Files
Dragan Spiridonov cda9fb3c05 fixup(adr-091): address devil's-advocate review
Single commit covering the 5 concrete findings from the qe-devils-advocate
review. Does not change the underlying CommandEvalRunner design or the 5
primitives — only the claims around them and the fixture-server hack the
yaml had silently inherited.

1. Revert promotion (G4): trust_tier 3 -> 2 in SKILL.md; ADR-091 status
   Implemented -> In Progress (2026-04-21); v3-adrs.md index row updated
   to reflect the same; counts 80->79 Implemented, 6->7 In Progress.
   The promotion gate is now documented on ADR-091: first green CI run
   of test-qe-browser.yml (unit + smoke + eval against real Vibium)
   before trust_tier 3 / Implemented are restored.

2. Fix yaml fixtures (G3): tc006/tc007 were referencing
   http://localhost:8088/qe-browser/SKILL.md.html which required an
   unstarted fixture server, so `aqe eval run --skill qe-browser` would
   have failed on a fresh machine. Rewrote both to use https://httpbin.org/html
   (matching scripts/smoke-test.sh tc006/tc007). Dropped tc009
   (poisoned-page check-injection) from the yaml — it needs the local
   serve-skills.js fixture which is out of scope for CommandEvalRunner.
   Documented as an explicit GAP comment in the yaml, noted that
   check-injection.js's severity path is unit-tested at
   tests/unit/scripts/qe-browser-check-injection.test.ts. yaml test_cases
   now 11 -> 10.

3. Correct pin comment wording (G1): the previous comment claimed
   ^26.3.18 was a "major.minor-line pin" — that's factually wrong under
   npm semver (^26.3.18 accepts 26.99.x). Rewritten to accurately
   describe the intent: major-line pin that blocks 27.0+ while
   allowing auto-uptake of 26.x security patches and additive features,
   with scripts/smoke-test.sh as the belt-and-suspenders API contract
   gate. The spec itself stays ^26.3.18 — the correct choice for an
   end-user tool under semver assumptions.

4. Add eval CI job (G2): third job in test-qe-browser.yml runs
   `aqe eval run --skill qe-browser --model claude-3.5-sonnet` against
   a real Vibium install after `npm run build`. This is the
   end-to-end proof that CommandEvalRunner dispatch works that the
   previous unit tests (all mocked CommandRunner) could not provide.
   Uploads the eval JSON as a CI artifact for post-run inspection.
   actionlint clean.

5. Scrub stray files (G5): git rm the coherence-comparison artifacts
   from docs/reports/ that were swept in by a prior `git add -A`, and
   added a focused pattern to .gitignore (not a blanket docs/reports/
   ignore) so future sessions can't repeat the mistake while intentional
   reports can still be committed.

Tests: 51 relevant tests still pass (3 files: command-eval-runner,
command-eval-runner-qe-browser, browser-engine-installer).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 14:09:37 +00:00

248 lines
4.8 KiB
Plaintext

# macOS
.DS_Store
.AppleDouble
.LSOverride
# Thumbnails
._*
# Files that might appear in the root of a volume
.DocumentRevisions-V100
.fseventsd
.Spotlight-V100
.TemporaryItems
.Trashes
.VolumeIcon.icns
.com.apple.timemachine.donotpresent
# Directories potentially created on remote AFP share
.AppleDB
.AppleDesktop
Network Trash Folder
Temporary Items
.apdisk
# Node.js (for future website development)
node_modules/
npm-debug.log*
yarn-debug.log*
yarn-error.log*
# Environment variables
.env
.env.local
.env.production.local
.env.development.local
.env.test.local
# Local n8n data (contains credentials, database, etc.)
.n8n-local/
# Core dumps (file only, not directories)
/core
# Allow wizard core infrastructure
!src/cli/wizards/core/
# Test results (generated files)
test-results/
# IDE
.vscode/
.idea/
*.swp
*.swo
*~
# Build outputs (for future website)
.next/
out/
build/
dist/
# Logs
logs/
*.log
# Testing
coverage/
# But allow Phase 3 QE tool directories
!src/mcp/tools/qe/coverage/
!src/mcp/tools/qe/flaky-detection/
!src/mcp/tools/qe/performance/
!src/mcp/tools/qe/visual/
.nyc_output/
# Test temporary databases (prevent leaking to project root)
.test-memory-*.db*
.test-learning*.db*
tests/.tmp/
# Misc
*.bak
*.tmp
.cache/
.roo/
.hive-mind/
# Project-specific ignores
CLAUDE.md.backup
/aqe
# Removed Windows wrapper files per user request
hive-mind-prompt-*.txt
claude-flow-core/bin/
claude-flow-core/dist-cjs/
tests/__mocks__/
!src/core/coordination/
!src/core/memory/
!src/coverage/
# But block Istanbul HTML report files generated inside src/coverage/
src/coverage/*.css
src/coverage/*.js
src/coverage/*.html
src/coverage/*.png
src/coverage/*.json
!src/memory/
!tests/memory/
.claude/agents/test-agent.json
.claude/agents/failing-agent.json
.claude/worktrees/
tests/temp/
# Ignore memory directories but allow source code
memory/claude-flow-data.json
memory/sessions/*
!memory/sessions/README.md
memory/agents/*
!memory/agents/README.md
coordination/memory_bank/*
coordination/subtasks/*
coordination/orchestration/*
*.db*
*.sqlite
*.sqlite-journal
*.sqlite-wal
# Claude Flow runtime (but not source adapters)
/claude-flow
!src/adapters/claude-flow/
.agentic-qe/aqe.rvf.manifest.json
.agentic-qe/memory/
.agentic-qe/data/learning/state.json
.agentic-qe/data/improvement/state.json
.agentic-qe/a11y-scans/
data/
!src/adapters/a2ui/data/
test-projects/
# Mock files - allow ESM module mocks for CI
__mocks__/*
!__mocks__/agentdb.ts
!__mocks__/@ruvector/
!__mocks__/@ruvector/**
# Test artifacts that should not be committed
test-learning-persistence
junit.xml
docs/qx-reports/*
# Generated reports and client-specific analysis (should not be committed)
*-qx-analysis-report.md
*-a11y-audit.md
*-qe-assessment.md
*-threat-model.md
*-security-threat-model.md
qx-*.md
QX-*.md
# Claude Flow generated files
.claude/settings.local.json
.claude/memory/
# Visual test artifacts
.visual-tests/
.mcp.json
claude-flow.config.json
.swarm/
.hive-mind/
.claude-flow/
!src/memory/
!src/core/memory/
!tests/memory/
!src/edge/p2p/coordination/
memory/claude-flow-data.json
memory/sessions/*
!memory/sessions/README.md
memory/agents/*
!memory/agents/README.md
coordination/memory_bank/*
coordination/subtasks/*
coordination/orchestration/*
*.db
*.db-journal
*.db-wal
*.sqlite
*.sqlite-journal
*.sqlite-wal
# Removed Windows wrapper files per user request
hive-mind-prompt-*.txt
tests/tmp/*
tmp/*
# RuVector intelligence data (local learning, not for git)
.ruvector/
**/intelligence.json
**/.ruvector/
.env.supabase
# AQE data directories (local, not for git)
.agentic-qe/results/*
.agentic-qe/.cve-cache
.agentic-qe/*-scans/
*.db-shm
# qe-browser visual baselines + helper script local state (ADR-091)
# Per-project baselines are intentionally local; users opt in to commit
# their own baselines by removing the relevant entry from their project
# .gitignore. The skill itself never commits baselines.
.aqe/
!.aqe/visual-baselines/.gitkeep
# RVF binary brain data (local learning state, not for git)
*.rvf
*.rvf.idmap.json
*.rvf.lock
# Accessibility scan outputs (generated, may contain site-specific data)
docs/accessibility-scans/
# QCSD Analysis Reports (site-specific, may contain sensitive findings)
Agentic QCSD/
L2C/
# n8n instance-specific files (contain internal URLs/credentials)
.env.n8n
scripts/n8n-predeploy-check.sh
**/n8n-*-config.*
**/*acngva*
# L2C Documents (user-specific, not for git)
L2C Documents/
:memory:
# v2 archive
v2-archive.tar.gz
.agentic-qe/.claude/memory/
.test-tmp/
.agentic-qe/sessions/
.agentic-qe/notifications/
# Timestamped audit-tool artifacts — written to docs/reports/ during
# sessions but should never land in commits. Explicit patterns (not a
# blanket docs/reports/ ignore) so intentional reports can still be
# committed.
docs/reports/coherence-comparison-*.json
docs/reports/coherence-comparison-*.md