mirror of
https://github.com/proffesor-for-testing/agentic-qe.git
synced 2026-09-19 08:45:47 +08:00
Dragan Spiridonov
e5a7719aa7
Closes the two security questions raised by the adversarial review that the prosecutors never returned a ruling on, so I settled them with evidence. 1. Coverage measurement executes the analyzed repository. Collecting real coverage means running the project's own tests: the JS/TS path runs `npx vitest|jest|nyc` (pre-existing), and the Rust path added in this release runs `cargo llvm-cov`, which compiles and runs test binaries, executes `build.rs`, and honors any `runner`/linker directive in that repo's `.cargo/config.toml`. For a trusted project that is exactly what the caller wants; it is surprising for an operation that reads like a static query, and an agent can be pointed at an untrusted checkout. Execution stays the default — requiring opt-in would make measured coverage the exceptional case and estimation the norm, inverting ADR-126's whole point — but is now opt-out via `AQE_COVERAGE_NO_EXEC=1`, which disables ALL build-tool execution. Existing coverage reports are still parsed; everything else degrades to clearly-labelled static estimation with guidance explaining why. Verified end-to-end through the real MCP server with a fake `cargo` shim on PATH: switch off -> cargo invoked; switch on -> not invoked. The unit test includes the same control, so it cannot pass vacuously. 2. Credential stripping in agentOverrides was already complete, but under-reported. `sanitizeAgentOverrides` builds its result as an ALLOW-LIST, so any field that is not provider/model/temperature/maxTokens/priority never survives — apiKey, token, password and friends were all dropped already. Only the *warning* was apiKey-specific, so a user who pasted a token got no feedback. The warning now covers all credential-shaped keys, and a test asserts no warning ever echoes a secret value. ADR-126 gains a section recording the execution decision and what was rejected (opt-in-by-default, sandboxing), plus the requirement that future language delegations honor the same switch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Agentic QE v3 Implementation Documentation
This directory contains all implementation documentation, planning, and research for Agentic QE v3.
Directory Structure
implementation/
├── adrs/ # Architecture Decision Records
├── architecture/ # Architecture diagrams & analysis
├── planning/ # Master plans & implementation strategies
├── security/ # Security considerations
└── agents/ # Agent specifications
Document Index
ADRs (Architecture Decision Records)
| Document | Description |
|---|---|
| v3-adrs.md | All 10 ADRs (001-010) master document |
Planning
| Document | Description |
|---|---|
| AQE-V3-MASTER-PLAN.md | Complete v3 master plan with DDD architecture |
Quick Links
- Skills: /.claude/skills/v3-qe-ddd-architecture/
- Agents: /.claude/agents/v3/
- Source (future): /v3/src/ - v3 source code (to be implemented)
Key Concepts
Domain-Driven Design for QE
Agentic QE v3 uses DDD with 13 bounded contexts:
- Test Generation - AI-powered test creation
- Test Execution - Parallel execution and retry
- Coverage Analysis - O(log n) gap detection
- Quality Assessment - Quality gates and metrics
- Defect Intelligence - Prediction and analysis
- Learning Optimization - Pattern learning and transfer
- Code Intelligence - Knowledge graph, dependency and impact analysis
- Requirements Validation - Acceptance-criteria and BDD validation
- Security Compliance - Security scanning and compliance checks
- Contract Testing - Consumer/provider contract validation
- Visual Accessibility - Visual regression and a11y auditing
- Chaos Resilience - Fault injection and resilience testing
- Enterprise Integration - SAP/middleware/E2E enterprise flows
Agent Hierarchy
21 specialized v3 agents organized hierarchically:
- Queen Coordinator (orchestration)
- Test Generation Group (4 agents)
- Quality Gates Group (3 agents)
- Intelligence Group (3 agents)
- Execution Group (3 agents)
- Coverage Group (3 agents)
- Learning Group (4 agents)
Key ADRs
| ADR | Decision |
|---|---|
| ADR-001 | Adopt DDD for QE bounded contexts |
| ADR-002 | Event-driven domain communication |
| ADR-003 | Sublinear O(log n) coverage analysis |
| ADR-004 | Plugin architecture for extensions |
| ADR-005 | AI-first test generation |
Getting Started
# Use v3 DDD skill
Task("Analyze QE architecture",
"Design DDD bounded contexts for quality engineering",
"system-architect")
# Use v3 Queen Coordinator
Task("Orchestrate QE workflow",
"Coordinate full quality engineering workflow",
"v3-qe-queen-coordinator")
# Use v3 Test Architect
Task("Generate tests",
"Create AI-powered test suite for UserService",
"v3-qe-test-architect")
Last Updated: 2026-01-07 Version: 1.0.0