mirror of
https://github.com/proffesor-for-testing/agentic-qe.git
synced 2026-09-19 08:45:47 +08:00
agent/release-v3.13.2
164 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Dragan Spiridonov
|
e841d1b094 |
feat(bench): Cognitum QE cost-Pareto benchmark for api.cognitum.one
A self-contained harness that measures, per quality-engineering task, the cheapest tier that clears the quality bar against api.cognitum.one — so tier routing (e.g. the qe-court model table) is set by evidence, not guessed. Structure (scripts/cognitum-qe-bench/): - 7 QE tasks spanning the oracle-provenance ladder: test-generation & mutation-adequacy (execution), security-triage / pr-severity / flaky-diagnosis / adversarial-review (labeled), coverage-gap (structural). - test-generation is graded by MUTATION SCORE over a diverse mutant set with per-test validity, truncation-repair, and emission-vs-quality separation — operators grounded in .claude/skills/mutation-testing/references. - Three policies per task: P1 always-cheap, P2 always-frontier, P3 cheap+escalate (high tier only as an advisor on low cheap-confidence). - Cost is ground truth from each x_cognitum.price_usd receipt; each row carries resolvedModel + requestId (reconcilable 1:1 against usage_ledger). - Keys come from local config (env / .env), never code; two-key split (worker low/mid, judge high) is enforced by scope. mint-bench-keys.mjs is a separate one-time owner tool (safe two-part write: metered subscription + scope-split key). README documents setup for team members. - Safety: dry-run default, --max-cost pre-flight abort, mid-run cost stop, AQE_MAX_BUDGET_USD backstop. Emits ruflo-compatible cognitum-qe.v1 records. First measured finding: on these QE tasks the cheap tier (glm-5.2) matches or beats the frontier tier at 3-4x less cost; on test-generation the frontier tier failed to emit runnable code (emit 0%) while cheap scored a full mutation score. Co-Authored-By: Ruflo & AQE |
||
|
Dragan Spiridonov
|
7537fefb4e |
feat(doe): definitive 27/27 DoE re-run via OpenRouter — real F-tests + persisted raw data
Completes and supersedes the 2026-07-09 directional DoE (which was 25/27 cells, had
no F-test, and — the reproducibility gap found this session — never persisted its raw
data). Re-run full under the CRIT-2 design (N=5 stochastic replicates of fixed item
A1-inRange, real within-cell error term), qwen local $0 + anthropic/claude-haiku-4.5
+ anthropic/claude-opus-4.8 via OpenRouter. $1.538 total, well under the $11 budget.
Results (real main-effects ANOVA, 135 observations, first real data the aggregator
has ever consumed — previously stub-only):
- scaffold: none 1.000 >> plan-and-solve 0.311 >> reflexion 0.067
F(2,108)=218.9, p=1.0e-38, 71.9% of variance — DOMINANT and strongly NEGATIVE.
Both scaffolds DROP. retort's "more harness lowers reliability", now overwhelming.
- model: qwen3-coder:30b 0.644 > haiku-4.5 0.400 > opus-4.8 0.333
F(2,108)=25.1, p=1.1e-9 — local qwen best & free; opus 5x+ cost = negative value.
(Complete 27/27 reverses the prior unequal-n haiku>opus>qwen ordering, significantly.)
- retrieval: off 0.480 > on 0.433 F(1,108)=1.5, p=0.22 NOT significant, slightly
negative — the ADR-118 flywheel feature-on-trial formally fails as `beads`.
EXPLAINED by the 2026-07-10 coupling finding: A1-inRange is a no-headroom item
the models know cold, so a retrieved exemplar has nothing to add.
- prompt: TDD 0.533 > ATDD 0.467 > neutral 0.378 F(2,108)=5.7, p=4.5e-3.
Changes:
- scripts/doe-run.ts: cloud path rewired from raw Anthropic fetch to OpenRouter
(vendor/model ids, opus-4.8 not opus-4-7, exact per-call cost from usage.cost).
- docs/implementation/doe-run-2026-07-10.jsonl: raw per-cell data persisted IN-REPO
(fixes the gap that lost the 2026-07-09 run's data).
- DOE-HARNESS-SCREEN-DESIGN.md §Results (DEFINITIVE) + ADR-122 status/history updated;
prior directional run retained, marked SUPERSEDED.
Verified: tsc 0 errors; $0 --stub and --smoke pipelines green before the metered run.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
68c8914f92 |
feat(learning-integrity): live coupling validation closes CRIT-1 — mechanism real but headroom-gated
Runs the CRIT-1 coupling experiment live on qwen3-coder:30b (Ollama, $0) and
characterizes EXACTLY when the ADR-118 flywheel's retrieval helps generated tests.
Result (N=5/condition, mutation-oracle graded, end-to-end "runs∧kills" response):
- POSITIVE CONTROL (POS-reserved — an arbitrary system-specific rule the model
cannot know a priori, a proxy for project-specific corpus knowledge):
NONE 0.00 / IRRELEVANT 0.00 / RELEVANT 1.00 → gain +1.00 COUPLING VALIDATED.
Without the exemplar qwen can't even write a passing test; with it, a perfect one.
- TEXTBOOK (B4-isLeapYear — the century/400 rule):
NONE 1.00 / RELEVANT 1.00 → NO HEADROOM (the model knows the trap cold).
Conclusion: the coupling mechanism is REAL (the harness demonstrably detects it, so
its nulls are live measurements) but HEADROOM-GATED — retrieval improves tests iff
the corpus supplies knowledge the base model lacks. Generic QE edge cases are
already known to code models (30b AND 7b), which is WHY the ADR-122 DoE rated
retrieval `beads`. This explains the prior honest nulls rather than contradicting them.
Getting here required fixing three measure-the-measurement traps that had produced a
FALSE "no coupling" verdict on the first run:
- baseline floored by 500-token truncation (→ 1400) and empty-input over-reach;
- spec leaked the trap (anchor inputUnderTest spells out the edge) → no headroom →
switched to UNDER-SPECIFIED specs graded against the frozen trap-encoding reference;
- metric conditioned on baseline, hiding retrieval's strongest effect (rescuing a
test that otherwise can't be written) → switched to end-to-end usable-quality.
Also:
- OpenRouter wired as the cloud path (vendor/model ids; anthropic/claude-haiku-4.5
et al. confirmed reachable), replacing the rate-limited Anthropic-direct fetch.
- coupled-anchor.test.ts: adds an honest AQE_LIVE_COUPLING-gated end-to-end test that
fails loudly (never fabricates a pass) rather than asserting the mechanism the
scripted unit test only assumes.
- ADR-118 status → "INFRASTRUCTURE WITH A CHARACTERIZED SIGNAL": the flywheel's
retrieval-tuning pays off iff qe_patterns holds knowledge the base model lacks.
Verified: tsc 0 errors; coupled-anchor 1 passed + 1 skipped.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
df183d1ea4 |
fix(learning-integrity): remediate brutal-honesty-review findings on ADR-117..122
Addresses the CRITICAL/HIGH/MED findings from the brutal-honesty review of the learning-integrity cluster. The theme: the machinery was real but several claims outran the evidence. This makes the claims honest and the evidence falsifiable. CRIT-1 / HIGH-3 (flywheel gated vapor / toy anchor can't move): - verification/anchors/qe-anchor-v2.json — 5 oracle-verified DISCRIMINATING items (13 mutants), each with a trap edge a happy-path test misses, so the anchor CAN actually move. v1's items were too easy to discriminate a retrieval effect. - scripts/coupling-experiment.ts — falsifiable NONE/IRRELEVANT/RELEVANT controlled test (N reps, temp>0, $0 mutation-oracle grading). Live run remains blocked on model availability; the harness refuses to fabricate a verdict. CRIT-2 (DoE "stats" were a range proxy): - scripts/doe-run.ts — N real replicates of a FIXED item at temp=0.6 (was 5 different items x1 at temp=0), per-replicate seed, plus a deterministic $0 --stub. - scripts/doe-aggregate.mjs — real main-effects factorial ANOVA: within-cell error term, F-test via dependency-free regularized incomplete beta; beads verdict now gates on p<0.05, not an eyeballed mean delta. - tests/unit/scripts/doe-aggregate.test.ts — F-CDF + incomplete-beta vs closed forms/R, planted-effect recovery (p<0.001), null factor (p>0.5), unbalanced cells. HIGH-4 / MED-6 (over-claimed gate guarantees): - ADR-120 gains a "Threat model and limits (honest)" section: gateReExecutes catches a lying log, not a buggy gate (same-process seal+rule). - ADR-118 status reframed to "infrastructure awaiting a validated signal." - tests/unit/validation/rule-consistency.test.ts — property test scoping what the gate actually guarantees (determinism, stable fingerprints, flipped-verdict). - DOE-HARNESS-SCREEN-DESIGN.md — unequal-n note. HIGH-5 / MED-7 (self-fulfilling test / brittle scripts): - tests/unit/learning/mmr-scaling.test.ts — FALSIFIABLE regression for the real O(n^4) scoreHeldOut hang the MMR_POOL_SIZE cap fixed (96s->420ms at n=300). - coupled-anchor.test.ts de-faked: relabeled as a MECHANISM/wiring test, documents that the scripted generator hardcodes the outcome and the real model was an honest null — no longer readable as evidence that coupling helps. - tests/unit/validation/sealed-hash-roundtrip.test.ts — regression for the canonicalJson undefined-key seal bug. Verification: tsc 0 errors; 33/33 new remediation tests + 290/290 full validation+flywheel cluster green. No live model run (Ollama offline + Anthropic account at usage limit) — coupling live-validation surfaced as the one honest open item, not faked. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
7694f69258 |
fix(doe): handle unclosed code fences in doe-run stripFence
The reflexion critique-and-revise step sometimes emits an opening ```javascript fence with no closing ```; the old match-a-closed-block regex then left the fence line in the generated test → a syntax error → false baseline failure. Strip fence lines directly so unclosed fences no longer inflate cell failures. Verified 2026-07-09: does not change the ADR-122 scaffold verdict (reflexion's hit is a genuine over-iteration effect), only removes cross-cell noise. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
0a8254f7a9 |
feat(learning): ADR-117..122 learning-integrity cluster (frozen anchor, two-gate judge, gate-reexecute, provenance tiers, receipt-gated flywheel, DoE)
Adopts the receipt-gated self-improvement discipline from the 2026-07 cross-repo analysis of ruflo (flywheel), MetaHarness (gateReExecutes), and retort (two-gate spec conformance + DoE). All DI'd and unit-tested (178 tests); run end-to-end on real qe_patterns; every limitation honestly scoped. - ADR-117 frozen oracle anchor: hash-pinned, constant-denominator eval set that no promotion may regress; loader throws on drift (verification/anchors/qe-anchor-v1.json). - ADR-118 receipt-gated QE-policy flywheel: generational loop over qe_patterns, conjunctive frozen accept(), Ed25519-signed receipts + compounding lineage, durable persistence (flywheel_receipts), corpus + semantic-retriever coupling. - ADR-119 two-gate quality verdicts: mechanical gate + frontier judge, three-valued (pass/fail/inconclusive) with preflight; new `aqe quality-gate` CLI + `qe/quality/gate` MCP tool. - ADR-120 gateReExecutes: re-execute a versioned frozen rule on sealed inputs; catches the A8-EXT forged-promote class; retrofit onto pattern-promote + dream-apply. - ADR-121 provenance tiers: only oracle:test-exec evidence changes fleet behavior; additive, conservative-backfill migration. - ADR-122 DoE screen: model x prompt x retrieval x scaffold, run on real data (25/27 cells, $1.25) — scaffolding (esp. reflexion) and retrieval degrade reliability (the retort `beads` signature); simplest+cheapest stack wins. - safe-db: AQE_DISABLE_WAL / AQE_JOURNAL_MODE env-gate (macOS virtiofs bind-mount WAL corruption mitigation; default behavior unchanged). Honest nulls documented: the flywheel lift is on a self-supervised proxy with the anchor held flat; making the coupled anchor move needs harder items + a relevant corpus (an ADR-117 re-freeze), not a retriever change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
ce1222a7c4 |
fix(learning): stop brain-export hook leak + harden DB backups on virtiofs mount
Real-time hook learning-capture was failing on this macOS Docker bind mount with `Failed to initialize UnifiedMemoryManager: database is locked`, and a brain-checkpoint hook was leaking deadlocked `brain export` subprocesses (4 found, ~1.5GB RSS). Root cause is SQLite concurrency on a WAL-hostile virtiofs mount, NOT a native-binary mismatch (better-sqlite3 loads fine). - brain-checkpoint.cjs: add AQE_DISABLE_BRAIN_CHECKPOINT env / marker-file kill switch (opt-in; shipped installs unaffected). The export spawns a native RVF writer that deadlocks in a futex and ignores the SIGTERM the timeout sends, so orphaned exporters piled up. Disabling stops the leak at the source. - aqe-hook.cjs: make the FATAL health-log fix-hint conditional. Only suggest `npm rebuild better-sqlite3` for real native markers; lock-contention failures now point at the actual cause instead of sending users down the wrong path. - feature-flags.ts: add the missing RUVECTOR_USE_RVF_PATTERN_STORE env override (the only RuVector flag lacking one) so an RVF FsyncFailed can fall back to the SQLite HNSW PatternStore. Activates after build. - scripts/aqe-db-backup.sh: consistent VACUUM INTO snapshots (safe with concurrent writers), integrity-verified before promotion, rotating + daily, to the host mount so they survive container loss. Restore round-trip tested. - devcontainer.json: auto-restart the backup loop (postStartCommand) and set bind-mount env mitigations (remoteEnv: AQE_DISABLE_WAL, RUVECTOR_USE_RVF_PATTERN_STORE=false, AQE_DISABLE_BRAIN_CHECKPOINT). - learning-config.json: clear the stale rebuildMode flag (no src reader; on since 2025-12). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
53ee377aec |
fix(learning): close system-integrity audit gaps in dream engine, witness chain, mincut, GOAP executor, and SONA
Full remediation of docs/analysis/SYSTEM-INTEGRITY-AUDIT-2026-07-04.md's P0-P2 findings, tracked in docs/plans/SYSTEM-INTEGRITY-REMEDIATION-GOAP-PLAN-2026-07-04.md. Highlights: - Dream engine: real pattern creation on insight apply, error/outcome concept nodes from real ADR-110 data, and a follow-up fix ensuring the concept refresh actually runs on the real automatic path (not just via test wrappers); persistTaskOutcome now genuinely promotes pending insights instead of blindly incrementing an applied counter - Witness chain: Ed25519 signing wired via persistent key directory, archival/append-after-archival bug fixed, CI verification gate added - Mincut: real event-bus wiring (was a no-op stub) and scaffold-vertex detection fixes - GOAP: real domain-API dispatch executor replacing the always-mock one - SONA: EWC++ cold-start deadlock fixed via independent request-count persistence - ADR-110 pattern-nulls wired into the real production capture path - Daemon/snapshot visibility, TTL unit bugs, and 8 ADRs re-statused with additive verification notes Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
9ca2c128ef | Merge remote-tracking branch 'origin/main' into feat/local-model-improvements | ||
|
Dragan Spiridonov
|
6dcb919aee |
feat(deps): dependency-security system + fix grpc-js HIGH (ADR-115)
Closes the gap that let @grpc/grpc-js@1.14.3 (CVE-2026-48068/48069, HIGH) sit undetected: every existing dependency check only fires on dep-file changes, so a CVE disclosed against a frozen pin was invisible. Adds: - scripts/dependency-audit.mjs in-repo + consumer-POV audit, severity gate - scripts/dependency-update.mjs security-first in-range updater with a guard that refuses to drop optional @ruvector platform deps (the Dependabot lockfile bug) - dependency-audit.yml daily consumer-POV scan -> tracking issue - dependency-update.yml weekly in-range security PR (gh CLI) - docs/guides/dependency-security-policy.md + ADR-115 - tests/unit/scripts/dependency-security.test.ts (11 hermetic tests) - npm scripts: deps:audit[:consumer], deps:update[:all] Also bumps @grpc/grpc-js 1.14.3 -> 1.14.4 in-range (HIGH 1 -> 0); optional platform deps preserved (90 -> 90). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
6174652c57 |
feat(llm): unified AQE_OLLAMA_URL + adaptive Ollama timeouts (#2, #3)
#2: single resolveOllamaBaseUrl() knob (AQE_OLLAMA_URL > OLLAMA_URL > each call-site default) wired into all local clients — chat provider, consensus provider, local judge, embeddings, free-tier. Unset = identical behavior; one var now repoints every client at a remote/host Ollama. #3: size each Ollama request timeout from num_predict and the model's observed tok/s (EMA) instead of a fixed 120s, so slow dense/thinking models (~15 tok/s measured) no longer silently time out mid-generation. Explicit/configured timeouts still win. Adds scripts/oracle-model-bench-local.ts (local mutation-oracle bench). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
0f418231c9 |
feat(conservation): gate plugins (strict mirror) + .kiro (presence); add --sync resync
Close the biggest remaining drift gap (ADR-114 follow-up). - skill-parity now gates plugins/agentic-qe-fleet/skills as a strict body-mirror alongside assets/skills; reconcileBody + `check-skill-parity --sync` resync drifted mirrors while preserving each tree's frontmatter (used to fix the plugins qe-quality-assessment drift) - .kiro/skills is an intentionally divergent 86-skill variant (qe- prefixed, some large .kiro-only bodies) — gated by PRESENCE via the conservation guard's kiro-skills surface, not body-equality (which would destroy the divergence) - both guards (verify:skill-parity blocking, verify:conservation non-blocking) wired into invariant-check.yml with plugins/.kiro paths; policy doc updated - tests: reconcileBody/splitFrontmatter covered; 16 validation tests pass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
af4140efb9 |
feat(quality): oracle evals, durable-first tests, conservation guard + provider fixes
Apply Phoenix Architecture principles to AQE — regenerate internals, conserve the interface. ADR-113 (evals are oracles, durable-first tests, mutation-score gate): - src/validation/oracle-eval.ts grades a generated test by running it against a reference impl + operator mutants (reuses qe-arena, ADR-104); rejects assertion-less output - oracle mode wired into scripts/run-skill-eval.ts (skips under the simulating runner; runs live) - qe-test-generation rewritten durable-first; its eval flipped to oracle - src/feedback/regenerability-gate.ts: mutation-score + regenerability gate (warn-default, opt-in block) - live-validated: Claude sonnet-4-6 clears the oracle 5/5; weak local-model output correctly fails ADR-114 (conservation layer, Phoenix essay 14): - src/validation/conservation-guard.ts + scripts/conservation-guard.ts guard CLI commands, output schemas, and dashboard API against breaking removals (deprecation registry exempts) - policy doc + baselines in verification/conservation/; wired into invariant-check.yml non-blocking LLM provider fixes: - OpenRouterProvider.type was 'openai' but registered under 'openrouter' -> ProviderManager failover never found it; fixed to 'openrouter' end-to-end - Gemini default model gemini-1.5-pro was retired -> gemini-2.5-flash; models/pricing refreshed from the live Gemini ListModels API - scripts/provider-health.ts (npm run providers:health) Cheaper-model eval lanes: - scripts/oracle-model-bench.ts + openrouter-models.ts; openai/gpt-oss-120b clears the oracle ~50-70x cheaper than Claude Sonnet; guide in docs/guides/cheaper-model-eval-lanes.md Verification: npm run build ok; 115 new+touched tests pass; 724 LLM tests pass; lint + parity clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
c0cfc16d27 |
feat(mcp): default-deny MCP policy gate — plan 05 / A1 (G1)
Closes G1 of the cross-pollination plan: AQE now governs its own ~90-tool
MCP surface with a default-deny policy + CI gate ("npm audit for agent tools").
- .harness/mcp-policy.json: truthful default-deny snapshot; _enforcement labels
what is wired (tool-scoping default-deny, witness-chain audit) vs posture/
stated-intent — not theater.
- scripts/mcp-policy-gate.mjs: self-contained mirror of MetaHarness mcp-scan's
HIGH checks; also reads .mcp.json (closing the scan false-negative where AQE's
server is declared there, not in .claude/settings.json). Exit 1 on any HIGH.
- .github/workflows/mcp-policy-gate.yml + `npm run security:mcp-policy`.
- tool-scoping: fix the interface doc-comment that claimed "empty/undefined ->
allowAll" (the code DENIES by default); export ALL_AGENT_ROLES.
- tests/unit/mcp/mcp-policy-gate.test.ts: drift guard (policy roles <-> enforcement),
default-deny posture. 46/46 green; scan = 0 HIGH; fails-closed verified.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
d95f0d7b18 |
chore(evals): refresh QE skill eval model matrix to current model IDs
The cross-model consistency matrix (models_to_test) in 54 skill evals + both eval templates pinned retired/malformed model IDs — `claude-3.5-sonnet` (malformed: dashes, not dots; resolves to Sonnet 3.5, retired Oct 2025) and `claude-3-haiku` (retired Apr 19 2026). Both 404, so those evals could not run a meaningful cross-model check. Refresh to current pinned IDs, preserving the original "primary + fast floor" design: - claude-sonnet-4-6 # primary (high accuracy) - claude-haiku-4-5 # fast floor (minimum quality) High-stakes skills additionally get the capability ceiling claude-opus-4-8 (security-testing, security-visual-testing, n8n-security-testing, pentest-validation, chaos-engineering-resilience, qe-chaos-resilience, qe-defect-intelligence) and the security eval template. Opus is scoped to these 7 + the security template rather than all 54 to avoid a fleet-wide eval-cost blowup. Also fixes the two `--model claude-3.5-sonnet/claude-3-haiku` examples in run-skill-eval.ts and a nested cross-model test-case input in qe-learning-optimization.yaml. Verified: all eval YAML parses; zero retired/deprecated Claude IDs remain across skills/evals + templates + runner. (src/domains/constants.ts MODEL_TIERS was already current — tier 1 claude-haiku-4-5 — so it is intentionally unchanged; the legacy claude-3-haiku-20240307 entries in cost-tracker/bedrock are retained historical pricing/availability data.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
bd0bb213ca |
feat(scripts): shipped-agent invariant verifier per ADR-107 (issue #522)
config/agent-invariants.json manifest + verify-shipped-invariants.ts: section-level content assertions (not keyword greps), shipped-vs-source divergence on invariant sections, assets-only-qe rule, loud exemptions, version-policy warnings. npm run verify:invariants. Found pre-existing drift on first run: qe-integration-architect.md (legacy format, no XML sections) and qe-queen-coordinator.md (missing 3 sections) — exempted with reasons pending maintainer decision; 53 agents carry frontmatter 3.0.0/3.1.0 vs package 3.10.5 (warn until semantics decided). Verified: baseline run 0 violations/55 warnings exit 0; mutation tests 9/9 (hollow-section, removed-section, divergence, reword-passes); E2E smoke on mutated tree exits 1 catching both hollow + divergence rules. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
dc6fce5e70 |
feat(contracts): ADR-103 structured verdict handoffs — RiskDecision et al
Versioned, additive-only verdict envelopes for agent/MCP handoffs:
RiskDecision (quality gates), FindingVerdict (review findings with
adversarial refutations), CoverageGap (risk-weighted gaps).
- src/contracts/verdicts.ts: dependency-free validators (source of
truth) + mirrored draft-07 JSON Schemas; no zod/ajv runtime deps
(light-install posture preserved)
- quality_assess MCP boundary now attaches a validated riskDecision
envelope derived from the gate outcome (approve/block, escalate when
indeterminate) — additive, existing payload unchanged; direct and
wrapped handlers share the same mapToResult so MCP parity is inherent
- schemas/*.schema.json published via scripts/generate-verdict-schemas.mjs
for external ajv validation and workflow agent({schema}) enforcement
(consumed by improvement 5)
17 contract tests (goldens validate; mutations rejected with field-level
errors; builder always emits valid envelopes). E2E: envelope emitted by
the compiled boundary builder validates with stock ajv against the
published schema; mutated sample rejected. tsc + eslint clean.
Part of #520 (improvement 6/7, Tier 3).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
f2a350ba7f |
feat(agents): ADR-101 nested-subagent readiness — provenance, probe, validation
Anthropic announced nested subagent support (depth=5) on 2026-06-09; the runtime currently strips Task at parent->child spawn (upstream denylist, empirically confirmed by our committed probe: level=1 status=NO_AGENT_TOOL, matching ruflo ADR-147). This lands the readiness infrastructure that is independently useful today and activates with zero changes when the gate lifts: - aqe hooks post-task gains --parent-agent-id / --depth (validated: identifier charset, integer 0 <= d <= 32; depth=0 survives as 0); provenance persisted to qe_trajectories.metadata_json (stage 1 — no schema migration) and forwarded into ReasoningBank feedback so learning can segment patterns per hierarchy level - TaskExecution gains optional parentAgentId/depth (additive types) - scripts/probe-nested-spawn-depth.mjs: single-shot empirical probe, committed transcript under docs/probes/ — re-run after every `claude update`; TASK_TOOL_LIVE is the signal for follow-up phases - fresh-project fix found by the E2E: persistTaskOutcome assumed captured_experiences/experience_applications exist, but they are middleware-created — Stream B silently no-oped on fresh installs; canonical DDL now ensured in the hook path Deliberately deferred (documented in ADR-101 P1): tools: frontmatter retrofit on shipped qe-*.md agents — Claude Code frontmatter is a restrictive allowlist and would sever inherited MCP tool access; needs maintainer sign-off + wildcard verification first. 8 unit tests green; E2E on a fresh temp project verified persistence, rejections, and depth=0 boundary. tsc + eslint clean. Part of #520 (improvement 4/7, Tier 2). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
e177bfcf58 | benchmarks | ||
|
Dragan Spiridonov
|
b9df2f9a58 |
fix(parsers): rebuild python/java/c#/rust/swift WASM grammars for web-tree-sitter 0.26
The committed grammars for these 5 languages were built with the pre-0.25 emscripten "side module" format and fail to load with web-tree-sitter 0.26 (getDylinkMetadata error) — the multi-language parser was silently falling back to regex for ALL of them. Rebuilt with tree-sitter-cli 0.26.9 (wasi-sdk) via scripts/build-grammars.sh. Verified: the WASM parser test suite now loads every grammar with ZERO "Failed to load WASM grammar" fallbacks (was one per parse); 117 parser tests pass. Also: build-grammars.sh installs grammar source packages with --legacy-peer-deps (they declare conflicting tree-sitter binding peers, irrelevant since we only consume their C source) so `build-grammars.sh all` resolves cleanly. |
||
|
Dragan Spiridonov
|
c3173a88ad |
feat(code-intelligence): parse TS/JS via bundled tree-sitter WASM — no typescript dependency (#511)
Code-intelligence (index/deps/impact/search) required the multi-megabyte
`typescript` compiler at runtime; without it every TS/JS file errored
("TypeScript is required for code analysis") and produced 0 nodes/edges — i.e.
the feature was broken out of the box for the entire JS/TS ecosystem.
Bundle tree-sitter WASM grammars for typescript/tsx/javascript and extract
entities/imports from them instead:
- assets/grammars/tree-sitter-{typescript,tsx,javascript}.wasm (shipped via
package `files: assets/**`).
- treesitter-ts-extractor.ts: extracts functions (incl. async arrows), classes +
methods (with visibility), interfaces, and imports (incl. require()).
- knowledge-graph.ts: TS/JS extraction now prefers tree-sitter (typescript-free),
falling back to the TypeScript compiler API only if tree-sitter is unavailable
AND `typescript` happens to be installed.
- tree-sitter-wasm-parser.ts: export loadWasmGrammar() reusing the proven WASM
init + grammar-path resolution.
Built with tree-sitter-cli 0.26.9 (matching web-tree-sitter ~0.26) via the new
scripts/build-grammars.sh (docker + emscripten/emsdk; reproducible — byte
identical across runs). Grammars built with the pre-0.25 emscripten dylink format
do NOT load with web-tree-sitter 0.26 (getDylinkMetadata error), which is why the
build pins the toolchain.
Verified on a real fresh project with NO typescript installed: code index → 8
nodes / 7 edges, deps → 2 connecting edges, search → 3 results. 232
code-intelligence tests + new extractor unit tests pass.
Note: the pre-existing assets/grammars/*.wasm for python/java/c#/rust/swift were
built with the old toolchain and currently fail to load with web-tree-sitter
0.26 (silently falling back to regex). They can be rebuilt with
`scripts/build-grammars.sh all` — tracked as a follow-up.
|
||
|
Dragan Spiridonov
|
3196c05edd |
feat(learning): pretrain-from-history bootstrap (#510 item 9)
Ports ruflo ADR-077: seed the pattern store from the repo's OWN git history
(commits = success trajectories) through the SAME live-learning code path, so
a fresh project starts with a non-empty, project-specific pattern store instead
of only the generic PRETRAINED_PATTERNS.
scripts/pretrain-from-history.ts (npm run pretrain:history):
- git log --no-merges -> per commit: domain = deriveTaskType(subject),
success = subject !startsWith 'revert' (a revert is a failure signal);
- records each via persistTaskOutcome (the live captured_experiences +
experience_applications + Q-update path, honoring AQE_PROJECT_ROOT);
- then consolidateExperiencesToPatterns() distills them into qe_patterns.
- flags: --limit N (default 500), --dry-run (classify+histogram, write nothing),
--verbose. Extracted a pure classifyCommit() helper (19 unit tests).
Correctness fix found during verification (in the script, not prod): a brand-new
store only has core schema, so persistTaskOutcome failed with
'no such table: experience_applications'. The script now calls the canonical
ensureAllBrainTables() + initializeExperienceCapture() before recording — the
same tables production creates lazily.
Verified against a THROWAWAY AQE_PROJECT_ROOT temp store (data protection):
--limit 150 -> captured_experiences 0->150, qe_patterns 0->4, exit 0;
--dry-run -> nothing recorded (captured_experiences stays 0);
real .agentic-qe/*.rvf byte-identical (sha256) before/after; 19 tests pass.
Side-finding: AQE's real embedding (ONNX) costs ~2.3s/commit here vs ruflo's
~3ms/trajectory, so bootstrapping 500 commits takes minutes — logged as a perf
follow-up (embedding backend / batching).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
0d80eb56ec |
feat(perf): RaBitQ 1-bit signature utility + benchmark (#510 item 8)
Ports ruflo's perf-M4 (sign-random-projection + Hamming popcount). Adds
src/shared/utils/rabitq.ts: signSignature (384-bit packed into 12 Uint32
words, 48 bytes), hammingDistance (SWAR popcount), hammingSimilarity, and
topKBySignature (Hamming prefilter gated at N>=100 + exact-cosine rerank of a
recall-aware pool, so output equals exact topK when the true top-k fall in the
pool). 16 tests + scripts/benchmark-rabitq.ts (npm run benchmark:rabitq).
HONEST FINDING (verified, does NOT match ruflo's optimistic 2.7x/10.9x):
N=1000: speedup 1.31x, recall@10 100%, index 1.46MB -> 47KB (32x smaller)
N=5000: speedup 1.18x, recall@10 99.9%, 7.32MB -> 234KB (32x smaller)
The 32x INDEX-MEMORY reduction is real and unconditional. The SPEEDUP is only
~1.2-1.5x in JS, not ruflo's figure: a 1-bit sign signature in 384-dim is
coarse, so preserving recall@10 >= 0.95 needs a large exact-rerank pool
(~40-55% of N), which eats most of the prefilter win. ruflo's big win came
from replacing a LINEAR scan; AQE's main search is already native HNSW
(sublinear), so that win doesn't transfer. Tests pin this tradeoff (recall==1.0
with a sufficient pool; small pool sacrifices recall) so it can't be
mis-sold later.
NOT INTEGRATED — no zero-regression consumer exists:
- unified-memory-hnsw search() IS the ranking (no separate exact rerank to
prefilter), so Hamming-prefiltering its beam would drop true neighbors;
- coherence-gate-energy O(N^2) SUM and k-means clustering are numerically
sensitive (Hamming would change results).
Committed as a tested, benchmarked, ready-to-use utility (real memory lever for
patterns.rvf and a future prefilter->exact-rerank consumer), not wired into any
production path. No production code or .agentic-qe stores touched.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
b1a462fba2 |
feat(mcp): protocol-compliance smoke + tool-parity audit (#510 item 4)
Ports ruflo's #1874 discipline. Replaces the FAKE mcp:validate theater (echo 'All tools registered' && exit 0) with a real smoke that boots the actual MCP server (tsx src/mcp/entry.ts) over stdio and validates the initialize + tools/list handshake against the MCP SPEC, not the code: - protocolVersion is a YYYY-MM-DD string (the core ruflo #1874 guard — an object here is what Claude Code's Zod rejects) - capabilities is an object; serverInfo.name/version are non-empty strings - tools/list returns a non-empty array, each entry name + object inputSchema scripts/audit-mcp-tool-parity.mjs is the AQE-equivalent of ruflo's CLI<->MCP parity audit (the CLI has no callMCPTool('name') string pattern, so the meaningful surface is advertisement<->handler parity). Drives the advertised set from a live tools/list, diffs a monotone baseline (verification/mcp-tool-parity-baseline.json, 86 tools), fails only on NEW discrepancies (removed tool = regression), and probes that unknown-tool tools/call is rejected. --update-baseline to re-baseline. Both scripts spawn the server against an isolated AQE_PROJECT_ROOT temp dir (data protection: real .agentic-qe/*.rvf proven byte-identical before/after) and kill the whole detached process group on exit (no leaked servers). Verified: npm run mcp:validate -> PASS (protocolVersion 2025-11-25, 86 tools); mcp:parity -> PASS (0 removed, 0 added). Both exit 0, real stores untouched. Side-finding (pre-existing, not fixed here): handleToolsCall throws a plain object for unknown tools, which escapes the request-handler safety net as 'Internal error: [object Object]' instead of a proper JSON-RPC -32601. Logged for a dedicated fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
9cb44d3252 |
feat(learning): self-learning verification harness (#510 item 1)
Ports ruflo's benchmark-self-learning.mjs discipline (the 'reports success but persists nothing' detector) to AQE. Proves the learning stores actually persist what they claim, that stat aggregators agree with the underlying index, that nothing writes accidentally, and that data survives restart. Sections (each isolated in a temp dir, each gating): A store persistence — N creates => totalPatterns delta == N B outcome learning — N outcomes => learningOutcomes delta == N, successRate matches fed ratio C negative control — read-only ops => 0 delta (no accidental writes) D restart survival — dispose + reopen on same temp path => counts persist E consistency — RvfPatternStore.getStats == adapter.totalVectors == bank.totalPatterns F audit-real — copies real stores read-only, checks banner numbers round-trip Data protection (CLAUDE.md): synthetic mode uses fresh temp dirs; audit-real copies stores and opens only copies. Verified real .rvf stores byte-identical (mtime+size+sha256) before/after a run. Audit-real finding on the live store: banner numbers corroborated (72.5% success, 39.7% confidence, 2131 routings) BUT RVF vector count (338) != SQLite qe_patterns rows (345), a ~7-pattern index/table drift the banner hides — exactly the divergence this harness exists to surface (reported as a diagnostic note, non-gating). Synthetic sections A-E pass; exit 1 on failure. npm run benchmark:self-learning Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
122f223c9a |
fix(security): migrate from @xenova/transformers to @huggingface/transformers
@xenova/transformers v2.17.2 (last publish 2024-05-29) pins onnxruntime-web@1.14.0, which pulls onnx-proto → protobufjs <=7.5.5. That chain has 8 GHSA advisories including a critical arbitrary-code- execution one (GHSA-xq3m-2v4x-88gg). Our top-level `overrides` block forced protobufjs@^7.5.6 in our own tree, hiding the vulns from `npm audit` in this repo — but `overrides` are root-only by design and do not propagate to downstream consumers. End users running `npm install agentic-qe` were getting 5 vulns (4 high, 1 critical). @huggingface/transformers@4.2.0 is the official maintained successor (same project, renamed). It pulls onnxruntime-web@1.26 which depends on protobufjs@^7.2.4 directly (no onnx-proto), so the version range resolves cleanly to the patched line. API changes handled: - pipeline()/Tensor: drop-in compatible, just the import path changes - `quantized: bool` → `dtype: DataType` (mapped from our QuantizationType enum: 'none'→'fp32', 'fp16'→'fp16', 'int8'→'int8', 'binary'→'q8'; binary stays a post-process step downstream) - progress_callback signature: ProgressInfo is now a discriminated union; `progress` only exists on the "progress" variant — narrowed accordingly Also added onnxruntime-node and onnxruntime-web to the CLI and MCP bundle externals lists. @huggingface/transformers ships both runtimes (node for Node.js, web as fallback); esbuild can't bundle the native .node binary so it must remain external. End-user verification (npm pack + clean install in /tmp/aqe-canary): - 183 packages (was 180 pre-migration; same order of magnitude) - 0 vulnerabilities (was 5: 4 high, 1 critical) - aqe init --auto runs in 93 ms; all 13 phases pass; optional-peers hint renders correctly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
b64540fe57 |
fix: resolve issues #467, #469, #470, #472, #473, #474
User-reported bugs across MCP tooling, fixed and verified end-to-end. #467 (__dirname not defined in ESM): - Added fileURLToPath polyfill to workflow-loader, quality-criteria-service, init/phases/07-hooks, init/phases/10-workers, cli/commands/sync, integrations/n8n/n8n-adapter, and integrations/n8n/agent-factory. #469 (qe_embeddings search returns no results, similarity near zero): - Routed the ONNX embedding generator through the real @xenova/transformers pipeline (all-MiniLM-L6-v2) instead of the random-vector mock. Cosine similarity of "apple pie" vs "apple fruit pie recipe" now ~0.78 (was -0.07). - Replaced `threshold || 0.5` with `threshold ?? 0.5` so explicit 0 is honored. #470 (qe_coherence_collapse riskLevel critical with isAtRisk false): - Guarded categorizeRisk against NaN/null/undefined (returns 'low' on non-finite input instead of falling through to 'critical'). - Defaulted missing numeric fields in heuristicAnalysis to safe values so degenerate input can't propagate NaN through the risk score. - Derived isAtRisk from riskLevel so the two can never disagree. #472 (qe_tests_schedule "this.config.phases is not iterable"): - Pipeline now falls back to DEFAULT_TEST_PHASES when the MCP wrapper doesn't pass an explicit phase list. #473 (session_cache_stats reports 0% hit rate): - Wired SessionOperationCache into the MCP tools/call dispatcher for isConcurrencySafe tools. Cache fingerprint is computed from the tool name and canonical args. Cache hits short-circuit the handler. #474 (test_generate_enhanced ignores language parameter): - Validate `language` against the supported set; reject unknown values with a clear error and the list of supported languages. - Auto-derive `framework` from `language` (DEFAULT_FRAMEWORKS) when not provided, instead of always defaulting to vitest. - Reject language/framework mismatches that would produce wrong output. - Expanded the MCP schema enum for framework to expose the full set of generators we already ship. Verified via scripts/verify-iteration-1.mjs which spawns the freshly-built MCP bundle and runs the user's exact reproductions over JSON-RPC. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
5d187de2a1 |
fix(install,rvf,hypergraph): unblock Windows install, fix RVF FsyncFailed, synthesize covers edges
Bundles fixes for issue #439 (Windows install) and Jordi RUFLO patches P020 (RVF init) + P220 (hypergraph blindness). Windows install (#439): - Move hnswlib-node from dependencies to optionalDependencies so installs no longer fail on Windows boxes without VS C++ Build Tools; HnswAdapter already routes around a missing native binary at runtime. - Replace HNSWIndex.ts top-level static `import hnswlib from 'hnswlib-node'` with a lazy require so package load survives the optional dep being absent. - README + preinstall.cjs: document toolchain requirement and disclose that the JS fallback degrades to O(N) brute-force when @ruvector/gnn is also unavailable (Windows default — no win32 prebuilds ship). - ADR-090 amendment reconciling the move with ADR-081's optional-dep + JS-fallback intent. RVF init (Jordi P020): - Root cause: shared-rvf-adapter and pattern-store factory always called RvfDatabase.create(), which throws `0x0303 FsyncFailed` when the .rvf file already exists from a prior init phase. Reproduced and confirmed against both 0.1.7 and 0.1.8 native binaries — not a version regression. - Fix: race-tolerant open-or-create ladder (try open → fall back to create → retry open on create-race) with dim() verification after open. Mismatched-dim files are closed and the caller degrades rather than corrupting silently. Hypergraph (Jordi P220): - Drop the original flushEdgesToHypergraph (wrote `call`/`extends` edges that no production query reads — devil's-advocate review caught it as dead infrastructure). - Add HypergraphEngine.synthesizeTestCoverage that re-tags test files type='test' and writes `covers` edges from each test file to functions in the source files it imports. This is the shape findUntestedFunctions / findImpactedTests actually filter on. - E2E verified: untested correctly excludes covered functions; impacted-tests returns the right test file. Verification: - `npm run build` clean - 276/276 tests pass across HNSW, RVF, KG, coordinator, hypergraph suites (5 new synthesizeTestCoverage tests; replaced 4 obsolete flush tests) - E2E on fresh project: aqe init clean, hooks stats shows nativeAvailable: true, code index logs `Test coverage synthesized`, hg untested + hg impacted return useful results Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
25b6bd732a |
chore(release): v3.9.18
Bundles 4 MCP bug fixes + new agentic-qe-fleet plugin. Fixed: - coverage_analyze_sublinear and other domain MCP tools blocked by governance after 1-2 calls (synthetic token-slope estimate replaced with 0; throttle decisions are no longer treated as hard blocks) - test_generate_enhanced framework=jest produced unrunnable tests (now emits @jest/globals imports instead of invalid 'jest' package import) - generated test imports referenced /tmp/aqe-temp-* paths (importPathOverrides plumbed through IGenerateTestsRequest end-to-end) - qe/coverage/gaps error message misled callers about which input failed (distinguishes coverageFile-empty vs autodiscovery-miss) Added: - test_generate_enhanced schema exposes framework, filePath, coverageGoal, aiEnhancement, detectAntiPatterns parameters - agentic-qe-fleet Claude Code plugin (11 agents, 9 commands, 9 skills) - scripts/smoke-test-fixes.sh and scripts/plugin-load-test.sh Verification: - 1301 MCP unit tests pass (zero regressions) - 734 targeted unit tests pass across changed code - aqe init --auto in fresh project succeeds (85 skills, 60 agents) - End-to-end MCP smoke test passes 5/5 - qe-coverage-specialist agent re-spawn confirms NO_GOVERNANCE_BLOCK - Plugin structural validation: 14/14 checks pass Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
9d3b514ee2 |
fix(v3.9.14): second P0/P1 wave from QE audit follow-up
Security (M-01): - src/cli/commands/learning.ts: replace execSync shell-interpolation of the user-controlled --file path with execFileSync + file-descriptor redirect (dump) and stdin input (import). Closes the command-injection vector where a crafted --file="x.db\"; rm -rf ~; \"" would escape shell quoting. Build / supply chain: - Move @claude-flow/guidance from dependencies to optionalDependencies alongside @claude-flow/browser. No stable successor exists on npm; usage is already guarded by try/await-import/catch fallbacks so demotion is safe. Documented in the follow-up research memo. - Lazy-load @faker-js/faker via dynamic import in test-data-generator.ts and mark it external in build-cli.mjs / build-mcp.mjs. Faker is a devDep that previously got statically bundled into shipped artefacts because of a top-level import. Tarball drops 11.5 MB → 9.6 MB. MCP API contracts: - Add required:true to semantically load-bearing first parameters on agent_metrics (agentId), coverage_analyze_sublinear (target), accessibility_test (url), defect_predict (target), code_index (target). Verified via live MCP tools/list handshake — required arrays now match the intent documented in each tool's description. CI hygiene: - Rewrite the "Commit telemetry data" step in qcsd-production-trigger.yml to push to a bot branch and open a PR instead of `git push` direct to protected main. That push failed 8/10 runs on the last audit cycle because of branch protection. Artifact upload (already present) continues to preserve the raw payload for 90 days regardless of whether the PR lands. Verification: - npm audit --omit=dev: 0 critical, 0 high (1 moderate in @mapbox/node-pre-gyp — extraneous, pre-existing, unrelated). - npm run typecheck: clean. - CLI + MCP bundles rebuild successfully. - 253/253 test-generation unit tests pass. - Live MCP protocol smoke: new required flags visible on tools/list; advisor_consult guard from v3.9.14 round 1 still fires. Memory note: see feedback_cli_is_aqe.md — CLAUDE.md ruflo refs were audited. Only 2 lines (204, 260-261) are stale AQE-product refs; the other 11 swarm/memory/daemon ruflo commands are legitimate orchestration-layer invocations and are intentionally retained. Deferred to a dedicated docs PR so the user can review each. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
6dd39a9938 |
fix(v3.9.14): close all 5 P0 blockers identified by v3.9.13 QE audit
Security (15 criticals → 0):
- Pin protobufjs to ^7.5.5 via overrides + resolutions to break the
@xenova/transformers → @claude-flow/{browser,guidance,embeddings}
→ onnxruntime-web → onnx-proto chain reaching the CVE-94 payload
(GHSA-xq3m-2v4x-88gg). npm audit --omit=dev now reports 0 vulns.
Tarball bloat (-42%):
- Add rmSync(dist/cli/chunks) to build-cli.mjs before the code-split
build so only fresh chunks ship. 799 → 240 chunks, dist/cli 44 → 11
MB, npm tarball 19.9 → 11.5 MB.
Retiring-model refs (ADR-093 tier-1 hardcodes):
- Replace 'claude-3-haiku-20240307' with 'claude-haiku-4-5' in
MODEL_TIERS[1] at constants.ts:608 and in five mirror implementations
across test-execution, contract-testing, chaos-resilience,
learning-optimization, and visual-accessibility services. Haiku 3
retirement will no longer 404 these tier-1 fallback paths. Backward-
compat refs retained intentionally in bedrock ARN table, cost
tracker, type unions, and RETIRING_MODELS schedule.
ESLint harness:
- package.json lint script invoked eslint on both `src` and `tests`
but .eslintrc.cjs explicitly ignores `tests`, causing ESLint to
abort. Narrow the script to `eslint src --ext .ts` so the harness
runs. (955 pre-existing rule violations remain as separate backlog.)
advisor_consult MCP contract (ADR-092 F-01):
- Mark `agent` and `task` parameters as required:true in the schema.
- Validate via trim() guard in the handler and return a structured
error when either is empty/whitespace instead of shelling out to
`aqe llm advise` with placeholder values. Verified via live MCP
stdio handshake: both empty-string and whitespace-only `agent`
produce the expected rejection without any child process spawn.
Verification:
- npm audit --omit=dev → 0 vulnerabilities (verified from node_modules,
not just lockfile).
- npm run typecheck → clean.
- npm run build → CLI + MCP bundles both build.
- 94/94 tests pass across the patterns touched (security-compliance
scanners + task-executor-errors).
- MCP protocol smoke test confirms advisor_consult guard fires.
Restores Dependency/Build from Grade C to Grade B and lifts the
composite quality score from 7.0 to ~7.3.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
3f743ada46 |
chore(adr-093): sweep remaining model refs in opencode plugin, scripts, .kiro, command docs
91 files changed, +99/-99. Fifth and final post-audit sweep. Addresses all gaps surfaced by the third broader audit pass. * packages/aqe-opencode-plugin/src/degradation/graceful-degradation.ts: tier map updated — anthropic/claude-opus-4 → -4.7, anthropic/claude-sonnet-4 → -4.6, anthropic/claude-haiku-3.5 → -4.5. JSDoc example model ID also refreshed. This package is shipped to OpenCode users. * scripts/adr-092-multi-model-trial.ts: EXECUTOR_MODEL constant updated to anthropic/claude-sonnet-4.6 (sibling of the harness already fixed in commit |
||
|
Dragan Spiridonov
|
2068c2932f |
fix(adr-093): clean up lingering retiring model refs in overrides + scripts
Post-verification sweep found 4 categories of missed references:
(a) 6 qe-* agents had explicit advisor.model: anthropic/claude-opus-4
overriding the new 4.7 default from Commit 5:
qe-coverage-specialist, qe-fleet-commander, qe-queen-coordinator,
qe-risk-assessor, qe-root-cause-analyzer, qe-test-architect.
Updated each to anthropic/claude-opus-4.7.
(b) scripts/adr-092-phase0a-harness.ts: EXECUTOR_MODEL /
ADVISOR_MODEL constants for the ADR-092 Phase 0 eval harness
still hardcoded Sonnet 4 / Opus 4. Updated to Sonnet 4.6 and
Opus 4.7 so re-running the harness produces data consistent
with the post-migration fleet.
(c) scripts/eval-driven-workflow.ts: YAML template's models_to_test
list updated from claude-sonnet-4 / claude-3-haiku to
claude-sonnet-4-6 / claude-haiku-4-5.
(d) .claude/settings.json:188 claudeFlow.modelPreferences.default
updated from claude-opus-4-5-20251101 to claude-opus-4-7
(explicit user approval).
Not touched in this commit:
* .claude/settings.json:189 modelPreferences.routing still
'claude-3-5-haiku-20241022' (retiring 2026-06-15). Awaiting
explicit user direction.
* .claude/skills/*/evals/*.yaml, assets/skills/a11y-ally/SKILL.md,
assets/skills/testability-scoring/evals/*.yaml — skill eval
YAMLs with model references. Scope deferred to user review.
* Historical docs/tests that reference retiring IDs as regression
coverage (CHANGELOG, ADR-056, SPEC-043-C, model-mapping/registry
test files).
Verification:
* 0 tsc errors
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
24e30e0584 |
feat(advisor): implement ADR-092 provider-agnostic advisor strategy
Multi-model routing layer with circuit breaking, PII redaction, and domain-specific prompts for the Queen coordinator. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
4f340bc183 |
feat(verification): chaos workflow + VERIFICATION.md + matrix embed (#409, #410)
Closes the two remaining init-corpus follow-ups from #401 in one PR: makes the verification layer visible to humans (#409) and adds adversarial-rare coverage to complement the everyday-real release gate (#410). # #410 — Chaos workflow Weekly cron-driven workflow that runs aqe init against 6 pathological project shapes the everyday-real corpus deliberately doesn't cover. Per-shape assertion is "exit anything except 124" — the watchdog is the load-bearing thing under test, not init's ability to make sense of garbage input. Fail-loudly in the Actions tab; no auto-issue creation, matching the #411 mirror-test pattern. Six shapes: utf16le-bom, mixed-line-endings, symlink-loop, binary-as-text, minified-bundle, control-chars. Generated at runtime into a tmpdir by tests/fixtures/init-chaos/generate.sh — synthetic generation is appropriate here per the chaos README's "Why synthetic generation here" section: chaos tests need controlled adversarial inputs that don't exist in any real public repo. Verified locally: ran the generator + ran aqe init against all 6 shapes. All 6 pass with rc=0 against the current build, proving the generator produces valid shapes and the existing watchdog handles them today. The workflow exists to catch the day a future change breaks one of these paths. # #409 — VERIFICATION.md + matrix embed New docs/VERIFICATION.md is the maintainer-facing entry point: gate architecture diagram, how to interpret a failed gate, how to add a new fixture (links to corpus README), how to embed the verification matrix into a release notes file. scripts/embed-verification-matrix.sh downloads the init-corpus-logs artifact from a given workflow run, parses summary.txt, and emits a markdown matrix. Status-only (option C from the proposal) — Time and KG-entries columns are tracked as future work because the gate's current summary.txt doesn't carry that data and extending it would touch load-bearing infrastructure that's out of scope. docs/policies/release-verification.md is fully rewritten around the post-#401 reality: the manual aqe init checklist that pre-dated the corpus is removed (the gate now does what it tried to do, with 22 assertions per fixture × 4 fixtures × the load-bearing doubleInit flag). The Version Update Policy + Workflow sections are preserved intact — they cover the one class of pre-release error the gate cannot catch. CONTRIBUTING.md links to the new VERIFICATION.md from the Documentation section. # Housekeeping Removes 3 stale rows from tests/fixtures/init-corpus/README.md's deferred-items table: #408 (already merged), #409 and #410 (this PR). Only #407 remains — its 4 trigger conditions still haven't fired, so it stays deferred per its own definition. # Verification of this PR (per #401 rules) - actionlint passed on .github/workflows/init-chaos.yml (#408 lesson: js-yaml is not enough for workflow files) - bash -n on both new shell scripts - generator ran cleanly and produced all 6 shapes with the expected byte content (verified BOM, line endings, symlink targets, PNG signature, single-line bundle size, embedded NULs) - embed script ran against synthetic summary files (PASS-only and mixed PASS/FAIL) — both render correctly - live smoke test: ran aqe init against all 6 chaos shapes locally using the globally-installed aqe binary, all 6 exited rc=0 within the watchdog budget - every link in docs/VERIFICATION.md and docs/policies/release- verification.md verified to point at a file that exists Closes #409 Closes #410 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
70713b0b45 |
feat(pr-template-check): CI enforcement for the #401 failure-modes checkbox
Replaces the honor-system PR template checkbox with a parser that fails any PR whose body either (a) unchecks or deletes the load-bearing failure-modes checkbox, or (b) contains dismissal phrases like "I believe it's unlikely" without a same-paragraph tracking issue reference. Both rules hard-fail. Covers the 3 phrases explicitly named in #408 plus 8 additional dismissal patterns that shipped or could ship the same class of reasoning that caused the v3.9.1–v3.9.4 init regression series. - scripts/check-pr-body.cjs: standalone Node parser, ESM-safe via .cjs, zero dependencies, exported for self-test. Skips the template's own checkbox paragraph when scanning for forbidden phrases — the stock instruction text quotes the phrase as a teaching example and would otherwise trip the linter on every clean PR. - .github/workflows/pr-template-check.yml: two jobs. lint-pr-body runs the parser against the actual PR body (dependabot[bot] allowlisted). self-test runs the parser against 11 fixtures and asserts both exit code and a content-specific substring in the output, so a parser regression fails loudly instead of silently passing bad PRs. - tests/fixtures/pr-body/: 3 valid fixtures (clean, tracked-phrase, tracked-edge-case), 6 invalid fixtures (unchecked, missing section, forbidden phrase, multi-violation, highly-unlikely, can't-see-how), 2 historical fixtures (the actual v3.9.3 PR body which fails for missing section, plus a synthetic body quoting #401's postmortem reference which fails for forbidden phrase). Rollout: workflow is intentionally not required at merge time on initial landing. Maintainer should promote it to a required status check in branch protection once it has been observed to behave correctly on live PRs — see the header comment in .github/workflows/pr-template-check.yml. Verified locally with the same self-test logic the workflow will run: 11/11 fixtures pass with content-aware assertions, and a mutation test (breaking the checkbox-state logic) correctly causes the valid fixture to fail, proving the self-test would catch a parser regression. Closes #408 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
7f46ff88f1 |
feat(init-corpus): mirror tarballs to GitHub Releases for codeload drift resilience
Populates the tarball.mirror field reserved in MANIFEST v2 and wires setup.sh to fall back to the mirror when codeload.github.com returns either a network error or bytes whose sha256 no longer matches the manifest — the exact failure mode that has hit GitHub's git archive toolchain at least twice (2023, 2024). Without this, the release gate would hard-fail on the next codeload regeneration until a maintainer manually rewrote the pinned checksums. - scripts/upload-init-corpus-mirror.sh: idempotent maintainer tool that downloads each fixture from primary, verifies sha256 against MANIFEST, and uploads as <sha256>.tar.gz to the init-corpus-v1 release. Refuses to upload on sha mismatch so drifted bytes can never reach the mirror. - tests/fixtures/init-corpus/setup.sh: primary→mirror fallback via a new download_and_verify helper. Emits loud WARNING lines on fallback so CI surfaces codeload drift even when the job stays green. Adds AQE_CORPUS_MANIFEST_PATH and AQE_CORPUS_FORCE_MIRROR env overrides for the mirror test workflow. - .github/workflows/init-corpus-mirror-test.yml: exercises both the mirror-reachability path (FORCE_MIRROR=1) and the fallback-on-drift path (local python3 http.server serves bogus primary bytes). Runs on every PR that touches the corpus and weekly on Mondays. - MANIFEST.json: populates tarball.mirror for tiny-ts, mid-ts, and multi-lang-real with the now-uploaded release assets. Closes #411 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
2cb001f697 |
chore: diagnostic scripts for issue #399 reproduction
Four self-contained Node scripts that reproduce each of the four
@ruvector/router 0.1.28 bugs and verify hnswlib-node's correctness
on the same fixtures. Kept in scripts/ so anyone can re-verify the
bug after upstream version bumps without re-deriving the test fixtures.
diagnose-issue-399.mjs — exact-match recall on the
project's FNV-hashed phase
fixture (the same data the
original failing test used)
diagnose-issue-399-realistic.mjs — same recall test on textbook
unit-Gaussian random vectors,
proves the bug isn't a fixture
pathology
diagnose-issue-399-direct.mjs — bypasses NativeHnswBackend wrapper
and calls @ruvector/router's
VectorDb directly to rule out
wrapper bugs and confirm the
defect is upstream
diagnose-issue-399-hnswlib.mjs — same fixture against hnswlib-node,
empirical evidence that the
replacement library returns
100% recall@10 with correct
ordering
Each script takes M, efC, efS as CLI args so future investigators
can sweep parameters without editing source. The four scripts
together produce the empirical numbers cited in ADR-090.
Refs #399, ADR-090.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
a6202c39a3 |
chore(release): v3.9.1 (#395)
* feat: implement ADR-062 (StrongDM all 3 tiers) and ADR-087 (RuVector 14/14 capabilities)
ADR-062 StrongDM Software Factory — all 6 actions across 3 tiers:
- Tier 1: Loop detection wired to MCP protocol-server (blocks on strike 3+),
token dashboard (pre-existing)
- Tier 2: Holdout testing (10% FNV-1a selection, filtered in test-execution),
gate ratcheting (monotonic 5-pass/2%/95% cap, persisted to MemoryBackend)
- Tier 3: Progressive context (TF-IDF prediction, reduces availableFiles on spawn),
meta-learning cycle (4 insight types, stored + published as domain events)
ADR-087 RuVector Advanced Capabilities — milestones 1-5:
- EWC++ recordOutcome + backgroundConsolidate wired to 3 domain coordinators
- R1: HDC fingerprinting (10K-bit hypervectors, wired to PatternStore.store())
- R3: Delta event sourcing (sparse encoding, wired to PatternStore.store())
- R13: Cognitive routing (predictive compression, wired to mailbox.send/receive)
- R14: Hyperbolic HNSW (Poincare ball, auto-indexed in PatternStore.store())
Also updates ADR statuses: 059, 060, 061 → Implemented (were already done),
062 → Implemented, 086 → In Progress, 087 → Implemented.
223 new tests across 11 test files, all passing. Zero regressions.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: implement RVF cluster (ADR-065/066/067/071) with native benchmarks
Implements the RVF persistence cluster for persistent HNSW vector storage,
agent memory branching, and HNSW unification foundation.
Key changes:
- RvfPatternStore: IPatternStore backed by @ruvector/rvf-node native HNSW
(1.2ms cold-start, 0.19ms search p50, verified with real native binary)
- AgentMemoryBranch: per-agent COW isolation via derive(), ingest-log merge,
wired into Kernel.initialize() + DefaultAgentCoordinator
- HnswLegacyBridge: adapts old IHNSWIndex to unified IHnswIndexProvider,
wired into PatternStore when useUnifiedHnsw flag enabled
- Factory routing: createPatternStore() returns RvfPatternStore when flag
enabled + native available + data directory exists
- Dream engine: accepts external RVF adapter (no duplicate file handles),
RVCOWBranchManager enhanced with recall validation check
- @ruvector/gnn bumped 0.1.19→0.1.25, 3 new feature flags added
- IPatternStore interface extracted for polymorphic pattern store usage
- 50 new tests (16 RvfPatternStore + 17 AgentMemoryBranch + 12 bridge + 5 benchmarks)
- 1188 tests pass, 0 regressions
ADR status: 066 Implemented, 067 Implemented, 065 Implemented,
069/071 In Progress (honest assessment after brutal-honesty review)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(init): resolve skills/agents paths from package root, not relative to bundle depth
esbuild code-splitting puts installer code into dist/cli/chunks/ (3 levels
deep) instead of dist/init/ (2 levels deep), so the old ../../ traversals
landed at dist/ instead of the package root — causing "Source directory not
found" errors for all global installs.
Replace brittle relative-path resolution in all 4 installers with a shared
findPackageRoot() that walks up to the nearest package.json with
name=agentic-qe. Prioritise assets/ paths (canonical npm source) over
.claude/ paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: complete RVF cluster Phases 2-3 (ADR-067/069/071/072) with devil's advocate fixes
Phase 2A (ADR-067): Agent memory branching enabled — useAgentMemoryBranching=true,
BRANCH_DISCARD witness action, recordIngest callback exposed to agents via config.
Phase 2B (ADR-069): Dream RVF COW — useRvfFork driven by isRVFPatternStoreEnabled(),
child adapter stored + temp files cleaned up on merge/discard, 13 tests.
Phase 2C (ADR-071): HNSW unification — useUnifiedHnsw=true, HNSWEmbeddingIndex routes
through HnswAdapter, UnifiedMemory vectorIndex uses UnifiedHnswIndex, HnswLegacyBridge
delegates to adapter string-ID APIs (no duplicate ID maps), addEmbeddingsBatch routed
correctly, saveIndex/loadIndex safe under unified mode.
Phase 3 (ADR-072): RVF primary migration scaffolding — RvfMigrationAdapter (5-stage
routing with write latency tracking), RvfConsistencyValidator (rolling divergence +
compaction), RvfStageGate (go/no-go with witness chain), rvfMigrationStage=1 default,
wired into shared-rvf-dual-writer at stage >= 2, 32 tests.
Cross-cutting fixes from devil's advocate review:
- Shared RVF adapter singleton eliminates dual file handles (kernel + dream engine)
- RvfPatternStore reports honest nativeAvailable=false + rvfInitError on failure
- ESM-safe dynamic import() replaces require() in dream-engine and branch-manager
- quality_assess defaults to src/ instead of cwd to prevent full-project scan hang
- discoverSourceFiles skips .agentic-qe/.claude/.cache dirs, adds maxFiles=5000 cap
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: complete RVF cluster plan — Phase 2C decommission, Phase 3 integration, fix 7 pre-existing test failures
Phase 2C (ADR-071) — HNSW decommission:
- Remove RuvectorFlatIndex fallback from unified-memory.ts; always use UnifiedHnswIndex
- Hardcode isUnifiedHnswActive()=true in HNSWEmbeddingIndex (hnswlib-node legacy path is dead code)
- Create HnswShadowValidator for brute-force vs HnswAdapter divergence validation
- Benchmark alias (rvf-pattern-store.bench.ts) for plan compliance
Phase 3 (ADR-072) — RVF Primary Migration integration:
- RvfMigrationCoordinator: wires adapter + validator + gate with real SQLite/RVF handles
- MCP tools: migration_status, migration_check, migration_promote (persistence category)
- Kernel boot wiring: coordinator initializes when rvfMigrationStage >= 2
- RvfMigrationAdapter.setStage(): propagate promotions to routing logic
- Promote default rvfMigrationStage from 1 (hybrid) to 2 (dual-write-sqlite-primary)
- Integration test: 13 tests covering full lifecycle (stage 1→2→3→4), write/read routing,
consistency checks, gate enforcement, fallback, metrics
Test fixes (7 pre-existing failures → 1 remaining):
- code-intelligence-metrics-wiring: spy console.info not console.log (logger routes to console.info)
- mcp-integration: disable ADR-062 loop detection (repeated identical calls are by design)
- dream-cycle-tool (2 tests): RvfPatternStore empty-query branch returns all patterns from SQLite
- coherence-integration (4 tests): RvfPatternStore vector search fallback computes brute-force
cosine over SQLite embeddings when RVF adapter unavailable; getStats() falls back to SQLite count;
auto-attach SQLitePatternStore in initialize() when not explicitly wired
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore(release): bump version to v3.9.1
- Version bump in package.json and skills-manifest.json
- Fix "Dynamic require of X is not supported" in ESM bundles by adding
createRequire banner to both CLI and MCP build scripts — every chunk
now has a working require() for Node.js builtins
- Add CHANGELOG.md entry and release notes for v3.9.1
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): regenerate package-lock.json for npm ci compatibility
The lock file was out of sync with package.json — new transitive
dependencies added on main were missing. All 15 CI checks failed
at `npm ci` with "Missing from lock file" errors.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): pin Node to 24.13.0 and restore working lock file
Node 24.14.1 ships npm 11.11.0 which enforces stricter lock file
validation than 11.6.x (what 24.13.0 ships). The existing lock file
passes under 11.6.x but fails under 11.11.0 with "Missing from lock
file" for transitive dependencies of private-registry packages.
Pin all 5 workflow files to node-version: '24.13.0' and restore the
lock file from commit
|
||
|
Dragan Spiridonov
|
1dcbfa5fb6 |
perf: lazy-load CLI handlers and enable esbuild code splitting
Convert heavy top-level imports (kernel, coordination, workers, unified-memory) to dynamic imports deferred until command execution. Extract workflow command into src/cli/commands/workflow.ts, add lazy-registry for on-demand handler loading, and enable esbuild splitting with chunk output. Reduces CLI startup cost by avoiding eager module resolution for unused commands. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
2086bafa6b |
feat(parsers): add web-tree-sitter WASM for Python, Java, C#, Rust, Swift (#323)
Integrate tree-sitter WASM as the default parser for 5 languages, replacing regex-only parsing (~97-98%) with AST-based parsing (~100% accuracy). - Add TreeSitterWASMParser implementing ILanguageParser for 5 languages - Bundle only needed WASM grammars in assets/grammars/ (8.5MB vs 50MB) - Add FallbackParser with 3-retry logic before permanent regex degradation - Add per-call parser instances to prevent concurrency races across await - Add cyclomatic complexity computation from AST branching nodes - Add property extraction from class/struct AST nodes - Add AQE_PARSER_REGEX_ONLY=1 env var for opt-out to regex - Replace require() with ESM-compatible dynamic import() in registry - Mark web-tree-sitter as external in CLI/MCP esbuild configs - Amend ADR-076 with decision rationale and alternatives evaluated Alternatives evaluated and rejected: - @ast-grep/napi: npm package only ships JS/TS/CSS/HTML, others need native .so - node-tree-sitter: requires native C compilation via node-gyp Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
21eae2456f |
fix(ci): check vitest stdout instead of junit.xml for test results
Root cause found: junit.xml is 0 bytes because vitest writes it only on clean process exit. When timeout sends SIGTERM, vitest is killed before flushing the junit report. New approach: pipe vitest output through tee to capture stdout. After timeout kills vitest, grep the captured output for vitest's "Test Files X passed" summary line (printed after all tests complete but before the process hang). If found with no failures, exit 0. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
2a8e21eff9 |
fix(ci): simplify junit check and add debug output
Previous check failed because TESTS_RUN grep returned empty. Simplify to just check for absence of <failure tags and presence of <testsuites tag. Add diagnostic notices to debug junit.xml state. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
76427caab2 |
fix(ci): use timeout --foreground to prevent killing wrapper script
The `timeout` command was killing the entire process group (including the wrapper script) before the junit.xml recovery check could run. Using `--foreground` sends the signal only to the vitest child process, allowing the wrapper to check junit.xml and exit 0 when tests passed. Also added diagnostic messages for when junit.xml is missing or shows failures, and uses && || pattern for bash -e compatibility. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
505e2944ff |
fix(ci): ensure junit reporter runs for timeout recovery (#376)
Two fixes: 1. ci-vitest-run.sh now injects --reporter=junit before user args so junit.xml is always written even when --reporter=verbose overrides vitest.config.ts reporters. Also use portable grep -o instead of grep -oP. 2. MCP Integration Tests: add continue-on-error to dorny/test-reporter step which was failing the job independently of test results. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
3f479e4a6f |
fix(ci): handle vitest process hang after test completion (#376)
Vitest completes all tests but hangs due to open handles (SQLite connections, HNSW models, timers). The `timeout 480` command kills it with exit code 124, which CI treats as failure even though all tests passed. Add scripts/ci-vitest-run.sh wrapper that checks junit.xml for actual test results when timeout kills the process. If all tests passed, exit 0 instead of 124. Fixes 6 CI jobs: Journey (Remaining Subdirs, Root-level, RuVector), MCP (Integration, Handlers, Root Files). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
fc1e86ad2d |
fix(security): resolve P0/P1 issues from v3.8.3 QE swarm analysis
P0 fixes: - Fix command injection (CWE-78) in test-verifier.ts: replace exec() with execFile() + ALLOWED_TEST_COMMANDS allowlist - Unify SQL allowlists: add 5 missing tables to sql-safety.ts, replace local duplicate in unified-memory.ts with canonical validateTableName() - Add validateTableName() to all 7 SQL interpolation sites in ruvector/brain-shared.ts P1 fixes: - Remove 70 process.exit() calls from learning.ts (45) and hooks.ts (25), replacing with return/throw for proper cleanup handler execution - Move @faker-js/faker from dependencies to devDependencies (~8MB savings) - Enable bundle minification: CLI 9.8→6.9MB (-30%), MCP 12→7.2MB (-40%) - Fix no-op verification scripts to perform real checks with non-zero exit codes on failure QE reports: - Add 12 comprehensive QE analysis reports for v3.8.3 covering code quality, security, performance, tests, SFDIPOT, dependencies, API contracts, architecture/DDD, accessibility, and brutal honesty audit Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
b48c2668d7 |
fix(security): pin deps and rebrand claude-flow to ruflo for supply chain safety
Socket.dev flagged runtime `npx -y @claude-flow/cli@latest` as a supply chain risk. This commit pins all unpinned dependencies, switches runtime CLI calls to `ruflo@3.5.18`, and adds backward-compat detection for both package names. - Pin @claude-flow/guidance and @claude-flow/browser to exact 3.0.0-alpha.1 - .mcp.json: ruflo@3.5.18 (eliminates @latest auto-install vector) - cfCliArgs() and detect.ts: ruflo-first with claude-flow fallback - settings-merge.ts and .claude/settings.json: ruflo + claude-flow permissions - Governance files: TODO(ruflo-rebrand) for blocked @ruflo/guidance migration - CLAUDE.md, helpers, scripts: updated CLI references to npx ruflo Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Profa
|
416c97ab39 |
feat(learning): implement Six Hats Tier 0-2 improvements and fix test flakiness
Tier 0 (Bug Fixes):
- Fix promotion threshold inconsistency (standardized on 3)
- Add embedding backfill script and ghost pattern health check
- Add FTS5 virtual table with hybrid vector/text search
Tier 1 (Quick Wins):
- Binary reward assignment (+1/-1/0) for outcome-based learning
- At-least-one learning guarantee per session
- Temporal decay on search results (30-day half-life)
- Configurable promotion activity window
- Enable coherence gate by default
Tier 2 (Medium Investments):
- Pre-compaction flush hook to prevent knowledge loss
- OPD remediation hints ("bad because X, fix by Y")
- Per-agent MCP tool scoping for security isolation
- Daily Markdown log tier for audit trail
- Proof-of-Quality CLI command with SHA-256 attestation
- Devil's advocate scoring fixes (FTS normalization, cap, decay, freshness)
Test Fixes:
- Fix queen governance flakiness in domain-handlers tests
- Fix cross-suite singleton contamination in handler-factory and e2e tests
- Fix mcp-server domain tool timeout and invocation failures
610 test files pass, 0 failures, 18,589 tests green.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
||
|
Profa
|
9f5b3b49bf |
fix: lazy-load typescript to prevent CLI crash on global install
TypeScript was an external ESM dependency loaded at bundle startup, crashing `aqe --version` when typescript isn't installed (global installs). Now lazy-loaded via createRequire Proxy — only triggers when AST parsing features are used. Also adds isolated install verification to /release skill (steps 8e and 15) to catch missing externals before they reach users. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |