preserveOverridesDir() used __dirname (undefined in ESM bundles), causing
a TypeError that crashed the agents installer. Skills were installed but
agents were silently skipped. Fixed by using import.meta.url resolution
with try/catch fallback. Also wrapped agents installer in try/catch in
the assets phase so one failure doesn't crash the entire phase.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tier 3 baseline instrumentation and critical fix for test-induced
production database deletion. Tests using relative '.agentic-qe/memory.db'
paths were deleting the production DB during cleanup — now all test DB
paths use os.tmpdir(). Also fixes resetUnifiedMemory() cache leak and
process.cwd() bypasses in pull-agent and brain-handler.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix MCP persistence pipeline so test_outcomes and coverage_sessions
receive data from live tool calls. Add Priority 2 instrumentation:
routing tier tags, HNSW/FTS5 search latency, token tracker auto-save,
and pipeline step timers. Collect baseline snapshots for all Tier 3
metrics.
Key changes:
- Fix handler-factory Step 5d: wire recordDomainFeedback into feedback loop
- Add getQualityFeedbackLoop singleton for cross-module access
- Graceful degradation for optional native modules (FlashAttention, DecisionTransformer)
- Add experience embedding computation on capture
- Add model_tier column to routing_outcomes with tier inference
- Add performance.now() timing to HNSW search and FTS5 searchFTS
- Activate TokenMetricsCollector DB persistence and auto-save on init
- Add per-step latencies to TestSchedulingPipeline result
- WAL checkpoint in brain-checkpoint before RVF export
- Baseline docs and JSON for Tier 3 benchmark comparison
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes CodeQL js/incomplete-sanitization finding by escaping backslash
characters before pipe escaping, preventing double-escape bypass.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Brain export v3.0 (25 tables), witness chain v3 with Ed25519 signing,
streaming for large tables, RVF freeze/derive/indexStats, npm packaging fix.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The massive file count (5473 files / 63MB) triggered npm's ENOTEMPTY race
condition during global install upgrades. Narrowed package.json `files` field
to exclude 2144 source maps and 36 dev-only scripts while keeping all 8
consumer-facing scripts (lifecycle hooks, skill validators, fetch-content).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CodeQL flagged `parseSkillFrontmatter` regex `/^---\s*\n([\s\S]*?)\n---/`
as polynomial-time on crafted input. Replaced with indexOf-based parsing
that avoids backtracking entirely.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implements three improvements from Claude Blog skill-creator analysis:
- Trigger Optimizer: analyzes skill descriptions/tags for false positive/negative activation risks
- Version Comparator: A/B testing between skill versions with Cohen's d effect size
- Skill Intent: classify skills as capability_uplift, encoded_preference, or hybrid
Includes 52 unit tests (23 + 29), schema sync across all 3 copies, and ADR-056 update.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
TypeScript was an external ESM dependency loaded at bundle startup,
crashing `aqe --version` when typescript isn't installed (global
installs). Now lazy-loaded via createRequire Proxy — only triggers
when AST parsing features are used.
Also adds isolated install verification to /release skill (steps 8e
and 15) to catch missing externals before they reach users.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All governance modules now properly load AND wire their guidance
counterparts using a local-first pattern where AQE logic is
authoritative and guidance supplements:
- continue-gate: maps ContinueDecision with full StepContext
- memory-write-gate: local-first evaluation order, proper WriteDecision mapping
- adversarial-defense: ThreatDetector + CollusionDetector wiring
- deterministic-gateway: gateway.evaluate() supplements tool-call gating
- proof-envelope: parallel audit trail via ProofChain.append()
- shard-retriever: embedding-based relevance boosting via retrieve()
- evolution-pipeline: signed change proposals on promote/demote
- trust-accumulator: guidance trust scoring integration
Also adds ./governance subpath export to package.json for consumers.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace weekly downloads badge with monthly and total download
badges for better visibility of package adoption.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace unindented heredoc (<<EOF) with echo statements in the
step summary. The heredoc content at column 0 broke YAML block scalar
parsing since it was inside a `run: |` block that requires indentation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add MAX_REGEX_LINE_LEN (1000) guard before every regex .match() call
in multi-language-parser.ts. This is the CodeQL-recommended mitigation
for polynomial ReDoS — caps worst-case at O(1M) which is sub-millisecond.
Source code lines above 1000 chars are not valid function/class declarations
and are safely skipped. Brace-depth tracking is preserved for Go/Kotlin
parsers that need it.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Line 356: split(/ +as +/) → split(' as ') to avoid polynomial scan
- Lines 502, 633: import/using \s+ → space-only, capture starts with \S
- Line 891: use + capture starts with \S to prevent overlap with leading spaces
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix 16 polynomial ReDoS in multi-language-parser.ts by eliminating
overlapping quantifiers between [^X]+ capture groups and \s* delimiters
- Fix incomplete sanitization in language-detector.ts: replace('*','')
only removes first occurrence, changed to replace(/\*/g, '')
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The release skill is a project-internal workflow orchestrator, not a
QE skill that produces JSON output. Tier 3 requires schemas/output.json
which doesn't apply here.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix MCP entry path resolution in mcp.ts (1 level up, not 2)
- Remove stale v3/ directory references in 10-workers.ts
- Fix CRLF line endings in 170+ skill files breaking frontmatter parsing
- Add CRLF→LF safety net in prepare-assets.sh
- Rewrite README.md for clarity (1097→280 lines, outcome-focused)
- Sync assets from .claude/skills via prepare-assets.sh
Fixes issues reported in v3.7.9 upgrade (skill-lint failures, MCP errors)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Matches local dev environment (Node 24 / npm 11) to fix lockfile
compatibility issues causing `npm ci` failures (jose@5.10.0 missing).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dragan Spiridonov