@avi770/testteam 2.0.0 → 3.2.0

package/dist/agents/registry.js

@@ -1,11 +1,12 @@
+import { DEFAULT_RUN_MODE } from '../core/run-mode/index.js';
 /**
  * Maps each agent number to its license tier.
- * - free (8 agents): core testing pipeline
- * - pro (26 agents): advanced testing capabilities
- * - enterprise (36 agents): full platform auditing
+ * - free (41 agents): core pipeline + the full static-analysis suite (#87–120)
+ * - pro (37 agents): advanced testing capabilities
+ * - enterprise (42 agents): full platform auditing
  */
 export const AGENT_TIERS = {
-    /* ── Free tier (8) ── */
+    /* ── Free tier (core pipeline; full totals in the docblock above) ── */
     1: 'free', // Analyst
     2: 'free', // Seed Architect
     3: 'free', // Test Generator
@@ -14,7 +15,7 @@ export const AGENT_TIERS = {
     9: 'free', // Healer
     10: 'free', // Reporter
     11: 'free', // Fixer
-    /* ── Pro tier (26) ── */
+    /* ── Pro tier (advanced testing; full totals in the docblock above) ── */
     6: 'pro', // API Exerciser
     7: 'pro', // Security Scout
     8: 'pro', // A11y Guardian
@@ -22,7 +23,7 @@ export const AGENT_TIERS = {
     13: 'pro', // Performance Profiler
     15: 'pro', // Regression Sentinel
     21: 'pro', // State & Session Tester
-    22: 'pro', // Email Notification Verifier
+    22: 'pro', // Email & Notification Verifier
     23: 'pro', // Migration Tester
     24: 'pro', // Signup & Onboarding Tester
     25: 'pro', // CRUD Flow Tester
@@ -41,7 +42,7 @@ export const AGENT_TIERS = {
     68: 'pro', // Dead Code Detector
     69: 'pro', // Type Safety Auditor
     70: 'pro', // Complexity Analyzer
-    /* ── Enterprise tier (36) ── */
+    /* ── Enterprise tier (full platform auditing; totals in the docblock above) ── */
     14: 'enterprise', // Data Integrity Auditor
     16: 'enterprise', // Chaos Agent
     17: 'enterprise', // Documentation Validator
@@ -71,17 +72,109 @@ export const AGENT_TIERS = {
     57: 'enterprise', // Export Tester
     58: 'enterprise', // Payment Flow Tester
     59: 'enterprise', // SSL/TLS Auditor
-    60: 'enterprise', // DNS/CDN Tester
+    60: 'enterprise', // DNS & CDN Tester
     61: 'enterprise', // Docker Health Checker
     63: 'enterprise', // Log Quality Auditor
     64: 'enterprise', // Analytics Tracker Tester
     65: 'enterprise', // GDPR Compliance Tester
     66: 'enterprise', // SOC2 Control Validator
     67: 'enterprise', // WCAG AAA Tester
+    /* ── Taxonomy Expansion: Functional Testing (pro/enterprise) ── */
+    71: 'pro', // Unit Testing Agent
+    72: 'pro', // Integration Testing Agent
+    73: 'enterprise', // System Testing Agent
+    74: 'pro', // Acceptance Testing Agent
+    75: 'pro', // Sanity Testing Agent
+    76: 'pro', // Regression Testing Agent
+    /* ── Taxonomy Expansion: Non-Functional Testing (pro/enterprise) ── */
+    77: 'pro', // Browser Load Testing Agent
+    78: 'enterprise', // Stress Testing Agent
+    79: 'enterprise', // Endurance Testing Agent
+    80: 'pro', // Usability Testing Agent
+    81: 'pro', // Compatibility Testing Agent
+    /* ── Taxonomy Expansion: Testing Approach (pro/enterprise) ── */
+    82: 'enterprise', // Exploratory Testing Agent
+    83: 'pro', // Static Analysis Agent
+    /* ── Taxonomy Expansion: Governance (enterprise) ── */
+    84: 'enterprise', // Governance Testing Agent
+    /* ── Sprint 4: Browser-agent layers ── */
+    85: 'pro', // Stagehand Agent (deterministic E2E in plain English)
+    86: 'enterprise', // Browser-Use Agent (autonomous exploratory)
+    /* ── Sprint 5: Alpha-phase coverage trio (whole-system walk + repair audit) ── */
+    87: 'free', // Connection Mapper (static graph of routes/hooks/imports)
+    88: 'free', // Localhost Walkthrough (deterministic dev-server walk + Stagehand fallback)
+    89: 'free', // Repair & Retest (classify findings against fix-loop policy)
+    /* ── Sprint 6: Alpha-phase contract + safety trio ── */
+    90: 'free', // Response Shape Validator (drift detection vs baseline)
+    91: 'free', // Boundary Fuzzer (opt-in malformed-input checker)
+    92: 'pro', // Repair Simulator (Pro: optional sandbox test execution)
+    /* ── Sprint 7: Env-var hygiene ── */
+    93: 'free', // Env Var Auditor (referenced vs declared cross-reference)
+    94: 'free', // Schema Validator (ORM models vs code references)
+    95: 'free', // API Contract Drift (OpenAPI/Swagger spec vs implemented routes)
+    /* ── Sprint 9: Cookie security ── */
+    96: 'free', // Cookie Security Auditor (httpOnly / secure / sameSite presence)
+    /* ── Sprint 10: Deploy readiness ── */
+    97: 'free', // Healthcheck Validator (liveness + readiness routes)
+    /* ── Sprint 11: Security headers ── */
+    98: 'free', // CORS / CSP Auditor (wildcard origin, unsafe-inline/eval)
+    /* ── Sprint 12: Logging hygiene ── */
+    99: 'free', // Logging Hygiene Auditor (secrets / PII in log calls)
+    /* ── Sprint 13: Error handling ── */
+    100: 'free', // Error-Handling Auditor (empty catch / no-op .catch)
+    /* ── Sprint 15: Rate limiting ── */
+    101: 'free', // Rate-Limit Auditor (opt-in burst probe on auth endpoints)
+    /* ── Sprint 16: Container hardening ── */
+    102: 'free', // Dockerfile Auditor (root user / latest tag / baked secret / no healthcheck)
+    /* ── Sprint 17: CI supply-chain ── */
+    103: 'free', // CI Workflow Auditor (pwn-request / unpinned action / broad token / plaintext secret)
+    /* ── Sprint 18: Query performance ── */
+    104: 'free', // N+1 Query Detector (ORM query inside a loop body)
+    /* ── Sprint 19: Query bounds ── */
+    105: 'free', // Unbounded Query Auditor (findMany/select with no limit)
+    /* ── Sprint 20: Hardcoded config ── */
+    106: 'free', // Hardcoded Config Auditor (localhost / cleartext-http URLs)
+    /* ── Sprint 21: Open redirect ── */
+    107: 'free', // Open-Redirect Detector (request-derived redirect targets)
+    /* ── Sprint 22: SQL injection ── */
+    108: 'free', // SQL Injection Detector (raw SQL built by interpolation/concat)
+    /* ── Sprint 23: Path traversal ── */
+    109: 'free', // Path Traversal Detector (fs sinks fed by request input)
+    /* ── Sprint 24: Mass assignment ── */
+    110: 'free', // Mass-Assignment Detector (wholesale req.body into writes)
+    /* ── Sprint 25: Dynamic code execution ── */
+    111: 'free', // Dynamic Code Execution Detector (eval / new Function / vm)
+    /* ── Sprint 26: Cross-file taint tracking ── */
+    112: 'free', // Cross-File Taint Tracker (1-hop request → wrapper param → sink)
+    /* ── Sprint 27: Response contract drift v2 ── */
+    113: 'free', // Response Contract Auditor (handler response shape vs spec schema)
+    /* ── Sprint 28: Static accessibility lint ── */
+    114: 'free', // Static A11y Auditor (JSX/TSX a11y: img-alt / empty-interactive / tabindex …)
+    /* ── Sprint 29: Multi-hop taint ── */
+    115: 'free', // Multi-Hop Taint Tracker (N-hop request → … → sink call graph)
+    /* ── Sprint 30: Runtime contract capture ── */
+    116: 'free', // Runtime Contract Capture (opt-in: live responses vs OpenAPI contract)
+    /* ── Sprint 31: ARIA rule engine ── */
+    117: 'free', // ARIA Rule Engine (spec-driven role / aria-* conformance)
+    /* ── Sprint 60: Insecure crypto / hardcoded secrets / async safety ── */
+    118: 'free', // Insecure Crypto Auditor (weak hash/cipher, Math.random for secrets)
+    119: 'free', // Hardcoded Secrets Scanner (provider tokens / high-entropy literals)
+    120: 'free', // Async Safety Auditor (floating promise / unhandled rejection)
 };
+/** Tiers for custom (SDK-loaded) agents, registered at load time so the
+ *  orchestrator's tier-gating recognises agent numbers outside the built-in set. */
+const customAgentTiers = new Map();
+/** Record a custom (SDK) agent's tier so `getAgentTier` / `isAgentAvailable` work for it. */
+export function registerCustomAgentTier(agentNumber, tier) {
+    customAgentTiers.set(agentNumber, tier);
+}
+/** Clear all registered custom-agent tiers (test isolation). */
+export function clearCustomAgentTiers() {
+    customAgentTiers.clear();
+}
 /** Returns the tier classification for a given agent number. */
 export function getAgentTier(agentNumber) {
-    const tier = AGENT_TIERS[agentNumber];
+    const tier = AGENT_TIERS[agentNumber] ?? customAgentTiers.get(agentNumber);
     if (!tier) {
         throw new Error(`Unknown agent number: ${agentNumber}`);
     }
@@ -102,156 +195,277 @@ export function isAgentAvailable(agentNumber, licenseTier) {
     const agentTier = getAgentTier(agentNumber);
     return TIER_HIERARCHY[licenseTier].has(agentTier);
 }
-import { AnalystAgent } from './01-analyst';
-import { SeedArchitectAgent } from './02-seed-architect';
-import { TestGeneratorAgent } from './03-test-generator';
-import { UnitRunnerAgent } from './04-unit-runner';
-import { BrowserCrawlerAgent } from './05-browser-crawler';
-import { ApiExerciserAgent } from './06-api-exerciser';
-import { SecurityScoutAgent } from './07-security-scout';
-import { A11yGuardianAgent } from './08-a11y-guardian';
-import { HealerAgent } from './09-healer';
-import { ReporterAgent } from './10-reporter';
-import { FixerAgent } from './11-fixer';
-import { UxInspectorAgent } from './12-ux-inspector';
-import { PerformanceProfilerAgent } from './13-performance-profiler';
-import { DataIntegrityAuditorAgent } from './14-data-integrity-auditor';
-import { RegressionSentinelAgent } from './15-regression-sentinel';
-import { ChaosAgent } from './16-chaos-agent';
-import { DocumentationValidatorAgent } from './17-documentation-validator';
-import { IntegrationWatchdogAgent } from './18-integration-watchdog';
-import { TenantIsolationAuditorAgent } from './19-tenant-isolation-auditor';
-import { WorkflowCompletionTesterAgent } from './20-workflow-completion-tester';
-import { StateSessionTesterAgent } from './21-state-session-tester';
-import { EmailNotificationVerifierAgent } from './22-email-notification-verifier';
-import { MigrationTesterAgent } from './23-migration-tester';
-import { CrudFlowTesterAgent } from './25-crud-flow-tester';
-import { FormValidatorAgent } from './26-form-validator';
-import { SignupOnboardingTesterAgent } from './24-signup-onboarding-tester';
-import { NavigationRoutingTesterAgent } from './28-navigation-routing-tester';
-import { SearchFilterTesterAgent } from './27-search-filter-tester';
-import { ResponsiveInteractionTesterAgent } from './29-responsive-interaction-tester';
-import { MultiUserScenarioTesterAgent } from './30-multi-user-scenario-tester';
-import { LoadTesterAgent } from './31-load-tester';
-import { MemoryLeakDetectorAgent } from './32-memory-leak-detector';
-import { BundleAnalyzerAgent } from './33-bundle-analyzer';
-import { XssScannerAgent } from './34-xss-scanner';
-import { CsrfTesterAgent } from './35-csrf-tester';
-import { AuthFuzzerAgent } from './36-auth-fuzzer';
-import { DependencyScannerAgent } from './37-dependency-scanner';
-import { SecretsScannerAgent } from './38-secrets-scanner';
-import { ApiContractTesterAgent } from './39-api-contract-tester';
-import { RateLimitTesterAgent } from './40-rate-limit-tester';
-import { ApiPaginationTesterAgent } from './41-api-pagination-tester';
-import { GraphqlTesterAgent } from './42-graphql-tester';
-import { DataConsistencyCheckerAgent } from './43-data-consistency-checker';
-import { BackupRecoveryTesterAgent } from './44-backup-recovery-tester';
-import { DataPrivacyScannerAgent } from './45-data-privacy-scanner';
-import { SeoAuditorAgent } from './46-seo-auditor';
-import { SocialPreviewTesterAgent } from './47-social-preview-tester';
-import { LighthouseAuditorAgent } from './48-lighthouse-auditor';
-import { I18nTesterAgent } from './49-i18n-tester';
-import { TimezoneTesterAgent } from './50-timezone-tester';
-import { ErrorRecoveryTesterAgent } from './51-error-recovery-tester';
-import { OfflineModeTesterAgent } from './52-offline-mode-tester';
-import { GracefulDegradationTesterAgent } from './53-graceful-degradation-tester';
-import { WebSocketTesterAgent } from './54-websocket-tester';
-import { RealtimeSyncTesterAgent } from './55-realtime-sync-tester';
-import { FileUploadTesterAgent } from './56-file-upload-tester';
-import { ExportTesterAgent } from './57-export-tester';
-import { PaymentFlowTesterAgent } from './58-payment-flow-tester';
-import { SslTlsAuditorAgent } from './59-ssl-tls-auditor';
-import { DnsCdnTesterAgent } from './60-dns-cdn-tester';
-import { DockerHealthCheckerAgent } from './61-docker-health-checker';
-import { EnvConfigValidatorAgent } from './62-env-config-validator';
-import { LogQualityAuditorAgent } from './63-log-quality-auditor';
-import { AnalyticsTrackerTesterAgent } from './64-analytics-tracker-tester';
-import { GdprComplianceTesterAgent } from './65-gdpr-compliance-tester';
-import { Soc2ControlValidatorAgent } from './66-soc2-control-validator';
-import { WcagAaaTesterAgent } from './67-wcag-aaa-tester';
-import { DeadCodeDetectorAgent } from './68-dead-code-detector';
-import { TypeSafetyAuditorAgent } from './69-type-safety-auditor';
-import { ComplexityAnalyzerAgent } from './70-complexity-analyzer';
+import { AnalystAgent } from './01-analyst.js';
+import { SeedArchitectAgent } from './02-seed-architect.js';
+import { TestGeneratorAgent } from './03-test-generator.js';
+import { UnitRunnerAgent } from './04-unit-runner.js';
+import { BrowserCrawlerAgent } from './05-browser-crawler.js';
+import { ApiExerciserAgent } from './06-api-exerciser.js';
+import { SecurityScoutAgent } from './07-security-scout.js';
+import { A11yGuardianAgent } from './08-a11y-guardian.js';
+import { HealerAgent } from './09-healer.js';
+import { ReporterAgent } from './10-reporter.js';
+import { FixerAgent } from './11-fixer.js';
+import { UxInspectorAgent } from './12-ux-inspector.js';
+import { PerformanceProfilerAgent } from './13-performance-profiler.js';
+import { DataIntegrityAuditorAgent } from './14-data-integrity-auditor.js';
+import { RegressionSentinelAgent } from './15-regression-sentinel.js';
+import { ChaosAgent } from './16-chaos-agent.js';
+import { DocumentationValidatorAgent } from './17-documentation-validator.js';
+import { IntegrationWatchdogAgent } from './18-integration-watchdog.js';
+import { TenantIsolationAuditorAgent } from './19-tenant-isolation-auditor.js';
+import { WorkflowCompletionTesterAgent } from './20-workflow-completion-tester.js';
+import { StateSessionTesterAgent } from './21-state-session-tester.js';
+import { EmailNotificationVerifierAgent } from './22-email-notification-verifier.js';
+import { MigrationTesterAgent } from './23-migration-tester.js';
+import { CrudFlowTesterAgent } from './25-crud-flow-tester.js';
+import { FormValidatorAgent } from './26-form-validator.js';
+import { SignupOnboardingTesterAgent } from './24-signup-onboarding-tester.js';
+import { NavigationRoutingTesterAgent } from './28-navigation-routing-tester.js';
+import { SearchFilterTesterAgent } from './27-search-filter-tester.js';
+import { ResponsiveInteractionTesterAgent } from './29-responsive-interaction-tester.js';
+import { MultiUserScenarioTesterAgent } from './30-multi-user-scenario-tester.js';
+import { LoadTesterAgent } from './31-load-tester.js';
+import { MemoryLeakDetectorAgent } from './32-memory-leak-detector.js';
+import { BundleAnalyzerAgent } from './33-bundle-analyzer.js';
+import { XssScannerAgent } from './34-xss-scanner.js';
+import { CsrfTesterAgent } from './35-csrf-tester.js';
+import { AuthFuzzerAgent } from './36-auth-fuzzer.js';
+import { DependencyScannerAgent } from './37-dependency-scanner.js';
+import { SecretsScannerAgent } from './38-secrets-scanner.js';
+import { ApiContractTesterAgent } from './39-api-contract-tester.js';
+import { RateLimitTesterAgent } from './40-rate-limit-tester.js';
+import { ApiPaginationTesterAgent } from './41-api-pagination-tester.js';
+import { GraphqlTesterAgent } from './42-graphql-tester.js';
+import { DataConsistencyCheckerAgent } from './43-data-consistency-checker.js';
+import { BackupRecoveryTesterAgent } from './44-backup-recovery-tester.js';
+import { DataPrivacyScannerAgent } from './45-data-privacy-scanner.js';
+import { SeoAuditorAgent } from './46-seo-auditor.js';
+import { SocialPreviewTesterAgent } from './47-social-preview-tester.js';
+import { LighthouseAuditorAgent } from './48-lighthouse-auditor.js';
+import { I18nTesterAgent } from './49-i18n-tester.js';
+import { TimezoneTesterAgent } from './50-timezone-tester.js';
+import { ErrorRecoveryTesterAgent } from './51-error-recovery-tester.js';
+import { OfflineModeTesterAgent } from './52-offline-mode-tester.js';
+import { GracefulDegradationTesterAgent } from './53-graceful-degradation-tester.js';
+import { WebSocketTesterAgent } from './54-websocket-tester.js';
+import { RealtimeSyncTesterAgent } from './55-realtime-sync-tester.js';
+import { FileUploadTesterAgent } from './56-file-upload-tester.js';
+import { ExportTesterAgent } from './57-export-tester.js';
+import { PaymentFlowTesterAgent } from './58-payment-flow-tester.js';
+import { SslTlsAuditorAgent } from './59-ssl-tls-auditor.js';
+import { DnsCdnTesterAgent } from './60-dns-cdn-tester.js';
+import { DockerHealthCheckerAgent } from './61-docker-health-checker.js';
+import { EnvConfigValidatorAgent } from './62-env-config-validator.js';
+import { LogQualityAuditorAgent } from './63-log-quality-auditor.js';
+import { AnalyticsTrackerTesterAgent } from './64-analytics-tracker-tester.js';
+import { GdprComplianceTesterAgent } from './65-gdpr-compliance-tester.js';
+import { Soc2ControlValidatorAgent } from './66-soc2-control-validator.js';
+import { WcagAaaTesterAgent } from './67-wcag-aaa-tester.js';
+import { DeadCodeDetectorAgent } from './68-dead-code-detector.js';
+import { TypeSafetyAuditorAgent } from './69-type-safety-auditor.js';
+import { ComplexityAnalyzerAgent } from './70-complexity-analyzer.js';
+import { UnitTestingAgent } from './71-unit-testing-agent.js';
+import { IntegrationTestingAgent } from './72-integration-testing-agent.js';
+import { SystemTestingAgent } from './73-system-testing-agent.js';
+import { AcceptanceTestingAgent } from './74-acceptance-testing-agent.js';
+import { SanityTestingAgent } from './75-sanity-testing-agent.js';
+import { RegressionTestingAgent } from './76-regression-testing-agent.js';
+import { BrowserLoadTestingAgent } from './77-browser-load-testing-agent.js';
+import { StressTestingAgent } from './78-stress-testing-agent.js';
+import { EnduranceTestingAgent } from './79-endurance-testing-agent.js';
+import { UsabilityTestingAgent } from './80-usability-testing-agent.js';
+import { CompatibilityTestingAgent } from './81-compatibility-testing-agent.js';
+import { ExploratoryTestingAgent } from './82-exploratory-testing-agent.js';
+import { StaticAnalysisAgent } from './83-static-analysis-agent.js';
+import { GovernanceTestingAgent } from './84-governance-testing-agent.js';
+import { StagehandAgent } from './85-stagehand-agent.js';
+import { BrowserUseAgent } from './86-browser-use-agent.js';
+import { ConnectionMapperAgent } from './87-connection-mapper.js';
+import { LocalhostWalkthroughAgent } from './88-localhost-walkthrough.js';
+import { RepairRetestAgent } from './89-repair-retest.js';
+import { ResponseShapeValidatorAgent } from './90-response-shape-validator.js';
+import { BoundaryFuzzerAgent } from './91-boundary-fuzzer.js';
+import { RepairSimulatorAgent } from './92-repair-simulator.js';
+import { EnvVarAuditorAgent } from './93-env-var-auditor.js';
+import { SchemaValidatorAgent } from './94-schema-validator.js';
+import { ContractDriftAgent } from './95-contract-drift.js';
+import { CookieSecurityAuditorAgent } from './96-cookie-security-auditor.js';
+import { HealthcheckValidatorAgent } from './97-healthcheck-validator.js';
+import { CorsCspAuditorAgent } from './98-cors-csp-auditor.js';
+import { LoggingHygieneAuditorAgent } from './99-logging-hygiene-auditor.js';
+import { ErrorHandlingAuditorAgent } from './100-error-handling-auditor.js';
+import { RateLimitAuditorAgent } from './101-rate-limit-auditor.js';
+import { DockerfileAuditorAgent } from './102-dockerfile-auditor.js';
+import { CiWorkflowAuditorAgent } from './103-ci-workflow-auditor.js';
+import { NPlusOneDetectorAgent } from './104-n-plus-one-detector.js';
+import { UnboundedQueryAuditorAgent } from './105-unbounded-query-auditor.js';
+import { HardcodedConfigAuditorAgent } from './106-hardcoded-config-auditor.js';
+import { OpenRedirectDetectorAgent } from './107-open-redirect-detector.js';
+import { SqlInjectionDetectorAgent } from './108-sql-injection-detector.js';
+import { PathTraversalDetectorAgent } from './109-path-traversal-detector.js';
+import { MassAssignmentDetectorAgent } from './110-mass-assignment-detector.js';
+import { DynamicEvalDetectorAgent } from './111-dynamic-eval-detector.js';
+import { CrossFileTaintTrackerAgent } from './112-taint-tracker.js';
+import { ResponseContractAuditorAgent } from './113-response-contract-auditor.js';
+import { StaticA11yAuditorAgent } from './114-static-a11y-auditor.js';
+import { MultiHopTaintTrackerAgent } from './115-multihop-taint-tracker.js';
+import { RuntimeContractCaptureAgent } from './116-runtime-contract-capture.js';
+import { AriaRuleEngineAgent } from './117-aria-rule-engine.js';
+import { InsecureCryptoAuditorAgent } from './118-insecure-crypto-auditor.js';
+import { SecretsScannerStaticAgent } from './119-secrets-scanner.js';
+import { AsyncSafetyAuditorAgent } from './120-async-safety-auditor.js';
+/**
+ * Agent IDs that opt into the shared Loop Engine kernel AT RUNTIME (Option B). Only these agents
+ * forward a live loop-event observer to their kernel, so a headed run streams their genuine
+ * cognition on the `event: loop-event` channel. Every other agent ignores the observer entirely
+ * (zero overhead), and headless/CI runs pass no observer at all. Add agents here as they adopt
+ * kernel cognition — see agents/89-repair-retest.ts for the first adopter.
+ */
+export const KERNEL_OPTED_AGENTS = new Set([
+    89, // Repair & Retest — its classify→retest→tally audit maps to the cognition loops.
+]);
 /**
- * Register all 70 agents with the orchestrator.
+ * Register all 120 agents with the orchestrator.
  * Each agent is instantiated with the validated config, phase, and run directory.
  * Since agents may run in different phases, we register them for all phases
  * and the orchestrator handles dispatching only the ones needed per phase.
+ *
+ * `loopEventObserver` (Option B): when supplied (a headed Cockpit run), it is wired to each
+ * KERNEL_OPTED agent so that agent's per-cycle LoopEvents stream live, tagged with the agent's
+ * id + name. Omitted on headless/CI runs — those agents then run with no observer (no cost).
  */
-export function registerAllAgents(orchestrator, config, phase, runDir) {
+export function registerAllAgents(orchestrator, config, phase, runDir, totalRecall, runMode = DEFAULT_RUN_MODE, frames, loopEventObserver) {
     const agents = [
-        new AnalystAgent(config, phase, runDir),
-        new SeedArchitectAgent(config, phase, runDir),
-        new TestGeneratorAgent(config, phase, runDir),
-        new UnitRunnerAgent(config, phase, runDir),
-        new BrowserCrawlerAgent(config, phase, runDir),
-        new ApiExerciserAgent(config, phase, runDir),
-        new SecurityScoutAgent(config, phase, runDir),
-        new A11yGuardianAgent(config, phase, runDir),
-        new HealerAgent(config, phase, runDir),
-        new ReporterAgent(config, phase, runDir),
-        new FixerAgent(config, phase, runDir),
-        new UxInspectorAgent(config, phase, runDir),
-        new PerformanceProfilerAgent(config, phase, runDir),
-        new DataIntegrityAuditorAgent(config, phase, runDir),
-        new RegressionSentinelAgent(config, phase, runDir),
-        new ChaosAgent(config, phase, runDir),
-        new DocumentationValidatorAgent(config, phase, runDir),
-        new IntegrationWatchdogAgent(config, phase, runDir),
-        new TenantIsolationAuditorAgent(config, phase, runDir),
-        new WorkflowCompletionTesterAgent(config, phase, runDir),
-        new StateSessionTesterAgent(config, phase, runDir),
-        new EmailNotificationVerifierAgent(config, phase, runDir),
-        new MigrationTesterAgent(config, phase, runDir),
-        new SignupOnboardingTesterAgent(config, phase, runDir),
-        new CrudFlowTesterAgent(config, phase, runDir),
-        new FormValidatorAgent(config, phase, runDir),
-        new SearchFilterTesterAgent(config, phase, runDir),
-        new NavigationRoutingTesterAgent(config, phase, runDir),
-        new ResponsiveInteractionTesterAgent(config, phase, runDir),
-        new MultiUserScenarioTesterAgent(config, phase, runDir),
-        new LoadTesterAgent(config, phase, runDir),
-        new MemoryLeakDetectorAgent(config, phase, runDir),
-        new BundleAnalyzerAgent(config, phase, runDir),
-        new XssScannerAgent(config, phase, runDir),
-        new CsrfTesterAgent(config, phase, runDir),
-        new AuthFuzzerAgent(config, phase, runDir),
-        new DependencyScannerAgent(config, phase, runDir),
-        new SecretsScannerAgent(config, phase, runDir),
-        new ApiContractTesterAgent(config, phase, runDir),
-        new RateLimitTesterAgent(config, phase, runDir),
-        new ApiPaginationTesterAgent(config, phase, runDir),
-        new GraphqlTesterAgent(config, phase, runDir),
-        new DataConsistencyCheckerAgent(config, phase, runDir),
-        new BackupRecoveryTesterAgent(config, phase, runDir),
-        new DataPrivacyScannerAgent(config, phase, runDir),
-        new SeoAuditorAgent(config, phase, runDir),
-        new SocialPreviewTesterAgent(config, phase, runDir),
-        new LighthouseAuditorAgent(config, phase, runDir),
-        new I18nTesterAgent(config, phase, runDir),
-        new TimezoneTesterAgent(config, phase, runDir),
-        new ErrorRecoveryTesterAgent(config, phase, runDir),
-        new OfflineModeTesterAgent(config, phase, runDir),
-        new GracefulDegradationTesterAgent(config, phase, runDir),
-        new WebSocketTesterAgent(config, phase, runDir),
-        new RealtimeSyncTesterAgent(config, phase, runDir),
-        new FileUploadTesterAgent(config, phase, runDir),
-        new ExportTesterAgent(config, phase, runDir),
-        new PaymentFlowTesterAgent(config, phase, runDir),
-        new SslTlsAuditorAgent(config, phase, runDir),
-        new DnsCdnTesterAgent(config, phase, runDir),
-        new DockerHealthCheckerAgent(config, phase, runDir),
-        new EnvConfigValidatorAgent(config, phase, runDir),
-        new LogQualityAuditorAgent(config, phase, runDir),
-        new AnalyticsTrackerTesterAgent(config, phase, runDir),
-        new GdprComplianceTesterAgent(config, phase, runDir),
-        new Soc2ControlValidatorAgent(config, phase, runDir),
-        new WcagAaaTesterAgent(config, phase, runDir),
-        new DeadCodeDetectorAgent(config, phase, runDir),
-        new TypeSafetyAuditorAgent(config, phase, runDir),
-        new ComplexityAnalyzerAgent(config, phase, runDir),
+        new AnalystAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SeedArchitectAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new TestGeneratorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new UnitRunnerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new BrowserCrawlerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ApiExerciserAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SecurityScoutAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new A11yGuardianAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new HealerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ReporterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new FixerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new UxInspectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new PerformanceProfilerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DataIntegrityAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new RegressionSentinelAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ChaosAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DocumentationValidatorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new IntegrationWatchdogAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new TenantIsolationAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new WorkflowCompletionTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new StateSessionTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new EmailNotificationVerifierAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new MigrationTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SignupOnboardingTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new CrudFlowTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new FormValidatorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SearchFilterTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new NavigationRoutingTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ResponsiveInteractionTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new MultiUserScenarioTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new LoadTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new MemoryLeakDetectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new BundleAnalyzerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new XssScannerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new CsrfTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new AuthFuzzerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DependencyScannerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SecretsScannerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ApiContractTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new RateLimitTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ApiPaginationTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new GraphqlTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DataConsistencyCheckerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new BackupRecoveryTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DataPrivacyScannerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SeoAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SocialPreviewTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new LighthouseAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new I18nTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new TimezoneTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ErrorRecoveryTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new OfflineModeTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new GracefulDegradationTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new WebSocketTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new RealtimeSyncTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new FileUploadTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ExportTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new PaymentFlowTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SslTlsAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DnsCdnTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DockerHealthCheckerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new EnvConfigValidatorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new LogQualityAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new AnalyticsTrackerTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new GdprComplianceTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new Soc2ControlValidatorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new WcagAaaTesterAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DeadCodeDetectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new TypeSafetyAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ComplexityAnalyzerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new UnitTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new IntegrationTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SystemTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new AcceptanceTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SanityTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new RegressionTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new BrowserLoadTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new StressTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new EnduranceTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new UsabilityTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new CompatibilityTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ExploratoryTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new StaticAnalysisAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new GovernanceTestingAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new StagehandAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new BrowserUseAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ConnectionMapperAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new LocalhostWalkthroughAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new RepairRetestAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ResponseShapeValidatorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new BoundaryFuzzerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new RepairSimulatorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new EnvVarAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SchemaValidatorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ContractDriftAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new CookieSecurityAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new HealthcheckValidatorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new CorsCspAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new LoggingHygieneAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ErrorHandlingAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new RateLimitAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DockerfileAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new CiWorkflowAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new NPlusOneDetectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new UnboundedQueryAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new HardcodedConfigAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new OpenRedirectDetectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SqlInjectionDetectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new PathTraversalDetectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new MassAssignmentDetectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new DynamicEvalDetectorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new CrossFileTaintTrackerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new ResponseContractAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new StaticA11yAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new MultiHopTaintTrackerAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new RuntimeContractCaptureAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new AriaRuleEngineAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new InsecureCryptoAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new SecretsScannerStaticAgent(config, phase, runDir, totalRecall, runMode, frames),
+        new AsyncSafetyAuditorAgent(config, phase, runDir, totalRecall, runMode, frames),
     ];
     for (const agent of agents) {
+        // Option B: wire the live loop-event observer to opted-in agents only, pre-bound to this
+        // agent's identity so the kernel-facing callback stays the plain (event) => void shape.
+        if (loopEventObserver && KERNEL_OPTED_AGENTS.has(agent.agentId)) {
+            const agentId = agent.agentId;
+            const agentName = agent.agentName;
+            agent.setLoopEventObserver((event) => loopEventObserver(agentId, agentName, event));
+        }
         orchestrator.registerAgent(agent.agentId, agent);
     }
 }