Integrate tree-sitter WASM as the default parser for 5 languages, replacing
regex-only parsing (~97-98%) with AST-based parsing (~100% accuracy).
- Add TreeSitterWASMParser implementing ILanguageParser for 5 languages
- Bundle only needed WASM grammars in assets/grammars/ (8.5MB vs 50MB)
- Add FallbackParser with 3-retry logic before permanent regex degradation
- Add per-call parser instances to prevent concurrency races across await
- Add cyclomatic complexity computation from AST branching nodes
- Add property extraction from class/struct AST nodes
- Add AQE_PARSER_REGEX_ONLY=1 env var for opt-out to regex
- Replace require() with ESM-compatible dynamic import() in registry
- Mark web-tree-sitter as external in CLI/MCP esbuild configs
- Amend ADR-076 with decision rationale and alternatives evaluated
Alternatives evaluated and rejected:
- @ast-grep/napi: npm package only ships JS/TS/CSS/HTML, others need native .so
- node-tree-sitter: requires native C compilation via node-gyp
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Based on Anthropic's "Lessons from Building Claude Code: How We Use Skills" article.
Transforms QE skills from flat knowledge cards into folder-based systems with
gotchas, progressive disclosure, composition, config, hooks, and run history.
Changes across all 4 phases:
- Add Gotchas sections to 30 skills with battle-tested failure data from Nagual/memory.db
- Rewrite all 84 skill descriptions as "Use when..." trigger conditions
- Strip 892 lines of textbook knowledge from 15 skills (26% reduction)
- Create 10 reference/template files across 7 skills (OWASP, k6, mutation operators, etc.)
- Add config.json with _setupPrompt to 7 skills
- Add run-history.json with write instructions to 5 metric-producing skills
- Create 5 on-demand hook skills with executable scripts (strict-tdd, no-skip, coverage-guard, freeze-tests, security-watch)
- Create 5 new category-filling skills (test-failure-investigator, coverage-drop-investigator, e2e-flow-verifier, test-metrics-dashboard, skill-stats)
- Add Skill Composition cross-references to 10 key skills
- Remove 3 redundant/obsolete skills (qe-contract-testing → contract-testing, qe-security-compliance → security-testing, aqe-v2-v3-migration)
- Add DEPRECATED_SKILLS cleanup to skills-installer.ts for --upgrade
- Update all manifests (trust-tier, TRUST-TIERS.md, README.md, CLAUDE.md)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- #361: opencode-installer uses package-relative path resolution with
resolveViaPackageJson() fallback, never uses CWD as source
- #362: permissions union-merged via _aqePermissions to preserve user entries
- #363: brain-checkpoint/statusline hooks use hardcoded projectRoot fallback
instead of `pwd` in $(git rev-parse ... || echo "<path>")
- #364: created .claude/helpers/validation-pipeline.cjs with 13-step
requirements pipeline, updated SKILL.md references
- #365: agents-installer bumps `updated:` frontmatter date when overlays
modify agent content
- #366: qe-security-scanner dependency on qe-dependency-mapper changed
from hard to soft
- #367: --steps parameter documented as comma-separated string consistently
Closes#361, closes#362, closes#363, closes#364, closes#365, closes#366, closes#367
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Blank lines between the opening `---` and closing `---` delimiters
caused frontmatter parsers to fail validation. Removed the offending
empty lines from all affected skills in both .claude/skills/ and
assets/skills/.
Closes#360
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Finish the claude-flow → ruflo rename in all remaining references:
skills (iterative-loop, QCSD swarms), git helpers, statusline, and
the TypeScript bridge modules (model-router, pretrain, trajectory).
Add resolveCliPackage() for consistent CLI resolution with fallback.
Also includes SONA graceful degradation and isSONAAvailable() API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fix MCP tool prefix mismatch in 8 agent files (mcp__agentic_qe_v3__ → mcp__agentic-qe__)
and permission pattern in settings.json/settings-merge.ts. Closes#357.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Helpers (brain-checkpoint.cjs, statusline-v3.cjs) used process.cwd()
to find the project root, which breaks when Claude Code runs hooks from
a different working directory. Fixed to use path.resolve(__dirname, '..', '..')
since these files always live at <project>/.claude/helpers/.
Also updated hook commands in 07-hooks.ts and settings-merge.ts to use
$(git rev-parse --show-toplevel) for absolute path resolution.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add three subsystems for fleet orchestration intelligence:
- Pre-spawn MCP validation scans agent files for tool references and
validates availability at install and spawn time (advisory only)
- Agent dependency graph with YAML frontmatter parsing, topological
sort, and phased spawn plans for multi-agent orchestration
- Co-execution repository tracks agent pair success rates, feeding
behavioral signals into the signal merger for routing decisions
Wire all subsystems into the queen coordinator: dependency graph built
on initialize(), MCP validation in requestAgentSpawn(), co-execution
recording in handleTaskCompletionCallback(), and getSpawnPlan()/
getDependencyGraph() exposed on the public interface.
Add structured dependencies frontmatter to 5 agent definitions and
475 passing tests including 7 end-to-end integration tests proving
the wiring works.
Closes#342
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Semgrep integration was well-written but only used as a fallback in the
coordination layer — never invoked when the regex scanner succeeded.
Now SASTScanner.scanWithRules() runs pattern scanning + semgrep in parallel
when semgrep is installed, merging and deduplicating results.
Also corrects agent documentation that falsely claimed OWASP ZAP, TruffleHog,
Gitleaks, ESLint Security, and Snyk integrations. The actual implementations
are: regex patterns + semgrep (SAST), OSV API (deps), custom fetch-based
scanner (DAST), and regex patterns (secrets).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add YAML deterministic pipeline loader and registry (Imp-9) for token-free workflow execution
- Add validation pipeline skill and MCP handler (BMAD-003) with 13-step requirements validation
- Add cross-phase signal handlers for QCSD feedback loops (store, query, agent_complete, phase events)
- Add heartbeat scheduler worker (Imp-10) for token-free background maintenance every 30 minutes
- Add defect intelligence and requirements traceability context sources
- Register all new MCP tools in protocol-server and server
- Update skills manifests, tests, and documentation
chore(release): bump version to v3.7.19
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implements three improvements from Claude Blog skill-creator analysis:
- Trigger Optimizer: analyzes skill descriptions/tags for false positive/negative activation risks
- Version Comparator: A/B testing between skill versions with Cohen's d effect size
- Skill Intent: classify skills as capability_uplift, encoded_preference, or hybrid
Includes 52 unit tests (23 + 29), schema sync across all 3 copies, and ADR-056 update.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix MCP entry path resolution in mcp.ts (1 level up, not 2)
- Remove stale v3/ directory references in 10-workers.ts
- Fix CRLF line endings in 170+ skill files breaking frontmatter parsing
- Add CRLF→LF safety net in prepare-assets.sh
- Rewrite README.md for clarity (1097→280 lines, outcome-focused)
- Sync assets from .claude/skills via prepare-assets.sh
Fixes issues reported in v3.7.9 upgrade (skill-lint failures, MCP errors)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create eval configs (evals/*.yaml, schemas/output.json, scripts/validate-config.json)
for: qcsd-cicd-swarm, qcsd-development-swarm, enterprise-integration-testing,
observability-testing-patterns, middleware-testing-patterns
- Set debug-loop and pr-review to tier 0 (advisory-only, no eval needed)
- Update trust-tier-manifest.json with correct tier assignments
- Fix prepare-assets.sh to include qcsd-*, n8n-*, and 15 additional QE skills
that were in assets/ but not matched by the copy filter
- Sync all eval infrastructure to assets/skills/ for npm distribution
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update ADRs 075-079 with implementation details, revise the
multi-language GOAP implementation plan, add test generators and
parser test fixtures for Go, Rust, Java, C#, Swift, Python.
Include skill validation schema updates and v2→v3 migration skill.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove redundant /v3/ segment from agent memory namespace paths
(e.g., aqe/v3/accessibility/outcomes/* → aqe/accessibility/outcomes/*).
Namespace identifiers in memory.db remain unchanged — this only
affects the documentation references in agent markdown files.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dragan Spiridonov