Ships qe-browser fleet skill (Vibium engine, ADR-091) — a ~10MB Go binary
replacement for 300MB Playwright with typed assertions, batch execution,
visual-diff, prompt-injection scanning, and semantic intents. 11 skills
migrated to the new engine.
Total skills: 84 → 85. Tier 3 verified: 49 → 50. Manifest: 1.3.0 → 1.4.0.
fleetVersion bumped to 3.9.9 in skills-manifest.json.
See CHANGELOG.md and docs/releases/v3.9.9.md for details.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
qe-browser is a new Tier 3 fleet skill (added in commits cd4ea7e4
through 9c52823e on this branch, per ADR-091). This commit propagates
its existence to the user-facing documentation and manifests that
were still carrying pre-qe-browser counts.
Count changes (AQE skills only; platform skills unchanged):
- Total QE skills: 84 → 85
- Tier 3 verified: 48 → 49
- V3 Domain skills: 23 → 24
- README.md headline: "74 QE Skills" → "75 QE Skills"
- agentic-qe-intro.md: "74 total" → "75 total", "114 defs" → "115"
Files updated:
- README.md: bumped headline count, Tier 3 count in tier table,
"View all X skills" summary, and added a new "Browser Automation (1)"
category row pointing at ADR-091
- docs/agentic-qe-intro.md: bumped "Selected QE skills (74 total)" to 75,
added "Browser" category row with /qe-browser, bumped tree "114
skill definitions" to 115
- .claude/skills/README.md + assets mirror: bumped Summary counts,
V3 Domain Skills heading, and added qe-browser as a full description
entry in the V3 Domain Skills list with a link to ADR-091
- .claude/skills/skills-manifest.json + mirror: manifest version 1.3.0
→ 1.4.0, totalSkills 48 → 49, totalQESkills 80 → 81, added new
"browser-automation" category, bumped skillBreakdown counts,
updated notes to reference ADR-091
- .claude/skills/trust-tier-manifest.json + mirror: summary.tier3
49 → 50 (this file already counted one more than skills-manifest),
total 112 → 113, validationStatus.passing 49 → 50, added qe-browser
entry to skillsByTier.tier3 list with category "browser-automation"
Historical CHANGELOG entries (v3.9.x and earlier) intentionally left
at 84 — they describe past state.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Phase 5 UAT discovered the helper scripts surfaced missing-vibium as
`actual: "eval error: vibium binary not found..."` inside a `failed`
envelope. The Fallback Policy in SKILL.md said scripts MUST return
status:"skipped" with reason "browser-engine-unavailable" — that
contract was aspirational. F1 makes it real.
Contract changes:
- lib/vibium.js: ENOENT now throws typed VibiumUnavailableError (with
stable code:"BROWSER_ENGINE_UNAVAILABLE" for cross-module duck typing)
- New helper unavailableEnvelope() returns canonical skipped envelope
with top-level vibiumUnavailable:true and output.reason field
- New runOrSkip() wraps each helper's main() and converts the typed
error into the documented envelope on the way out
- New rethrowIfUnavailable() helper used inside per-script catch blocks
so missing-vibium bubbles past local "convert exception to fail()"
handlers — assert.runConsoleCheck/runNetworkCheck/runBrowserSideCheck,
batch's per-step catch, check-injection main, intent-score main,
visual-diff main all updated
- emit() now returns exit code 2 for status:"skipped" (was 1)
- Exit code contract documented: 0=success, 1=failed, 2=skipped
Downstream skills can now branch on result.vibiumUnavailable === true
or exit code === 2 instead of grepping the actual string for
"vibium binary not found".
Tests: 103 (was 86). New file qe-browser-unavailable-e2e.test.ts spawns
each of the 5 helpers under PATH=/tmp/fake-bin (node only, no vibium)
and asserts exit 2 + skipped envelope shape. vibium-lib test grew from
10 to 22 cases including VibiumUnavailableError, runOrSkip, exit codes.
Smoke test: 10/10 PASS (was 9/9). New tc011 builds a fake bin dir
inside the smoke test work dir and verifies the contract end-to-end
against the actual installed scripts.
SKILL.md updated:
- Output Contract section now documents all 3 statuses with shapes
and exit codes
- Fallback Policy replaced generic prose with concrete bash + Node
snippets that branch on the structured field
ADR-091 Phase 6 documents the change and verification.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Ran fresh `aqe init --auto` against an empty test project at
/tmp/qe-browser-uat and exercised every helper script as a real user.
12 checks documented in ADR-091, all passing:
1. qe-browser skill installed cleanly
2. navigate + assert end-to-end against httpbin.org
3. M5 --threshold=0.42 form parsed live (verified non-default value)
4. M6 batch pre-validation aborts BEFORE side effects
5. M7 intent-score returns scored candidates from real form
6. M4+M8 check-injection --exclude-selector strips body (3595→35 chars)
7. M2 fixture server binds 127.0.0.1 (verified via banner)
8. M3 path traversal blocked (HTTP 404 on /etc/passwd.html)
9. Vibium-missing fallback returns clear actionable error
10. Installed smoke-test.sh: 9/9 PASS from inside test project
11. Idempotent re-init: Browser engine line still printed
12. JSON envelope contract validated on every emit
H6 pre-flight short-circuit confirmed in production:
"Browser engine: vibium 26.3.18 (already installed)"
The "this can take 1-3 minutes" banner is suppressed when vibium is
already on PATH, matching the documented Phase 2 behavior.
New finding logged as F1 (NOT a Phase 4 regression):
Helper scripts surface missing-vibium as `actual: "eval error: ..."`
inside a `failed` envelope. The SKILL.md Fallback Policy says
downstream skills should report status:"skipped" reason:
"browser-engine-unavailable". A cleaner contract would be a
top-level vibiumUnavailable:true flag. Not a blocker.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
M1 visual-diff threshold: documented "max difference fraction" convention
matching Playwright maxDiffPixelRatio (was inconsistent in docs/code).
M2 fixture server bind: default to 127.0.0.1 instead of 0.0.0.0;
QE_BROWSER_FIXTURE_HOST=0.0.0.0 opt-in for explicit external access.
Codespaces auto-forwards 0.0.0.0 ports — this was an unintentional open
server every time the eval ran.
M3 path-traversal guard: replaced startsWith() with path.relative() +
'..'/absolute check. The old guard false-passed sibling-prefix dirs
(/foo vs /foo2) and was fragile on Windows mixed separators.
M4 ANSI escape injection: added sanitizeSnippet() that strips C0 controls
(0x00-0x1F except \t\n) and DEL (0x7F) from every check-injection
finding snippet. Prevents `cat findings.json` from triggering terminal
control sequences embedded in malicious page content.
M5 parseArgs --key=value: split on first '=' so --threshold=0.05 works
alongside --threshold 0.05. Only the first '=' is split so URL/base64
values survive intact.
M6 batch.js pre-validation: added validateAllSteps() that walks every
step's required fields BEFORE the first vibium call. Step 17 typo now
aborts before steps 1-16 execute their side effects.
M7 intent-score bare-x regex: anchored \bx\b in close_dialog scorer so
"fix", "exit", "extra", "sixteen" no longer match. Unicode × and ✕
unchanged.
M8 check-injection --exclude-selector: new flag drops subtrees from
the scan. Page text is read from a CLONE of <body> with matching
elements removed — live page unchanged. Lets docs sites scan their
own pages without self-flagging documentation about prompt injection.
M9 09-assets vibium catch: wrapped raw error with actionable recovery
guidance (`npm install -g vibium`, then re-run `aqe init`).
Hidden bug found and fixed during M2/M3 testing: fixtures/serve-skills.js
existed but had never been run because the repo root is ESM and the file
uses CommonJS require(). Added scoped fixtures/package.json with
"type": "commonjs" matching the existing scripts/package.json pattern.
Tests: 86 unit tests across 7 files (was 50). All pass.
Smoke test: 9/9 still passing against real Vibium v26.3.18.
Mirrored .claude/skills/qe-browser → assets/skills/qe-browser.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
User pushed back on Phase 3 attempt 1 ("blocked on linux-arm64"). After
re-verifying upstream — Vibium 26.3.18 IS the latest on npm, Chrome for
Testing across Stable/Beta/Dev/Canary still ships only linux64 (x86_64),
mac-arm64, mac-x64, win32, win64 — installed Debian's native ARM64
chromium + chromium-driver via apt and symlinked them into Vibium's
cache. Then ran the smoke test for real and found four real bugs in
the qe-browser helper scripts that would have shipped broken.
Bugs found and fixed:
1. Eval contract was wrong. lib/vibium.js's vibiumEvalStdin sent
`console.log(...)` expecting Vibium to capture it. Vibium doesn't —
`eval` returns the LAST EXPRESSION's value as
`{"ok":true,"result":"<stringified>"}`. Fix: dropped console.log
wrappers from assert.js/intent-score.js/check-injection.js; added
unwrapEvalResult() in lib/vibium.js that parses the envelope and
JSON-decodes the result string back into our object.
2. lib/vibium.js did not inject --headless. Vibium defaults to visible
browser, which fails in headless containers with "Missing X server
or $DISPLAY". Fix: lib/vibium.js prepends --headless unless
QE_BROWSER_HEADED=1 is set in the env.
3. `vibium screenshot -o /abs/path/foo.png` ignores the directory and
saves to `~/Pictures/Vibium/foo.png`. Verified live. Fix:
visual-diff.js passes just the basename, reads from Vibium's actual
output dir, copies to the requested path, unlinks the source.
4. `vibium screenshot --selector` flag does NOT exist in v26.3.x.
Verified via `vibium screenshot --help`. Fix: visual-diff.js throws
a clear error with remediation guidance if a caller passes
--selector. (B3's "fall back to eval-clip" comment is now removed.)
Plus a real environment-flakiness fix: smoke-test.sh sets
`vibium viewport 1280 720` before tc006/tc007 visual-diff captures
because httpbin.org/html renders at non-deterministic dimensions
(765x672 vs 780x654 observed) when no viewport is set, causing
spurious pixel-diff failures.
Verbatim smoke test result on this codespace:
Smoke testing against vibium v26.3.18
PASS tc001 url_contains on httpbin form
PASS tc002 selector_visible h1 on httpbin /html
PASS tc003 failing assertion exits 1
PASS tc004 batch 3-step happy path
PASS tc005 batch stops on first failure
PASS tc006 visual-diff baseline created
PASS tc007 visual-diff second run matches
PASS tc008 check-injection clean page
PASS tc010 intent-score submit_form on httpbin form
PASS: 9 FAIL: 0 SKIPPED: 0
Unit tests still pass: 50/50 (one test had to be updated — it asserted
`buildScript` includes 'console.log', which is now correctly NOT in the
script after the eval-contract fix).
Phase 3 verification COMPLETE per ADR-091. The qe-browser helpers work
end-to-end against real Vibium + real Chromium + pinned httpbin.org
fixtures. The Linux ARM64 chromium-symlink workaround is documented in
ADR-091; user-facing docs in references/migration-from-playwright.md
still need updating (marked as Phase 4 follow-up).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Ran the smoke test in this codespace (linux-arm64). Vibium installed
cleanly (v26.3.18) and the H1 detectVibium fix verified against real
binary output. tc003 and tc005 passed (failure-path tests that don't
need a browser). The other 7 tests failed because Google does not
publish chrome-for-testing for linux-arm64; Vibium downloaded the
linux64 (x86_64) variant which dies under Rosetta with an elf-loader
error.
Workarounds attempted and rejected:
- apt install chromium → native ARM64 binary works but Vibium
hardcodes its own cached chromedriver, no --browser-path flag
- searched the binary for VIBIUM_CHROME_PATH / --browser-path /
BROWSER env var support → none in v26.3.18
- System chromium responds at /json/version with CDP, not BiDi;
would need a BiDi-speaking chromedriver to use --connect
Conclusion: Phase 3 verification cannot complete on linux-arm64. This
is a Vibium upstream platform gap, NOT a qe-browser bug. The qe-browser
script-level integration with the real vibium binary IS partially
verified by the 2 passing tests.
Added "Vibium does not support Linux ARM64 today" to the Negative
Consequences section. PR reopen still gated on running smoke-test.sh
on linux-x64 or mac-arm64.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Three correctness blockers identified by qe-devils-advocate review of the
initial qe-browser implementation (PR #420, closed without merge):
B1: intent-score.js String.replace special-char corruption
- SCORER_JS.replace('__SCOPE__', JSON.stringify(scope)) interpreted $&,
$`, $', $1-$9 in the replacement string. Scopes like
div[data-x="$amount"] silently corrupted the generated script.
- Fix: split('__TOKEN__').join(value) for literal substitution.
- Tests: 4 new regression tests covering $&, $', $1, intent placeholder.
B2: assert.js fail-OPEN on console/network telemetry errors
- runConsoleCheck/runNetworkCheck used to return ok:true when
`vibium console --json` failed for any reason. no_console_errors
silently reported pass when telemetry was unavailable.
- Fix: new unavailable() sentinel returns ok:false + unavailable:true.
runCheck surfaces it via a new `unavailable` field. Summary
distinguishes "assertion failed" from "telemetry unavailable".
- Bonus (H5): expected-field uses ?? not || so element_count {count: 0}
reports `expected: 0` instead of `null`.
- Tests: 2 new regression tests on the sentinel + element_count zero.
B3: visual-diff.js dead fallback comment
- Source comment promised "fall back to eval-clip if not present" but
no fallback existed. Direct violation of feedback_no_unverified_failure_modes.
- Fix: comment removed; specific error handler added for unsupported
--selector flag with clear remediation message. No fake fallback —
silently substituting full-page would produce wrong baselines.
Plus: ADR-091 documents the Vibium-as-engine decision with full
rejected-alternatives section (dev-browser, gsd-browser, Playwright MCP,
status quo, build-from-scratch), four implementation phases, and a risks
table tracking the 11 devil's-advocate findings with status. Phase 3
(real Vibium install + smoke test) is explicitly gating PR reopen.
Verification:
- 420/420 tests pass (387 init + 33 qe-browser, 6 new regression tests)
- npm run build: clean
- eslint on touched files: clean
- All 6 helper scripts pass node --check
Branch is intentionally not pushed and PR is intentionally not reopened
until Phase 2 (H1, H2, H4, H6, H7, H8) and Phase 3 (real Vibium smoke
test) are complete.
Refs: docs/implementation/adrs/ADR-091-qe-browser-skill-vibium-engine.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
First live execution of the #409 tooling. Generated from npm-publish.yml
run 24132328008 via ./scripts/embed-verification-matrix.sh — all 4
release-gate corpus fixtures passed all 22 assertions in 6m 20s.
Refs: #409, v3.9.8
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Release-process maturity release. No source code changes since v3.9.7
— every commit lands in CI infrastructure, fixtures, scripts, or docs.
The published package is functionally identical to v3.9.7 except for
a refreshed lockfile carrying two transitive security patches.
Closes 4 of the 5 #401 follow-up issues:
- #408 PR template CI enforcement (#416)
- #409 VERIFICATION.md + matrix embed (#417)
- #410 Weekly chaos workflow (#417)
- #411 Mirror init-corpus tarballs to GitHub Releases (#415)
Plus #414 (dependabot transitive bumps: hono 4.12.9→4.12.12,
@hono/node-server 1.19.11→1.19.13).
The remaining #401 follow-up is #407 (worker_threads phase 06
isolation), which stays deferred per its own definition — none of
its 4 trigger conditions have fired.
Verification (per docs/policies/release-verification.md):
- npm run build — clean (CLI + MCP bundles report v3.9.8)
- npm run typecheck — clean (zero errors)
- 711/711 unit tests pass on the critical CLI subset + the load-
bearing phase 06 watchdog test
- 15/15 performance gates pass
- Clean-room install: npm pack -> fresh project -> npm install ->
aqe --version returns 3.9.8 with exit 0
- aqe init --auto --json in fresh project: zero step errors, 84
skills installed, 60 agents installed, MCP configured, CLAUDE.md
generated, workers started
Full test:ci suite intentionally not run locally per CLAUDE.md
("DO NOT run local tests in Codespace if they OOM — CI tests in
the workflow are sufficient"). The release-gate corpus + post-
publish canary will exercise the full surface in CI.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Closes the two remaining init-corpus follow-ups from #401 in one PR:
makes the verification layer visible to humans (#409) and adds
adversarial-rare coverage to complement the everyday-real release
gate (#410).
# #410 — Chaos workflow
Weekly cron-driven workflow that runs aqe init against 6 pathological
project shapes the everyday-real corpus deliberately doesn't cover.
Per-shape assertion is "exit anything except 124" — the watchdog is
the load-bearing thing under test, not init's ability to make sense
of garbage input. Fail-loudly in the Actions tab; no auto-issue
creation, matching the #411 mirror-test pattern.
Six shapes: utf16le-bom, mixed-line-endings, symlink-loop,
binary-as-text, minified-bundle, control-chars. Generated at runtime
into a tmpdir by tests/fixtures/init-chaos/generate.sh — synthetic
generation is appropriate here per the chaos README's "Why synthetic
generation here" section: chaos tests need controlled adversarial
inputs that don't exist in any real public repo.
Verified locally: ran the generator + ran aqe init against all 6
shapes. All 6 pass with rc=0 against the current build, proving the
generator produces valid shapes and the existing watchdog handles
them today. The workflow exists to catch the day a future change
breaks one of these paths.
# #409 — VERIFICATION.md + matrix embed
New docs/VERIFICATION.md is the maintainer-facing entry point: gate
architecture diagram, how to interpret a failed gate, how to add a
new fixture (links to corpus README), how to embed the verification
matrix into a release notes file.
scripts/embed-verification-matrix.sh downloads the init-corpus-logs
artifact from a given workflow run, parses summary.txt, and emits a
markdown matrix. Status-only (option C from the proposal) — Time and
KG-entries columns are tracked as future work because the gate's
current summary.txt doesn't carry that data and extending it would
touch load-bearing infrastructure that's out of scope.
docs/policies/release-verification.md is fully rewritten around the
post-#401 reality: the manual aqe init checklist that pre-dated the
corpus is removed (the gate now does what it tried to do, with
22 assertions per fixture × 4 fixtures × the load-bearing doubleInit
flag). The Version Update Policy + Workflow sections are preserved
intact — they cover the one class of pre-release error the gate
cannot catch.
CONTRIBUTING.md links to the new VERIFICATION.md from the
Documentation section.
# Housekeeping
Removes 3 stale rows from tests/fixtures/init-corpus/README.md's
deferred-items table: #408 (already merged), #409 and #410 (this
PR). Only #407 remains — its 4 trigger conditions still haven't
fired, so it stays deferred per its own definition.
# Verification of this PR (per #401 rules)
- actionlint passed on .github/workflows/init-chaos.yml (#408 lesson:
js-yaml is not enough for workflow files)
- bash -n on both new shell scripts
- generator ran cleanly and produced all 6 shapes with the expected
byte content (verified BOM, line endings, symlink targets, PNG
signature, single-line bundle size, embedded NULs)
- embed script ran against synthetic summary files (PASS-only and
mixed PASS/FAIL) — both render correctly
- live smoke test: ran aqe init against all 6 chaos shapes locally
using the globally-installed aqe binary, all 6 exited rc=0 within
the watchdog budget
- every link in docs/VERIFICATION.md and docs/policies/release-
verification.md verified to point at a file that exists
Closes#409Closes#410
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Release notes + CHANGELOG + fleetVersion bump for v3.9.7. See
docs/releases/v3.9.7.md for the user-facing summary.
Highlights:
- Release-gate corpus with 4 pinned real public repo fixtures
(mitt, p-queue, RuView with sha256-pinned regression marker,
agentic-qe self-dogfood) running `aqe init --auto` end-to-end
before every publish
- `aqe init --json` with stable schemaVersion 1 contract and
stricter exit codes
- Phase 06 no longer hides non-critical failures behind
result.success:true (the v3.9.3 failure shape is now structurally
impossible to ship silently)
- Post-publish canary re-runs the corpus against the freshly
published package via real npm CDN edge
- Watchdog effectiveness unit test covering async-stall branches
- AQE_SKIP_CODE_INDEX promoted to permanent supported flag
Verification:
- npm run build — clean
- npm run typecheck — clean
- tests/unit/init/ + tests/unit/cli/ — 1084/1084 pass
- Full corpus gate against /tmp/agentic-qe-3.9.7.tgz — 4/4 pass
with 22 assertions each
- Isolated install probe (npm install + aqe --version) — OK
- aqe security --sast on all touched files — 0 findings
Refs: #401, #412
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Headline change: native HNSW search actually works again. The previous
NativeHnswBackend wrapped @ruvector/router 0.1.28's VectorDb, which a
fresh investigation found to have four serious bugs:
1. HNSW search returned essentially random results — recall@10 ≈ 0%
on the project's FNV fixture and 10% on textbook unit-Gaussian
random vectors. The graph walk could not find self-vectors when
querying with a stored vector.
2. The VectorDb constructor unconditionally wrote a vectors.db redb
file to the user's project root, polluting CWD with multi-MB
files outside .agentic-qe/, in a non-SQLite format that no AQE
migration or backup tooling knew about.
3. Process-wide singleton lock — only ONE VectorDb instance could
exist per process. Subsequent constructors threw "Database error:
Database already open. Cannot acquire lock."
4. NAPI dispose did not synchronously release the redb lock — root
cause of v3.9.5's futex deadlock.
NativeHnswBackend was rewritten to wrap hnswlib-node@^3.0.0 (the
canonical Yury Malkov C++ Hnswlib reference implementation, used by
Pinecone, Weaviate, Qdrant, LangChain, ChromaDB). All four bugs are
gone in one swap. Empirical verification: 100% recall@10 vs the old
10%, faster inserts, multiple instances coexist, no CWD pollution.
useNativeHNSW default is flipped back from false to true (reverting
the v3.9.5 hotfix). Users with large codebases get sublinear HNSW
search by default again.
aqe init now warns when it detects a stale `vectors.db` from the
previous version and suggests `rm vectors.db`. It does NOT auto-delete
(per the data protection rules).
No new dependency was added — hnswlib-node was already in package.json.
Bumps fleetVersion in skills-manifest.json from 3.9.2 (stale) to
3.9.6 to match.
Adds release notes at docs/releases/v3.9.6.md and updates the
release index.
Closes#399. Closes#396 (test-suite cleanup carried over from the
closed PR #403, also in this release).
See ADR-090 for the full decision record and CHANGELOG.md for the
user-facing summary.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Documents the four @ruvector/router 0.1.28 bugs found during the
issue #399 investigation, the empirical verification numbers
showing hnswlib-node fixes all four, the rejected alternatives
(wait for upstream, tune efSearch, brute-force, hybrid threshold),
and the user migration guide for stale vectors.db files.
Includes a comparison table:
- Recall@10 (1k vectors, default params): 10% → 100%
- Self-vector found in top-10: NO → YES
- Auto-creates files in CWD: YES → NO
- Multiple instances per process: NO → YES
- Dispose releases resources: NO → YES (immediate JS-side null)
- Native filter functions: NO → YES
- Runtime efSearch tuning: NO → YES
- Resize past initial capacity: NO → YES
- Insert latency (1k × 384 dim): ~430ms → ~324ms
Cross-references the diagnostic scripts in `scripts/diagnose-issue-399*.mjs`
that reproduce each bug and verify hnswlib-node's correctness on
the same fixtures.
CHANGELOG.md gets a new [Unreleased] section describing the migration,
the removed CWD pollution, and the added test infrastructure. The
release manager will rename [Unreleased] to the next version at
release time.
Refs #399.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ROOT CAUSE FOUND for the ruview / ruview_live.py hang.
Investigation
-------------
v3.9.4's per-file log gave the user the exact stalling file:
examples/ruview_live.py from the public RuView project. I downloaded
the file (28 KB, 776 lines, 95 entities — normal-shaped Python),
reproduced the hang locally against v3.9.4, then dumped kernel
state of the hung process via /proc/<pid>/wchan and strace.
Findings:
Main thread: futex(0x3c6ded50, FUTEX_WAIT_PRIVATE, 1, NULL)
(NULL timeout = wait forever)
17 total threads:
- MainThread (blocked in futex)
- V8Worker × 4 (blocked in futex)
- DelayedTaskScheduler (epoll_wait — normal libuv)
- SignalInspector (blocked in futex)
- tokio-runtime-w × 6 (blocked in futex)
- libuv-worker × 4 (blocked in futex)
Native modules loaded:
- ruvector-router.linux-arm64-gnu.node
- ruvector-gnn.linux-arm64-gnu.node
- better_sqlite3.node
The deadlock is reproducible: every run against this file produces
the same futex_wait_queue state. After 7 successful VectorDb.insert()
calls (7 rows visible in the vectors table), the 8th never returns.
This is a futex deadlock inside the @ruvector/router native NAPI
module, triggered by VectorDb.insert() against certain vector content
shapes. The Rust tokio runtime threads inside the module hold a lock
the main thread is waiting for, and never release it. The setTimeout-
based watchdog v3.9.3 added cannot interrupt this — setTimeout
callbacks queue between event loop iterations and the event loop is
frozen inside a kernel futex syscall. That's a Node.js architectural
limitation, not a bug in our watchdog code.
The fix
-------
One-line change: useNativeHNSW feature flag default flipped from
true to false in src/integrations/ruvector/feature-flags.ts. All
HNSW operations now route through ProgressiveHnswBackend instead of
NativeHnswBackend. The native module is still loaded and still
available to anyone who explicitly opts in via
setRuVectorFeatureFlags({ useNativeHNSW: true }) — the default path
just no longer touches the deadlock-prone code.
Why this isn't a regression
---------------------------
ProgressiveHnswBackend was already updated in v3.9.3 commit 2bd601b0
to use brute-force exact cosine for the cosine metric. For AQE's
typical KG sizes (<10k vectors @ 384 dim), brute-force cosine is
*faster* than HNSW because it skips the per-query graph-walk
overhead:
1k vectors: brute-force ~0.4 ms vs native HNSW ~0.8 ms (BF wins)
10k vectors: brute-force ~4 ms vs native HNSW ~1.5 ms (HNSW wins)
100k vectors: brute-force ~40 ms vs native HNSW ~3 ms (HNSW wins)
For workloads AQE actually runs in production, brute-force is
faster. Native HNSW only matters above ~10k vectors, which is rare.
And critically, brute-force cannot deadlock — it's a deterministic
loop in pure JS.
Verification
------------
- examples/ruview_live.py: was deadlock, now 258 ms / 95 entries / exit 0
- 200-file synthetic fixture: 1761 ms / 2600 entries / exit 0
- 1-file empty fixture: 380 ms total init / exit 0
- HNSW + memory + init test suites: 152/152 + 452/452 = 604/604 pass
Test updates: native-hnsw-backend.test.ts had three tests asserting
the OLD `useNativeHNSW: true` default. Updated to assert the new
`false` default with a comment explaining v3.9.5's reasoning so
future contributors understand why the flag was flipped.
What's still v3.9.6 scope (#401)
---------------------------------
The architectural fix — running phase 06 inside a killable
worker_threads.Worker so any future native deadlock can be
terminated by the parent — remains tracked in #401. v3.9.5
disables the deadlock-prone path; v3.9.6 will make the watchdog
actually effective for any native code regardless of the underlying
library. Both layers are needed for long-term reliability. The
verification gap that allowed v3.9.3 to ship (no real-world
fixtures, no watchdog effectiveness test, no post-publish canary)
is also tracked in #401 with concrete release-gate changes that
will land alongside v3.9.6.
What we kept from v3.9.4
------------------------
- AQE_SKIP_CODE_INDEX env var + --skip-code-index flag (kept as
user-facing emergency overrides for any future native-layer issue)
- Per-file progress logging in phase 06 (diagnostic transparency)
- Governance / kiro / sync installer findPackageRoot walk-up fixes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Same-day hotfix for two issues v3.9.3 did not catch:
1. Governance phase failing on chunked bundles (cf-devpod).
2. Phase 06 hang on codespaces (ruview) — watchdog unable to
interrupt synchronous native code blocking the event loop.
v3.9.4 ships:
- Fix C: findPackageRoot() walk-up for governance/kiro/sync
installers — repairs the chunk-split regression class of bugs.
- Fix A: AQE_SKIP_CODE_INDEX env var + --skip-code-index flag —
escape hatch for the phase 06 stall until the proper killable-
worker fix lands in v3.9.5.
- Fix B: Per-file progress logging — exposes the exact file the
indexer is processing when a stall happens, providing the
diagnostic evidence needed for a targeted fix.
The proper fix for the phase 06 stall (running the indexer in a
killable worker_thread or child_process.fork) is deferred to
v3.9.5 and tracked in a separate issue. v3.9.4 is a unblock-first
release, not an architectural change.
All v3.9.1 feature benefits (RVF pattern store, unified HNSW,
agent memory branching, KG semantic search) remain enabled.
Local verification: 440/440 init + kernel + optimizer unit tests
pass. Build + typecheck clean. Three real fixture runs confirm
the escape hatch works, per-file logging works, and governance
phase succeeds with asterisk.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Version bump and release docs for the 5-fix init reliability release.
v3.9.3 addresses the remaining root causes the v3.9.2 hotfix did not
cover:
Fix 1: HnswAdapter dispose() plumbing for test/shutdown paths.
Fix 2: Lazy TokenOptimizerService — no more bootstrap noise at
CLI startup. CLI commands that don't use the token optimizer
no longer open patterns.rvf or memory.db.
Fix 3: Phase 10 no longer spawns the MCP daemon — the spawn was
racing the parent for file locks and producing cosmetic
error spam. Claude Code starts MCP on demand via .mcp.json.
Fix 4: findMcpEntry() works with esbuild code-split chunks
(regression of v3.7.10 fix introduced in v3.9.0).
Fix 5: Phase 06 now has a 30 s per-file and 180 s whole-phase
watchdog with progress logs every 100 files. KG semantic
search and vector embeddings remain fully enabled.
All v3.9.1 feature flags (useRVFPatternStore, useUnifiedHnsw,
useAgentMemoryBranching) remain true — this release preserves the
v3.9.1 benefits and fixes the rollout bugs.
User-perspective verification (all passing):
Empty fresh project: 427 ms exit 0
200-file fixture: 672 ms with progress logs
15k-entity heavy fixture: 3120 ms exit 0
Pre-existing .agentic-qe + aqe --version: 1 line "3.9.3"
aqe mcp --help: exits 0 with usage text
Targeted test results:
token-optimizer-service: 17/17
HNSW (native/legacy/unification): 99/99
unified-memory: 53/53
pattern-store / rvf-pattern-store: 65/65
init/orchestrator + init/phases/database-phase: 32/32
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Two related fixes for the init flow broken in v3.9.1:
1. aqe init --auto hangs at "Code intelligence pre-scan"
After v3.9.1 flipped useRVFPatternStore to true by default,
AQELearningEngine.initialize() would open patterns.rvf twice in
the same process:
a) createPatternStore() -> _createRvfStore('.agentic-qe/patterns.rvf')
acquires an exclusive native file lock via @ruvector/rvf-node
b) getSharedRvfDualWriter() -> getSharedRvfAdapter() ->
createRvfStore('.agentic-qe/patterns.rvf') tries to acquire the
same exclusive lock -> deadlocks forever
Fix: createPatternStore() now routes through the getSharedRvfAdapter()
singleton. Only one file handle exists per process; subsequent callers
receive the cached instance. RvfPatternStore.dispose() gains a
skipCloseOnDispose option so it won't close a shared adapter.
2. CLI doesn't exit after init completes
Native NAPI handles from @ruvector/rvf-node and @ruvector/router
kept the event loop alive indefinitely. cleanupAndExit() previously
used async dynamic imports for cleanup modules, which loaded more
native bindings before the unref'd 3s force-exit timer could fire.
Fix: cleanupAndExit() is now synchronous — fire-and-forget disposes
followed by immediate process.exit(). Init completes and exits
cleanly in ~7s.
Verification:
- aqe init --auto on fresh project: EXIT=0, ~7s, all 12 phases pass
- Isolated npm pack+install: aqe --version returns 3.9.2
- 65 pattern-store + rvf-pattern-store tests pass
- 15/15 performance gates pass
- Build + typecheck: zero errors
Note: Full unit suite runtime regression (>22min, unrelated to this
fix) tracked separately in #396.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: implement ADR-062 (StrongDM all 3 tiers) and ADR-087 (RuVector 14/14 capabilities)
ADR-062 StrongDM Software Factory — all 6 actions across 3 tiers:
- Tier 1: Loop detection wired to MCP protocol-server (blocks on strike 3+),
token dashboard (pre-existing)
- Tier 2: Holdout testing (10% FNV-1a selection, filtered in test-execution),
gate ratcheting (monotonic 5-pass/2%/95% cap, persisted to MemoryBackend)
- Tier 3: Progressive context (TF-IDF prediction, reduces availableFiles on spawn),
meta-learning cycle (4 insight types, stored + published as domain events)
ADR-087 RuVector Advanced Capabilities — milestones 1-5:
- EWC++ recordOutcome + backgroundConsolidate wired to 3 domain coordinators
- R1: HDC fingerprinting (10K-bit hypervectors, wired to PatternStore.store())
- R3: Delta event sourcing (sparse encoding, wired to PatternStore.store())
- R13: Cognitive routing (predictive compression, wired to mailbox.send/receive)
- R14: Hyperbolic HNSW (Poincare ball, auto-indexed in PatternStore.store())
Also updates ADR statuses: 059, 060, 061 → Implemented (were already done),
062 → Implemented, 086 → In Progress, 087 → Implemented.
223 new tests across 11 test files, all passing. Zero regressions.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: implement RVF cluster (ADR-065/066/067/071) with native benchmarks
Implements the RVF persistence cluster for persistent HNSW vector storage,
agent memory branching, and HNSW unification foundation.
Key changes:
- RvfPatternStore: IPatternStore backed by @ruvector/rvf-node native HNSW
(1.2ms cold-start, 0.19ms search p50, verified with real native binary)
- AgentMemoryBranch: per-agent COW isolation via derive(), ingest-log merge,
wired into Kernel.initialize() + DefaultAgentCoordinator
- HnswLegacyBridge: adapts old IHNSWIndex to unified IHnswIndexProvider,
wired into PatternStore when useUnifiedHnsw flag enabled
- Factory routing: createPatternStore() returns RvfPatternStore when flag
enabled + native available + data directory exists
- Dream engine: accepts external RVF adapter (no duplicate file handles),
RVCOWBranchManager enhanced with recall validation check
- @ruvector/gnn bumped 0.1.19→0.1.25, 3 new feature flags added
- IPatternStore interface extracted for polymorphic pattern store usage
- 50 new tests (16 RvfPatternStore + 17 AgentMemoryBranch + 12 bridge + 5 benchmarks)
- 1188 tests pass, 0 regressions
ADR status: 066 Implemented, 067 Implemented, 065 Implemented,
069/071 In Progress (honest assessment after brutal-honesty review)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(init): resolve skills/agents paths from package root, not relative to bundle depth
esbuild code-splitting puts installer code into dist/cli/chunks/ (3 levels
deep) instead of dist/init/ (2 levels deep), so the old ../../ traversals
landed at dist/ instead of the package root — causing "Source directory not
found" errors for all global installs.
Replace brittle relative-path resolution in all 4 installers with a shared
findPackageRoot() that walks up to the nearest package.json with
name=agentic-qe. Prioritise assets/ paths (canonical npm source) over
.claude/ paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: complete RVF cluster Phases 2-3 (ADR-067/069/071/072) with devil's advocate fixes
Phase 2A (ADR-067): Agent memory branching enabled — useAgentMemoryBranching=true,
BRANCH_DISCARD witness action, recordIngest callback exposed to agents via config.
Phase 2B (ADR-069): Dream RVF COW — useRvfFork driven by isRVFPatternStoreEnabled(),
child adapter stored + temp files cleaned up on merge/discard, 13 tests.
Phase 2C (ADR-071): HNSW unification — useUnifiedHnsw=true, HNSWEmbeddingIndex routes
through HnswAdapter, UnifiedMemory vectorIndex uses UnifiedHnswIndex, HnswLegacyBridge
delegates to adapter string-ID APIs (no duplicate ID maps), addEmbeddingsBatch routed
correctly, saveIndex/loadIndex safe under unified mode.
Phase 3 (ADR-072): RVF primary migration scaffolding — RvfMigrationAdapter (5-stage
routing with write latency tracking), RvfConsistencyValidator (rolling divergence +
compaction), RvfStageGate (go/no-go with witness chain), rvfMigrationStage=1 default,
wired into shared-rvf-dual-writer at stage >= 2, 32 tests.
Cross-cutting fixes from devil's advocate review:
- Shared RVF adapter singleton eliminates dual file handles (kernel + dream engine)
- RvfPatternStore reports honest nativeAvailable=false + rvfInitError on failure
- ESM-safe dynamic import() replaces require() in dream-engine and branch-manager
- quality_assess defaults to src/ instead of cwd to prevent full-project scan hang
- discoverSourceFiles skips .agentic-qe/.claude/.cache dirs, adds maxFiles=5000 cap
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: complete RVF cluster plan — Phase 2C decommission, Phase 3 integration, fix 7 pre-existing test failures
Phase 2C (ADR-071) — HNSW decommission:
- Remove RuvectorFlatIndex fallback from unified-memory.ts; always use UnifiedHnswIndex
- Hardcode isUnifiedHnswActive()=true in HNSWEmbeddingIndex (hnswlib-node legacy path is dead code)
- Create HnswShadowValidator for brute-force vs HnswAdapter divergence validation
- Benchmark alias (rvf-pattern-store.bench.ts) for plan compliance
Phase 3 (ADR-072) — RVF Primary Migration integration:
- RvfMigrationCoordinator: wires adapter + validator + gate with real SQLite/RVF handles
- MCP tools: migration_status, migration_check, migration_promote (persistence category)
- Kernel boot wiring: coordinator initializes when rvfMigrationStage >= 2
- RvfMigrationAdapter.setStage(): propagate promotions to routing logic
- Promote default rvfMigrationStage from 1 (hybrid) to 2 (dual-write-sqlite-primary)
- Integration test: 13 tests covering full lifecycle (stage 1→2→3→4), write/read routing,
consistency checks, gate enforcement, fallback, metrics
Test fixes (7 pre-existing failures → 1 remaining):
- code-intelligence-metrics-wiring: spy console.info not console.log (logger routes to console.info)
- mcp-integration: disable ADR-062 loop detection (repeated identical calls are by design)
- dream-cycle-tool (2 tests): RvfPatternStore empty-query branch returns all patterns from SQLite
- coherence-integration (4 tests): RvfPatternStore vector search fallback computes brute-force
cosine over SQLite embeddings when RVF adapter unavailable; getStats() falls back to SQLite count;
auto-attach SQLitePatternStore in initialize() when not explicitly wired
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore(release): bump version to v3.9.1
- Version bump in package.json and skills-manifest.json
- Fix "Dynamic require of X is not supported" in ESM bundles by adding
createRequire banner to both CLI and MCP build scripts — every chunk
now has a working require() for Node.js builtins
- Add CHANGELOG.md entry and release notes for v3.9.1
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): regenerate package-lock.json for npm ci compatibility
The lock file was out of sync with package.json — new transitive
dependencies added on main were missing. All 15 CI checks failed
at `npm ci` with "Missing from lock file" errors.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): pin Node to 24.13.0 and restore working lock file
Node 24.14.1 ships npm 11.11.0 which enforces stricter lock file
validation than 11.6.x (what 24.13.0 ships). The existing lock file
passes under 11.6.x but fails under 11.11.0 with "Missing from lock
file" for transitive dependencies of private-registry packages.
Pin all 5 workflow files to node-version: '24.13.0' and restore the
lock file from commit f9b76968 (last CI-passing state) with only the
version bump to 3.9.1.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): regenerate package-lock.json with npm 10 for stable npm ci
npm 11 (Node 24) produces internally inconsistent lock files that npm ci
rejects — each npm install resolves transitive deps differently. Generated
with npm 10 (Node 22 LTS) which produces stable lock files compatible with
both npm 10 and npm 11.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Address verification findings from user-perspective review of IMP-00 through IMP-10:
- Implement 8 missing env var kill switches (AQE_MICROCOMPACT, AQE_RETRY_DISABLED,
AQE_SESSION_DURABILITY, AQE_PROMPT_CACHE_LATCH, AQE_FAST_PATHS,
AQE_HOOKS_SSRF_DISABLED, AQE_COMPACTION_DISABLED, AQE_PLUGINS_DISABLED)
- Add 5 missing test files: parallel-prefetch, session-durability-middleware,
and plugin sources (local, github, npm) — 40 new tests
- Add kill switch test coverage for all 8 env vars — 10 new tests
- Fix stdout log leak: redirect [ParserRegistry], [ContinueGateIntegration],
timestamped logs, and other internal prefixes to stderr
- Update plan doc verification matrix with correct test file names (37 files)
- Add user-perspective verification report
466 tests pass across 37 IMP test files. Build clean.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
11 improvements across 4 priority tiers, all integrated into production
code paths with 416 new tests across 33 test files. Each wave passed
a brutal honesty audit with all findings resolved.
Wave 0-2 (P0/P1): Middleware chain, microcompact, tool concurrency,
retry engine, session durability, prompt cache latch, startup fast
paths, hook security hardening.
Wave 3 (P2): 4-tier context compaction pipeline, plugin architecture
with local/GitHub/npm sources.
Wave 4 (P3): QE Quality Daemon — priority queue, git watcher (with
Linux polling fallback), coverage delta analyzer, CI monitor, test
suggester, nightly consolidation, notification service with SSRF guard,
persistent SQLite-backed memory, CLI commands, MCP startup integration.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Delete dead MCP server.ts (911 lines, never used in production — entry.ts
imports MCPProtocolServer). Add legacy aliases in index.ts for backwards compat.
- Fix ESLint: rename .eslintrc.js to .eslintrc.cjs (CommonJS in ESM project)
- Fix hardcoded version '3.0.0' in protocol-server.ts and http-server.ts —
now reads dynamically from package.json
- Fix vitest process hang: add worker-level afterAll force-exit (setup-worker.ts)
and global teardown safety net. Native modules (better-sqlite3, hnswlib-node)
held open handles preventing fork worker exit.
- Add test gate to npm-publish.yml — 194 unit test files must pass before publish
- Disable benchmark.yml release trigger (benchmarks/suite.ts doesn't exist)
- Remove continue-on-error from test steps in optimized-ci.yml (was masking failures)
- Add getToolDefinitions() to MCPProtocolServer for test introspection
- Update e2e and integration tests to use production server API
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Implements R4 (GraphMAE), R5 (Modern Hopfield), R6 (Cold-Tier GNN) with
full integration wiring into pattern-store and code-intelligence domains.
R4 GraphMAE Self-Supervised Learning:
- SPSA optimizer for gradient-free training of masked graph autoencoders
- Decoder head reconstructs features from embeddings (SCE loss, γ=2)
- Per-epoch lossHistory for convergence analysis
- Wired into coordinator-gnn.ts:generateGraphMAEEmbeddings()
- 21 tests including 1K-node scale test
R5 Modern Hopfield Networks:
- Exponential-capacity exact pattern recall (Ramsauer 2020)
- L2-normalized patterns for consistent softmax attention
- Dimension-aware singleton, zero-vector rejection
- Wired into pattern-store.ts store()/search() as exact-recall tier
- 28 tests including 10K capacity and <2ms benchmark
R6 Cold-Tier GNN Training:
- LRU-cached mini-batch trainer with memory cap enforcement
- FileBackedGraph for real disk-backed larger-than-RAM graphs
- Unbiased Fisher-Yates shuffle (rejection sampling)
- Wired into coordinator-gnn.ts:trainWithColdTier()
- 25 tests including FileBackedGraph round-trip and mode equivalence
Shared:
- Extracted Xorshift128 PRNG to src/shared/utils/xorshift128.ts
- 3 feature flags (default false) with documented activation criteria
- Barrel exports for all types, classes, and factories
74 new tests, 0 type errors, 0 regressions across 1030 existing tests.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds 4 new capabilities with production wiring, 148 tests, and performance baselines:
- R1: HDC Pattern Fingerprinting — 10K-bit binary hypervectors with O(1) XOR binding,
wired into PatternStore search as Hamming-distance pre-filter
- R2: CUSUM Drift Detection — two-sided statistical change-point detection across all
4 coherence gate types (retrieve/write/learn/act), auto-enabled via feature flag
- R3: Delta Event Sourcing — pattern version history with rollback via SQLite
pattern_deltas table, wired into PatternStore store/recordUsage paths
- EWC++ Activation — three-loop protocol (instantAdapt→recordOutcome→backgroundConsolidate)
wired in quality-assessment, test-generation, and contract-testing coordinators
with double-flag guard (useSONAThreeLoop && useEwcPlusPlusRegularization)
Extracts coherence-gate.ts (930 lines) into 4 modules under 500-line limit.
All feature flags default true (opt-out) per amended ADR-087 policy.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Integrate tree-sitter WASM as the default parser for 5 languages, replacing
regex-only parsing (~97-98%) with AST-based parsing (~100% accuracy).
- Add TreeSitterWASMParser implementing ILanguageParser for 5 languages
- Bundle only needed WASM grammars in assets/grammars/ (8.5MB vs 50MB)
- Add FallbackParser with 3-retry logic before permanent regex degradation
- Add per-call parser instances to prevent concurrency races across await
- Add cyclomatic complexity computation from AST branching nodes
- Add property extraction from class/struct AST nodes
- Add AQE_PARSER_REGEX_ONLY=1 env var for opt-out to regex
- Replace require() with ESM-compatible dynamic import() in registry
- Mark web-tree-sitter as external in CLI/MCP esbuild configs
- Amend ADR-076 with decision rationale and alternatives evaluated
Alternatives evaluated and rejected:
- @ast-grep/napi: npm package only ships JS/TS/CSS/HTML, others need native .so
- node-tree-sitter: requires native C compilation via node-gyp
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Based on Anthropic's "Lessons from Building Claude Code: How We Use Skills" article.
Transforms QE skills from flat knowledge cards into folder-based systems with
gotchas, progressive disclosure, composition, config, hooks, and run history.
Changes across all 4 phases:
- Add Gotchas sections to 30 skills with battle-tested failure data from Nagual/memory.db
- Rewrite all 84 skill descriptions as "Use when..." trigger conditions
- Strip 892 lines of textbook knowledge from 15 skills (26% reduction)
- Create 10 reference/template files across 7 skills (OWASP, k6, mutation operators, etc.)
- Add config.json with _setupPrompt to 7 skills
- Add run-history.json with write instructions to 5 metric-producing skills
- Create 5 on-demand hook skills with executable scripts (strict-tdd, no-skip, coverage-guard, freeze-tests, security-watch)
- Create 5 new category-filling skills (test-failure-investigator, coverage-drop-investigator, e2e-flow-verifier, test-metrics-dashboard, skill-stats)
- Add Skill Composition cross-references to 10 key skills
- Remove 3 redundant/obsolete skills (qe-contract-testing → contract-testing, qe-security-compliance → security-testing, aqe-v2-v3-migration)
- Add DEPRECATED_SKILLS cleanup to skills-installer.ts for --upgrade
- Update all manifests (trust-tier, TRUST-TIERS.md, README.md, CLAUDE.md)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fix MCP tool prefix mismatch in 8 agent files (mcp__agentic_qe_v3__ → mcp__agentic-qe__)
and permission pattern in settings.json/settings-merge.ts. Closes#357.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
All new RuVector capabilities (native HNSW, neural routing, coherence
gates, transfer learning, etc.) now ship enabled so users get immediate
value on upgrade. Users can disable individual features via CLI or
setRuVectorFeatureFlags() for opt-out.
Update 11 test files to match new defaults.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Upgrade from v3.7.23 to v3.8.0 — this is a minor version bump
reflecting the scope of the RuVector integration (23 tasks, 4 phases).
Regenerate package-lock.json from scratch to fix npm ci failures
caused by stale transitive dependency entries (agentic-flow@2.0.7
referenced packages not in the lock file).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dragan Spiridonov