Removed Promise.race() wrapper in integration-test-orchestrate.ts
that caused deadlock under CI memory pressure.
Root Cause:
- Promise.race() between timeout and execute promises
- Under memory constraints (512MB heap), setTimeout fires
before executePromise microtasks are processed
- Results in immediate timeout despite 30s limit
Fix:
- Remove Promise.race() wrapper
- Let Jest handle timeouts via testTimeout config (30s)
- Tests now complete in designed <300ms
Analysis by: qe-flaky-investigator agent
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Enhanced setNestedProperty() with comprehensive prototype pollution protection:
- Use Set for O(1) dangerous key lookup
- Add defense-in-depth check during traversal loop
- Verify current hasn't become a built-in prototype (Object, Array, Function)
- Create intermediate objects with Object.create(null) pattern
- Final safety check ensures target is valid object, not prototype
Resolves: https://github.com/proffesor-for-testing/agentic-qe/security/code-scanning/48🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
### Added
- C4 diagram builders for context, container, and component levels
- ProjectMetadataAnalyzer for system type inference from package.json/docker-compose
- ExternalSystemDetector for database, API, cache, and queue detection
- ComponentBoundaryAnalyzer for layer and relationship mapping
- CLI commands: `aqe kg c4-context`, `aqe kg c4-container`, `aqe kg c4-component`
- CodeIntelligenceAgent c4-diagrams capability
- 22 unit tests for C4 diagram builders
### Changed
- MermaidGenerator with static C4 generation methods
- Type consolidation in src/code-intelligence/inference/types.ts
- Standardized ComponentRelationship to use sourceId/targetId
- Updated qe-code-intelligence.md with C4 capabilities and examples
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add `aqe kg` CLI command with index, query, graph, stats subcommands
- Fix default database credentials to match ruvector container (ruvector/ruvector_db)
- Add post-release indexing to release workflow in CLAUDE.md
- Create scripts/post-release-index.sh for automated code indexing
- Add npm script: `npm run postrelease:index`
- fix(security): resolve prototype pollution in ConfigLoader.setNestedProperty (CodeQL #47)
Usage:
aqe kg index --git-since v2.6.1 # Index changes since release
aqe kg query "how does routing work" # Natural language search
aqe kg stats # Show knowledge graph statistics
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Fixes
- Add jose@5.10.0 dependency to fix npm ci sync error
- All CI workflows were failing due to missing jose in lock file
## Changed
- README.md Features section completely rewritten:
- Removed all version references (v1.9.0, v2.2.0, Phase 1/2/3)
- User-focused language highlighting unique value
- Clear tables showing cost savings by task complexity
- Updated agent count to 48 (21 + 11 + 15 + 1)
- Highlighted December 2025 model catalog
- Better skill organization with contributor credits
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Added
- ML-Based Complexity Classification with 4-level task analysis
- Model Capability Registry with 25+ December 2025 models
- Claude Opus 4.5, DeepSeek R1/V3, GPT-5, Gemini 2.5 Pro
- Cost Optimization Strategies (PromptCompressor, Caching, Batching)
- HybridRouter integration with complexity-based model selection
## Changed
- README.md Quick Start section (user-focused, no version numbers)
- .env.example rewritten for Phase 2 features
- CONTRIBUTORS.md updated with @fndlalit's n8n contribution (#151)
## Fixed
- HybridRouter RuVector test isolation
- Compression benchmarks with honest expectations (2-8% vs false 50%)
## New Tests
- ComplexityClassifier, ModelCapabilityRegistry, CompressionBenchmark
- HybridRouter integration, model selection, and cost tracking tests
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Upgrade tree-sitter-typescript from ^0.21.2 to ^0.23.2
- Add nested overrides for all tree-sitter language parsers
- Uses $tree-sitter reference to inherit version from direct dependency
- Reduces peer dependency warnings during npm install
Note: Some warnings persist for end users because npm overrides only
apply during local development. tree-sitter@0.22.4 is required for
Node.js 20/22 LTS compatibility (has prebuilt binaries).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The package-lock.json was regenerated but had different dependency
resolution than main branch, causing npm ci to fail with missing jose@5.10.0.
Reset to main's package-lock and updated only the version.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add npm overrides to force tree-sitter@^0.22.4 resolution
- Remove --legacy-peer-deps from all CI workflows
- Fix DbOptions type import in HNSWPatternStore.ts
Closes#167🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update README.md: 19 → 21 QE agents, add token reduction benefit
- Add link to benchmark results in quickstart guide
- Highlight 80% token reduction as key feature
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
All CI workflows updated to handle the tree-sitter peer dependency:
- tree-sitter@0.22.4 (required by tree-sitter-python, tree-sitter-rust)
- tree-sitter@0.21.x (optional peer of tree-sitter-go, tree-sitter-javascript)
The parsers work correctly despite the version mismatch - verified locally.
Added --legacy-peer-deps to npm ci in all workflows to allow installation.
Also adds benchmark script for Code Intelligence token consumption analysis.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Wave 1: Database Foundation
- Add SQL schema for code_chunks, code_entities, entity_relationships
- Use RuVector 768-dim embeddings (not pgvector)
- Implement hybrid_code_search function (BM25 + vector)
- Add pg_trgm extension for full-text search
- Create setup scripts for Ollama/nomic-embed-text
## Wave 2: Multi-Language Parser
- Implement TreeSitterParser with 5 language support
- Add language-specific extractors (TS, Python, Go, Rust, JS)
- Implement incremental parsing with tree caching
- Create comprehensive test suite with fixtures
## Architecture Decision
- Defer Apache AGE to v2 (see ADR-002)
- Use SQL tables for graph relationships
- Rationale: Lower complexity, team familiarity, sufficient for v1
Closes#159, Closes#160🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove Mac docker.sock mount from devcontainer.json to use local Docker
- Add RuVector integration to CoverageAnalyzerAgent
- Fix BaseAgent HybridRouter property and imports
- Fix CoverageAnalyzerAgent constructor and config handling
- Fix SwarmMemoryManager constructor call in RuVectorPatternStore
- Fix factory arguments in agents/index.ts
This enables isolated Docker environment inside DevPod for development
and testing without affecting the host machine.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
BREAKING: This fixes API compatibility issues exposed after Phase 0.5 BaseAgent migration.
Changes:
- Make capabilities, context, and eventBus optional in BaseAgentConfig
- Provide sensible defaults in BaseAgent constructor (empty array for capabilities, new EventEmitter for eventBus)
- Fix QualityAnalyzerAgent constructor to accept optional fields
- Fix QualityGateAgent.performTask to use task.payload instead of task.requirements
- Update journey tests to use createTaskAssignment helper for proper TaskAssignment structure
- Fix test assertions to use performanceMetrics.tasksCompleted instead of performance.optimizationsCompleted
Test Results: All 57 tests pass (6 suites, 13 skipped)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Change console.error to console.warn for graceful degradation scenarios:
- LLM initialization fallback (agents work without LLM)
- Federated learning initialization fallback
- Hook execution failures (optional functionality)
These are expected behaviors in CI environments and shouldn't
trigger Jest's console.error detection.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Phase 0.5: Universal RuVector Integration (v2.5.9)
## Agent Architecture Migration
- **CoverageAnalyzerAgent**: Migrated from EventEmitter to extend BaseAgent
- Full RuVector integration with HybridRouter support
- Implements abstract methods: initializeComponents(), performTask(), loadKnowledge(), cleanup()
- New getCoverageStatus() method for agent-specific status
- Configuration via CoverageAnalyzerConfig extending BaseAgentConfig
- **QualityGateAgent**: Migrated from EventEmitter to extend BaseAgent
- Full RuVector integration with HybridRouter support
- Implements abstract methods: initializeComponents(), performTask(), loadKnowledge(), cleanup()
- New getQualityGateStatus() method for agent-specific status
- Configuration via QualityGateConfig extending BaseAgentConfig
## RuVector Methods Now Available on All Agents
All QE agents now inherit these methods from BaseAgent:
- hasRuVectorCache() - Check if RuVector GNN cache is enabled
- getRuVectorMetrics() - Get GNN/LoRA/cache performance metrics
- getCacheHitRate() - Get cache hit rate (0-1)
- getRoutingStats() - Get routing decisions and latency statistics
- forceRuVectorLearn() - Trigger LoRA learning consolidation
- getCostSavingsReport() - Get cost savings from caching
- getLLMStats() - Get LLM provider status including RuVector
## Other Changes
- Updated QEAgentFactory to use new single-config constructor pattern
- Added 6 RuVector MCP tools for external integration
- Updated verification script - All 6 tests pass
- Added BaseAgent.RuVector.test.ts unit tests
- Added ruvector-agent-usage.ts example
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace insecure Math.random() with cryptographically secure randomUUID()
for session and memory ID generation in RuvllmProvider.
Fixes CodeQL alert #42: js/insecure-randomness (CWE-338)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The HNSWPatternStore and related files were excluded by .gitignore
pattern 'memory/' which was too broad. Added negation patterns to
allow src/memory/ source files.
Files added:
- src/memory/HNSWPatternStore.ts - HNSW vector search pattern store
- src/memory/index.ts - Module exports
- src/memory/README.md - Documentation
- src/memory/__tests__/HNSWPatternStore.test.ts - Unit tests
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Dragan Spiridonov