proffesor-for-testing__agentic-qe/docs/releases/v3.6.4.md

v3.6.4 Release Notes

Release Date: 2026-02-12

Highlights

3-sprint security hardening, dream scheduler for automated learning consolidation, QE pattern seeding across 9 domains, and delta scanning for faster initialization.

Added

• Dream Scheduler — Automated dream consolidation with configurable cron schedules, CLI subcommand (aqe learning dream), and schema migration for dream cycle persistence.
• QE Pattern Seeding — 18 QE patterns seeded across 9 previously empty learning domains (chaos-resilience, code-intelligence, contract-testing, defect-intelligence, learning-optimization, quality-assessment, requirements-validation, security-compliance, visual-accessibility).
• Delta Scanning for Code Intelligence — aqe init code intelligence phase now performs incremental delta scans instead of full re-scans, with expanded exclusion patterns for faster initialization.
• Concept Graph Edge Discovery — ConceptGraph.loadFromPatterns() is now idempotent and automatically discovers co-occurrence and similarity edges between related patterns.
• Pattern Usage Recording — Domain handler factory records pattern usage asynchronously after task completion, feeding the self-learning feedback loop.
• 5 New Security Validator Test Suites — Command, crypto, input sanitizer, path traversal, and regex safety validators with 150+ test cases.

Fixed

• Security Hardening (3 Sprints) — OAuth provider PKCE enforcement, rate limiter bypass prevention, schema validator prototype pollution protection, SQL injection via table name interpolation, ReDoS-safe regex patterns, connection pool resource exhaustion guards.
• SQL Safety Module — New sql-safety.ts shared module with table name allowlist applied consistently across all SQL interpolation sites.
• 4 Flaky Test Suites Stabilized — Retry queue, event batcher, queen coordinator race condition, and domain tools tests now use deterministic mocking instead of timing-dependent assertions.
• SONA Test Timeouts — Learning optimization coordinator and plugin tests no longer time out during CI runs.
• Init Auto-Install Prevention — aqe init no longer triggers npx auto-installation of @claude-flow/cli when the package isn't available.
• MCP Config Cleanup — Removed duplicate agentic-qe-v3 MCP server entry, keeping only the canonical agentic-qe entry.

Changed

• Performance Hardening — Connection pool with bounded size limits, mincut calculator iteration caps, embedding generator batch size guards, and SSE/WebSocket/stdio transport resource cleanup improvements.
• Statusline Updated — Reflects 13 domains and 60 agents in the fleet configuration.