docs: update all documentation for v4.13.0 Phase 8

- SECURITY.md + .github/SECURITY.md: version table 4.13.x current, Phase 8 security entries (matcher hooks, approval gates, confidence filtering)
- README.md: What's Included table + test table with Phase 8 rows, 1,924/23 suites
- ARCHITECTURE.md: project structure tree with Phase 7+8 lib modules
- references/adapter-system.md: 4 new sections (matcher filtering, phase pipeline, confidence filter, fan-out/fan-in)
- SKILL.md: TypeScript engine note linking parallel strategies to Phase 8 modules
- CLAUDE.md, CODEX.md: version + project structure
- CONTRIBUTING.md: test count
- copilot-instructions.md: Key Files with Phase 8

Author: jovanSAPFIONEER

.github/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported |
 |---------|-----------|
-| 4.12.x  | ✅ Yes — full support (current) |
-| 4.11.x  | ✅ Security fixes only |
+| 4.13.x  | ✅ Yes — full support (current) |
+| 4.12.x  | ✅ Security fixes only |
 | 4.9.x   | ✅ Security fixes only |
 | 4.8.x   | ✅ Security fixes only |
 | 4.7.x   | ✅ Security fixes only |
@@ -44,6 +44,9 @@ Network-AI includes built-in security features:
 - **Deferred Adapter Initialization** (v4.12.0) -- adapters are materialized only on first use via `registerDeferred()`, preventing untrusted adapter code from running at startup
 - **Adapter Hook Middleware** (v4.12.0) -- `beforeExecute` / `afterExecute` / `onError` lifecycle hooks; enables request-level logging, tracing, and custom security gates without modifying adapters
 - **Flow Control** (v4.12.0) -- `pause()` / `resume()` / `setThrottle()` on the blackboard; prevents write floods and enables coordinated maintenance windows
+- **Matcher-Based Hook Filtering** (v4.13.0) -- `HookMatcher` with `agentPattern`, `actionPattern`, `toolPattern` globs, and custom `condition` functions; hooks only fire when all conditions pass, enabling fine-grained security policies per tool or agent pattern
+- **Phase Pipeline with Approval Gates** (v4.13.0) -- `PhasePipeline` orchestrates multi-phase workflows; `requiresApproval` boolean halts execution until explicit human approval is granted, enforcing human-in-the-loop for sensitive operations
+- **Confidence-Based Filtering** (v4.13.0) -- `ConfidenceFilter` rejects low-confidence agent findings below configurable thresholds and validates rejected results with secondary agents; aggregation strategies (unanimous, majority) enforce consensus before accepting multi-agent results
 
 ## Security Scan Results
 

.github/copilot-instructions.md

@@ -27,9 +27,12 @@ Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, gu
 - `lib/locked-blackboard.ts` — LockedBlackboard with atomic propose → validate → commit
 - `lib/fsm-journey.ts` — JourneyFSM behavioral control plane
 - `lib/compliance-monitor.ts` — Real-time agent behavior surveillance
-- `lib/adapter-hooks.ts` — AdapterHookManager lifecycle hooks
+- `lib/adapter-hooks.ts` — AdapterHookManager lifecycle hooks + matcher-based filtering
 - `lib/skill-composer.ts` — SkillComposer meta-operations (chain/batch/loop/verify)
 - `lib/semantic-search.ts` — SemanticMemory BYOE vector store
+- `lib/phase-pipeline.ts` — PhasePipeline multi-phase workflows with approval gates
+- `lib/confidence-filter.ts` — ConfidenceFilter multi-agent result scoring and filtering
+- `lib/fan-out.ts` — FanOutFanIn parallel agent spawning with pluggable aggregation
 - `adapters/` — 17 framework adapters (LangChain, AutoGen, CrewAI, MCP, Codex, MiniMax, NemoClaw, APS, etc.)
 
 ## Build & Test

ARCHITECTURE.md

@@ -291,7 +291,13 @@ Network-AI/
 │   ├── blackboard-validator.ts   # Content quality gate (Layer 1 + Layer 2)
 │   ├── qa-orchestrator.ts        # QA orchestrator (scenario replay, regression, contradictions)
 │   ├── fsm-journey.ts            # FSM state machine and compliance monitor
-│   └── swarm-utils.ts            # Helper utilities
+│   ├── swarm-utils.ts            # Helper utilities
+│   ├── adapter-hooks.ts          # Lifecycle hooks + matcher-based filtering (v4.12–4.13)
+│   ├── skill-composer.ts         # chain/batch/loop/verify meta-operations (v4.12)
+│   ├── semantic-search.ts        # BYOE vector store with cosine similarity (v4.12)
+│   ├── phase-pipeline.ts         # Multi-phase workflows with approval gates (v4.13)
+│   ├── confidence-filter.ts      # Multi-agent result scoring and filtering (v4.13)
+│   └── fan-out.ts                # Parallel agent spawning with pluggable aggregation (v4.13)
 ├── scripts/                      # Python helper scripts (local orchestration only)
 │   ├── blackboard.py             # Shared state management with atomic commits
 │   ├── swarm_guard.py            # Handoff tax prevention, budget tracking

CLAUDE.md

@@ -4,7 +4,7 @@ This file is read automatically by Claude Code when working in this repository.
 
 ## Project Overview
 
-Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination. Version 4.12.0.
+Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination. Version 4.13.0.
 
 ## Build & Test Commands
 
@@ -28,9 +28,12 @@ All tests must pass before any commit. No test should be skipped or marked `.onl
 - `lib/locked-blackboard.ts` — LockedBlackboard with atomic propose → validate → commit and file-system mutex
 - `lib/fsm-journey.ts` — JourneyFSM behavioral control plane
 - `lib/compliance-monitor.ts` — Real-time agent behavior surveillance
-- `lib/adapter-hooks.ts` — AdapterHookManager: beforeExecute/afterExecute/onError lifecycle hooks
+- `lib/adapter-hooks.ts` — AdapterHookManager: beforeExecute/afterExecute/onError lifecycle hooks + matcher-based filtering
 - `lib/skill-composer.ts` — SkillComposer: chain/batch/loop/verify meta-operations
 - `lib/semantic-search.ts` — SemanticMemory: BYOE vector store with cosine similarity
+- `lib/phase-pipeline.ts` — PhasePipeline: multi-phase workflows with approval gates
+- `lib/confidence-filter.ts` — ConfidenceFilter: multi-agent result scoring and filtering
+- `lib/fan-out.ts` — FanOutFanIn: parallel agent spawning with pluggable aggregation
 - `adapters/` — 17 framework adapters (LangChain, AutoGen, CrewAI, MCP, Codex, MiniMax, NemoClaw, APS, etc.)
 - `bin/cli.ts` — CLI entry point (`npx network-ai`)
 - `bin/mcp-server.ts` — MCP server (SSE + stdio transport)

CODEX.md

@@ -4,7 +4,7 @@ This file is read automatically by OpenAI Codex CLI when working in this reposit
 
 ## Project Overview
 
-Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination. Version 4.12.0.
+Network-AI is a TypeScript/Node.js multi-agent orchestrator — shared state, guardrails, budgets, and cross-framework coordination. Version 4.13.0.
 
 ## Build & Test Commands
 
@@ -28,6 +28,12 @@ All tests must pass before any commit. No test should be skipped or marked `.onl
 - `lib/locked-blackboard.ts` — LockedBlackboard with atomic propose → validate → commit and file-system mutex
 - `lib/fsm-journey.ts` — JourneyFSM behavioral control plane
 - `lib/compliance-monitor.ts` — Real-time agent behavior surveillance
+- `lib/adapter-hooks.ts` — AdapterHookManager: lifecycle hooks + matcher-based filtering
+- `lib/skill-composer.ts` — SkillComposer: chain/batch/loop/verify meta-operations
+- `lib/semantic-search.ts` — SemanticMemory: BYOE vector store with cosine similarity
+- `lib/phase-pipeline.ts` — PhasePipeline: multi-phase workflows with approval gates
+- `lib/confidence-filter.ts` — ConfidenceFilter: multi-agent result scoring and filtering
+- `lib/fan-out.ts` — FanOutFanIn: parallel agent spawning with pluggable aggregation
 - `adapters/` — 17 framework adapters (LangChain, AutoGen, CrewAI, MCP, Codex, MiniMax, NemoClaw, APS, etc.)
 - `bin/cli.ts` — CLI entry point (`npx network-ai`)
 - `bin/mcp-server.ts` — MCP server (SSE + stdio transport)

CONTRIBUTING.md

@@ -16,7 +16,7 @@ Unsolicited PRs without a linked, approved issue will be closed.
 
 ### Code Quality
 
-- All 1,778 existing tests must pass (`npm run test:all`)
+- All 1,924 existing tests must pass (`npm run test:all`)
 - Zero TypeScript compile errors (`npx tsc --noEmit`)
 - New features must include tests with >90% branch coverage
 - Follow existing code style and patterns

README.md

@@ -7,7 +7,7 @@
 [![CodeQL](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml)
 [![Release](https://img.shields.io/badge/release-v4.13.0-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
 [![npm](https://img.shields.io/npm/dw/network-ai.svg?label=npm%20downloads)](https://www.npmjs.com/package/network-ai)
-[![Tests](https://img.shields.io/badge/tests-1778%20passing-brightgreen.svg)](#testing)
+[![Tests](https://img.shields.io/badge/tests-1924%20passing-brightgreen.svg)](#testing)
 [![Adapters](https://img.shields.io/badge/frameworks-17%20supported-blueviolet.svg)](#adapter-system)
 [![License](https://img.shields.io/badge/license-MIT-brightgreen.svg)](LICENSE)
 [![Socket](https://socket.dev/api/badge/npm/package/network-ai)](https://socket.dev/npm/package/network-ai/overview)
@@ -94,6 +94,10 @@ Runs priority preemption, AuthGuardian permission gating, FSM governance, and co
 | ✅ Flow control | Pause / resume / throttle writes on the blackboard |
 | ✅ Skill composition | `chain()` / `batch()` / `loop()` / `verify()` meta-operations over agent calls |
 | ✅ Semantic memory search | BYOE vector store with cosine similarity over blackboard data |
+| ✅ Phase pipeline | Multi-phase workflows with human-in-the-loop approval gates |
+| ✅ Confidence filtering | Multi-agent result scoring, threshold validation, and consensus aggregation |
+| ✅ Matcher-based hooks | Glob patterns on agent/action/tool for targeted hook filtering |
+| ✅ Fan-out / fan-in | Parallel agent spawning with pluggable aggregation strategies |
 | ✅ TypeScript native | ES2022 strict mode, zero native dependencies |
 
 ---
@@ -389,7 +393,7 @@ npm run test:priority     # Priority & preemption
 npm run test:cli          # CLI layer
 ```
 
-**1,778 passing assertions across 22 test suites** (`npm run test:all`):
+**1,924 passing assertions across 23 test suites** (`npm run test:all`):
 
 | Suite | Assertions | Covers |
 |---|---|---|
@@ -414,6 +418,7 @@ npm run test:cli          # CLI layer
 | `test-cli.ts` | 65 | CLI layer: bb, auth, budget, audit commands |
 | `test-qa.ts` | 67 | QA orchestrator: scenarios, feedback loop, regression, contradictions |
 | `test-phase7.ts` | 94 | Deferred init, hook middleware, flow control, skill composer, semantic search |
+| `test-phase8.ts` | 146 | Phase pipeline, confidence filter, matcher-based hooks, fan-out/fan-in |
 
 ---
 

SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported |
 |---------|-----------||
-| 4.12.x  | ✅ Yes — full support (current) |
-| 4.11.x  | ✅ Security fixes only |
+| 4.13.x  | ✅ Yes — full support (current) |
+| 4.12.x  | ✅ Security fixes only |
 | 4.9.x   | ✅ Security fixes only |
 | 4.8.x   | ✅ Security fixes only |
 | 4.7.x   | ✅ Security fixes only |
@@ -44,6 +44,9 @@ Network-AI includes built-in security features:
 - **Deferred Adapter Initialization** (v4.12.0) -- adapters are materialized only on first use via `registerDeferred()`, preventing untrusted adapter code from running at startup
 - **Adapter Hook Middleware** (v4.12.0) -- `beforeExecute` / `afterExecute` / `onError` lifecycle hooks; enables request-level logging, tracing, and custom security gates without modifying adapters
 - **Flow Control** (v4.12.0) -- `pause()` / `resume()` / `setThrottle()` on the blackboard; prevents write floods and enables coordinated maintenance windows
+- **Matcher-Based Hook Filtering** (v4.13.0) -- `HookMatcher` with `agentPattern`, `actionPattern`, `toolPattern` globs, and custom `condition` functions; hooks only fire when all conditions pass, enabling fine-grained security policies per tool or agent pattern
+- **Phase Pipeline with Approval Gates** (v4.13.0) -- `PhasePipeline` orchestrates multi-phase workflows; `requiresApproval` boolean halts execution until explicit human approval is granted, enforcing human-in-the-loop for sensitive operations
+- **Confidence-Based Filtering** (v4.13.0) -- `ConfidenceFilter` rejects low-confidence agent findings below configurable thresholds and validates rejected results with secondary agents; aggregation strategies (unanimous, majority) enforce consensus before accepting multi-agent results
 
 ## Security Scan Results
 

SKILL.md

@@ -498,6 +498,8 @@ Use for redundancy - take first successful result.
 ### Strategy 4: Chain
 Sequential processing - output of one feeds into next.
 
+> **TypeScript engine (v4.13.0):** These strategies map directly to the `FanOutFanIn` module (`lib/fan-out.ts`) which provides `merge`, `vote`, `firstSuccess`, and `consensus` fan-in strategies with concurrency control. For multi-phase workflows with approval gates, see `PhasePipeline` (`lib/phase-pipeline.ts`). For result scoring and threshold filtering, see `ConfidenceFilter` (`lib/confidence-filter.ts`). Matcher-based hooks (`lib/adapter-hooks.ts`) can target specific agents or tools via glob patterns.
+
 ### Example Parallel Workflow
 
 > **Platform note:** `sessions_send` and `sessions_history` are **OpenClaw host platform built-ins**, not provided by this skill. This skill provides only the `swarm_guard.py` budget/handoff check that runs before each delegation.

references/adapter-system.md

@@ -444,3 +444,140 @@ bb.getThrottle();     // 500
 // Constructor option
 const bb2 = new LockedBlackboard({ throttleMs: 100, conflictResolution: 'last-write-wins' });
 ```
+
+## Matcher-Based Hook Filtering (v4.13.0)
+
+Target hooks to specific agents, actions, or tools using glob patterns:
+
+```typescript
+import { AdapterHookManager, HookMatcher, matchGlob } from 'network-ai';
+
+const hooks = new AdapterHookManager();
+
+// Matcher: only fire for agents matching 'security-*' using tool 'file_*'
+const matcher: HookMatcher = {
+  agentPattern: 'security-*',
+  toolPattern: 'file_*',
+};
+
+hooks.beforeExecute(async (ctx) => {
+  console.log(`Security hook for ${ctx.agentId}`);
+}, { priority: 5, matcher });
+
+// Custom condition function for dynamic filtering
+const dynamicMatcher: HookMatcher = {
+  condition: (ctx) => ctx.payload?.handoff?.risk === 'high',
+};
+
+hooks.beforeExecute(async (ctx) => {
+  return { abort: true, reason: 'High-risk operations require approval' };
+}, { priority: 1, matcher: dynamicMatcher });
+```
+
+- `agentPattern` — glob matched against `ctx.agentId`
+- `actionPattern` — glob matched against `ctx.action`
+- `toolPattern` — glob matched against `ctx.tool`
+- `condition` — arbitrary predicate `(ctx) => boolean`
+- All specified fields use AND logic; hook fires only when all match
+- `matchGlob(pattern, value)` and `matchToolPattern(pattern, tool)` are exported utilities
+
+## Phase Pipeline (v4.13.0)
+
+Orchestrate multi-phase workflows with approval gates:
+
+```typescript
+import { PhasePipeline, PhaseDefinition } from 'network-ai';
+
+const phases: PhaseDefinition[] = [
+  {
+    name: 'research',
+    agents: ['researcher-1', 'researcher-2'],
+    parallel: true,
+  },
+  {
+    name: 'review',
+    agents: ['reviewer'],
+    requiresApproval: true,  // halts until approved
+  },
+  {
+    name: 'deploy',
+    agents: ['deployer'],
+    payloadFactory: (prev) => ({ ...prev, approved: true }),
+  },
+];
+
+const pipeline = new PhasePipeline(phases, executeFn, {
+  autoApprove: false,
+  approvalCallback: async (phase) => {
+    // Human-in-the-loop: return true to proceed, false to reject
+    return await askHuman(`Approve phase "${phase.name}"?`);
+  },
+  onPhaseStart: (name) => console.log(`Starting: ${name}`),
+  onPhaseComplete: (name, result) => console.log(`Done: ${name}`),
+});
+
+const result = await pipeline.run(initialPayload);
+// result.phases — per-phase results
+// result.status — 'completed' | 'rejected' | 'error'
+```
+
+## Confidence Filter (v4.13.0)
+
+Score, filter, and aggregate multi-agent results:
+
+```typescript
+import { ConfidenceFilter, Finding } from 'network-ai';
+
+const filter = new ConfidenceFilter({ threshold: 0.7 });
+
+// Score individual findings
+const findings: Finding[] = [
+  { id: 'f1', source: 'agent-a', content: 'SQL injection found', confidence: 0.92 },
+  { id: 'f2', source: 'agent-b', content: 'Minor style issue', confidence: 0.45 },
+];
+
+const result = filter.filter(findings);
+// result.accepted  — [f1] (above threshold)
+// result.rejected  — [f2] (below threshold)
+
+// Validate rejected findings with a secondary agent
+const validated = await filter.validateRejected(result, async (finding) => {
+  return { ...finding, confidence: 0.8 };  // secondary agent re-scores
+});
+
+// Aggregate across multiple agents
+const aggregated = filter.aggregate(findings, 'majority');
+// Strategies: 'highest', 'average', 'unanimous', 'majority'
+```
+
+## Fan-Out / Fan-In (v4.13.0)
+
+Spawn parallel agents with concurrency control and pluggable aggregation:
+
+```typescript
+import { FanOutFanIn, FanOutStep } from 'network-ai';
+
+const fan = new FanOutFanIn(executeFn);
+
+const steps: FanOutStep[] = [
+  { agentId: 'researcher-1', payload: { query: 'topic A' }, tag: 'r1' },
+  { agentId: 'researcher-2', payload: { query: 'topic B' }, tag: 'r2' },
+  { agentId: 'researcher-3', payload: { query: 'topic C' }, tag: 'r3' },
+];
+
+// Fan-out with concurrency limit
+const results = await fan.fanOut(steps, { concurrency: 2, continueOnError: true });
+// results — TaggedResult[] with { tag, result, success, error? }
+
+// Fan-in with strategy
+const merged = fan.fanIn(results, 'merge');
+// Strategies: 'merge', 'firstSuccess', 'vote', 'consensus'
+
+// Or use run() for convenience (fan-out + fan-in in one call)
+const final = await fan.run(steps, 'vote', { concurrency: 2 });
+
+// Custom reducer
+const custom = fan.fanIn(results, 'custom', (tagged) => {
+  return { combined: tagged.map(t => t.result) };
+});
+```