THE PROPHECY
What has been forged. What is being forged. What will be forged.
Old Tom Bombadil has watched the forge from the beginning.130 versions across 23 major eras. From 150 named agents to 264+. From a text file to a living methodology. The river keeps flowing, and old Tom keeps singing.
BombadilSHIPPED
“In the beginning, there was nothing. And then someone typed /build.”— Picard
It begins.— 2026-03-10
6 agent protocols with named characters150+ named sub-agents across 5 universes13-phase build protocol with verification gatesInitial methodology framework
“The forge learned to listen. Commands, patterns, wizards. It went from a tool to a system.”— Stark
Slash commands. Code patterns. PRD frontmatter. The forge learns to listen.— 2026-03-10
Slash command framework (/build, /qa, /security, /ux, /devops, /architect)Testing protocol with framework mapping7 code patterns (API route, service, component, middleware, error handling, job queue, multi-tenant)PRD frontmatter for conditional build phasesAgent tool orchestration and troubleshooting guide
Interactive wizards. Encrypted vault. Real cloud provisioning. The forge can build AND deploy.— 2026-03-12
Gandalf's setup wizard — browser-based onboarding with PRD generationHaku's deploy wizard — 6 targets (Docker, AWS VPS, Vercel, Railway, Cloudflare, Static)AES-256-GCM encrypted credential vaultAuto-provisioning: EC2, RDS, ElastiCache, S3/git command — Coulson's release management with semver and changelogRenamed project to VoidForge — "from nothing, everything"
“Seven universes. Thirteen phases. One hundred and seventy agents. The forge became a world.”— Fury
Three tiers. One methodology. The knowledge crystallizes.— 2026-03-12
The VoidForge Holocron — complete 9-chapter user guideThree-tier distribution: main (full), scaffold (methodology), core (ultra-light)Branch sync enforcement — shared files propagate across all tiersREADME as system reference document
DNS wiring. Domain registration. 43 security findings resolved. Production-grade.— 2026-03-13
EC2 instance sizing based on workloadCloudflare DNS wiring with automatic CNAME/A recordsPlatform domain registration via Cloudflare Registrar APIAsync resource polling for RDS/ElastiCache provisioning43-finding security hardening passFix silent PRD truncation with model-aware max tokens
Reviews get reviewed. Batman runs it twice. Trust nothing the first time.— 2026-03-13
Double-pass review cycle: find → fix → re-verify/test command — Batman's test-writing mode/review command — Picard's code review3 new sub-agents added to the rosterParallelized analysis across review agents1M context window adaptation
Chani rides the sandworm. Bombadil syncs the forge. The desert awakens.— 2026-03-14
/thumper — Telegram bridge with Gom Jabbar authenticationDune universe added (7th universe, 9th lead agent)/void — Bombadil's self-update commandCross-methodology hardening from Kongo.io lessons170+ named characters across 7 universes
One command to rule them all. Fury assembles the full pipeline.— 2026-03-14
/assemble — full pipeline: architect → build → 3x review → UX → 2x security → devops → QA → test → crossfire → councilFury (Nick Fury) joins as 10th lead agent12 total slash commandsCouncil vote: all leads must sign off before shippingCrossfire protocol: agents challenge each other's findings
End-to-end deploy. Every target. No hand-holding required.— 2026-03-14
End-to-end deploy automation for all 6 targetsGitHub integration for CI/CD workflowsSSH deploy with rollback capabilityHaku's deploy wizard handles the full lifecycle
The Emissary arrives. Read the PRD. Pick a mission. Win the war.— 2026-03-14
/campaign — autonomous PRD-to-product mission sequencingSisko (Benjamin Sisko, DS9) joins as 11th lead agent13 total slash commandsMission-by-mission execution with /assemble per missionKira recon, Dax analysis, Odo prerequisites, Sisko command
“Reliability. Observability. Imagination. The forge stopped building things and started building itself.”— Celebrimbor
The forge hardens. Pre-deploy builds. CI/CD generation. Env validation. The foundation becomes unbreakable.— 2026-03-14
Pre-deploy build step — verify before you shipCI/CD pipeline generation (GitHub Actions, Railway)Environment variable validation at build timeRailway API migration for smoother deploysCredential scoping — keys isolated per deploy target
The forge can see itself. Deploy logs. Cost estimation. Health monitoring. Sentry integration.— 2026-03-14
Deploy log streaming with real-time outputCost estimation before provisioningHealth monitoring and uptime checksSentry error tracking integration
The developer experience levels up. Prisma types. OpenAPI docs. ERD generation. Database seeding.— 2026-03-14
Prisma type generation for typed database queriesOpenAPI documentation generationERD (Entity Relationship Diagram) generationIntegration templates for common servicesDatabase seeding for development environments
The forge learns to see. Celebrimbor generates images. Bashir writes post-mortems. The methodology heals itself.— 2026-03-15
/imagine — Celebrimbor's AI image generation from PRD descriptions/debrief — Bashir's post-mortem analysis and upstream feedbackCelebrimbor (Lord of Eregion) joins as 12th lead agentBashir (Julian Bashir, DS9) joins as 13th lead agent7 new sub-agents across Tolkien and Star Trek15 total slash commands
The forge learns to delight. Éowyn reviews every micro-moment. Transitions breathe. Empty states invite.— 2026-03-15
Éowyn's Enchantment Review — Step 1.75 in /ux pipelineMicro-interaction audit: transitions, empty states, loading anticipationMotion language consistency checksBrand resonance in the first 5 seconds
“The forge learned from its wounds. Every field report made it stronger. Every failure became a lesson.”— Bashir
Thanos arrives. The Gauntlet tests everything. Gimli optimizes every image. The forge heals from its own field reports — and then puts itself through hell.— 2026-03-15
/gauntlet — Thanos's Comprehensive Review: 5 rounds, 30+ agents, every domain testedThanos (The Mad Titan) joins as 14th lead agent16 total slash commandsGimli's image optimization — Step 5.5 in /imagine: resize, WebP, <200KB per imageComplexity-first mission ordering in /campaign — hard features firstÉowyn's Enchantment Review — Step 1.75 in /ux for delight and micro-interactionsField report integration — Issues #4, #5, #6, #8, #9 implemented upstream
“The forge built a castle around itself. Walls, gates, watchtowers. Now it defends what it creates.”— Kenobi
The forge gets a command center. The Lobby dashboard. Project registry. Health polling. The forge manages itself.— 2026-03-15
The Lobby dashboard — multi-project management interfaceProject registry with health polling and status trackingImport flow for onboarding existing projectsSSRF protection on all internal service calls
The tower gets walls. Five layers of security. TOTP 2FA. Self-deploy. Audit trail. The forge defends itself.— 2026-03-15
5-layer security architecture for remote accessTOTP 2FA authentication (two-password architecture)Self-deploy capability — the forge provisions its own infrastructureComprehensive audit trail for all operationsGauntlet build-output verification — field report #9 implemented
Merlin → Gandalf (setup wizards merged into edge case handling)Camelot → Avengers Tower naming across all referencesGreat Hall → The Lobby, Round Table → The Penthouse9 methodology fixes from field reports #4, #5, #6, #8, #9, #10, #13
“The forge doesn't just build for one. It builds for many. Roles, permissions, coordination. Scale demands structure.”— Picard
The forge gets executive floors. Multi-user RBAC. Per-project ACLs. Linked services. The forge becomes enterprise.— 2026-03-15
Multi-user role-based access control (RBAC)Per-project access control lists (ACLs)Linked services — coordinated deploys across projectsRollback capability for linked service groupsCost tracker and agent memory across projects
Three-act wizard redesign plan for onboardingResilience Pack reclassification of deployment features9 methodology fixes from downstream field reportsPreview deploy gate added to /devops protocolTailwind v4 source() directive documented in troubleshooting
The wizard learns a new dance. Three acts. One flow. Simple and advanced become one.— 2026-03-15
Three-act wizard flow replaces simple/advanced splitOperations menu for post-deploy managementResilience Pack — deploy features reclassified as core infrastructureSimplified onboarding experience
Thanos forges the Gauntlet from battle scars. 31 code fixes. 11 methodology fixes. 7 enchantments. WCAG AA. The forge earns its armor.— 2026-03-15
31 code fixes from Gauntlet review findings11 methodology fixes across agent protocols7 enchantments — micro-interactions, transitions, delight momentsWCAG AA compliance across all interactive elementsv8.0+ roadmap defined (The Hive Mind, The Multiverse, The Singularity)
Fix Avengers Tower terminal crash on Node.js v24node-pty upgraded from 1.1.0 to 1.2.0-beta.12
Avengers Tower gets a renovation. WebSocket library. Vault unlock. Build-state in the Lobby. Sisko gets blitz mode.— 2026-03-16
WebSocket library migration (ws) for Avengers TowerVault unlock flow improvementsBuild-state visibility in The Lobby dashboard/campaign --blitz — full autonomous mode: skip confirmations, auto-continue between missionsIPv6 connectivity fix for remote access
--blitz no longer implies --fast — full review quality preserved in autonomous mode--blitz and --fast are now independent flags (combine explicitly for speed + autonomy)Auto-debrief after each blitz mission (/debrief --submit) — learnings captured while context is fresh
Twenty methodology fixes from the field. Hawkeye gets smoke tests. Éowyn gets enchantments in the Gauntlet. The forge hardens from battle.— 2026-03-16
Hawkeye's runtime smoke test added to /assemble (Phase 2.5)Éowyn's enchantment emphasis via --ux-extra in /gauntletTroi's PRD compliance check in the Council20 methodology fixes across 7 agent protocols
15 fixes from upstream field reports (issues #31–#34)Gauntlet round structure refinedCampaign mission ordering improvementsSub-agent protocol hardening
Chani upgrades the thumper. Inline keyboard. Bot personalization. Water-rings fix. The desert gets a command center.— 2026-03-16
Telegram inline keyboard grid for all 15 VoidForge commandsBot personalization — name, description, command menu, DALL-E avatarClaude-native /thumper setup flow — no manual BotFather stepsWater-rings stop hook for turn completion notificationsCommand-doc sync check (Friday) in /git releases
19 fixes from field reports #36–#40Vault awareness in /campaign and /build pre-flightAnonymity invariant check in security auditDeployment verification in /assemble (field report #37)WCAG contrast verification protocol for Samwise
HOLOCRON credentials flow documentationv7.6 Vault Pipeline roadmap defined
Triage of field reports #42–#44Vault key naming conventions documentedOutbound URL safety checks in security auditAccordion a11y pattern added to component reference
Deploy --env-only. Standalone vault reader. PTY cleanup. The forge manages its own credentials.— 2026-03-16
deploy --env-only — write vault credentials to .env without full provisioningStandalone vault reader for credential extractionPTY cleanup and process management improvementsengines field added to package.json (>=20.11.0)
Architecture doc refresh. Server auto-restart detection. COMPATIBILITY.md. The forge tidies up.— 2026-03-16
Architecture documentation refreshServer auto-restart detection in smoke testsCOMPATIBILITY.md for Node.js version requirementsContext pressure fix — actual usage checks, not heuristics
“The forge remembers. Every lesson, every failure, every triumph. It reads its own history and fights smarter the next time.”— Sisko
The forge remembers. Agent Memory reads lessons. Conflict Prediction catches mistakes early. /prd generates PRDs from conversation.— 2026-03-16
Agent Memory — active LESSONS.md read-back in /qa, /review, /security, /uxConflict Prediction — Phase 0.5 scans PRD for 8 structural contradictions/prd command — Sisko's 5-act structured interview to generate complete PRDs17 total slash commands
16 fixes from field reports #46–#53Quality Reduction Anti-Pattern — agents can never reduce quality based on context pressureengines >=20.11.0 enforced across all tiers9 methodology fixes across agent protocols
Ten new agents activated. Troi reads the PRD. Celeborn governs the design system. The roster deepens.— 2026-03-16
Troi (PRD compliance verification in Phase 0 and Council)Padmé (functional verification in build gates)Celeborn (design system governance in /ux)Worf (security implications in /architect)Riker (ADR review in /architect)Torres (performance architecture in /architect)Cyborg (integration testing in /qa)Raven (deep analysis bugs in /qa)Wonder Woman (code-vs-behavior truth detection in /qa)Valkyrie (disaster recovery in /devops)
Extended DC Roster — Flash, Batgirl, Green Arrow, Huntress, Aquaman, Superman, Green Lantern, Martian ManhunterExtended Star Wars Roster — Qui-Gon, Han, Anakin, Bo-Katan, Din Djarin, Bail Organa, Cassian, SabineExtended Tolkien Roster — Aragorn, Faramir, Pippin, Boromir, Haldir, Glorfindel, Frodo, MerryExtended Anime Roster — Vegeta, Trunks, Mikasa, Erwin, Mustang, Olivier, Hughes, Calcifer, DuoExtended Marvel Roster — T'Challa, Wanda, Shuri, Rocket, Okoye, Falcon, BuckyExtended Star Trek Roster — Janeway, Tuvok, Crusher, Archer, Kim, Pike
Extended agents integrated into /qa, /security, /ux, /architect commandsExtended agents integrated into /gauntlet, /assemble, /campaign pipelinesPhase 0.5 First Strike added to /security (Han + Cassian)Security re-verification expanded to Maul + Anakin + Din Djarin
The forge improves itself. Wong promotes lessons to method docs. Custom sub-agents join the roster.— 2026-03-16
Self-improving methodology — Wong analyzes lesson clusters and drafts method doc promotionsCustom sub-agents — user-defined specialists via CUSTOM_AGENTS.mdLesson promotion pipeline — 3+ same-category lessons auto-draft updates
The forge runs itself. Git tags before every mission. Rollback on critical findings. Five-mission checkpoints.— 2026-03-16
/campaign --autonomous — supervised autonomy with git tags and rollback/campaign --continuous — chain campaigns within a major versionCritical-finding rollback to pre-mission tag5-mission human checkpoints for long campaigns
“One forge. Many languages. Many platforms. The methodology transcends the stack.”— Picard
META_WORKFLOW.md. Pattern evolution. /imagine key persistence. The forge documents how to develop itself.— 2026-03-17
META_WORKFLOW.md — how to use VoidForge to develop VoidForgePattern evolution data collection — Wong's Phase 12.5/imagine API key persistence to .env.local (field report #62)Pattern usage logging across campaigns
Python joins the forge. Django DRF and FastAPI deep-dives in all 8 patterns. The methodology speaks a new language.— 2026-03-17
Django DRF + FastAPI code examples in all 8 existing patternsPython framework detection in Build Protocol Phase 0Django middleware, Celery tasks, django-tenants patternsFastAPI dependencies, ARQ workers, SQLAlchemy services
iOS and Android join the forge. React Native patterns. Mobile QA, UX, and security checklists. The forge goes mobile.— 2026-03-17
mobile-screen.tsx — React Native screen pattern with safe area and 4 statesmobile-service.ts — Offline-first data with sync queue and conflict resolutionMobile QA checklist (orientation, deep links, push, offline, app lifecycle)Mobile security checklist (cert pinning, secure storage, jailbreak detection)3 conditional mobile agents (Uhura-Mobile, Samwise-Mobile, Rex-Mobile)
Games join the forge. Fixed-timestep loops. State machines. Entity Component Systems. The forge plays.— 2026-03-17
game-loop.ts — Fixed-timestep game loop with interpolation and pause/resumegame-state.ts — Hierarchical state machine with save/load serializationgame-entity.ts — Entity Component System with component stores and systems12-phase game build adaptation in Build ProtocolGame QA checklist (frame rate, input latency, speedrun exploits)Game UX/game feel checklist (juice, controller support, death feedback)4 game agents (Spike-GameDev, Eowyn-GameFeel, Deathstroke-Exploit, L-Profiler)
“The forge watches itself work. Confidence scores. Agent debates. Living PRDs. The methodology becomes self-aware.”— Thanos
Mission control dashboard. Five core panels. WebSocket real-time feed. Agent activity ticker. The forge watches itself work.— 2026-03-17
Mission control dashboard with 5 core panelsWebSocket real-time feed for live agent activityAgent activity ticker — see every agent launch in real-timeLiving PRD — PRD evolves with the build, Troi checks two-wayOne Mission One Commit anti-pattern enforcement
Agent confidence scoring (0-100) — low-confidence findings get second opinionsAgent debate protocol — structured 3-exchange disagreement resolution/prd --challenge — Boromir argues against the PRD before buildingCross-project memory — global lessons persist across all projectsBuild archaeology — trace production bugs back through the build protocol
Live WebSocket feeds. Confidence scoring in commands. Agent debates. Living PRD gates.— 2026-03-17
Danger Room data feeds + feature enforcementLive WebSocket integrationConfidence scoring in all review commandsAgent debate protocol in findings
Natural Language Deploy. Methodology A/B Testing. Prophecy Visualizer. Ideas documented but not yet built.— 2026-03-17
Natural Language Deploy conceptMethodology A/B Testing conceptProphecy Visualizer concept
“The forge grows what it builds. The Cosmere awakens. Marketing, treasury, growth — the forge becomes a business.”— Kelsier
The Cosmere awakens. Kelsier leads growth. Dockson manages money. 18 agents. 6-phase growth protocol. Financial vault with TOTP 2FA.— 2026-03-18
8th Universe: Cosmere (Brandon Sanderson) — 18 growth/marketing/treasury agentsKelsier joins as 15th lead agent (Growth Strategist)Dockson joins as 16th lead agent (Treasury)/grow command — 6-phase growth protocol/cultivation — installable autonomous growth engineFinancial vault with TOTP 2FA and safety tiers
Dockson opens the books. Revenue adapters. Heartbeat daemon. Reconciliation engine. The forge manages its own money.— 2026-03-18
/treasury command — revenue ingest, budget allocation, spend executionHeartbeat daemon for automated financial monitoringReconciliation engine — daily spend-to-budget matchingRevenue adapters for Stripe, Paddle, bank APIs
Six ad platform adapters. Campaign state machine. Spend execution pipeline. Compliance framework.— 2026-03-18
6 ad platform adapters (Meta, Google, TikTok, LinkedIn, Twitter, Reddit)Campaign state machine — create, test, measure, optimize, scaleSpend execution pipeline with budget enforcementCompliance framework — GDPR, CAN-SPAM, platform ToS
/portfolio command. Mercury/Brex adapters. Anomaly detection. Encrypted backup. Desktop notifications.— 2026-03-18
/portfolio command — cross-project financial dashboardMercury and Brex bank adaptersAnomaly detection in spend patternsEncrypted financial backupDesktop notifications for budget alerts
“The forge sees everything. Deep Current scans, analyzes, proposes. Autonomous intelligence that thinks about what to build next.”— Tuvok
Autonomous campaign intelligence. /current command. Site scanner. Situation model. Cold start intake. The forge thinks about what to build next.— 2026-03-18
Tuvok promoted to 17th lead agent (Deep Current)/current command — autonomous campaign intelligenceSite scanner — crawl and analyze any URLSituation model — persistent market understandingCold start intake for new projects
Seven's gap analysis. Campaign proposal generator. Tier 1 advisory mode.— 2026-03-18
Seven's gap analysis — identify growth opportunities from situation modelCampaign proposal generator with budget and ROAS estimatesTier 1 advisory — suggests but doesn't execute
Chakotay's correlation engine. Prediction tracking. Cross-pipeline data flow.— 2026-03-18
Chakotay's correlation engine — links actions to outcomesPrediction tracking — did the proposal's ROAS estimate hold?Cross-pipeline data flow between growth and treasury
Paris's route optimizer. Finds the fastest path to growth targets.— 2026-03-18
Paris's route optimizer — sequences campaigns for maximum impactBudget allocation optimization across channelsSeasonal and trend-aware scheduling
Route optimizer. Tier 2/3 autonomy. Circuit breakers. Kill switch. Deploy freeze. The forge runs itself.— 2026-03-18
Tier 2 autonomy — execute approved campaigns without human confirmationTier 3 autonomy — full autonomous growth with circuit breakersKill switch — /treasury --freeze stops all automated spendingDeploy freeze — pause all automated actions during incidents
/dangerroom command file — was listed in CLAUDE.md but the command never existedTier column (All/Full) in CLAUDE.md Slash Commands tableWizard prerequisite checks on /cultivation, /grow, /treasury, /portfolio, /currentBuild-time env var verification in Phase 13 and Gauntlet smoke test (field report #104)Post-push deploy check in Release Manager (field report #104)
Agent deployment manifests: /review gets 20+ agents, /devops gets 16, /assemble gets 80+ documented. Every command knows its full team.— 2026-03-19
Agent deployment manifests in /review (4 review teams, 20+ agents)Agent deployment manifests in /devops (16 agents across anime universe)Agent deployment manifests in /assemble (80+ agents across full initiative)Agent deployment manifests in /architect (15-agent bridge crew)Agent deployment manifests in /treasury (Dockson's financial team)
/assess command. --assess gauntlet flag. Stub detection. Migration completeness check. Auth-from-day-one. Process manager discipline.— 2026-03-22
/assess command — Picard's pre-build assessment for existing codebases--assess gauntlet flag — Rounds 1-2 only, findings grouped by root causeStub detection pattern in QA — methods returning success without side effectsMigration completeness check in Phase 1 — flag duplicate implementationsAuth-from-day-one — API key middleware stub from Phase 1Process manager discipline — never kill ports when PM2 owns the process
Learned Rules — recurring root causes become persistent pre-flight checksHistorical data validation for data-dependent systems in Phase 0PRD evolution log for iterative /architect --plan refinement
LAN mode proposal — private network access for ZeroTier/Tailscale/WireGuardDanger Room bug fixes and feature proposals from field reports #127-128
Campaign state gitignore warning — prevent silent data lossBlitz pre-flight checklist for all campaign modes--adr-only lightweight architect mode — ADRs only, skip full bridge crew
Encryption egress audit — trace all usages of encrypted fields across egress pointsGROUP BY compatibility guidancev14.0 Day-0 Engine roadmap planning
“The forge watches itself in real-time. Status Line, agent ticker, LAN mode. The dashboard becomes the forge's mirror.”— Fury
Consolidation release. 3-tier UX. LAN mode. Status Line bridge. Agent activity ticker. New dashboard panels.— 2026-03-22
LAN mode (--lan) — private network access for ZeroTier, Tailscale, WireGuardStatus Line bridge — connects Claude Code's Status Line API to the Danger RoomAgent activity ticker — methodology-driven JSONL logging with live WebSocket broadcastTests panel and Git status panel for the Danger RoomDashboard config (danger-room.config.json) for project-specific panel settings3-tier UX consolidation across the Danger Room interface
Break circular import, CORS/CSP LAN, header context gauge, consolidate private IP.— 2026-03-22
Fixed circular import in dashboard modulesCORS/CSP configuration for LAN modeHeader context gauge for live usage displayConsolidated private IP validation into shared module
“The forge doesn't just build — it launches businesses. Treasury, revenue, ad platforms, budget, creatives, tracking. Day zero to revenue.”— Kelsier
Cultivation onboarding redesign: treasury, revenue, ad platforms, budget, creatives, tracking, launch. The forge doesn't just build — it launches businesses.— 2026-03-22
Cultivation Day-0 Engine — complete onboarding rewriteTreasury-first flow: connect revenue before spendingAd platform OAuth setup integrated into onboardingBudget allocation with safety tiers from day zeroCreative pipeline with template generationTracking verification before launch
“The code is built. The tests pass. But it's not real until it's deployed. The forge closes the gap between 'done' and 'live.'”— Kusanagi
/deploy command. Campaign auto-deploy. /git --deploy. Drift detector. The gap between 'done' and 'live' closes.— 2026-03-22
/deploy command — Kusanagi's deploy agent with target detection, health check, rollbackCampaign auto-deploy — Victory Gauntlet can trigger deploy automatically/git --deploy flag — version bump + deploy in one commandDrift detector — alerts when deployed code diverges from committed code
Infinity Gauntlet (47 fixes), vault rate-limit + auto-lock, HMAC key rotation, 91 tests with vitest.— 2026-03-23
Infinity Gauntlet produced 47 fixes across all domainsVault rate-limiting and auto-lock on failed attemptsHMAC key rotation for authenticationMigrated to vitest — 91 tests passingUX enchantments across dashboard
Tower-auth split (636→3 modules), SSH security group restriction post-provisioning.— 2026-03-23
Tower auth module split from 636 lines into 3 focused modulesSSH security group restriction after provisioning completesCode organization improvements
4 methodology fixes from field report triage3 new lessons captured in LESSONS.mdContinuous improvement from production feedback
9 public docs updated to v15.2.1 — 76 staleness issues fixed across HOLOCRON, patterns README, and methodology references.— 2026-03-23
HOLOCRON docs refresh — 76 staleness issues fixed across 9 public documentsPatterns README updated with current pattern inventoryVersion references aligned across all public-facing documentation
“The forge doesn't just write code — it understands AI. Model selection, prompt architecture, tool schemas, evaluations. Psychohistory for the intelligence layer.”— Hari Seldon
Foundation universe. Hari Seldon (18th lead). /ai command. 6 AI patterns. AI Intelligence layer integrated into 8 existing commands.— 2026-03-24
Foundation universe (Isaac Asimov) — 9th fictional universe with 12 named agentsHari Seldon promoted to 18th lead agent (AI Intelligence Architect)/ai command — AI Intelligence Audit: model selection, prompts, tool-use, orchestration, safety, evals6 new AI patterns: orchestrator, classifier, router, prompt-template, eval, tool-schemaAI audit integrated into /assemble, /build, /campaign, /gauntlet, /prd, /qa, /security, /architectoutbound-rate-limiter pattern now documented in CLAUDE.md
Migration safety, data pipelines, backtest/execution patterns, dependency health, load testing, branch CI.— 2026-03-24
4 new patterns: database-migration, data-pipeline, backtest-engine, execution-safetyMigration safety checks in build protocol and gauntletDependency health audits in DevOps methodologyLoad testing guidance in systems architectBranch CI integration in campaign methodologyCLAUDE.md Personality section: honest assessment directive
“No stubs. No placeholders. No functions that lie. Every line does what it says, or it doesn't exist. The forge ships real code.”— Batman
No Stubs Doctrine. P0/P1 security fixes. Cultivation activated with sandbox + Stripe adapters. 74 new tests (167 total). 8 stub files deleted.— 2026-03-24
No Stubs Doctrine — never ship functions that return hardcoded success without side effectsCultivation activated: sandbox adapters, Stripe revenue integration, heartbeat wiring, growth tabsP0/P1 security fixes across vault, auth, and financial modules74 new tests (167 total)8 stub files deleted and replaced with real implementations
HMAC vault comparison, negative spend clamping, TypeScript 0 errors, tsc in CI, 26 new tests (193 total), 3 ADRs.— 2026-03-24
HMAC vault comparison for constant-time authenticationNegative spend clamping in financial modulesTypeScript strict mode — 0 errors across entire codebasetsc added to CI pipeline26 new tests (193 total)3 new Architecture Decision Records
101 new tests for 7 P0 security modules. 294 total tests. Zero TypeScript errors.— 2026-03-24
101 new tests covering 7 priority-zero security modulesTotal test count: 294 (from 193)Vault, auth, HMAC, financial, and growth modules fully coveredZero TypeScript errors maintained
--muster flag for full 9-universe agent deployment. Flag nomenclature standardized across 13 files. Flag Taxonomy in CLAUDE.md.— 2026-03-24
--muster flag — deploy every viable agent across all 9 universes in 3 wavesFlag nomenclature standardized (8 fixes across 13 files)Flag Taxonomy added to CLAUDE.md: Tier 1 (universal), Tier 2 (scope), Tier 3 (intensity)MUSTER.md method doc — full roster deployment protocol
“You can review code all day. But until you open a browser and watch it run, you're guessing. The proving ground doesn't lie.”— Batman
Playwright E2E + axe-core a11y (21 browser tests). Browser verification in 6 method docs. e2e-test.ts pattern. 315 total tests.— 2026-03-24
Playwright E2E testing with axe-core a11y scanning (21 browser tests)New e2e-test.ts pattern — Page Object Model, a11y fixtures, network mockingBrowser verification added to 6 method docs (QA, Security, Frontend, Testing, Backend, DevOps)315 total tests across unit, integration, and E2E'Solve, don't delegate' personality directive
browser-review.ts pattern. Console error capture, behavioral walkthroughs, security inspection. Browser intelligence in QA, UX, Security, Gauntlet.— 2026-03-25
New browser-review.ts pattern — give review agents browser eyes during /qa, /ux, /security, /gauntletConsole error capture as evidence for triageBehavioral walkthroughs: click flows, form submissions, navigation pathsSecurity header inspection (CSP, HSTS, X-Frame-Options)32 total patterns
Browser intelligence applied to VoidForge itself. 6 a11y heading fixes. CDN fallback for tower. Security verified clean.— 2026-03-25
VoidForge dogfooded with browser review — 6 a11y heading fixesCDN fallback for Avengers Tower dashboardSecurity headers verified clean across all endpoints
“The forge doesn't just build — it funds itself. Stablecoins to invoices, adapters to autopilot. The money pipeline is alive.”— Dockson
Stablecoin treasury to ad billing. Circle, Mercury, Google/Meta billing adapters. 8 heartbeat jobs, 6 circuit breakers, funding policy engine. 3 new patterns (35 total).— 2026-03-25
Stablecoin Ad Funding Rail — USDC → Circle off-ramp → Mercury bank → Google/Meta billing pipeline3 new patterns: stablecoin-adapter, ad-billing-adapter, funding-plan (35 total)8 new heartbeat daemon jobs — stablecoin balance, off-ramp poll, settlement monitor, runway forecast6 circuit breakers — provider down, SLA breach, reconciliation mismatch, invoice shortfall, debit failure, daily capTreasury planner, funding policy engine, reconciliation engine (3-way matching)Google Ads billing adapter (invoice reads, settlement instructions) + Meta Ads billing adapter (debit projection)
Production intelligence: adapter factory, Mercury/billing wiring, auto-funding execution, WAL recovery. 66 new financial tests (380 total). All 9 Muster-identified gaps resolved.— 2026-03-26
Adapter factory — config-driven adapter selection from encrypted vault, zero hard-coded instantiationsAuto-funding execution — approved funding plans automatically execute off-ramps (APPROVED → PENDING_SETTLEMENT → SETTLED)WAL recovery + rotation — daemon startup resumes incomplete operations, 7-file rotation on pending-ops66 new financial tests: funding-policy (22), reconciliation-engine (17), platform-planner (15), sandbox-stablecoin (12)Billing jobs wired — Google invoice scan and Meta debit monitor read real data via adapter factoryMercury wired — bank-settlement-monitor reads real bank balance via adapter factoryCircle stable IDs — listCompletedTransfers uses Circle payout ID, not random UUID
TikTok billing adapter. AdPlatform type widened to 7 platforms. Adapter factory extensibility proven. 385 total tests.— 2026-03-26
TikTok billing adapter — spend monitoring, debit projection, MONITORED_ONLY classification via Marketing APIAdPlatform type widened from google | meta to 7-platform union (+ tiktok, linkedin, twitter, reddit, snap)5 new TikTok billing tests — capability detection, spend projection, normalized stateAdapter extensibility proven — adding a new billing platform: 3 files, same pattern every time/vault command — Seldon's Time Vault for session intelligence preservation and handoff
22 field reports triaged, 13 fixes promoted, 5 patterns documented. Multi-environment isolation. Testing anti-patterns. Assessment findings reduced to 0.— 2026-03-30
Multi-environment isolation — 8-point checklist in DevOps: separate users, credentials, storage, Redis auth, worktree model, git hooks, Docker port audit4 testing anti-patterns documented — error format migration, source-code string assertions, standalone test handlers, version-agnostic assertionsHTML sanitizer preservation — DOMPurify client-fallback detection for JSX with React hooksSchema.sql sync gate in Phase 12 — IF NOT EXISTS post-processing, reference file freshness5 new patterns documented: ad-billing-adapter, funding-plan, stablecoin-adapter, browser-review, e2e-test (37 total)
Real campaign execution — Google Ads API v17, Meta Marketing API v19.0, TikTok Marketing API v1.3. 4 adapters, 5 daemon handlers, 0 stubs remain.— 2026-03-31
Real campaign execution — Google Ads API v17, Meta Marketing API v19.0, TikTok Marketing API v1.34 campaign adapters: sandbox (realistic fake metrics), Google, Meta, TikTokAll 5 daemon heartbeat handlers wired to real platform adapters — 0 stubs remainLive campaign metrics in the Danger Room: CTR, CPC, ROAS, updated every 5 minutesStatus polling + freeze/unfreeze all campaigns instantly454 total tests (403 → 454)
Fourth entry path: drop a pre-written PRD, run /blueprint, start building. Wong discovers docs, Boromir challenges assumptions, Kusanagi provisions.— 2026-03-31
Fourth entry path: drop a pre-written PRD, run /blueprint, start building/blueprint command: validate → discover docs → merge directives → provision → campaign--challenge flag: Boromir argues against the PRD before buildingWong discovers supporting docs (ADRs, ops playbooks, reference materials)Wizard auto-detection: recognizes pre-existing PRD and offers blueprint path499 total tests (454 → 499), 28 slash commands
ADR-035: Operational Learnings (docs/LEARNINGS.md) — project-scoped knowledge that persists across sessions/debrief extracts learnings (O'Brien + Nog), /vault catches them at session end/build, /campaign, /architect, /assemble, /qa, /security load learnings at startupSignature-first rule: read actual function signatures before writing callsCSP execution verification: verify scripts run under the policy, not just that headers existRead-operation guards: protect reads, not just writesData-UI enum consistency: verify backend enums match frontend display valuesSemantic verification: check meaning, not just types (Gauntlet crossfire)50-entry cap with staleness tracking and promotion pipeline to LESSONS.md
“Every campaign needs a landing page. Every landing page needs data. The forge generates both, tests both, and feeds the winners back into the next cycle.”— Kelsier
Every ad campaign gets a dedicated landing page. Kongo generates, tests, and optimizes — the forge closes the loop from spend to conversion.— 2026-04-02
Kongo Engine Integration (ADR-036) — first-party landing page system with 10 modulesPhase 3.5 in /grow: Raoden + Shallan generate dedicated Kongo pages per campaign with 6 A/B variants3-phase activation: Manual → Semi-Auto → Fully Auto (--auto-pages flag)Heartbeat jobs: growth signal polling, seed extraction on A/B winner, HMAC-verified webhookskongo-integration.ts pattern (37th) — client, from-PRD generation, growth signal, webhook handlersOperational Learnings system activated (first LEARNINGS.md entries written in production)119 tests, Infinity Gauntlet passed (3 Critical + 10 High fixed)
Parallel Agent Standard (ADR-036) — main thread orchestrates, sub-agents do all analysisStructured agent briefs: role, mission, scope, deliverable format, constraintsMax 3 concurrent agents, findings summaries between phases (not raw code)ID Space Audit (Oracle) — verify identifier comparisons use the same ID spaceSafety Parameter Audit — verify critical params can't be overridden to unsafe valuesMaul mandatory gate — crossfire re-probe is now a hard gate, not optional7 field report triages (#264-#270) with 14 methodology fixes
Scaffold and core users can now run /cultivation and /grow partially. Spring cleaning removed 274 files from the scaffold branch.— 2026-04-03
ADR-037: Graceful Tier Degradation — sentinel file check, methodology-only fallbackSpring Cleaning migration in /void — auto-cleans leaked main-only files from old clones/grow Prerequisites softened — 'On no' proceeds to Phases 1-3 instead of stopping/cultivation install — Steps 4-8 display skip messages when wizard absent274 files removed from scaffold branch (408 → 134 tracked files)10 method doc additions across QA, Security, Architecture, Troubleshooting, Backend6 field reports closed (#271-#276)
“The wizard is an application for launching and managing projects. It is not part of a project. The forge extracted itself.”— Kusanagi
The wizard is an application for launching and managing projects. It is not part of a project. npm packages replace git branches.— 2026-04-08
Monorepo extraction (ADR-038) — packages/voidforge/ (wizard+CLI) and packages/methodology/npm package 'thevoidforge' — CLI with 12 commands (init, update, install, uninstall, deploy, doctor, migrate, version, templates, help).voidforge marker file — JSON identity at project root for CLI detectionExtension system — voidforge install danger-room / cultivation for per-project addonsnpx voidforge update replaces /void git-fetch — same Bombadil UX, npm transportvoidforge migrate converts v20.x projects (embedded wizard) to v21.0 with backup and rollbackDaemon aggregator — multi-project heartbeat connection, aggregated KPIs, freeze/unfreeze675 tests (618 original + 57 new across 7 modules)
Build pipeline, CI/CD, and npm publish. The forge ships itself to the world.— 2026-04-08
Build pipeline — tsc compile to dist/ for production distributionCI/CD pipeline — GitHub Actions for npm publish on git tagBranch deprecation — scaffold and core branches marked deprecated (delete date: 2026-05-08)Published to npm as 'thevoidforge'
“Everything is project-scoped. Multi-project wizard with per-project dashboards, financial isolation, and daemon configuration.”— Picard
Everything is project-scoped. Multi-project wizard with per-project dashboards, financial isolation, and daemon configuration.— 2026-04-09
Project dashboard — new project.html with 5-tab SPA (Overview, Tower, Danger Room, War Room, Deploy)ProjectContext type — rich interface with 15+ derived paths for project-scoped operationsresolveProject() middleware — validates project access on all 20 dashboard routesPer-project treasury — paths moved from ~/.voidforge/treasury/ to project/cultivation/treasury/Per-project daemon — voidforge heartbeat start --project-dir configures per-project operationWebSocket subscription rooms — broadcast filtered by project ID, no cross-project leakageDual-daemon guard — prevents split-brain when per-project daemon starts alongside globalRBAC bypass fix on freeze endpoint, LAN WebSocket auth gap fixedADR-040 (project-scoped architecture), ADR-041 (Muster review: 17 agents, 3 waves, 14 findings)696 tests (21 new), 0 type errors, +1337/-385 lines
Treasury migration CLI, summary cache for O(1) dashboard reads, per-project vault with HKDF-SHA256 key derivation.— 2026-04-09
Treasury migration CLI — voidforge migrate treasury --project=<id> archives global, starts per-project freshTreasury summary cache — writeTreasurySummaryFile() for O(1) dashboard KPIs (replaces O(n) JSONL scan)Per-project vault — HKDF-SHA256 key derivation from global master key per project ID45 new tests (treasury migrator, summary cache, project vault)
Max by default. The flag taxonomy inverts — autonomous + full roster is now the default. Opt OUT, not in.— 2026-04-09
First-run onboarding UX — empty project detection, guided wizard entry, enhanced empty statesADR-043: Flag taxonomy inversion — autonomous + full roster is default. --light, --interactive, --solo opt outRetired flags: --blitz, --muster, --infinity (accepted as silent no-ops)19 legacy routes get Deprecation + Sunset headers (sunset July 2026)741 tests confirmed, 263 agents verified
“The forge chooses its own champions. Every command summons the right agents — not all of them, the right ones. Intelligence before deployment.”— Picard
Every named agent is now a Claude Code subagent definition. 263 agents materialized with 3-tier model routing and description-driven dynamic dispatch.— 2026-04-09
263 subagent definitions in .claude/agents/ — every named agent from NAMING_REGISTRY.md3-tier model routing: Opus (20 leads), Sonnet (190 specialists + 15 adversarial), Haiku (38 scouts)4-category tool restrictions: Builder (full), Reviewer (read+bash), Scout (read-only), Adversarial (read+bash, no edits)Description-driven dynamic dispatch (ADR-044) — Opus matches git diff against agent descriptions18 command files migrated from inline prompts to subagent_type: referencesAgent Classification manifest: docs/AGENT_CLASSIFICATION.md with full tier/tool/ID mapping
Operational knowledge from 33+ campaigns injected into agent definitions. The recursive knowledge loop is complete.— 2026-04-09
35 agent definitions enriched with Operational Learnings from method docs, LESSONS.md, and LEARNINGS.mdDebrief→agent pipeline: Wong promotes learnings into .claude/agents/ definitionsVault Step 1.6: captures agent definition update recommendations for next sessionADR-045: Knowledge Injection architecture — closes 6 breaks in the learning-to-agent flowDistribution pipeline includes .claude/agents/ in init, update, and /void syncHaku (Deploy Wizard) and Gandalf (Setup Wizard) added to Team roster — 20 leads total
599 new tests. 17 orphans purged. 9 oversized files split into 25 focused modules. The forge proves its own correctness.— 2026-04-10
599 new tests across the codebase (741→1340 total, 77% coverage)17 orphan files purged — unused code identified and removed9 oversized files split into 25 focused modulesField report #297 learnings triaged into 4 agent definitionsDistribution verification gate added (BUILD_PROTOCOL Phase 12.75)
Wizard UI fix — 'Files to be created' list matched actual init output
The wizard gets a full UI audit. 3 critical API fixes. 4 WCAG a11y fixes. 2,400 lines of legacy code removed. The forge cleans house.— 2026-04-12
3 critical API fixes in wizard UI4 WCAG accessibility fixes across wizard interfaceRetired --blitz flag cleanup — autonomous execution is now the defaultContent accuracy pass across wizard pages7 UX improvements to wizard onboarding flow-2,400 lines of legacy code removed
XSS escaping fix in blueprint banner componentROADMAP staleness detection added to Gauntlet checksLobby dashboard accessibility improvements
The forge learns to choose its own team. Haiku pre-scans your code, matches it against 40 agent tags, and deploys the optimal roster. Intelligent dispatch.— 2026-04-12
Herald intelligent agent dispatch — Haiku pre-scan selects optimal agent rosterAgent registry with 40 descriptive tags across 264 agents--focus flag for biasing agent selection toward a topic14 commands wired with Herald dispatchADR-047: Intelligent Agent Dispatch architecture
Fix CLI self-upgrade: wrong package name (voidforge → thevoidforge) + stale npx cache on re-exec/void auto-cleanup ~/.claude/ duplicates + git init stack trace fix
Fix 201 broken subagent_type refs (filename IDs → YAML names)/campaign established as the default entry command
Retired --blitz, --muster, --infinity flag references cleaned across tutorials/build → /campaign as primary command on hero + tutorials14-phase → 13-phase protocol count corrections
Command-doc sync fixes from /assess auditROADMAP version alignment, build.md Phase 12.75, UX screenshot mandate, QA dynamic counts
Silver Surfer — Herald invocation bridge. CLI: npx thevoidforge herald. ADR-048.— 2026-04-12
Silver Surfer (Norrin Radd) — agent #264, Herald pre-scan dispatch via HaikuADR-048: Herald invocation bridge — CLI npx thevoidforge herald --command /<name> --jsonSilver Surfer Pre-Scan replaces Herald Pre-Scan in all 14 command files
263 → 264 agent count updated across 13 command files263 → 264 agent count updated across 8 method docs
Eliminate hardcoded agent counts from 30+ methodology files. Single source of truth: AGENT_CLASSIFICATION.md.— 2026-04-12
Hardcoded agent counts eliminated from 30+ command and method doc filesSingle source of truth for agent counts: AGENT_CLASSIFICATION.mdDynamic references replace static '263 agents' / '264 agents' strings
Silver Surfer dispatched via Agent tool (subagent_type: Silver Surfer)Guaranteed to work in every environment — no CLI dependencyMandatory on every command invocation
Explicit Agent tool parameters for Silver Surfer invocationEnvironment-safe: works without CLI, npx, or shell access
14 character-authentic Silver Surfer one-liners in agent definitionRandom heralding announced before every pre-scan — the Surfer arrives with style
Heralding one-liners for all 264 agents. Character-authentic announcements on every deployment. ADR-049.— 2026-04-12
heralding: field added to all 264 agent definitionsCharacter-authentic one-liners announced when each agent deploysADR-049: Agent Personality — heraldings as identity, not decorationEvery agent now announces itself: Batman growls, Bilbo quips, Picard commands
v23.8.1 – v23.8.2: Silver Surfer anti-skip hardening. 'NO EXCEPTIONS' enforcement promoted from command-level to root CLAUDE.md after three documented skip incidents in production sessions.v23.8.3 – v23.8.11: Cross-session agent-cache lessons, typecheck pre-flight gate before deploys, prompt-schema lockstep operational learning — a steady stream of small reliability tightenings.v23.8.12: Field report triage (issues #299, #300) — campaign autonomy fix, ToS checks for outreach tooling, deploy type-check gate, and three operational learnings landed into docs/LESSONS.md.
/review → /engage and /security → /sentinel renames (old names are permanent aliases) to coexist with Claude Code's native skills — ADR-050Silver Surfer Gate moves from prose to mechanical hook enforcement via PreToolUse — skipping the Surfer is now blocked at the runtime boundary, not just by the prompt — ADR-051Hook state relocated from world-writable /tmp to $XDG_RUNTIME_DIR / $HOME/.voidforge/gate with 0700 perms — ADR-060Silver Surfer → Haiku 4.5 for ~5× cost reduction on the highest-frequency agent — ADR-054Prompt-injection hardening: --focus args wrapped in <user_input> delimiters across 14 gated commands — ADR-053JSONL event emission for every gate ALLOW/BLOCK/ROSTER_RECEIVED — the gate is now observable — ADR-056
Domain-aligned npm package (voidforge-build). SLSA provenance on every release. ADR-061.— 2026-04-20
npm package renamed to voidforge-build to match the voidforge.build domain — bin name 'voidforge' unchanged, so post-install UX is identical — ADR-061Published as voidforge-build + voidforge-build-methodology. Legacy thevoidforge + thevoidforge-methodology deprecated with redirect messages.SLSA provenance v1 attestation signed to sigstore's transparency log on every CI release — cryptographic proof that what you install was built from this repo by the real workflowLegacy-install migration banner: existing thevoidforge CLIs print uninstall + reinstall commands on every run until users migrateCI publish workflow is now idempotent — re-tagging or running after a manual publish is a no-op instead of failingFour operational learnings captured (LRN-1 to LRN-4): agent cache at session start, shell-escape at source not destination, sibling-doc drift, npm name parity with install instructions
23 field reports closed across two waves. 9 new patterns. Tag-by-default release discipline. The methodology absorbed every lesson.— 2026-05-10
v23.10.0 — Wave triage of 6 field reports (#303–#308): SPEC_HANDOFF.md formalizes cross-session implementation hand-off (verified-against-commit stamping, nav-order requirements). deploy-preflight.ts + post-deploy-probe.sh wired into /deploy Steps 2.5 + 4.5. New FORGE_KEEPER §Deployment Hygiene + §Cross-Repo Scalar Sync sections. New DEVOPS_ENGINEER §Deploy Surface Boundary (repo root ≠ deploy surface; per-platform enforcement table). Post-push live-URL fingerprint (broken auto-deploy detection). Methodology-exposure curl denylist. /campaign Step 0.5 TECH_DEBT SLA Audit (Critical+Immediate+LowEffort 48h SLA).v23.11.0 — Two-wave triage of 18 field reports (#313–#320, #322–#330) with 9 new patterns landing alongside: adr-verification-gate.md (Fixture Bindability discipline), audit-log.ts (system-event NULL trap resolution), multi-tenant-property-test.ts (property-based isolation: A's writes never appear in B's reads), multi-tenant-pool-bypass.ts (pre_org_resolution_scope ContextVar), rls-test-fixture.py (db_as_app SAVEPOINT defeating the SUPERUSER + BYPASSRLS=t fixture trap), structural-sql-sentinel.py (adversarial-test discipline for SQL regex sentinels), refactor-extraction.md (8-commit per-entity large-refactor template), ai-prompt-safety.ts (Type A instructions vs Type B constraints), llm-state-dedup.ts (LLM-emitted ids are display labels, not primary keys).Pattern extensions: ai-eval.ts gained CLAUDE_PROMPT_EVAL_CATEGORIES (prompt-structure invariants, sanitizer round-trip, refusal stability, JSON schema adherence, cost regression). middleware.ts gained a hot-path logging gate (fireOnce / shouldEmit token-bucket) preventing observability-pipeline DoS from naked logger.critical() per-request.Method docs touched: SYSTEMS_ARCHITECT.md (Step 4.5 operator sign-off on invented constraints; Step 4.6 schema-vs-ADR cross-check; Step 4.7 implementation rehearsal for infra ADRs), SECURITY_AUDITOR.md (sanitizer bypass-class checklist, 7 named classes), CAMPAIGN.md (pause-bias anti-pattern in autonomous mode), GAUNTLET.md, AI_INTELLIGENCE.md, BACKEND_ENGINEER.md, BUILD_PROTOCOL.md, DEVOPS_ENGINEER.md, FORGE_KEEPER.md, PRD_GENERATOR.md, QA_ENGINEER.md, RELEASE_MANAGER.md, SUB_AGENTS.md, TESTING.md, TIME_VAULT.md, TROUBLESHOOTING.md.Spec-adversary pass for non-trivial methodology ADRs — code-vs-ADR review confirms fidelity; spec-adversary review confirms correctness. Both run before implementation. Reference: ADR-069 false-positive in barrierwatch FWER caught only after production alert.v23.11.1 — /git release-discipline patch. v23.10.0 and v23.11.0 reached origin/main with bumped versions but no git tags and no npm publish — the publish workflow fires on tag push, so both releases sat stranded for a full cycle. Coulson now tags by default (Step 4.5, --no-tag to skip) and exposes --npm for same-session manual publish (Step 7, opt-in, with preflight + dependency-ordered publish). Tag push in Step 6 is verified against git ls-remote --tags origin.Operational learnings (10 entries closed): stat -f %m non-portability (LRN-5), npm ci lockfile drift (LRN-6), npm org vs scope availability (LRN-7), CI workspace-scoped test bypasses root pretest (LRN-8), spec-handoff pattern (LRN-9), marketing-site scalar count drift (LRN-10), plus 4 from v23.9.x.
All 12 open field reports triaged and fixed in one session. 58 fixes across 32 files. Seven lesson clusters absorbed.— 2026-06-09
/debrief --inbox triaged every open report (#342–#353) via two-phase workflow orchestration — triage then apply — with an adversarial verify pass on every changed fileVerify-the-FIX doctrine: the adversarial pass must now vet the proposed fix, not just the original finding (SUB_AGENTS.md, GAUNTLET.md, /engage)Production-config gate — sandbox-green is not ship-ready: new GAUNTLET prod-boot + sandbox-blind-spot round and a CAMPAIGN Victory ChecklistSilver Surfer roster sizing reworked: scope_bias, scope_density, an ~18-agent cap, and basename normalization in the heraldThree new patterns — design-tokens.ts, nginx-vhost.conf, error-message-categorization.tsx (48 → 51) — plus the new /audit-docs command and DOC_AUDIT.mdCreative/UX grounding (world-scan, de-AI, token-scoped theming) and a batch of deploy/DevOps foot-gun fixes across DEVOPS_ENGINEER.md
#354: ported /gauntlet's vote-based REFUTE lens into /engage and /sentinel, which still used the old 'second agent disagrees → drop' modelNamed find → cluster → 3-lens-verify as the default review shape in SUB_AGENTS.mdEnforcement-keyed severity rubric: a server-enforced client affordance leak is UX P2/P3, not a P0 breach#355: contrast findings must cite literal source hex for foreground + background with file:line and re-grep the pairing before calling Critical (token names ≠ values)Glob-derived fan-out work-lists with a mandatory post-fan-out residual sweep (CAMPAIGN.md, SUB_AGENTS.md)Fixed the chronically-red validate-branches.yml check — its grep mis-read /docs/* rows as commands — and registered /audit-docs in the CLAUDE.md table
/git Step 3 now bumps every versioned package.json plus the voidforge-build-methodology dependency pin and re-syncs the tracked generated CLAUDE.md copySteps 4 and 5 staging + verify updated to match the multi-package bumpRELEASE_MANAGER.md: E404-on-publish means wrong npm account/scope, not expiry — check npm owner ls first (cites the four-failed-runs incident with a rotated non-owner token)RELEASE_MANAGER.md: sequential oldest-first multi-version publish so the latest dist-tag lands on the newest semverFirst release cut via the corrected procedure as a dogfood
Reports #356–#361 triaged against the post-v23.12.2 tree. 23 fixes across 17 files, one new pattern.— 2026-06-12
Two-phase workflow orchestration: per-report investigators, then an adversarial verify of every already-fixed verdict, then per-file appliersDeploy-safety cluster: empty-string-into-strict-Zod boot crash with a z.preprocess fix, a 'render ≠ load' config-LOADS gate, canary-worker-first, and a pre-build disk preflightAdversarial-verify rigor: reproduce through the REAL execution path, not a library in isolation, plus a composition/wiring lens for the Victory GauntletSecret surfaces: git remote and .git/config inline-credential scan added to SECURITY_AUDITOR.md Phase 1 and the deploy preflightSurfer-gate roster TTL raised 600s → 3600s with refresh-on-activity (check.sh, ADR-060)New pattern codemod-hygiene.md — strip incidental recast reformatting (51 → 52)
The #360 roster-TTL change (600s → 3600s in check.sh) did not update the gate's own test.sh stale-roster caseThat case aged a roster 11 minutes and expected a block — now still fresh under the 1-hour TTL — so it returned exit 0 instead of 2The CI pretest gate failed, the npm publish job's test stage failed, and both publish jobs were skipped (npm stayed at 23.12.2)Fix: age the stale-roster test roster to 61 minutes, past the new TTL, and relabel it '>1hr'Lesson: a TTL/threshold change in a gate script must update the gate's adversarial test in the same commit
Reports #362 and #363 closed via /debrief --inbox. 8 fixes across 9 files, including a self-filed release-flow gap.— 2026-06-12
#363 (self-filed last session): the release flow now runs the full test suite as Step 5's first action before any tag, since a tag push arms an irreversible publishNumeric constant migration checklist generalizing the error-shape rule (TESTING.md)Registry-Derived Fan-Out coverage rule — enumerate the accepted (fixId, targetFile) tuple set and diff-check after appliersChronically-Red Check Policy: a check red for ≥2 releases must be fixed, made informational, or removed; plus publish-gate alignment so publish needs the full E2E + a11y suite#362: a named, right-sized Pre-Deploy Review Gate (diff-scoped N lenses + mandatory adversarial-verify) realized as a new /engage --pre-deploy --diff modeAtomic-visual render-harness screenshot carve-out (QA_ENGINEER.md, PRODUCT_DESIGN_FRONTEND.md)
The gate is blind to Workflow-spawned agents — proven empirically and written up as ADR-064. Plus a live runtime-bug fix.— 2026-06-13
Empirically confirmed the Silver Surfer PreToolUse gate is blind to Workflow-tool-spawned agents (60+ workflow agents → 2 gate events; controlled probe before = 2, after = 2) and wrote ADR-064Fixed a live runtime bug: anthropic.ts fell back to the non-existent claude-sonnet-4-7 (404 on the exact degraded path the fallback exists for) → claude-sonnet-4-6, plus the bug-asserting testPurged stale model IDs across 6 pattern files and updated Opus 4.7 → 4.8 across SUB_AGENTS and 4 ADRsAdded the effort-tiering policy (leads xhigh / specialists medium / Haiku omit-no-effort + 200K ceiling) to SUB_AGENTS.md and the CLAUDE.md flag taxonomyAmended ADR-059 with the real platform caps (~16 concurrent / ~1,000 per run) and fixed GAUNTLET.md's contradicting 'waves of 3'
ADR-064 implemented: the gate now guards the Workflow tool launch, closing the proven bypass. Plus the platform floor and a native-capability tracker.— 2026-06-13
ADR-064: the Silver Surfer PreToolUse hook matcher is now Agent|Workflow and check.sh gates the Workflow tool launch on a recorded roster (closes the bypass where workflow-spawned agents skipped the gate); test.sh 23/23Behavior change: a Workflow run now requires a recorded roster or a --light/--solo bypass — build/apply/research workflows should set a bypassADR-065 (platform floor): docs/COMPATIBILITY.md gains a Claude Code platform-floor and per-feature maturity table, an informational claudeCodeFloor field, and a semver rule (raising the floor is breaking)ADR-066 (native-capability tracker): new docs/NATIVE_CAPABILITIES.md audits all commands vs native skills with dispositions (/qa, /test coexist + document; /git keep)Amended ADR-051 (workflow-exemption → closure) and ADR-054 (effort tiers + Haiku 200K / no-effort)
Per-agent reasoning spend, verified against the official docs and applied across all 264 agents. The largest cost lever in the fleet.— 2026-06-13
Verified against the official Claude Code sub-agents docs that effort is a supported sub-agent frontmatter field (low/medium/high/xhigh/max; available levels depend on the model)Applied across all 264 agent definitions: 20 leads (model: inherit) → effort: xhigh, 201 Sonnet specialists → effort: medium, 43 Haiku scouts → omitted (Haiku doesn't support the parameter)200 specialists no longer pay lead-level reasoning for read-and-report review — a per-agent lever independent of model tierFrontmatter-only, idempotent insert after the model: line; validate-agent-refs and the full suite (1390/1390) green; integrity preservedUpdated ADR-054 (status → fleet-applied), SUB_AGENTS.md, and COMPATIBILITY.md; closes the M2 deferral from v23.16.0
ADR-067: /gauntlet and /assemble move onto schema-validated JS workflows. A new authoring standard, WORKFLOWS.md.— 2026-06-13
New .claude/workflows/gauntlet.workflow.js (discovery → JS dedupe → 3-lens adversarial REFUTE → crossfire → council, schema-validated)New assemble-review.workflow.js (engage + sentinel over a mission diff; build/arch/devops stay prose)New docs/methods/WORKFLOWS.md authoring standard — API, the #348/#363 gotchas, 16/1000 caps, and the ADR-064 gate-launch sequence (Surfer → record-roster → Workflow)gauntlet.md and assemble.md gain workflow-execution sections; personas, fix-application, and the Debate Protocol stay proseDistribution gate: .claude/workflows/ is a new shared category, added to prepack.sh (npm) and copy-assets.sh (init) so the scripts ship to consumers
Ran the new gauntlet workflow live on the v23.13–v23.18 platform code and fixed the 14 confirmed findings. The re-platform validated by running it on itself.— 2026-06-13
Live run: 10-agent Surfer roster → 347 agents → 99 distinct claims → 66 confirmed + 24 crossfire, 0 Critical, then fixed the 3-lens-confirmed findingsGate security: _paths.sh reap was missing -mindepth 1 and could rm -rf the entire sessions/ tree — the reaper now refreshes mtime on activity, the threshold sits above the TTL, and shasum → sha256sum fallback fixes silent breakage on AlpineGate: a bypass.sh run before the first hook fire now records a repo-scoped pending bypass that check.sh promotes (was a silent no-op)Workflows: strike no longer re-runs the same roster twice, survives:true + REFUTED crossfire verdicts are logged instead of vanishing, dedup keeps the highest severity, and JSON.parse(args) is guardedDistribution: init now copies .claude/workflows/ + AGENT_CLASSIFICATION.md and update propagates .claude/workflows + scripts/surfer-gate (both were stranded)Validation: new scripts/validate-workflows.sh wired into pretest gates workflow syntax errors from shipping; gate suite 23 → 27, full suite 1390 → 1392
THE STARS AHEAD
- Cross-project memory — lessons-global.json shared across all VoidForge projects
- Methodology compatibility matrix — version range contracts between agents, patterns, and commands
- Agent performance baselines — per-agent metrics from campaign history to guide model routing
- The forge builds the forge — VoidForge generates its own next version
- Cross-project orchestration — one campaign manages multiple repos as a single product
- Methodology A/B testing — compare agent configurations across projects
The roadmap is not a promise — it is a heading. We adjust course as the mission demands. But the destination is clear: a forge that remembers, a forge that learns, and a forge that can build anything from nothing.
Picard