@goodandready/dsh-moa 0.2.74 → 0.2.76

package/README.md

@@ -52,6 +52,8 @@ Single-model AI generation often suffers from blind spots, single-perspective bi
 9. **Run History & Win-Rate Leaderboard**: Persistent logging of every run kind (synthesis, fast mode, questionnaire) with built-in REST endpoints (`/dsh-moa/history`, `/dsh-moa/leaderboard`, `/dsh-moa/runs/<id>`).
 10. **Live Canvas 1-Click Preview (optional)**: when the `@goodandready/dsh-live-canvas` plugin is installed in the same profile, the promoted HTML is pushed to its sandbox and the MoA answer carries a one-click preview link; without it the step is skipped silently.
 11. **Interactive Workbench (File Scoring 1–10, User Pick & Mix, Top-Model Glue & Judge Re-Check)**: Judge scores each candidate file (1–10) with pros and cons. Users can mix and match files across proposals in the WebUI. The turn's top-performing reference model harmonizes cross-file imports and contracts, followed by a final judge re-audit before promotion. Companion integration with [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) for safe pre-promotion rollback checkpoints.
+12. **Adversarial White-Hat Security Fuzzing Gate (#302)**: Red Team security audit scanning candidate code for SQLi, XSS, Command Injection, Path Traversal, ReDoS, and Prototype Pollution with blocking `SECURITY_VETO`.
+13. **Chain-of-Verification (CoVe) Fact-Checking Gate for Code (#314)**: Independent pre-judge verification formulating factual API questions, validating modules and functions against standard library and project manifests to eliminate hallucinated methods.
 
 ---
 
@@ -195,6 +197,12 @@ Dispatches `moa/judge-escalation` Cordis events and displays escalation decision
 ### 22. Self-Consistency Temperature Sampling for Single Models
 Allows single-model configurations (such as a local Ollama/vLLM instance or a single API key) to leverage Mixture-of-Agents diversity. When enabled on a preset with 1 model slot, the runner expands it into $N$ parallel candidate streams with distinct temperatures (e.g. 0.2, 0.6, 0.9) and complementary personas (`proposer`, `challenger`, `minimalist`), calculates agreement ratio, and performs full MoA consensus synthesis. Dispatches `moa/self-consistency-expand` Cordis events. Configured via `self_consistency_enabled: true`, `self_consistency_samples: 3`, and `self_consistency_temperatures: [0.2, 0.6, 0.9]`.
 
+### 23. Stack-Aware Dynamic Persona Evolution
+Scans project manifests (`package.json`, `Cargo.toml`, `pyproject.toml`, `requirements.txt`, `go.mod`) to detect languages, frameworks, and libraries. Automatically specializes candidate proposers into domain-specific roles (e.g. React Optimization, TypeScript Safety, Accessibility, FastAPI Async) to maximize hypothesis diversity. Emits `moa/stack-detected` Cordis events. Configured via `stack_aware_personas_enabled: true`.
+
+### 24. Self-Learning Developer Preferences Metaprompt
+Maintains a persistent profile of developer coding principles and architectural preferences in `~/.dsh/moa/preferences.json`. Injects active principles into the Judge prompt to bias consensus toward team standards (strict typing, functional immutability, error boundaries). Manageable via `GET/POST/DELETE /dsh-moa/preferences` REST endpoints and preset toggle `developer_preferences_enabled: true`.
+
 ### 6. Live Canvas 1-Click Preview (optional)
 If `@goodandready/dsh-live-canvas` is installed in the same profile, `dsh-moa` pushes the promoted HTML file to the Live Canvas REST contract (`POST /dsh-live-canvas/api/preview`, served by the same harness webServer) and appends a one-click preview link (`/dsh-live-canvas/sandbox/<id>`) to the answer. Without the plugin the step is skipped silently — no errors in the log, no dead links.
 

package/README.ru.md

@@ -52,6 +52,8 @@
 9. **История запусков и лидерборд моделей**: Персистентное логирование всех видов запусков (синтез, fast mode, опросник) и REST-эндпоинты (`/dsh-moa/history`, `/dsh-moa/leaderboard`, `/dsh-moa/runs/<id>`).
 10. **Live Canvas 1-клик предпросмотр (опционально)**: если в профиле установлен `@goodandready/dsh-live-canvas`, промоученный HTML отправляется в его песочницу, а ответ MoA содержит ссылку на предпросмотр в 1 клик; без плагина шаг тихо пропускается.
 11. **Интерактивный воркбенч (Оценка файлов 1–10, выбор в UI, склейка лучшей моделью и повторный аудит)**: Судья оценивает каждый сгенерированный файл каждого кандидата (1–10) с указанием ключевых плюсов и минусов. Пользователь комбинирует желаемый набор файлов в WebUI; лучшая модель раунда вызывается для гармонизации импортов и контрактов, после чего судья выполняет финальную валидацию перед промоушеном. Совместимо с [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) для безопасных теневых снимков Git.
+12. **Состязательный White-Hat фильтр безопасности (#302)**: Red Team аудит безопасности перед арбитражем судьи, выявляющий SQLi, XSS, инъекции команд, Path Traversal, ReDoS и Prototype Pollution с блокирующим вердиктом `SECURITY_VETO`.
+13. **Фильтр верификации фактов и API (CoVe) (#314)**: Автономная цепочка верификации (Chain-of-Verification), формулирующая проверочные вопросы по вызовам методов и пакетам, исключающая галлюцинированные и несуществующие API библиотек.
 
 ---
 
@@ -195,6 +197,12 @@ graph TD
 ### 22. Самосогласованное температурное сэмплирование для одиночных моделей (Self-Consistency)
 Позволяет пользователям с единственной моделью (локальная Ollama, vLLM или единственный API-ключ) получать преимущества ансамблевой валидации MoA. Автоматически разворачивает одиночный слот на $N$ параллельных запусков с различными температурами (`0.2, 0.6, 0.9`) и дополняющими друг друга инженерными персонами (`proposer`, `challenger`, `minimalist`), вычисляет коэффициент согласия (Self-Consistency Agreement) и синтезирует итоговый результат. Генерирует событие `moa/self-consistency-expand`.
 
+### 23. Динамическая адаптация персон по манифестам проекта (Stack-Aware Personas)
+Автоматически сканирует манифесты проекта (`package.json`, `Cargo.toml`, `pyproject.toml`, `requirements.txt`, `go.mod`) для определения стека технологий и библиотек. Специализирует роли кандидатов под конкретный стек (оптимизация рендера, строгая типизация, доступность, асинхронные интерфейсы), обеспечивая многоаспектный анализ задачи. Генерирует событие `moa/stack-detected`. Включается через `stack_aware_personas_enabled: true`.
+
+### 24. Метапромпт предпочтений разработчика (Developer Preferences)
+Хранит профиль архитектурных стандартов и стилевых предпочтений разработчика в `~/.dsh/moa/preferences.json`. Инжектирует активные принципы в контекст судьи, гарантируя соответствие выбранного решения вкусам команды (строгая типизация, иммутабельность, обработка ошибок). Доступен REST API (`GET/POST/DELETE /dsh-moa/preferences`) и опция пресета `developer_preferences_enabled: true`.
+
 ### 6. Live Canvas 1-клик предпросмотр (опционально)
 Если в профиле установлен `@goodandready/dsh-live-canvas`, `dsh-moa` отправляет промоученный HTML-файл в REST-контракт Live Canvas (`POST /dsh-live-canvas/api/preview`, тот же webServer харнесса) и добавляет к ответу ссылку на предпросмотр (`/dsh-live-canvas/sandbox/<id>`). Без плагина шаг пропускается тихо — без ошибок в журнале и без битых ссылок.
 

package/README.zh.md

@@ -52,6 +52,8 @@
 9. **运行历史与胜率排行榜**：对每一类运行（综合、快速模式、问卷）进行持久化记录，并内置 REST 端点（`/dsh-moa/history`、`/dsh-moa/leaderboard`、`/dsh-moa/runs/<id>`）。
 10. **Live Canvas 一键预览（可选）**：当同一 profile 中安装了 `@goodandready/dsh-live-canvas` 时，提升到项目根目录的 HTML 会被推入其沙箱，MoA 回答附带一键预览链接；未安装时该步骤静默跳过。
 11. **交互式工作台 (1-10分文件打分、自由混搭、最优模型粘合与裁判复审)**：裁判对每个候选模型生成的每个文件进行 1–10 分打分并列出优缺点。用户可在 WebUI 中自由勾选组合所需文件；当轮最高分模型被调用以粘合协同跨文件导入与类型接口，随后由裁判进行最终复审。支持配套插件 [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) 在文件提升前创建影子 Git 回滚快照。
+12. **对抗性白帽安全模糊测试关卡 (#302)**：红队安全审计器在裁判前检查 SQLi、XSS、命令注入、路径穿越、ReDoS 和原型污染漏洞，发现严重漏洞时触发 `SECURITY_VETO` 否决。
+13. **代码事实与 API 验证链关卡 (CoVe) (#314)**：独立的裁判前事实核验，生成针对性 API 问题并对照标准库及项目配置清单，杜绝调用虚构不存在的幻觉方法。
 
 ---
 
@@ -172,6 +174,12 @@ graph TD
 ### 22. 单模型自洽性温度采样 (Self-Consistency Temperature Sampling)
 专为仅配置单模型（如本地 Ollama/vLLM 或单一 API Key）的场景设计。开启后自动将单槽位扩展为 $N$ 个并行采样（分别采用 0.2、0.6、0.9 等递增温度与 `proposer`、`challenger`、`minimalist` 互补提示词），评估自洽一致性比率并进行全流程 MoA 综合聚合，触发 `moa/self-consistency-expand` 事件。
 
+### 23. 基于项目清单的感知角色演化 (Stack-Aware Personas)
+自动扫描工作区清单 (`package.json`, `Cargo.toml`, `pyproject.toml`, `go.mod`) 识别编程语言、框架与核心依赖，动态为各候选槽位分派互补的领域专家角色（如 React 渲染优化、TypeScript 严格类型安全、可访问性审查、FastAPI 异步架构），触发 `moa/stack-detected` 事件。通过 `stack_aware_personas_enabled: true` 配置。
+
+### 24. 自学习开发者代码偏好元提示词 (Developer Preferences)
+在本地 `~/.dsh/moa/preferences.json` 持久化存储团队编码规范与架构偏好，将启用的规则动态注入裁判评审阶段，使综合方案贴合开发者个人习惯（严格类型、函数不可变性、防御性错误边界）。提供 `GET/POST/DELETE /dsh-moa/preferences` REST 端点，通过 `developer_preferences_enabled: true` 开启。
+
 ### 6. Live Canvas 一键预览（可选）
 若同一 profile 中安装了 `@goodandready/dsh-live-canvas`，`dsh-moa` 会将提升后的 HTML 文件推送到 Live Canvas 的 REST 契约（`POST /dsh-live-canvas/api/preview`，由同一 harness webServer 提供服务），并在回答中附上一键预览链接（`/dsh-live-canvas/sandbox/<id>`）。未安装该插件时此步骤静默跳过——日志无报错，也不会出现死链接。
 

package/lib/client.js

@@ -224,7 +224,15 @@ window.__ModuleLoader__.load({
       "aggregator.escalation_policy_upgrade": "Auto-Upgrade to Senior Judge on Divergence",
       "aggregator.escalation_policy_council": "Convene 3-Judge Majority Council on Divergence",
       "aggregator.escalation_threshold": "Divergence Threshold:",
-      "aggregator.escalation_judge_label": "Senior Judge:"
+      "aggregator.escalation_judge_label": "Senior Judge:",
+      "aggregator.stack_personas_title": "\u{1F4E6} Stack-Aware Dynamic Persona Evolution (Project Manifests)",
+      "aggregator.stack_personas_desc": "Scans project manifests (package.json, Cargo.toml, pyproject.toml, go.mod) and assigns specialized engineering roles to candidate slots.",
+      "aggregator.preferences_title": "\u{1F9E0} Developer Coding Principles & Preferences Metaprompt",
+      "aggregator.preferences_desc": "Injects learned developer preferences (strict typing, functional immutability, error boundaries) to guide Judge synthesis.",
+      "aggregator.security_gate_title": "\u{1F6E1}\uFE0F Adversarial White-Hat Security Fuzzing Gate",
+      "aggregator.security_gate_desc": "Red-team security auditor checks candidate proposals for SQLi, XSS, ReDoS, Command Injection and Path Traversal with blocking SECURITY_VETO.",
+      "aggregator.cove_gate_title": "\u{1F50D} Chain-of-Verification (CoVe) Fact-Checking Gate",
+      "aggregator.cove_gate_desc": "Formulates API existence & method signature verification questions, disqualifying candidates that use hallucinated methods."
     };
     const zh = {
       title: "\u667A\u80FD\u4F53\u6DF7\u5408 (MoA)",
@@ -439,7 +447,15 @@ window.__ModuleLoader__.load({
       "aggregator.escalation_policy_upgrade": "\u5206\u6B67\u65F6\u81EA\u52A8\u5347\u7EA7\u81F3\u9AD8\u9636\u88C1\u5224",
       "aggregator.escalation_policy_council": "\u5206\u6B67\u65F6\u7EC4\u5EFA 3 \u88C1\u5224\u591A\u6570\u51B3\u7B56\u5E2D",
       "aggregator.escalation_threshold": "\u5206\u6B67\u9608\u503C:",
-      "aggregator.escalation_judge_label": "\u9AD8\u9636\u88C1\u5224\u6A21\u578B:"
+      "aggregator.escalation_judge_label": "\u9AD8\u9636\u88C1\u5224\u6A21\u578B:",
+      "aggregator.stack_personas_title": "\u{1F4E6} \u57FA\u4E8E\u9879\u76EE\u914D\u7F6E\u6E05\u5355\u7684\u611F\u77E5\u89D2\u8272\u6F14\u5316 (Stack-Aware Personas)",
+      "aggregator.stack_personas_desc": "\u81EA\u52A8\u626B\u63CF\u9879\u76EE\u6E05\u5355 (package.json, Cargo.toml, pyproject.toml, go.mod) \u5E76\u4E3A\u5404\u5019\u9009\u69FD\u4F4D\u6307\u6D3E\u4E13\u5C5E\u4E13\u4E1A\u89D2\u8272\u3002",
+      "aggregator.preferences_title": "\u{1F9E0} \u81EA\u5B66\u4E60\u5F00\u53D1\u8005\u4EE3\u7801\u504F\u597D\u5143\u63D0\u793A\u8BCD (Developer Preferences)",
+      "aggregator.preferences_desc": "\u5C06\u5F00\u53D1\u8005\u504F\u597D\uFF08\u4E25\u683C\u7C7B\u578B\u3001\u51FD\u6570\u4E0D\u53EF\u53D8\u6027\u3001\u9632\u5FA1\u6027\u9519\u8BEF\u5904\u7406\u7B49\uFF09\u6CE8\u5165\u88C1\u5224\u7EFC\u5408\u8BC4\u5BA1\u9636\u6BB5\u3002",
+      "aggregator.security_gate_title": "\u{1F6E1}\uFE0F \u5BF9\u6297\u6027\u767D\u5E3D\u5B89\u5168\u6A21\u7CCA\u6D4B\u8BD5\u5173\u5361",
+      "aggregator.security_gate_desc": "\u7EA2\u961F\u5B89\u5168\u5BA1\u8BA1\u5668\u68C0\u67E5\u5019\u9009\u65B9\u6848\u4E2D\u7684 SQLi\u3001XSS\u3001ReDoS\u3001\u547D\u4EE4\u6CE8\u5165\u548C\u8DEF\u5F84\u7A7F\u8D8A\u6F0F\u6D1E\uFF0C\u5E76\u5728\u53D1\u73B0\u4E25\u91CD\u6F0F\u6D1E\u65F6\u89E6\u53D1 SECURITY_VETO \u5426\u51B3\u3002",
+      "aggregator.cove_gate_title": "\u{1F50D} \u9A8C\u8BC1\u94FE (CoVe) \u4EE3\u7801\u4E8B\u5B9E\u4E0E API \u6838\u67E5\u5173\u5361",
+      "aggregator.cove_gate_desc": "\u751F\u6210 API \u5B58\u5728\u6027\u4E0E\u65B9\u6CD5\u7B7E\u540D\u6838\u9A8C\u95EE\u9898\uFF0C\u81EA\u52A8\u60E9\u7F5A\u6216\u53D6\u6D88\u4F7F\u7528\u865A\u6784\u5E7B\u89C9\u65B9\u6CD5\u7684\u5019\u9009\u65B9\u6848\u3002"
     };
     function makeT(dict, fallback) {
       return function t(key, vars) {
@@ -2354,6 +2370,7 @@ window.__ModuleLoader__.load({
                   )
                 )
               ),
+              // --- src/client/86-card-aggregator-ext2.js ---
               /* Pre-Judge Local Syntax Gate (#303) & Early Semantic Consensus (#299) */
               React.createElement(
                 "div",
@@ -2559,6 +2576,90 @@ window.__ModuleLoader__.load({
                   )
                 )
               ),
+              /* Stack-Aware Dynamic Persona Evolution (#308) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.stack_aware_personas_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, stack_aware_personas_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.stack_personas_title") || "\u{1F4E6} Stack-Aware Dynamic Persona Evolution (Project Manifests)"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.stack_personas_desc") || "Scans project manifests (package.json, Cargo.toml, pyproject.toml, go.mod) and assigns specialized engineering roles to candidate slots."
+                )
+              ),
+              /* Self-Learning Developer Preferences Metaprompt (#309) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.developer_preferences_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, developer_preferences_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.preferences_title") || "\u{1F9E0} Developer Coding Principles & Preferences Metaprompt"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.preferences_desc") || "Injects learned developer preferences (strict typing, functional immutability, error boundaries) to guide Judge synthesis."
+                )
+              ),
+              /* Adversarial White-Hat Security Fuzzing Gate (#302) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.security_gate_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, security_gate_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.security_gate_title") || "\u{1F6E1}\uFE0F Adversarial White-Hat Security Fuzzing Gate"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.security_gate_desc") || "Red-team security auditor checks candidate proposals for SQLi, XSS, ReDoS, Command Injection and Path Traversal with blocking SECURITY_VETO."
+                )
+              ),
+              /* Chain-of-Verification (CoVe) Fact-Checking Gate (#314) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.cove_verification_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, cove_verification_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.cove_gate_title") || "\u{1F50D} Chain-of-Verification (CoVe) Fact-Checking Gate"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.cove_gate_desc") || "Formulates API existence & method signature verification questions, disqualifying candidates that use hallucinated methods."
+                )
+              ),
               /* Fallback Judges Chain */
               React.createElement(
                 "div",

package/lib/events.js

@@ -9,6 +9,10 @@ export const MOA_EVENTS = {
   EARLY_CONSENSUS: 'moa/early-consensus',
   JUDGE_ESCALATION: 'moa/judge-escalation',
   SELF_CONSISTENCY_EXPAND: 'moa/self-consistency-expand',
+  STACK_DETECTED: 'moa/stack-detected',
+  PREFERENCES_APPLIED: 'moa/preferences-applied',
+  SECURITY_AUDIT: 'moa/security-audit',
+  COVE_VERIFIED: 'moa/cove-verified',
   CRITIQUE_COMPLETE: 'moa/critique-complete',
   JUDGE_VERDICT: 'moa/judge-verdict',
   CONTEXT_PRUNING: 'moa/context-pruning',
@@ -34,4 +38,3 @@ export function emitEvent(ctx, eventName, payload) {
     /* best-effort event dispatch: listener exceptions must never abort pipeline */
   }
 }
-

package/lib/moa-schema.js

@@ -89,6 +89,12 @@ export const PresetSchema = z.object({
   escalation_policy: z.string().default('single'),
   escalation_disagreement_threshold: z.number().default(0.40),
   escalation_judge: ModelSlotSchema.default({ provider: '', model: '' }),
+  stack_aware_personas_enabled: z.boolean().default(false),
+  developer_preferences_enabled: z.boolean().default(false),
+  security_gate_enabled: z.boolean().default(false),
+  security_gate_strict_veto: z.boolean().default(true),
+  cove_verification_enabled: z.boolean().default(false),
+  cove_max_questions: z.number().default(5),
 })
 
 export const Config = z.object({
@@ -124,6 +130,12 @@ export const Config = z.object({
   escalation_policy: z.string().default('single').volatile(),
   escalation_disagreement_threshold: z.number().default(0.40).volatile(),
   escalation_judge: ModelSlotSchema.default({ provider: '', model: '' }).volatile(),
+  stack_aware_personas_enabled: z.boolean().default(false).volatile(),
+  developer_preferences_enabled: z.boolean().default(false).volatile(),
+  security_gate_enabled: z.boolean().default(false).volatile(),
+  security_gate_strict_veto: z.boolean().default(true).volatile(),
+  cove_verification_enabled: z.boolean().default(false).volatile(),
+  cove_max_questions: z.number().default(5).volatile(),
   smart_routing_model: ModelSlotSchema.default({ provider: '', model: '' }).volatile(),
   prices: z.dict(PriceRow).default({}).volatile(),
   presets: z.array(PresetSchema).default([
@@ -193,4 +205,3 @@ export function plainConfig(value) {
   }
   return value
 }
-

package/lib/pipeline/context.js

@@ -1,3 +1,5 @@
+import { detectProjectStack, assignStackAwarePersonas, formatStackAwareDirective } from './manifest-stack.js'
+import { formatPreferencesDirective } from './developer-preferences.js'
 import { expandSelfConsistencySlots } from './self-consistency.js'
 import { emitEvent, MOA_EVENTS } from '../events.js'
 import { balanceCandidateQuotas } from '../moa-quota-balancer.js'
@@ -81,6 +83,34 @@ export async function stageProjectContext({
   const semanticCacheEnabled = Boolean(preset?.semantic_cache_enabled)
   const semanticCacheTtlHours = typeof preset?.semantic_cache_ttl_hours === 'number' ? preset.semantic_cache_ttl_hours : 168
 
+  const stackInfo = detectProjectStack(cwd)
+  if (stackInfo.manifestFound) {
+    emitEvent(ctx, MOA_EVENTS.STACK_DETECTED, {
+      primaryLanguage: stackInfo.primaryLanguage,
+      frameworks: stackInfo.frameworks,
+      libraries: stackInfo.libraries,
+      stackSummary: stackInfo.stackSummary,
+    })
+    if (typeof onProgress === 'function' && stackInfo.stackSummary) {
+      onProgress(`📦 *Project Stack: Detected ${stackInfo.stackSummary}*\n`)
+    }
+  }
+
+  const stackAwarePersonasEnabled = Boolean(preset?.stack_aware_personas_enabled)
+  if (stackAwarePersonasEnabled && !selfConsistencyExpanded) {
+    const stackRes = assignStackAwarePersonas(effectiveReferenceModels, stackInfo, { enabled: true })
+    if (stackRes.isSpecialized) {
+      effectiveReferenceModels = stackRes.references
+    }
+  }
+
+  const developerPreferencesEnabled = Boolean(preset?.developer_preferences_enabled)
+  const developerPreferencesDirective = formatPreferencesDirective(null, { enabled: developerPreferencesEnabled })
+  if (developerPreferencesDirective) {
+    emitEvent(ctx, MOA_EVENTS.PREFERENCES_APPLIED, { enabled: true })
+  }
+  const stackAwareDirective = formatStackAwareDirective(stackInfo)
+
   const collectedCtx = await collectProjectContext(cwd, 16000)
   const isRefinement = Boolean(collectedCtx?.files?.length > 0 && isRefinementTask(userPrompt, collectedCtx.files))
   let projectContext = ''
@@ -170,6 +200,7 @@ export async function stageProjectContext({
     semanticCacheEnabled, semanticCacheTtlHours,
     selfConsistencyEnabled, selfConsistencyExpanded, selfConsistencySamples, selfConsistencyTemperatures,
     escalationPolicy, escalationDisagreementThreshold, escalationJudge,
+    stackInfo, stackAwareDirective, developerPreferencesDirective,
   }
 }