Add three subsystems for fleet orchestration intelligence:
- Pre-spawn MCP validation scans agent files for tool references and
validates availability at install and spawn time (advisory only)
- Agent dependency graph with YAML frontmatter parsing, topological
sort, and phased spawn plans for multi-agent orchestration
- Co-execution repository tracks agent pair success rates, feeding
behavioral signals into the signal merger for routing decisions
Wire all subsystems into the queen coordinator: dependency graph built
on initialize(), MCP validation in requestAgentSpawn(), co-execution
recording in handleTaskCompletionCallback(), and getSpawnPlan()/
getDependencyGraph() exposed on the public interface.
Add structured dependencies frontmatter to 5 agent definitions and
475 passing tests including 7 end-to-end integration tests proving
the wiring works.
Closes#342
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Semgrep integration was well-written but only used as a fallback in the
coordination layer — never invoked when the regex scanner succeeded.
Now SASTScanner.scanWithRules() runs pattern scanning + semgrep in parallel
when semgrep is installed, merging and deduplicating results.
Also corrects agent documentation that falsely claimed OWASP ZAP, TruffleHog,
Gitleaks, ESLint Security, and Snyk integrations. The actual implementations
are: regex patterns + semgrep (SAST), OSV API (deps), custom fetch-based
scanner (DAST), and regex patterns (secrets).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Hook deduplication: add brain-checkpoint.cjs and .claude/helpers/ patterns to
AQE_COMMAND_PATTERNS so mergeHooksSmart() correctly identifies them as AQE-owned
and removes old copies on re-init instead of accumulating duplicates.
Governance time budget: change budgetRemaining.timeMs to measure idle time since
last action instead of total elapsed since first action, and increase default
idleTimeoutMs from 5 to 15 minutes. Prevents false "Budget exhausted: time"
blocks on requirements_validate and coverage_analyze_sublinear.
Closes#344, closes#345
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add YAML deterministic pipeline loader and registry (Imp-9) for token-free workflow execution
- Add validation pipeline skill and MCP handler (BMAD-003) with 13-step requirements validation
- Add cross-phase signal handlers for QCSD feedback loops (store, query, agent_complete, phase events)
- Add heartbeat scheduler worker (Imp-10) for token-free background maintenance every 30 minutes
- Add defect intelligence and requirements traceability context sources
- Register all new MCP tools in protocol-server and server
- Update skills manifests, tests, and documentation
chore(release): bump version to v3.7.19
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
preserveOverridesDir() used __dirname (undefined in ESM bundles), causing
a TypeError that crashed the agents installer. Skills were installed but
agents were silently skipped. Fixed by using import.meta.url resolution
with try/catch fallback. Also wrapped agents installer in try/catch in
the assets phase so one failure doesn't crash the entire phase.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tier 3 baseline instrumentation and critical fix for test-induced
production database deletion. Tests using relative '.agentic-qe/memory.db'
paths were deleting the production DB during cleanup — now all test DB
paths use os.tmpdir(). Also fixes resetUnifiedMemory() cache leak and
process.cwd() bypasses in pull-agent and brain-handler.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix MCP persistence pipeline so test_outcomes and coverage_sessions
receive data from live tool calls. Add Priority 2 instrumentation:
routing tier tags, HNSW/FTS5 search latency, token tracker auto-save,
and pipeline step timers. Collect baseline snapshots for all Tier 3
metrics.
Key changes:
- Fix handler-factory Step 5d: wire recordDomainFeedback into feedback loop
- Add getQualityFeedbackLoop singleton for cross-module access
- Graceful degradation for optional native modules (FlashAttention, DecisionTransformer)
- Add experience embedding computation on capture
- Add model_tier column to routing_outcomes with tier inference
- Add performance.now() timing to HNSW search and FTS5 searchFTS
- Activate TokenMetricsCollector DB persistence and auto-save on init
- Add per-step latencies to TestSchedulingPipeline result
- WAL checkpoint in brain-checkpoint before RVF export
- Baseline docs and JSON for Tier 3 benchmark comparison
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes CodeQL js/incomplete-sanitization finding by escaping backslash
characters before pipe escaping, preventing double-escape bypass.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Brain export v3.0 (25 tables), witness chain v3 with Ed25519 signing,
streaming for large tables, RVF freeze/derive/indexStats, npm packaging fix.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The massive file count (5473 files / 63MB) triggered npm's ENOTEMPTY race
condition during global install upgrades. Narrowed package.json `files` field
to exclude 2144 source maps and 36 dev-only scripts while keeping all 8
consumer-facing scripts (lifecycle hooks, skill validators, fetch-content).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CodeQL flagged `parseSkillFrontmatter` regex `/^---\s*\n([\s\S]*?)\n---/`
as polynomial-time on crafted input. Replaced with indexOf-based parsing
that avoids backtracking entirely.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implements three improvements from Claude Blog skill-creator analysis:
- Trigger Optimizer: analyzes skill descriptions/tags for false positive/negative activation risks
- Version Comparator: A/B testing between skill versions with Cohen's d effect size
- Skill Intent: classify skills as capability_uplift, encoded_preference, or hybrid
Includes 52 unit tests (23 + 29), schema sync across all 3 copies, and ADR-056 update.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
TypeScript was an external ESM dependency loaded at bundle startup,
crashing `aqe --version` when typescript isn't installed (global
installs). Now lazy-loaded via createRequire Proxy — only triggers
when AST parsing features are used.
Also adds isolated install verification to /release skill (steps 8e
and 15) to catch missing externals before they reach users.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dragan Spiridonov