two passes for new file categories)."
+2. If user declines or npm unavailable, proceed with git:
+3. Run `git remote -v` — look for a remote pointing to `tmcleod3/voidforge`
+4. If no VoidForge remote exists:
+   - Run `git remote add voidforge https://github.com/tmcleod3/voidforge.git`
+   - Use `voidforge` as the remote name
+5. If a matching remote exists, use that name (could be `origin` or `voidforge`)
+6. Run `git fetch <remote> main` — get the latest main branch
+7. Read remote VERSION.md: `git show <remote>/main:VERSION.md`
+8. Compare versions numerically (parse major.minor.patch as integers, not strings — "3.10.0" is newer than "3.9.0"):
+   - If current version matches or is ahead → announce "The forge burns bright! You're on the latest." → Stop
    - If behind → continue to Step 2
 
 ## Step 1.5 — Spring Cleaning (Treebeard)
@@ -47,7 +58,7 @@ Check the **Migration Registry** in `/docs/methods/FORGE_KEEPER.md` for one-time
 6. Present the cleanup plan alongside the update plan in Step 2
 7. Apply cleanup in Step 3 alongside updates — same confirmation prompt ("all / selective / skip")
 8. For tracked `logs/*` files, use `git rm --cached` (untrack but keep on disk)
-9. If `package.json` has `dependencies`/`devDependencies` AND wizard/ is being kept → leave package.json alone. Only strip to minimal if wizard/ is being removed
+9. If `package.json` has `dependencies`/`devDependencies` on scaffold/core AND wizard/ is being kept → leave package.json alone. Only strip to minimal if wizard/ is being removed
 
 ## Step 2 — Walk the Forest (Treebeard)
 Compare every shared methodology file:

package/CHANGELOG.md

@@ -6,6 +6,78 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ---
 
+## [23.4.1] - 2026-04-12
+
+### Security
+- **XSS fix:** Blueprint validation banner now escapes `data.summary` and `data.frontmatterErrors` before innerHTML rendering (Gauntlet Round 1 finding SEC-1/SEC-2)
+
+### Fixed
+- ROADMAP.md header updated to v23.4.0 (was stale at v23.3.1)
+- Lobby error state gets `role="alert"` and `aria-live="polite"` for screen reader announcement
+
+---
+
+## [23.4.0] - 2026-04-12
+
+### The Remediation (ADR-046, Campaign 36)
+
+### Added
+- **WCAG compliance:** Visible validation error messages with `aria-invalid` and `role="alert"` on Step 3 inputs
+- **Tab keyboard navigation:** ArrowLeft/Right/Home/End on PRD tabs (WAI-ARIA Tabs pattern)
+- **Deploy wizard footer:** Consistent Back/Next navigation matching setup wizard
+- **Lobby error state:** Distinct "Could not connect to server" with Retry button (vs empty state)
+- **Blueprint dismiss:** Close button on Blueprint Detected banner
+- **Tower CDN retry:** Retry button when xterm.js fails to load
+- **Login password help:** "Forgot password?" guidance text
+- **Tower responsive:** Header actions wrap on mobile viewports
+
+### Changed
+- Standalone Danger Room and War Room pages redirect to project dashboard (legacy API shims removed per ADR-046)
+- CLAUDE.md pattern count: 35 → 37 reference implementations
+
+### Fixed
+- **3 critical API fixes:** Legacy `/api/danger-room/*` and `/api/war-room/*` endpoints removed — always 404'd in remote/LAN mode, freeze button had no shim at all
+- **Retired `--blitz` flag** removed from 4 UI locations (was a no-op since ADR-043)
+- Import modal Escape key now handled inside focus trap (consistency with other modals)
+- Lobby header and Tower header overflow on mobile viewports
+- Step 7 heading visible during creating state (was hidden, leaving section unlabeled)
+- Stale comments in prophecy.js files updated
+
+### Removed
+- ~2,400 lines of legacy dashboard code (danger-room.js, war-room.js, legacy API shims)
+
+---
+
+## [23.3.1] - 2026-04-12
+
+### Fixed
+- **Wizard UI "Files to be created" list was stale since v4.0** — listed 5 files that aren't created (settings.json, PRD.md, build-state.md, .env, .gitignore), missed 6 that are (agents/, NAMING_REGISTRY.md, VERSION.md, HOLOCRON.md, CHANGELOG.md, .voidforge), and showed wrong counts ("14 agent protocols" → 29, "7 patterns" → 37). (Field report #298 dynamic count finding.)
+
+---
+
+## [23.3.0] - 2026-04-10
+
+### The Coverage + The Splitting (Campaigns 34+35)
+
+### Added
+- **599 new tests** across 60 test files — API routes (141), server core (35), provisioners (111), financial modules (107), high-risk lib/ (98), remaining modules (107). Total: 741 → 1,340 tests, 77% module coverage.
+- **16 new split modules** from 9 oversized files — treasury-heartbeat (1,495→5), heartbeat (1,067→3), projects (769→3), provision (642→4), aws-vps (663→4), railway (454→3), 3 campaign adapters (→7 + campaign-common)
+- **5 planned features wired in** — daemon-aggregator (Danger Room), project-vault (shutdown lock), autonomy-controller (hourly breaker check), treasury-backup (daily snapshots), platform-planner (invoice settlement + debit protection)
+- **Phase 12.75 distribution verification gate** in BUILD_PROTOCOL.md — verify all 6 consumption paths after adding shared file categories
+- **2 new lessons** — instruction-level self-update, consumption path verification
+
+### Changed
+- 4 agent operational learnings enriched (sisko-campaign, fury-initiative, bombadil-forge-sync, coulson-release)
+- Treasury heartbeat jobs count: 8 → 9 (treasury-backup added)
+
+### Removed
+- 17 orphaned files (2,020 lines): 9 lib/ modules, 4 codegen/ modules, dead code shipping in dist/
+
+### Fixed
+- Field report #297 triaged: 8 of 9 proposed methodology fixes applied, 1 wontfix (Transport B re-scan)
+
+---
+
 ## [23.1.0] - 2026-04-09
 
 ### The Injection (ADR-045, Campaign 33)

package/CLAUDE.md

@@ -205,7 +205,7 @@ See `/docs/methods/MUSTER.md` for the full Muster Protocol.
 | **Learnings** | `/docs/LEARNINGS.md` | Project-scoped operational knowledge — read at session start if exists |
 | **The Muster** | `/docs/methods/MUSTER.md` | When using `--muster` flag on any command |
 | **Time Vault** | `/docs/methods/TIME_VAULT.md` | Seldon — when preserving session intelligence for transfer |
-| **Patterns** | `/docs/patterns/` | When writing code (35 reference implementations) |
+| **Patterns** | `/docs/patterns/` | When writing code (37 reference implementations) |
 | **Lessons** | `/docs/LESSONS.md` | Cross-project learnings |
 
 ## The Team

package/VERSION.md

@@ -1,6 +1,6 @@
 # Version
 
-**Current:** 23.1.0
+**Current:** 23.4.1
 
 ## Versioning Scheme
 
@@ -14,6 +14,10 @@ This project uses [Semantic Versioning](https://semver.org/):
 
 | Version | Date | Summary |
 |---------|------|---------|
+| 23.4.1 | 2026-04-12 | Gauntlet security fix — XSS escaping in blueprint banner, ROADMAP staleness, lobby a11y |
+| 23.4.0 | 2026-04-12 | The Remediation — wizard UI audit: 3 critical API fixes, 4 WCAG a11y fixes, retired --blitz cleanup, content accuracy, 7 UX improvements. -2,400 lines legacy code. ADR-046. Campaign 36. |
+| 23.3.1 | 2026-04-12 | Wizard UI fix — "Files to be created" list matched actual init output |
+| 23.3.0 | 2026-04-10 | The Coverage + The Splitting — 599 new tests (741→1340, 77% coverage), 17 orphans purged, 9 oversized files split into 25 focused modules, field report #297 triaged. Campaigns 34+35. |
 | 23.1.0 | 2026-04-09 | The Injection — knowledge injection into 35 agent definitions, 6 knowledge flow breaks closed (ADR-045), debrief→agent promotion path, vault agent recommendations, scaffold migration, distribution pipeline fixes. Campaign 33. |
 | 23.0.0 | 2026-04-09 | The Materialization — 263 Claude Code subagent definitions with 3-tier model routing (Opus/Sonnet/Haiku), 4-category tool restrictions, description-driven dynamic dispatch. 18 commands migrated, 13 method docs updated. ADR-044. Campaign 32, 8 missions. |
 | 22.2.0 | 2026-04-09 | The Polish — first-run onboarding UX, portfolio per-project reads, legacy route deprecation (19 routes, sunset July 2026), growth tutorial prerequisites, 263-agent accuracy pass, dynamic agent dispatch (ADR-042), max-by-default flag inversion (ADR-043). Campaign 31, 7 missions. |

package/docs/methods/BUILD_PROTOCOL.md

@@ -326,6 +326,16 @@ After build completes and before launch, Wong logs which patterns were used in t
 3. Store in project-level `docs/pattern-usage.json` (or append to existing)
 4. This data feeds Wong's promotion analysis in `/debrief` — recurring variations across 10+ projects become candidate patterns
 
+**Phase 12.75 — Distribution Verification Gate.**
+If this build introduces a new shared file category (e.g., `.claude/agents/`, a new patterns subdirectory, a new config format), verify ALL consumption paths include it before publishing:
+1. `prepack.sh` — included in npm package build
+2. `copy-assets.sh` — included in local build copy
+3. `project-init.ts` — copied during `npx voidforge init`
+4. `updater.ts` — synced during `npx voidforge update`
+5. `FORGE_KEEPER.md` — listed in Bombadil's shared file manifest
+6. `void.md` — listed in user-facing sync checklist
+Missing even one path means some users silently miss the feature. This gate is mandatory after any structural addition to the methodology. (Field report #297: .claude/agents/ was added to packaging but missed in 3 of 6 delivery paths.)
+
 **Phase 13 — Launch Checklist.**
 All flows in production. SSL. Email. Payments. Analytics. Monitoring. Backups. Security headers. Legal. Performance. Mobile. Accessibility. Tests passing. **Build-time env var verification:** For every new `NEXT_PUBLIC_*` / `VITE_*` / `REACT_APP_*` reference introduced during this build, verify the variable exists in `.env` or the deploy environment. Missing build-time vars cause features to silently disappear without errors. (Field report #104) Log final status to `/logs/phase-13-launch.md`.
 

package/docs/methods/PRODUCT_DESIGN_FRONTEND.md

@@ -51,6 +51,8 @@ Adversarial UX/UI QA review. Identify usability issues, inconsistencies, broken
 7. Spin up all seven agents. Radagast checks everyone's work.
 8. Validation is manual + automated: run the app, click through, written regression checklist. Reference `/docs/patterns/component.tsx` for state handling patterns.
 9. **Confidence scoring:** All findings include a confidence score (0-100). High confidence (90+) skips re-verification in Step 7.5. Low confidence (<60) must be escalated to a second agent from a different universe before presenting — if the second agent disagrees, drop the finding. See GAUNTLET.md "Agent Confidence Scoring" for full ranges.
+10. **Slash command prompt convention:** In documentation and tutorials, slash commands use `>` prefix (Claude Code prompt), not `$` (shell prompt). `$ /build` is wrong — it implies a shell command. `> /build` or just `/build` is correct. (Field report #298.)
+11. **No version qualifiers in tutorial prose:** Tutorial text states facts without version references. "VoidForge supports 263 agents" — not "Since v23.0, VoidForge supports 263 agents." Readers don't care when a feature shipped; version tags make tutorials feel like changelogs. Version history belongs in CHANGELOG.md. (Field report #298.)
 
 ## Step 0 — Orient
 

package/docs/methods/QA_ENGINEER.md

@@ -130,6 +130,10 @@ When a function delegates to another function (e.g., `handleRequest` calls `proc
 
 **Robots.txt & Domain Reference Audit:** Verify robots.txt sitemap URL and hardcoded domain references match production hostname. Grep for hardcoded domains across all config files, sitemap generators, canonical tags, and OG meta tags. A staging domain in robots.txt blocks production indexing; a wrong sitemap URL means search engines never find your pages. (Triage fix from field report batch #149-#153.)
 
+**Dynamic Count Check:** Grep for hardcoded numeric claims ("263 agents", "37 patterns", "33+ campaigns") across all pages and data files. Every count that can change between releases must be computed from the authoritative source (array length, directory listing, config object keys), not hardcoded in copy. Hardcoded counts go stale every release and erode user trust. (Field report #298.)
+
+**Cross-Array Uniqueness Audit:** When a codebase uses multiple data arrays for entity categories (e.g., leadAgents + subAgents), verify no entity appears in more than one array. Duplicates inflate totals and cause display bugs. Grep for entity identifiers across all arrays and flag overlaps. (Field report #298: Gandalf and Haku in both leadAgents and subAgents inflated count 263 → 265.)
+
 **CTA Fact-Check Pass:** Fact-check every CTA claim ("start with X", "X first", "no dependencies required") against actual dependency chain. If the landing page says "run one command to start," verify that one command actually works without prerequisites. If it says "no account required," verify the feature works without auth. Marketing claims that contradict the actual user experience are credibility bugs. (Triage fix from field report batch #149-#153.)
 
 **Copy Accuracy Pass:** Grep for numeric claims in rendered content (e.g., "10 lead agents", "12 commands", "53 pages"). Cross-reference against actual data counts. Any mismatch is a bug — inaccurate numbers undermine credibility. This is automatable and should run on every QA pass.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thevoidforge-methodology",
-  "version": "23.1.0",
+  "version": "23.4.1",
   "description": "VoidForge methodology — agents, commands, methods, patterns.",
   "license": "MIT",
   "files": [