@claude-flow/cli 3.38.12 → 3.38.13

package/plugins/ruflo-metaharness/.claude-flow/metrics/test-gaps.json

@@ -0,0 +1,95 @@
+{
+  "timestamp": "2026-07-09T18:43:49.365Z",
+  "mode": "headless",
+  "workerType": "testgaps",
+  "model": "sonnet",
+  "durationMs": 155519,
+  "executionId": "testgaps_1783622473846_t839e5",
+  "success": true,
+  "findings": {
+    "sections": [
+      {
+        "title": "Test Coverage Analysis — `plugins/ruflo-metaharness`",
+        "content": "\n**Testing model:** no framework (no Jest/Vitest/Mocha, no `package.json` in this directory) — coverage is via hand-rolled `scripts/test-*.mjs` node scripts that assert and exit non-zero on failure. 34 `.mjs` files (~6,900 lines): 6 shared library modules (`_*.mjs`), 22 CLI wrappers, 6 test scripts.\n\n",
+        "level": 2
+      },
+      {
+        "title": "What's actually covered today",
+        "content": "\n| Test file | Covers |\n|---|---|\n| `test-similarity.mjs` | `_similarity.mjs` pure functions (`projectToVec`, `cosine`, `categoricalAgreement`, `jaccard`, `similarity`) + `_harness.mjs`'s `SEVERITY_RANK`/`rankSeverity`/`parseMcpScanText` |\n| `test-graceful-degradation.mjs` | **Degraded-path only** (network blocked) for `score`, `genome`, `mcp-scan`, `threat-model`, `oia-audit`, `audit-list`, `audit-trend`, `mint` — asserts exit 0 + `\"degraded\":true` |\n| `test-mcp-tools.mjs` | MCP tool registry handler contract (callable, returns `{success,data,degraded,exitCode}`, never throws) |\n| `test-pipeline-roundtrip.mjs` | E2E `oia-audit` → `audit-trend` chain against the real repo |\n| `test-parallel-pipeline.mjs` | `recordPair`/`recordPairOutcome` (TS, elsewhere) → `.jsonl` → `router-parallel-analyze.mjs` composition |\n| `test-with-openrouter.mjs` | Costed E2E: scaffold via `mint` + `doctor`/`validate`/`score`/`genome` lifecycle |\n\nEvery one of these is an **integration/degraded-path/contract** test. None of them is a true unit test of a CLI wrapper's own logic (arg parsing, safety checks, output shaping) on its **success path** with a **fake/mocked upstream**.\n\n---\n\n",
+        "level": 3
+      },
+      {
+        "title": "Gap 1 — `_invoke.mjs`: zero direct unit tests (highest priority)",
+        "content": "\nThis is the shared plumbing layer imported by ~15 scripts (`classifyDegraded`, `injectJson`, `parseTrailingJson`, `satisfiesTildeRange`, `findLocalPackageDir`, `ensureCachedInstall`, `importOptionalLibrary`, `makeDegradedEmitter`). It's pure/near-pure and currently only exercised transitively through e2e degraded-path runs — no test asserts its behavior directly.\n\n**Untested edge cases:**\n- `classifyDegraded`: `exitCode === null` → `-timeout` reason vs `DEGRADED_RX` match → `-not-available` vs neither → `{degraded:false}`. The regex itself (`could not determine executable|404|not installed|MODULE_NOT_FOUND|ENOTFOUND|getaddrinfo|ECONNREFUSED|ETIMEDOUT|npm ERR`) has no per-token test.\n- `parseTrailingJson`: multiple `{...}` blocks (must pick **last** parseable one, not first — this was called out in the file header as a fixed bug), nested objects that break the lazy regex (falls back to greedy whole-span match), no JSON present → `null`.\n- `injectJson`: `args` already contains `--json` → no duplicate; `wantJson=false` → untouched copy (not mutated).\n- `satisfiesTildeRange`: same major.minor + patch ≥ pin → true; different minor → false; malformed version strings → false (no throw).\n- `findLocalPackageDir`: `RUFLO_METAHARNESS_SKIP_LOCAL=1` short-circuits; pin-version filtering skips a stale ancestor install.\n\n```javascript\n// scripts/test-invoke.mjs — unit tests for _invoke.mjs (skeleton)\nimport {\n  classifyDegraded, injectJson, parseTrailingJson, satisfiesTildeRange,\n} from './_invoke.mjs';\n\nlet failures = 0;\nfunction assertEq(actual, expected, label) {\n  const ok = JSON.stringify(actual) === JSON.stringify(expected);\n  if (!ok) { failures++; console.error(`FAIL ${label}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`); }\n}\n\n// classifyDegraded\nassertEq(classifyDegraded('', null, 'x'), { degraded: true, reason: 'x-timeout' }, 'timeout');\nassertEq(classifyDegraded('npm ERR! 404', 1, 'x'), { degraded: true, reason: 'x-not-available' }, 'npm-404');\nassertEq(classifyDegraded('normal output', 0, 'x'), { degraded: false }, 'healthy');\n\n// injectJson\nassertEq(injectJson(['a'], true), ['a', '--json'], 'inject-json');\nassertEq(injectJson(['a', '--json'], true), ['a', '--json'], 'no-dup');\nassertEq(injectJson(['a'], false), ['a'], 'opt-out');\n\n// parseTrailingJson — LAST block wins (regression guard for the documented bug)\nassertEq(parseTrailingJson('progress {\"partial\":1}\\nfinal: {\"result\":\"ok\"}'), { result: 'ok' }, 'last-block');\nassertEq(parseTrailingJson('no json here'), null, 'no-json');\n\n// satisfiesTildeRange\nassertEq(satisfiesTildeRange('0.3.2', '~0.3.0'), true, 'patch-ok');\nassertEq(satisfiesTildeRange('0.4.0', '~0.3.0'), false, 'minor-mismatch');\nassertEq(satisfiesTildeRange('garbage', '~0.3.0'), false, 'malformed');\n\nconsole.log(failures === 0 ? 'PASS' : `${failures} FAILED`);\nprocess.exit(failures === 0 ? 0 : 1);\n```\n\n",
+        "level": 3
+      },
+      {
+        "title": "Gap 2 — `_darwin.mjs`: zero coverage (not even degraded-path)",
+        "content": "\n`test-graceful-degradation.mjs` explicitly lists 8 covered skills; **none of `evolve`, `bench`, `security-bench`, `gepa` (all `_darwin.mjs` consumers) are in that list.** So the entire darwin invocation path — sync (`runDarwin`) and async streaming (`runDarwinAsync`, `onProgress` callback, `signal` abort, timeout kill) — has no test at all, degraded or otherwise.\n\n```javascript\n// scripts/test-darwin-degraded.mjs (skeleton) — extend test-graceful-degradation.mjs's\n// pattern (unresolvable registry) to cover the darwin-backed skills.\nimport { spawnSync } from 'node:child_process';\n\nconst DARWIN_SKILLS = [\n  { name: 'bench', args: ['scripts/bench.mjs', '--op', 'verify', '--suite', '/tmp/nonexistent.json'] },\n  { name: 'evolve', args: ['scripts/evolve.mjs', '--repo', '.', '--confirm'] },\n  { name: 'security-bench', args: ['scripts/security-bench.mjs'] },\n  { name: 'gepa', args: ['scripts/gepa.mjs', '--op', 'genome'] },\n];\n\nlet failures = 0;\nfor (const skill of DARWIN_SKILLS) {\n  const r = spawnSync('node', skill.args, {\n    encoding: 'utf-8',\n    env: { ...process.env, npm_config_registry: 'http://127.0.0.1:1' },\n  });\n  const ok = r.status === 0 && /\"degraded\"\\s*:\\s*true/.test(r.stdout || '');\n  if (!ok) { failures++; console.error(`FAIL ${skill.name}: exit=${r.status}`); }\n}\nprocess.exit(failures === 0 ? 0 : 1);\n```\n\n",
+        "level": 3
+      },
+      {
+        "title": "Gap 3 — `evolve.mjs`: safety-critical logic, zero tests",
+        "content": "\nThis is the only script that mutates a target repo and has a documented safety model (ADR-153). Its **pure logic is fully unit-testable without spawning darwin** but isn't tested:\n- `safetyChecks()`: `--generations` 0/51 rejected, `--children` 0/21 rejected, `--concurrency` 0/9 rejected, invalid `--sandbox`/`--selection`/`--mutator` rejected, nonexistent `--repo` → exit 2.\n- `defaultTimeoutMs()`: arithmetic for `mock` vs `real` sandbox, `Math.ceil(variants/parallelism)` bucketing.\n- `--confirm` omitted → dry-run plan printed, exit 0, **no subprocess spawned** (this is the load-bearing safety guarantee and has no regression test).\n- Exit code 99 propagation (`safetyDisqualified`) — never exercised.\n- `looksLikeGepaTranscript` / `extractGepaTranscripts` / `summarizeTraces` — pure functions handling malformed/absent `.metaharness/runs/*.json`, never tested with synthetic fixtures.\n\n```javascript\n// scripts/test-evolve-safety.mjs (skeleton)\nimport { spawnSync } from 'node:child_process';\n\nlet failures = 0;\nfunction expectExit(args, wantCode, label) {\n  const r = spawnSync('node', ['scripts/evolve.mjs', ...args], { encoding: 'utf-8' });\n  if (r.status !== wantCode) { failures++; console.error(`FAIL ${label}: exit ${r.status}, want ${wantCode}`); }\n  return r;\n}\n\nexpectExit(['--repo', '.', '--generations', '0'], 2, 'generations-too-low');\nexpectExit(['--repo', '.', '--generations', '51'], 2, 'generations-too-high');\nexpectExit(['--repo', '.', '--children', '21'], 2, 'children-cap');\nexpectExit(['--repo', '.', '--sandbox', 'bogus'], 2, 'bad-sandbox');\nexpectExit(['--repo', '/nonexistent/path'], 2, 'bad-repo');\n\n// dry-run: no --confirm → must never spawn darwin, must exit 0 with a plan\nconst dry = expectExit(['--repo', '.'], 0, 'dry-run-plan');\nif (!/\"dryRun\"\\s*:\\s*true/.test(dry.stdout)) { failures++; console.error('FAIL dry-run-plan: missing dryRun:true'); }\n\nprocess.exit(failures === 0 ? 0 : 1);\n```\n\n",
+        "level": 3
+      },
+      {
+        "title": "Gap 4 — `mint.mjs`: path-traversal safety check untested",
+        "content": "\n`safetyChecks()` refuses to write to the project root or inside the calling repo — this is a directory-traversal guard with no negative test:\n\n```javascript\n// scripts/test-mint-safety.mjs (skeleton)\nimport { spawnSync } from 'node:child_process';\n\nlet failures = 0;\nfunction expectRejected(target, label) {\n  const r = spawnSync('node', ['scripts/mint.mjs', '--name', 'x', '--template', 'minimal', '--target', target], { encoding: 'utf-8' });\n  if (r.status !== 2) { failures++; console.error(`FAIL ${label}: expected exit 2, got ${r.status}`); }\n}\n\nexpectRejected(process.cwd(), 'refuses-repo-root');\nexpectRejected(process.cwd() + '/subdir', 'refuses-inside-repo');\n\n// missing --name / --template\nfor (const args of [['--template', 'minimal'], ['--name', 'x']]) {\n  const r = spawnSync('node', ['scripts/mint.mjs', ...args], { encoding: 'utf-8' });\n  if (r.status !== 2) { failures++; console.error(`FAIL missing-required-arg ${args}`); }\n}\nprocess.exit(failures === 0 ? 0 : 1);\n```\n\n",
+        "level": 3
+      },
+      {
+        "title": "Gap 5 — `drift-from-history.mjs`: composed pipeline, zero tests",
+        "content": "\n404-line orchestrator (3-way fast-path selection: slow / `--baseline-key` / `--baseline-file`) with no test at any level. Highest-value untested branches:\n- `--baseline-file` path skips memory entirely (`skippedAuditList=true, usedBaselineFile=true`) — the `timing.path === 'file'` label is asserted nowhere.\n- Empty `audit-list` result (no history) → exit 2, distinguished from `metaharness` absence → exit 3 (uses `auditResult.json?.degraded` from the *other* parallel branch — subtle coupling, easy to regress).\n- `--alert-on-new-severity` orthogonal gate: fires independent of `--threshold`, and the two reasons must both appear in `alert.reasons` when both trigger.\n- `runScriptJsonAsync` error path (`spawn` failure → `exitCode:127`, `stderr:'spawn-failed'`) — never simulated.\n\n```javascript\n// scripts/test-drift-from-history.mjs (skeleton, fixture-driven)\nimport { spawnSync } from 'node:child_process';\nimport { writeFileSync, mkdtempSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { tmpdir } from 'node:os';\n\nlet failures = 0;\nconst dir = mkdtempSync(join(tmpdir(), 'drift-test-'));\n\n// Fixture: two near-identical oia-audit-shaped records with fingerprints.\nconst baseline = { startedAt: '2026-01-01T00:00:00Z', composite: { worst: 'clean' },\n  fingerprint: { score: { dims: [1,1,1] }, genome: { tags: ['a'] } } };\nwriteFileSync(join(dir, 'baseline.json'), JSON.stringify(baseline));\n\n// --baseline-file path: assert timing.path === 'file' and no audit-list call\nconst r = spawnSync('node', [\n  'scripts/drift-from-history.mjs',\n  '--baseline-file', join(dir, 'baseline.json'),\n  '--format', 'json',\n], { encoding: 'utf-8' });\nconst json = JSON.parse((r.stdout.match(/\\{[\\s\\S]*\\}/) || ['{}'])[0]);\nif (json.timing?.path !== 'file') { failures++; console.error('FAIL baseline-file: wrong fast-path label'); }\n\nprocess.exit(failures === 0 ? 0 : 1);\n```\n\n",
+        "level": 3
+      },
+      {
+        "title": "Gap 6 — Untested error/malformed-input handling across CLI wrappers",
+        "content": "\nNone of the following are exercised anywhere:\n- `audit-trend.mjs` / `similarity.mjs`: malformed JSON file for `--baseline`/`--a`/`--b` (both have a try/catch around `JSON.parse` → exit 2, but no test); missing `composite` key in a supplied record (`audit-trend.mjs:104-107`); memory-namespace key-not-found path (`memRetrieve` returns `null`).\n- `mcp-scan.mjs`: invalid `--fail-on` value → exit 2 (untested); `rankSeverity` applied to an unknown/undefined severity in `findings` (regression the code comment explicitly calls out as a past bug — iter 63 — but has no test guarding it).\n- `redblue.mjs`: unknown subcommand → exit 2; `attack` without a valid family → exit 2; `report` without `--in` → exit 2; unknown `--flag` passthrough forwarding (`_passthrough` accumulation logic, including the \"peek next token, only consume if not another flag\" branch) — no test.\n- `gepa.mjs`: invalid `--op` → exit 2; `--transcript` pointing at a non-array JSON → exit 2; `readJsonFile` on missing file → exit 2.\n- `learn.mjs`: `CHECKOUT_RX` detection path (`requires a metaharness repo checkout` in combined stdout/stderr) → `{status:'checkout-required'}` — this is a load-bearing distinct-from-`degraded` state with no test.\n\n```javascript\n// scripts/test-cli-arg-validation.mjs (skeleton — one file to batch cheap negative-path checks)\nimport { spawnSync } from 'node:child_process';\n\nconst CASES = [\n  { args: ['scripts/mcp-scan.mjs', '--fail-on', 'bogus'], code: 2, label: 'mcp-scan bad --fail-on' },\n  { args: ['scripts/redblue.mjs', 'nonsense'], code: 2, label: 'redblue unknown subcommand' },\n  { args: ['scripts/redblue.mjs', 'attack', 'bogus-family'], code: 2, label: 'redblue bad attack family' },\n  { args: ['scripts/redblue.mjs', 'report'], code: 2, label: 'redblue report missing --in' },\n  { args: ['scripts/gepa.mjs', '--op', 'bogus'], code: 2, label: 'gepa bad --op' },\n  { args: ['scripts/bench.mjs', '--op', 'bogus'], code: 2, label: 'bench bad --op' },\n  { args: ['scripts/bench.mjs', '--op', 'verify'], code: 2, label: 'bench verify missing --suite' },\n];\n\nlet failures = 0;\nfor (const c of CASES) {\n  const r = spawnSync('node', c.args, { encoding: 'utf-8' });\n  if (r.status !== c.code) { failures++; console.error(`FAIL ${c.label}: exit ${r.status}, want ${c.code}`); }\n}\nprocess.exit(failures === 0 ? 0 : 1);\n```\n\n",
+        "level": 3
+      },
+      {
+        "title": "Gap 7 — `router-parallel-analyze.mjs`: promotion-criteria math untested in isolation",
+        "content": "\nCovered only via `test-parallel-pipeline.mjs`'s full e2e (recorder → jsonl → analyzer). The three-criteria AND-gate arithmetic (`median`, `pctile`, `mean`, the >2%/<1%/<5% thresholds) has no direct unit test with a synthetic `.jsonl` fixture that pins one criterion failing while the other two pass — the case most likely to regress silently (OR-vs-AND was literally the bug this file's header warns about).\n\n```javascript\n// scripts/test-router-parallel-analyze.mjs (skeleton)\nimport { writeFileSync, mkdtempSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { tmpdir } from 'node:os';\nimport { spawnSync } from 'node:child_process';\n\nconst dir = mkdtempSync(join(tmpdir(), 'rpa-test-'));\nconst file = join(dir, 'router-parallel.jsonl');\n\n// Fixture: quality +5% (passes >2%), cost +2% (FAILS <1%), latency +1% (passes <5%)\n// → overall must NOT be promotable even though 2/3 criteria pass (AND, not OR).\nconst rows = Array.from({ length: 20 }, (_, i) => JSON.stringify({\n  ts: new Date(0).toISOString(),\n  bandit: { pick: 'a', predictedQuality: 0.80, predictedCostUsd: 0.0100 },\n  ser:    { pick: 'b', predictedQuality: 0.84, predictedCostUsd: 0.0102 },\n  outcome: { actualModel: 'b', actualQuality: 0.84, actualUsd: 0.0102, actualLatencyMs: 1010 },\n}));\nwriteFileSync(file, rows.join('\\n'));\n\nconst r = spawnSync('node', ['scripts/router-parallel-analyze.mjs', '--input', file, '--strict', '--format', 'json'], { encoding: 'utf-8' });\nlet failures = 0;\nif (r.status !== 1) { failures++; console.error('FAIL: cost regression should block promotion under --strict (AND-gate)'); }\nprocess.exit(failures === 0 ? 0 : 1);\n```\n\n---\n\n",
+        "level": 3
+      },
+      {
+        "title": "Summary table",
+        "content": "| File | Lines | Existing coverage | Gap severity |\n|---|---:|---|---|\n| `_invoke.mjs` | 232 | none (transitive only) | **High** — shared by ~15 files |\n| `_darwin.mjs` | 211 | none | **High** — powers evolve/bench/security-bench/gepa |\n| `evolve.mjs` | 405 | none | **High** — mutates repos, safety-critical |\n| `drift-from-history.mjs` | 364 | none | **High** — 3-way fast-path branching |\n| `gepa.mjs` | 154 | none | Medium |\n| `learn.mjs` | 128 | none | Medium |\n| `security-bench.mjs` | 175 | none (incl. markdown parser `parseSecurityBenchMarkdown`) | Medium |\n| `bench.mjs` | 96 | none | Medium |\n| `redblue.mjs` / `_redblue.mjs` | 286 / 144 | none | Medium |\n| `mint.mjs` | 127 | degraded-path only | Medium — success + safety-check paths untested |\n| `similarity.mjs` (CLI) | 159 | `_similarity.mjs` internals tested; CLI wrapper (arg parsing, mem lookup, `--alert-below`) not | Low-Medium |\n| `audit-trend.mjs` | 273 | degraded-path + e2e roundtrip only | Low-Medium — malformed-record/missing-key branches untested |\n| `mcp-scan.mjs` | 111 | `parseMcpScanText` tested via `_harness.mjs`; CLI arg validation + severity-filter edge cases not | Low |\n| `router-parallel-analyze.mjs` | 250 | e2e only | Low — pure math untested in isolation |\n\n**Recommendation:** prioritize `test-invoke.mjs` (Gap 1) — it's pure, fast, and de-risks every other script that imports it — then `test-evolve-safety.mjs` and `test-mint-safety.mjs` (Gaps 3–4) since those guard destructive/safety-critical behavior with zero regression protection today.",
+        "level": 3
+      }
+    ],
+    "codeBlocks": [
+      {
+        "language": "javascript",
+        "code": "// scripts/test-invoke.mjs — unit tests for _invoke.mjs (skeleton)\nimport {\n  classifyDegraded, injectJson, parseTrailingJson, satisfiesTildeRange,\n} from './_invoke.mjs';\n\nlet failures = 0;\nfunction assertEq(actual, expected, label) {\n  const ok = JSON.stringify(actual) === JSON.stringify(expected);\n  if (!ok) { failures++; console.error(`FAIL ${label}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`); }\n}\n\n// classifyDegraded\nassertEq(classifyDegraded('', null, 'x'), { degraded: true, reason: 'x-timeout' }, 'timeout');\nassertEq(classifyDegraded('npm ERR! 404', 1, 'x'), { degraded: true, reason: 'x-not-available' }, 'npm-404');\nassertEq(classifyDegraded('normal output', 0, 'x'), { degraded: false }, 'healthy');\n\n// injectJson\nassertEq(injectJson(['a'], true), ['a', '--json'], 'inject-json');\nassertEq(injectJson(['a', '--json'], true), ['a', '--json'], 'no-dup');\nassertEq(injectJson(['a'], false), ['a'], 'opt-out');\n\n// parseTrailingJson — LAST block wins (regression guard for the documented bug)\nassertEq(parseTrailingJson('progress {\"partial\":1}\\nfinal: {\"result\":\"ok\"}'), { result: 'ok' }, 'last-block');\nassertEq(parseTrailingJson('no json here'), null, 'no-json');\n\n// satisfiesTildeRange\nassertEq(satisfiesTildeRange('0.3.2', '~0.3.0'), true, 'patch-ok');\nassertEq(satisfiesTildeRange('0.4.0', '~0.3.0'), false, 'minor-mismatch');\nassertEq(satisfiesTildeRange('garbage', '~0.3.0'), false, 'malformed');\n\nconsole.log(failures === 0 ? 'PASS' : `${failures} FAILED`);\nprocess.exit(failures === 0 ? 0 : 1);"
+      },
+      {
+        "language": "javascript",
+        "code": "// scripts/test-darwin-degraded.mjs (skeleton) — extend test-graceful-degradation.mjs's\n// pattern (unresolvable registry) to cover the darwin-backed skills.\nimport { spawnSync } from 'node:child_process';\n\nconst DARWIN_SKILLS = [\n  { name: 'bench', args: ['scripts/bench.mjs', '--op', 'verify', '--suite', '/tmp/nonexistent.json'] },\n  { name: 'evolve', args: ['scripts/evolve.mjs', '--repo', '.', '--confirm'] },\n  { name: 'security-bench', args: ['scripts/security-bench.mjs'] },\n  { name: 'gepa', args: ['scripts/gepa.mjs', '--op', 'genome'] },\n];\n\nlet failures = 0;\nfor (const skill of DARWIN_SKILLS) {\n  const r = spawnSync('node', skill.args, {\n    encoding: 'utf-8',\n    env: { ...process.env, npm_config_registry: 'http://127.0.0.1:1' },\n  });\n  const ok = r.status === 0 && /\"degraded\"\\s*:\\s*true/.test(r.stdout || '');\n  if (!ok) { failures++; console.error(`FAIL ${skill.name}: exit=${r.status}`); }\n}\nprocess.exit(failures === 0 ? 0 : 1);"
+      },
+      {
+        "language": "javascript",
+        "code": "// scripts/test-evolve-safety.mjs (skeleton)\nimport { spawnSync } from 'node:child_process';\n\nlet failures = 0;\nfunction expectExit(args, wantCode, label) {\n  const r = spawnSync('node', ['scripts/evolve.mjs', ...args], { encoding: 'utf-8' });\n  if (r.status !== wantCode) { failures++; console.error(`FAIL ${label}: exit ${r.status}, want ${wantCode}`); }\n  return r;\n}\n\nexpectExit(['--repo', '.', '--generations', '0'], 2, 'generations-too-low');\nexpectExit(['--repo', '.', '--generations', '51'], 2, 'generations-too-high');\nexpectExit(['--repo', '.', '--children', '21'], 2, 'children-cap');\nexpectExit(['--repo', '.', '--sandbox', 'bogus'], 2, 'bad-sandbox');\nexpectExit(['--repo', '/nonexistent/path'], 2, 'bad-repo');\n\n// dry-run: no --confirm → must never spawn darwin, must exit 0 with a plan\nconst dry = expectExit(['--repo', '.'], 0, 'dry-run-plan');\nif (!/\"dryRun\"\\s*:\\s*true/.test(dry.stdout)) { failures++; console.error('FAIL dry-run-plan: missing dryRun:true'); }\n\nprocess.exit(failures === 0 ? 0 : 1);"
+      },
+      {
+        "language": "javascript",
+        "code": "// scripts/test-mint-safety.mjs (skeleton)\nimport { spawnSync } from 'node:child_process';\n\nlet failures = 0;\nfunction expectRejected(target, label) {\n  const r = spawnSync('node', ['scripts/mint.mjs', '--name', 'x', '--template', 'minimal', '--target', target], { encoding: 'utf-8' });\n  if (r.status !== 2) { failures++; console.error(`FAIL ${label}: expected exit 2, got ${r.status}`); }\n}\n\nexpectRejected(process.cwd(), 'refuses-repo-root');\nexpectRejected(process.cwd() + '/subdir', 'refuses-inside-repo');\n\n// missing --name / --template\nfor (const args of [['--template', 'minimal'], ['--name', 'x']]) {\n  const r = spawnSync('node', ['scripts/mint.mjs', ...args], { encoding: 'utf-8' });\n  if (r.status !== 2) { failures++; console.error(`FAIL missing-required-arg ${args}`); }\n}\nprocess.exit(failures === 0 ? 0 : 1);"
+      },
+      {
+        "language": "javascript",
+        "code": "// scripts/test-drift-from-history.mjs (skeleton, fixture-driven)\nimport { spawnSync } from 'node:child_process';\nimport { writeFileSync, mkdtempSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { tmpdir } from 'node:os';\n\nlet failures = 0;\nconst dir = mkdtempSync(join(tmpdir(), 'drift-test-'));\n\n// Fixture: two near-identical oia-audit-shaped records with fingerprints.\nconst baseline = { startedAt: '2026-01-01T00:00:00Z', composite: { worst: 'clean' },\n  fingerprint: { score: { dims: [1,1,1] }, genome: { tags: ['a'] } } };\nwriteFileSync(join(dir, 'baseline.json'), JSON.stringify(baseline));\n\n// --baseline-file path: assert timing.path === 'file' and no audit-list call\nconst r = spawnSync('node', [\n  'scripts/drift-from-history.mjs',\n  '--baseline-file', join(dir, 'baseline.json'),\n  '--format', 'json',\n], { encoding: 'utf-8' });\nconst json = JSON.parse((r.stdout.match(/\\{[\\s\\S]*\\}/) || ['{}'])[0]);\nif (json.timing?.path !== 'file') { failures++; console.error('FAIL baseline-file: wrong fast-path label'); }\n\nprocess.exit(failures === 0 ? 0 : 1);"
+      },
+      {
+        "language": "javascript",
+        "code": "// scripts/test-cli-arg-validation.mjs (skeleton — one file to batch cheap negative-path checks)\nimport { spawnSync } from 'node:child_process';\n\nconst CASES = [\n  { args: ['scripts/mcp-scan.mjs', '--fail-on', 'bogus'], code: 2, label: 'mcp-scan bad --fail-on' },\n  { args: ['scripts/redblue.mjs', 'nonsense'], code: 2, label: 'redblue unknown subcommand' },\n  { args: ['scripts/redblue.mjs', 'attack', 'bogus-family'], code: 2, label: 'redblue bad attack family' },\n  { args: ['scripts/redblue.mjs', 'report'], code: 2, label: 'redblue report missing --in' },\n  { args: ['scripts/gepa.mjs', '--op', 'bogus'], code: 2, label: 'gepa bad --op' },\n  { args: ['scripts/bench.mjs', '--op', 'bogus'], code: 2, label: 'bench bad --op' },\n  { args: ['scripts/bench.mjs', '--op', 'verify'], code: 2, label: 'bench verify missing --suite' },\n];\n\nlet failures = 0;\nfor (const c of CASES) {\n  const r = spawnSync('node', c.args, { encoding: 'utf-8' });\n  if (r.status !== c.code) { failures++; console.error(`FAIL ${c.label}: exit ${r.status}, want ${c.code}`); }\n}\nprocess.exit(failures === 0 ? 0 : 1);"
+      },
+      {
+        "language": "javascript",
+        "code": "// scripts/test-router-parallel-analyze.mjs (skeleton)\nimport { writeFileSync, mkdtempSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { tmpdir } from 'node:os';\nimport { spawnSync } from 'node:child_process';\n\nconst dir = mkdtempSync(join(tmpdir(), 'rpa-test-'));\nconst file = join(dir, 'router-parallel.jsonl');\n\n// Fixture: quality +5% (passes >2%), cost +2% (FAILS <1%), latency +1% (passes <5%)\n// → overall must NOT be promotable even though 2/3 criteria pass (AND, not OR).\nconst rows = Array.from({ length: 20 }, (_, i) => JSON.stringify({\n  ts: new Date(0).toISOString(),\n  bandit: { pick: 'a', predictedQuality: 0.80, predictedCostUsd: 0.0100 },\n  ser:    { pick: 'b', predictedQuality: 0.84, predictedCostUsd: 0.0102 },\n  outcome: { actualModel: 'b', actualQuality: 0.84, actualUsd: 0.0102, actualLatencyMs: 1010 },\n}));\nwriteFileSync(file, rows.join('\\n'));\n\nconst r = spawnSync('node', ['scripts/router-parallel-analyze.mjs', '--input', file, '--strict', '--format', 'json'], { encoding: 'utf-8' });\nlet failures = 0;\nif (r.status !== 1) { failures++; console.error('FAIL: cost regression should block promotion under --strict (AND-gate)'); }\nprocess.exit(failures === 0 ? 0 : 1);"
+      }
+    ]
+  },
+  "rawOutputPreview": "## Test Coverage Analysis — `plugins/ruflo-metaharness`\n\n**Testing model:** no framework (no Jest/Vitest/Mocha, no `package.json` in this directory) — coverage is via hand-rolled `scripts/test-*.mjs` node scripts that assert and exit non-zero on failure. 34 `.mjs` files (~6,900 lines): 6 shared library modules (`_*.mjs`), 22 CLI wrappers, 6 test scripts.\n\n### What's actually covered today\n\n| Test file | Covers |\n|---|---|\n| `test-similarity.mjs` | `_similarity.mjs` pure functions (`projectToVec`, `cosine`, `categoricalAgreement`, `jaccard`, `similarity`) + `_harness.mjs`'s `SEVERITY_RANK`/`rankSeverity`/`parseMcpScanText` |\n| `test-graceful-degradation.mjs` | **Degraded-path only** (network blocked) for `score`, `genome`, `mcp-scan`, `threat-model`, `oia-audit`, `audit-list`, `audit-trend`, `mint` — asserts exit 0 + `\"degraded\":true` |\n| `test-mcp-tools.mjs` | MCP tool registry handler contract (callable, returns `{success,data,degraded,exitCode}`, never throws) |\n| `test-pipeline-roundtrip.mjs` | E2E `oia-audit` → `audit-trend` chain against the real repo |\n| `test-parallel-pipeline.mjs` | `recordPair`/`recordPairOutcome` (TS, elsewhere) → `.jsonl` → `router-parallel-analyze.mjs` composition |\n| `test-with-openrouter.mjs` | Costed E2E: scaffold via `mint` + `doctor`/`validate`/`score`/`genome` lifecycle |\n\nEvery one of these is an **integration/degraded-path/contract** test. None of them is a true unit test of a CLI wrapper's own logic (arg parsing, safety checks, output shaping) on its **success path** with a **fake/mocked upstream**.\n\n---\n\n### Gap 1 — `_invoke.mjs`: zero direct unit tests (highest priority)\n\nThis is the shared plumbing layer imported by ~15 scripts (`classifyDegraded`, `injectJson`, `parseTrailingJson`, `satisfiesTildeRange`, `findLocalPackageDir`, `ensureCachedInstall`, `importOptionalLibrary`, `makeDegradedEmitter`). It's pure/near-pure and currently only exercised transitively through e2e degraded-path runs — no test asserts its behavior direc",
+  "rawOutputLength": 16613
+}

package/plugins/ruflo-metaharness/.claude-flow/neural/stats.json

@@ -0,0 +1,6 @@
+{
+  "trajectoriesRecorded": 654,
+  "patternsLearned": 654,
+  "signalsProcessed": 0,
+  "lastAdaptation": 1783622549806
+}

package/plugins/ruflo-metaharness/skills/harness-gepa/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: harness-gepa
-description: Inspect and audit GEPA genomes via the `@metaharness/darwin/gepa` library entry (darwin 0.8.0) — load/validate a genome (default: the shipped cand-6 promotion), render the system prompt a genome compiles to, or classify failure modes in a run transcript. The `gepaOptimize` loop itself is library-only (bring your own evaluator) and not surfaced here — use `harness-evolve` for sandbox-scored evolution. Degrades gracefully when @metaharness/darwin is absent.
+description: "Inspect and audit GEPA genomes via the `@metaharness/darwin/gepa` library entry (darwin 0.8.0) — load/validate a genome (default is the shipped cand-6 promotion), render the system prompt a genome compiles to, or classify failure modes in a run transcript. The `gepaOptimize` loop itself is library-only (bring your own evaluator) and not surfaced here — use `harness-evolve` for sandbox-scored evolution. Degrades gracefully when @metaharness/darwin is absent."
 argument-hint: "--op genome|validate|render|analyze [--path <genome.json>] [--transcript <t.json>] [--alert-on-invalid]"
 allowed-tools: Bash
 ---