@dailephd/my-dev-kit-lab 0.3.3 → 0.3.4

package/README.md

@@ -2,9 +2,9 @@
 
 my-dev-kit-lab is the experiment, evidence, reporting, security-validation, and audit companion for my-dev-kit. It runs reproducible experiments that test whether my-dev-kit's graph-guided retrieval helps coding-agent workflows, collects metrics, renders reports, generates plots, captures screenshots, builds gallery outputs, performs automated CLI/package security validation, and runs the generic audit framework.
 
-The current published baseline is `v0.3.2`. `v0.3.0` introduced the generic audit framework and the first implemented code-rot detector family; `v0.3.1` added the language-aware code-rot substrate plus TypeScript/JavaScript support; `v0.3.2` added Python-aware code-rot support and a first security-validation audit adapter. The generic experiment-plugin framework was introduced in `v0.2.0`. The first plugin is `context-strategy-comparison`, which preserves the existing raw-full-file vs my-dev-kit-guided workflow through the plugin runner.
+The current published baseline is `v0.3.3`. `v0.3.0` introduced the generic audit framework and the first implemented code-rot detector family; `v0.3.1` added the language-aware code-rot substrate plus TypeScript/JavaScript support; `v0.3.2` added Python-aware code-rot support and a first security-validation audit adapter; `v0.3.3` adds Java/Kotlin source-facts support and JVM-aware code-rot detector integration. The generic experiment-plugin framework was introduced in `v0.2.0`. The first plugin is `context-strategy-comparison`, which preserves the existing raw-full-file vs my-dev-kit-guided workflow through the plugin runner.
 
-The checked-out implementation is ahead of the published baseline: release-prepared, not-yet-published `v0.3.3` work adds Java/Kotlin source-facts support and JVM-aware code-rot detector integration on top of the published `v0.3.2` baseline. Package metadata is now `0.3.3` as part of release preparation. Java/Kotlin support is conservative static analysis only: dependency-free scanners, static Gradle/Maven metadata detection, and no compiler, classpath, Gradle, Maven, Android, or target-test execution. Cross-language stability, Android validation, framework-aware profiles, and the `quality`/`project`/`all` audit types remain future roadmap work.
+`v0.3.3` is the previously published npm baseline. Java/Kotlin support is conservative static analysis only: dependency-free scanners, static Gradle/Maven metadata detection, and no compiler, classpath, Gradle, Maven, Android, or target-test execution. `v0.3.4` is release-prepared in this repository: package metadata has been bumped to `0.3.4`, adding mixed-language stability coverage, repeated-run report hardening, cross-platform/path normalization tests, CRLF/LF stability checks, and final documentation reconciliation. `v0.3.4` is not yet published to npm, not tagged, and no GitHub release has been created — local Windows validation has passed and a latest-Node cross-platform workflow is configured for ubuntu/macos/windows, but a fresh remote multi-OS run should be verified during publication.
 
 my-dev-kit is most useful when the repository is larger than the task. It helps coding agents work with large codebases through reusable structural indexing, graph-guided retrieval, targeted source slices, and auditable context selection. Results are scoped evidence; the project does not claim that my-dev-kit always saves tokens.
 
@@ -35,8 +35,9 @@ my-dev-kit is most useful when the repository is larger than the task. It helps
 - Plugin-aware JSON and HTML reports with plugin, target, variant, metric, artifact, warning, skip, and failure metadata
 - Security validation framework: dependency audit, package tarball inspection, CLI adversarial tests, static scans (CodeQL/Semgrep), bounded fuzz smoke, attack-scenario checks, and structured verdict/report output — runnable against any local project via `security:validate --target <path>`. `security:validate` remains the standalone, focused security-validation command; it is not replaced by the audit adapter below.
 - Generic audit framework, current published baseline: `npm run audit` runs heuristic, conservative code-rot detectors and writes text/JSON reports under `reports/audits/code-rot/` by default. `code-rot` and `security` are the currently implemented audit types (`--types code-rot`, `--types security`, or combined `--types code-rot,security`); `quality`, `project`, and `all` audit types are planned and fail cleanly instead of running. `npm run audit` supports `--target`, `--types`, and other flags — see [docs/COMMANDS.md](docs/COMMANDS.md). Audit does not modify target files and does not auto-fix issues.
-- Language-aware code-rot support, current checked-out package state: normalized language/file-role inventory, a source-facts model and collector, TypeScript/JavaScript, Python, Java, and Kotlin analyzers, and conservative detector integrations for `dead-code-candidate`, `duplicate-implementation-candidate`, `test-rot`, and `docs-code-mismatch`. Python project metadata remains a top-level audit report field. Java/Kotlin support adds static JVM project metadata detection for Gradle/Maven/source-set shape and conservative source-facts evidence, but no compiler parsing, type resolution, classpath resolution, Gradle/Maven execution, Android validation, or target-project test execution. No `SourceFacts` schema change or new audit command was added for `v0.3.3`.
-- Security-validation audit adapter, current checked-out package state: `npm run audit -- --types security` runs security validation through the shared audit/report surface by calling the same `runSecurityValidation()` internals `security:validate` uses, maps security findings into audit-issue-shaped entries, and adds a `securitySummary` field (verdict, check counts, finding counts, and links to the original `reports/security/*.txt`/`*.json` report) to audit JSON/text reports. `npm run audit -- --types code-rot,security` runs both audit types together. The original `security:validate` command and its `reports/security/` output are unchanged.
+- Language-aware code-rot support, current published package state: normalized language/file-role inventory, a source-facts model and collector, TypeScript/JavaScript, Python, Java, and Kotlin analyzers, and conservative detector integrations for `dead-code-candidate`, `duplicate-implementation-candidate`, `test-rot`, and `docs-code-mismatch`. Python project metadata remains a top-level audit report field. Java/Kotlin support adds static JVM project metadata detection for Gradle/Maven/source-set shape and conservative source-facts evidence, but no compiler parsing, type resolution, classpath resolution, Gradle/Maven execution, Android validation, or target-project test execution. No `SourceFacts` schema change or new audit command was added for `v0.3.3`.
+- Security-validation audit adapter, current published package state: `npm run audit -- --types security` runs security validation through the shared audit/report surface by calling the same `runSecurityValidation()` internals `security:validate` uses, maps security findings into audit-issue-shaped entries, and adds a `securitySummary` field (verdict, check counts, finding counts, and links to the original `reports/security/*.txt`/`*.json` report) to audit JSON/text reports. `npm run audit -- --types code-rot,security` runs both audit types together. The original `security:validate` command and its `reports/security/` output are unchanged.
+- `v0.3.4` implementation state (release-prepared, not yet published): mixed-language fixture corpus, source-facts invariants, full-registry mixed-language detector stability tests, repeated-run audit report determinism checks, cross-platform/path normalization hardening, CRLF/LF parsing stability coverage, and final documentation reconciliation. Package metadata is bumped to `0.3.4`; it is not yet tagged or published.
 
 ---
 
@@ -207,14 +208,14 @@ See [docs/METRICS.md](docs/METRICS.md) for full metric definitions.
 
 ## Current baseline release positioning
 
-my-dev-kit-lab is at a working baseline. The raw-vs-indexed experiment pipeline is fully implemented and produces reproducible artifacts. Real-agent campaign support exists for Codex and Claude. The current published npm baseline is `v0.3.2`, which includes the generic audit framework, the code-rot detector family, the language-aware code-rot substrate with TypeScript/JavaScript and Python support, and a first security-validation audit adapter, on top of the earlier experiment and automated security-validation work.
+my-dev-kit-lab is at a working baseline. The raw-vs-indexed experiment pipeline is fully implemented and produces reproducible artifacts. Real-agent campaign support exists for Codex and Claude. The previously published npm baseline is `v0.3.3`, which added Java/Kotlin analyzers, JVM metadata detection, Java/Kotlin detector support, and Java/Kotlin/Gradle/Maven docs-code-mismatch checks on top of the published `v0.3.2` baseline.
 
-The release-prepared, not-yet-published `v0.3.3` implementation extends that baseline with Java/Kotlin analyzers, JVM metadata detection, Java/Kotlin detector support, and Java/Kotlin/Gradle/Maven docs-code-mismatch checks. This work is documented here as checked-out behavior, not as a published package state; package metadata is now `0.3.3`, while `v0.3.2` remains the previous published baseline until publication completes.
+`v0.3.4` is release-prepared in this repository: package metadata has been bumped to `0.3.4`. It hardens the existing language-aware audit path with mixed-language fixture coverage, detector and report determinism checks, cross-platform/path normalization coverage, CRLF/LF stability coverage, and documentation reconciliation. It does not add a new command. It is not yet published, not tagged, and no GitHub release has been created.
 
-Planned roadmap direction after the published baseline:
+Planned roadmap direction after the previously published baseline:
 
-- `v0.3.3`: Java/Kotlin code-rot support (release-prepared, not yet published)
-- `v0.3.4`: cross-language stability for the language-aware code-rot track
+- `v0.3.3`: Java/Kotlin code-rot support (published)
+- `v0.3.4`: cross-language stability for the language-aware code-rot track (release-prepared in this checkout; not yet published)
 - `v0.4.0` through `v0.4.2`: Android automated security validation, including an Android-specific extension of the security audit adapter
 - manual pentest: post-v1 / version TBD
 

package/dist/src/audits/core/collectSourceFacts.js

@@ -41,17 +41,18 @@ export async function collectSourceFacts(targetRoot, inventory, registry = DEFAU
     // filtering preserves that order, so no re-sort is needed here.
     const eligible = inventory.files.filter((entry) => ANALYZABLE_ROLES.has(entry.role));
     for (const entry of eligible) {
+        const relativePath = normalizeRelativePath(entry.relativePath);
         const analyzer = selectLanguageAnalyzer(registry, entry.language, entry.extension);
         if (!analyzer) {
-            files.push(buildFallbackFacts(entry));
+            files.push(buildFallbackFacts(entry, relativePath));
             continue;
         }
-        const absolutePath = path.join(resolvedRoot, entry.relativePath);
+        const absolutePath = resolveInventoryFilePath(resolvedRoot, relativePath);
         try {
             const content = fs.readFileSync(absolutePath, "utf8");
             const facts = await analyzer.analyzeFile({
                 targetRoot: resolvedRoot,
-                relativePath: entry.relativePath,
+                relativePath,
                 absolutePath,
                 content,
                 inventoryEntry: entry,
@@ -65,13 +66,13 @@ export async function collectSourceFacts(targetRoot, inventory, registry = DEFAU
             const diagnostic = {
                 severity: "error",
                 code: "analyzer-error",
-                message: `Analyzer "${analyzer.id}" failed on "${entry.relativePath}": ${message}`,
-                path: entry.relativePath,
+                message: `Analyzer "${analyzer.id}" failed on "${relativePath}": ${message}`,
+                path: relativePath,
                 analyzerId: analyzer.id,
             };
             analyzerDiagnostics.push(diagnostic);
             files.push({
-                relativePath: entry.relativePath,
+                relativePath,
                 language: entry.language,
                 role: entry.role,
                 parseStatus: "parse-error",
@@ -94,7 +95,7 @@ export async function collectSourceFacts(targetRoot, inventory, registry = DEFAU
         warnings,
     };
 }
-function buildFallbackFacts(entry) {
+function buildFallbackFacts(entry, relativePath) {
     const known = KNOWN_LANGUAGES.has(entry.language);
     const parseStatus = known ? "file-level-only" : "unsupported";
     const diagnostic = known
@@ -102,18 +103,18 @@ function buildFallbackFacts(entry) {
             severity: "info",
             code: "no-analyzer-registered",
             message: `No language analyzer is registered for "${entry.language}" yet; only inventory-level facts are available.`,
-            path: entry.relativePath,
+            path: relativePath,
             analyzerId: null,
         }
         : {
             severity: "info",
             code: "unsupported-language",
             message: `Language "${entry.language}" is not supported for source-fact extraction.`,
-            path: entry.relativePath,
+            path: relativePath,
             analyzerId: null,
         };
     return {
-        relativePath: entry.relativePath,
+        relativePath,
         language: entry.language,
         role: entry.role,
         parseStatus,
@@ -126,6 +127,16 @@ function buildFallbackFacts(entry) {
         diagnostics: [diagnostic],
     };
 }
+function normalizeRelativePath(relativePath) {
+    const normalized = path.posix.normalize(relativePath.replace(/\\/g, "/"));
+    if (normalized === ".")
+        return "";
+    return normalized.replace(/^\/+/, "").replace(/^\.\//, "");
+}
+function resolveInventoryFilePath(root, relativePath) {
+    const parts = relativePath.split("/").filter((part) => part.length > 0);
+    return parts.length === 0 ? root : path.resolve(root, ...parts);
+}
 function countByLanguage(files) {
     const counts = Object.fromEntries(NORMALIZED_LANGUAGES.map((l) => [l, 0]));
     for (const file of files) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {

package/tests/fixtures/audits/mixed-language/mixed-docs-claims/README.md

@@ -0,0 +1,16 @@
+# mixed-docs-claims fixture
+
+Current: this fixture ships `com.example.Widget` (Java) and `com.example.Gadget`
+(Kotlin), matching the classes actually present under `src/main/java` and
+`src/main/kotlin` -- these are current, accurate claims about this fixture's
+own source.
+
+Planned (not yet implemented): Android-specific validation of this project's
+JVM sources is planned for a later `v0.4.x` release track.
+
+Out of scope: this fixture's `build.gradle.kts` is never executed by Gradle,
+and `pom.xml`-style Maven execution is not performed against this project --
+static classification only.
+
+Future (not yet implemented): a combined `quality`, `project`, or `all`
+audit type covering this fixture does not exist yet.

package/tests/fixtures/audits/mixed-language/mixed-docs-claims/build.gradle.kts

@@ -0,0 +1,4 @@
+plugins {
+    id("java")
+    kotlin("jvm") version "1.9.0"
+}

package/tests/fixtures/audits/mixed-language/mixed-docs-claims/src/main/java/com/example/Widget.java

@@ -0,0 +1,7 @@
+package com.example;
+
+public class Widget {
+    public String label() {
+        return "widget";
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-docs-claims/src/main/kotlin/com/example/Gadget.kt

@@ -0,0 +1,7 @@
+package com.example
+
+class Gadget {
+    fun label(): String {
+        return "gadget"
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/README.md

@@ -0,0 +1,10 @@
+# mixed-generated-vendor fixture
+
+Current: a single real source file (`src/index.ts`) alongside
+`generated/schema.ts`, `dist/index.js`, `build/Main.class`, and
+`vendor/lib.py` -- files that live under path segments the existing
+`projectInventory.ts` policy already classifies as generated/build-output/
+vendor. Used to prove those files do not pollute source-facts collection
+(role stays generated/build-output/vendor, not source/test) and are excluded
+from `SourceFactsSnapshot.files` the same way `sourceFacts.test.ts`'s
+existing vendor/generated test already proves for a single language.

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/build/Main.class

@@ -0,0 +1 @@
+binary-placeholder

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/dist/index.js

@@ -0,0 +1 @@
+module.exports = { identity: (v) => v };

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/generated/schema.ts

@@ -0,0 +1 @@
+export type GeneratedSchema = { id: string };

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/src/index.ts

@@ -0,0 +1,3 @@
+export function identity<T>(value: T): T {
+  return value;
+}

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/vendor/lib.py

@@ -0,0 +1,2 @@
+def vendored():
+    return "vendored"

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/README.md

@@ -0,0 +1,10 @@
+# mixed-java-kotlin fixture
+
+Current: a conventional Gradle Kotlin DSL JVM project layout with one Java
+class (`src/main/java/com/example/FooService.java`), one Kotlin class
+(`src/main/kotlin/com/example/BarService.kt`), and matching test classes
+under `src/test/java` and `src/test/kotlin`. `build.gradle.kts` and
+`settings.gradle.kts` are present to prove Gradle Kotlin DSL build scripts
+are classified as config, not Kotlin source. Used to prove Java and Kotlin
+source facts coexist in one JVM-style project without disrupting each
+other's declarations or role classification.

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/build.gradle.kts

@@ -0,0 +1,8 @@
+plugins {
+    id("java")
+    kotlin("jvm") version "1.9.0"
+}
+
+repositories {
+    mavenCentral()
+}

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/settings.gradle.kts

@@ -0,0 +1 @@
+rootProject.name = "mixed-java-kotlin-fixture"

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/main/java/com/example/FooService.java

@@ -0,0 +1,7 @@
+package com.example;
+
+public class FooService {
+    public String greet(String name) {
+        return "Hello, " + name;
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/main/kotlin/com/example/BarService.kt

@@ -0,0 +1,7 @@
+package com.example
+
+class BarService {
+    fun greet(name: String): String {
+        return "Hello, $name"
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/test/java/com/example/FooServiceTest.java

@@ -0,0 +1,8 @@
+package com.example;
+
+public class FooServiceTest {
+    public void testGreet() {
+        FooService service = new FooService();
+        assert service.greet("world").equals("Hello, world");
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/test/kotlin/com/example/BarServiceTest.kt

@@ -0,0 +1,8 @@
+package com.example
+
+class BarServiceTest {
+    fun testGreet() {
+        val service = BarService()
+        assert(service.greet("world") == "Hello, world")
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-python-ts/README.md

@@ -0,0 +1,8 @@
+# mixed-python-ts fixture
+
+Current: a Python module (`src/app.py`) and a TypeScript module
+(`src/index.ts`) that both declare an equivalent `add` function/declaration,
+plus one Python test file. Used to prove Python and TypeScript source facts
+coexist without schema or ordering drift, and that a duplicate-name
+declaration across languages is not merged into a single cross-language
+candidate.

package/tests/fixtures/audits/mixed-language/mixed-python-ts/src/app.py

@@ -0,0 +1,7 @@
+def add(a, b):
+    return a + b
+
+
+class Calculator:
+    def compute(self, a, b):
+        return add(a, b)

package/tests/fixtures/audits/mixed-language/mixed-python-ts/src/index.ts

@@ -0,0 +1,3 @@
+export function add(a: number, b: number): number {
+  return a + b;
+}

package/tests/fixtures/audits/mixed-language/mixed-python-ts/tests/test_app.py

@@ -0,0 +1,5 @@
+from src.app import add
+
+
+def test_add():
+    assert add(1, 2) == 3

package/tests/fixtures/audits/mixed-language/mixed-ts-js/README.md

@@ -0,0 +1,7 @@
+# mixed-ts-js fixture
+
+Current: a minimal TypeScript entrypoint (`src/index.ts`) calling a plain
+JavaScript helper (`src/helper.js`), with one test file. Used by
+`tests/audits/mixedLanguageSourceFacts.test.ts` to prove TypeScript and
+JavaScript files coexist in a single source-facts collection without schema
+or ordering drift.

package/tests/fixtures/audits/mixed-language/mixed-ts-js/src/helper.js

@@ -0,0 +1,5 @@
+function greet(name) {
+  return "Hello, " + name;
+}
+
+module.exports = { greet };

package/tests/fixtures/audits/mixed-language/mixed-ts-js/src/index.ts

@@ -0,0 +1,3 @@
+export function main(name: string): string {
+  return `Hello, ${name}`;
+}

package/tests/fixtures/audits/mixed-language/mixed-ts-js/tests/index.sample.ts

@@ -0,0 +1,5 @@
+import { main } from "../src/index.js";
+
+test("main returns a greeting", () => {
+  expect(main("world")).toContain("world");
+});

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/README.md

@@ -0,0 +1,10 @@
+# mixed-ts-python-jvm fixture
+
+Current: TypeScript, JavaScript, Python, Java, and Kotlin source files
+coexisting in one target, plus a `build.gradle.kts` JVM metadata file. Used
+to prove all currently-supported language families (v0.3.3 baseline) can be
+collected together without crashing, without cross-language schema drift,
+and without one analyzer's output disturbing another's.
+
+Planned (not implemented): Android-specific source-set validation and
+manual pentest coverage are out of scope for this fixture and for v0.3.4.

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/build.gradle.kts

@@ -0,0 +1,4 @@
+plugins {
+    id("java")
+    kotlin("jvm") version "1.9.0"
+}

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/pytests/test_app.py

@@ -0,0 +1,5 @@
+from src.app import multiply
+
+
+def test_multiply():
+    assert multiply(2, 3) == 6

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/app.py

@@ -0,0 +1,2 @@
+def multiply(a, b):
+    return a * b

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/helper.js

@@ -0,0 +1,5 @@
+function double(x) {
+  return x * 2;
+}
+
+module.exports = { double };

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/index.ts

@@ -0,0 +1,3 @@
+export function multiply(a: number, b: number): number {
+  return a * b;
+}

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/main/java/com/example/Multiplier.java

@@ -0,0 +1,7 @@
+package com.example;
+
+public class Multiplier {
+    public int multiply(int a, int b) {
+        return a * b;
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/main/kotlin/com/example/Divider.kt

@@ -0,0 +1,7 @@
+package com.example
+
+class Divider {
+    fun divide(a: Int, b: Int): Int {
+        return a / b
+    }
+}