Fleet initialization takes >10s under CI resource pressure. Set
describe-level timeout to 30s on core-handlers, domain-handlers,
and memory-handlers test suites to prevent flaky timeouts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- memory-handlers: relax entry count assertions to handle max-capacity
eviction (10000 entries) and concurrent test interference
- mcp-server: increase fleet_init test timeout from 10s to 30s for CI
environments under resource pressure
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The cached learning engine was not being disposed when resetTaskExecutor()
was called between tests. With 65+ domain handler tests each creating a
new learning engine (SQLite connections, HNSW indices, pattern stores),
the undisposed instances accumulated and exhausted the 1024MB worker
memory limit in CI.
Three fixes:
- resetTaskExecutor/resetLearningEngine: call engine.dispose() before nulling
- recordPatternUsageAsync: use already-cached engine directly instead of
triggering heavy lazy initialization via getLearningEngine()
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Create docs/releases/v3.6.2.md, v3.6.3.md, v3.6.4.md
- Update docs/releases/README.md with all versions through v3.6.4
- Add step 4b to /release skill: create release doc + update index
- Update step 10 staging to include docs/releases/ files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Make ConceptGraph.loadFromPatterns idempotent with edge discovery
- Record pattern usage to qe_pattern_usage table for analytics
- Add fire-and-forget pattern usage recording in domain handler factory
- Remove duplicate agentic-qe-v3 MCP server entry from mcp.json
- Add comprehensive reasoning bank tests and benchmark updates
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Expand the ignore list from 4 to 27 patterns (build artifacts, lock files,
venvs, minified bundles, source maps, secrets) and add delta scanning so
re-init only indexes files modified since the last scan instead of skipping
entirely.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace all `npx @claude-flow/cli@latest` detection calls with a shared
smart detector that checks only local signals (MCP config, package.json,
npx --no-install cache). This eliminates ~10 npm download attempts that
produced noisy auth errors and slow init times when Claude Flow is not
installed.
- Add shared detect.ts with cached detection and friendly not-found message
- All bridges and adapters delegate to shared detector
- Runtime CLI calls use --no-install to prevent surprise downloads
- Init handler shows clear standalone-mode message with install instructions
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Seed patterns across all 9 previously-empty QE domains (2 per domain)
and add cross-domain transfer to propagate generalizable patterns to
related domains. Fix 2 pre-existing SONA timeout failures by mocking
SQLite-dependent infrastructure in unit tests.
- Add qeDomain override to CreateQEPatternOptions for explicit targeting
- Seed 18 patterns: quality-assessment, defect-intelligence,
requirements-validation, code-intelligence, security-compliance,
contract-testing, visual-accessibility, chaos-resilience,
learning-optimization
- Add seedCrossDomainPatterns() to QEReasoningBank with 0.8x confidence
decay and duplicate detection
- Mock createPersistentSONAEngine and createDreamEngine in coordinator
and plugin tests to avoid real SQLite hanging (177/177 tests pass)
- Fix TS2345 in oauth-provider.ts by collapsing two clientSecret guards
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add enterprise-integration as 13th DDD domain, update agent fleet
target from 50 to 60 across statusline-v3.cjs, statusline-v3.sh,
and settings.json.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- domain-tools: mock getSharedMemoryBackend to prevent real SQLite init
- event-batcher: replace real setTimeout with vi.useFakeTimers
- retry-queue: replace real setTimeout with vi.useFakeTimers
- queen-coordinator-race-condition: mock 12 heavy dependencies (MinCut,
governance, circuit breakers, agent teams, tracing, etc.) to eliminate
60s+ singleton initialization that caused first-test hangs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Performance:
- Cap findNovelAssociations active nodes to 200 (O(n²) → bounded)
- Replace trimCoActivationCounts full sort with O(n) quickselect
- Connection pool idle Set for O(1) acquire/release/prune
- SSE connection manager threadId index for O(1) lookup
Security:
- Apply safeJsonParse to contract-testing validate.ts (2 locations)
- Apply createSafeRegex to deterministic-gateway-integration.ts
- Apply createSafeRegex to contract-validator.ts and schema-validator.ts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CRITICAL-01 from QE audit listed 14 SQL interpolation locations across
6 files, but Sprint 1 only fixed 2 in unified-memory.ts. This commit
covers the remaining 12 locations:
- Extract validateTableName/ALLOWED_TABLE_NAMES to shared/sql-safety.ts
to avoid heavy transitive imports from unified-memory.ts
- Apply validateTableName() in unified-memory-migration.ts (3 locations)
- Apply validateTableName() in sync/readers/sqlite-reader.ts (4 locations)
- Apply validateTableName() in sync/embeddings/sync-embedding-generator.ts (7 locations)
- Re-export from unified-memory.ts for backward compatibility
- Add 'patterns' table to allowlist (sync embedding generator default)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Performance:
- Replace findPartitioningPoints O(V*(V+E)) clone-per-vertex with
Tarjan's bridge-finding algorithm O(V+E) for articulation point detection
Security - Prototype pollution prevention:
- Replace JSON.parse() with safeJsonParse() in all 4 MCP transport
entry points (stdio, SSE, WebSocket, HTTP server) using secure-json-parse
with __proto__/constructor key removal
Security - ReDoS prevention:
- Apply createSafeRegex() to schema-validator pattern matching (user-supplied)
- Apply createSafeRegex() to rate-limiter endpoint pattern matching (2 locations)
- Regex format validator now checks for ReDoS safety, not just syntax
Security - A2A OAuth provider hardening:
- Replace direct string comparison with timing-safe comparison (crypto.timingSafeEqual)
- Hash client secrets via SHA-256 before comparison (supports secretHashed flag)
- Use timing-safe comparison for PKCE code challenge verification
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The cross-platform migration replaced per-skill validate.sh scripts
with a centralized scripts/validate-skill.cjs + per-skill
validate-config.json. Update CI to call the centralized validator
with the skill name argument instead of looking for per-skill scripts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The QX Analysis MCP tool was added in a prior commit but the registry
test's hardcoded tool count was not updated.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Migrate all QE agent pattern storage from mcp__claude_flow__hooks_intelligence_pattern_store
to mcp__agentic-qe__memory_store with learning namespace. This removes the unauthorized
claude-flow platform dependency from QE agents. Also add gitignore-aware severity
calibration to qe-security-auditor to prevent false-positive CRITICAL findings on
gitignored .env files.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Platform fixes:
- Replace bash start-daemon.sh/stop-daemon.sh with Node.js .cjs scripts
in both init-wizard.ts and 10-workers.ts (CRITICAL: bash scripts
won't execute on Windows)
- Add shell: true to all execSync calls in claude-flow-adapter.ts
so npx resolves correctly on Windows cmd.exe
Stop hook hang fix:
- Don't initialize HybridMemoryBackend just for session-end stats —
only read stats if hooks system was already initialized. This avoids
opening a database connection, starting cleanup intervals, and loading
HNSW vectors just to print "session ended"
- unref() cleanup intervals in HybridMemoryBackend and InMemoryBackend
so setInterval doesn't prevent Node.js process exit
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reverts devcontainer.json changes from PR #248 as requested by repo owner.
Keeps Claude VSCode extensions, restores compact JSON formatting, removes
premature AQE_* env vars. README and docs changes from PR #248 are retained.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The start() method checks for pre-existing tunnels before spawning
gcloud. Tests were not accounting for this checkPort() call, causing
mock connections to succeed prematurely and skip spawn entirely.
Added setupPortCheckMock() helper that fails the pre-spawn check
(simulating no existing tunnel) and succeeds on post-spawn checks.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes#243 (agent parse errors on helper/README files) and #244 (YAML
parser returns {} for empty arrays causing TypeError in mergeConfigs).
- Move helpers install to .claude/helpers/v3/ to avoid claude doctor
parsing .md reference files as agent definitions
- Write agents index to .claude/docs/ instead of .claude/agents/v3/
- Add post-parse normalization for known array fields in YAML parser
- Add Array.isArray guard in mergeConfigs for disabled domains
- Update helper path references in quality-criteria-service and agents
- Add 2 regression tests for Issue #244 scenarios
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Enable cloud sync to Google Cloud PostgreSQL (IAP tunnel) for
continuous data backup. Fix tunnel manager to detect and reuse
existing external tunnels instead of failing on port conflicts.
- Set AQE_CLOUD_SYNC_ENABLED=true in MCP config
- Enable sync in cloud-db-config.json
- Add external tunnel detection in IAPTunnelManager.start()
- Add gcloud CLI permission to local settings
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Agent definition now explicitly requires reading
sfdipot-reference-template.html before generating HTML output,
matching the pattern already established by Quality Criteria agent.
Prevents freestyle HTML generation that misses charts, filters,
QCSD context, and collapsible category sections.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
New qe/qx/analyze MCP tool with 23+ heuristics engine, oracle problem
detection, and impact analyzer. Updated QX Partner agent with content
fetch cascade, QCSD framework attribution, and QX Session guidance.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use captured `now` timestamp instead of new Date() for record creation,
and add 1s buffer to end time to prevent race condition in slow CI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Separate display string from regex-safe string so CodeQL can verify
dots are properly escaped before flowing into RegExp constructor.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ADR-064 Agent Teams integration, distributed tracing, competing hypotheses,
dynamic scaling, federation mailbox, circuit breakers, task DAG scheduling,
HNSW graph indexing, pattern training pipeline, and Devils Advocate agent.
Also restructured README with separate release notes, fixed release skill
with real CLI commands and npm scripts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Document the correct release workflow: create GitHub Release triggers
npm-publish.yml (not publish-v3-alpha.yml). Prevents using wrong
workflow for production releases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dragan Spiridonov