@goodandready/dsh-moa 0.2.75 → 0.2.77

package/README.md

@@ -52,6 +52,10 @@ Single-model AI generation often suffers from blind spots, single-perspective bi
 9. **Run History & Win-Rate Leaderboard**: Persistent logging of every run kind (synthesis, fast mode, questionnaire) with built-in REST endpoints (`/dsh-moa/history`, `/dsh-moa/leaderboard`, `/dsh-moa/runs/<id>`).
 10. **Live Canvas 1-Click Preview (optional)**: when the `@goodandready/dsh-live-canvas` plugin is installed in the same profile, the promoted HTML is pushed to its sandbox and the MoA answer carries a one-click preview link; without it the step is skipped silently.
 11. **Interactive Workbench (File Scoring 1–10, User Pick & Mix, Top-Model Glue & Judge Re-Check)**: Judge scores each candidate file (1–10) with pros and cons. Users can mix and match files across proposals in the WebUI. The turn's top-performing reference model harmonizes cross-file imports and contracts, followed by a final judge re-audit before promotion. Companion integration with [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) for safe pre-promotion rollback checkpoints.
+12. **Adversarial White-Hat Security Fuzzing Gate (#302)**: Red Team security audit scanning candidate code for SQLi, XSS, Command Injection, Path Traversal, ReDoS, and Prototype Pollution with blocking `SECURITY_VETO`.
+13. **Chain-of-Verification (CoVe) Fact-Checking Gate for Code (#314)**: Independent pre-judge verification formulating factual API questions, validating modules and functions against standard library and project manifests to eliminate hallucinated methods.
+14. **Runtime CPU & Memory Profiler Gate (#315)**: Sandboxed micro-benchmarking of candidate execution duration, ops/sec throughput, and heap usage with hard timeout protection to select algorithmically optimal code.
+15. **Mutation Testing Gate for Candidate Tests (#316)**: Injects AST-level fault mutations to compute Mutation Score (killed vs survived mutants), weeding out tautological assertions and fake test suites.
 
 ---
 

package/README.ru.md

@@ -52,6 +52,10 @@
 9. **История запусков и лидерборд моделей**: Персистентное логирование всех видов запусков (синтез, fast mode, опросник) и REST-эндпоинты (`/dsh-moa/history`, `/dsh-moa/leaderboard`, `/dsh-moa/runs/<id>`).
 10. **Live Canvas 1-клик предпросмотр (опционально)**: если в профиле установлен `@goodandready/dsh-live-canvas`, промоученный HTML отправляется в его песочницу, а ответ MoA содержит ссылку на предпросмотр в 1 клик; без плагина шаг тихо пропускается.
 11. **Интерактивный воркбенч (Оценка файлов 1–10, выбор в UI, склейка лучшей моделью и повторный аудит)**: Судья оценивает каждый сгенерированный файл каждого кандидата (1–10) с указанием ключевых плюсов и минусов. Пользователь комбинирует желаемый набор файлов в WebUI; лучшая модель раунда вызывается для гармонизации импортов и контрактов, после чего судья выполняет финальную валидацию перед промоушеном. Совместимо с [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) для безопасных теневых снимков Git.
+12. **Состязательный White-Hat фильтр безопасности (#302)**: Red Team аудит безопасности перед арбитражем судьи, выявляющий SQLi, XSS, инъекции команд, Path Traversal, ReDoS и Prototype Pollution с блокирующим вердиктом `SECURITY_VETO`.
+13. **Фильтр верификации фактов и API (CoVe) (#314)**: Автономная цепочка верификации (Chain-of-Verification), формулирующая проверочные вопросы по вызовам методов и пакетам, исключающая галлюцинированные и несуществующие API библиотек.
+14. **Профайлер производительности CPU и памяти (#315)**: Изолированный бенчмаркинг времени выполнения кандидатов, пропускной способности (ops/sec) и потребления heap-памяти с защитой от зависаний для выбора алгоритмически оптимального кода.
+15. **Мутационное тестирование тестов кандидатов (#316)**: Внедрение AST-мутаций кода для расчёта Mutation Score (убитые vs выжившие мутанты), устраняющее ложноположительные и тавтологические тесты.
 
 ---
 

package/README.zh.md

@@ -52,6 +52,10 @@
 9. **运行历史与胜率排行榜**：对每一类运行（综合、快速模式、问卷）进行持久化记录，并内置 REST 端点（`/dsh-moa/history`、`/dsh-moa/leaderboard`、`/dsh-moa/runs/<id>`）。
 10. **Live Canvas 一键预览（可选）**：当同一 profile 中安装了 `@goodandready/dsh-live-canvas` 时，提升到项目根目录的 HTML 会被推入其沙箱，MoA 回答附带一键预览链接；未安装时该步骤静默跳过。
 11. **交互式工作台 (1-10分文件打分、自由混搭、最优模型粘合与裁判复审)**：裁判对每个候选模型生成的每个文件进行 1–10 分打分并列出优缺点。用户可在 WebUI 中自由勾选组合所需文件；当轮最高分模型被调用以粘合协同跨文件导入与类型接口，随后由裁判进行最终复审。支持配套插件 [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) 在文件提升前创建影子 Git 回滚快照。
+12. **对抗性白帽安全模糊测试关卡 (#302)**：红队安全审计器在裁判前检查 SQLi、XSS、命令注入、路径穿越、ReDoS 和原型污染漏洞，发现严重漏洞时触发 `SECURITY_VETO` 否决。
+13. **代码事实与 API 验证链关卡 (CoVe) (#314)**：独立的裁判前事实核验，生成针对性 API 问题并对照标准库及项目配置清单，杜绝调用虚构不存在的幻觉方法。
+14. **运行期 CPU 与内存性能分析关卡 (#315)**：在隔离沙箱中微基准测试候选方案执行延迟、吞吐量（ops/sec）与堆内存占用，带有硬超时保护，指引裁判挑选算法最优代码。
+15. **候选测试套件变异测试关卡 (#316)**：注入 AST 级别故障变异以计算变异得分（消灭 vs 存活变异体），剔除恒真废测试与虚假测试套件。
 
 ---
 

package/lib/client.js

@@ -228,7 +228,15 @@ window.__ModuleLoader__.load({
       "aggregator.stack_personas_title": "\u{1F4E6} Stack-Aware Dynamic Persona Evolution (Project Manifests)",
       "aggregator.stack_personas_desc": "Scans project manifests (package.json, Cargo.toml, pyproject.toml, go.mod) and assigns specialized engineering roles to candidate slots.",
       "aggregator.preferences_title": "\u{1F9E0} Developer Coding Principles & Preferences Metaprompt",
-      "aggregator.preferences_desc": "Injects learned developer preferences (strict typing, functional immutability, error boundaries) to guide Judge synthesis."
+      "aggregator.preferences_desc": "Injects learned developer preferences (strict typing, functional immutability, error boundaries) to guide Judge synthesis.",
+      "aggregator.security_gate_title": "\u{1F6E1}\uFE0F Adversarial White-Hat Security Fuzzing Gate",
+      "aggregator.security_gate_desc": "Red-team security auditor checks candidate proposals for SQLi, XSS, ReDoS, Command Injection and Path Traversal with blocking SECURITY_VETO.",
+      "aggregator.cove_gate_title": "\u{1F50D} Chain-of-Verification (CoVe) Fact-Checking Gate",
+      "aggregator.cove_gate_desc": "Formulates API existence & method signature verification questions, disqualifying candidates that use hallucinated methods.",
+      "aggregator.profiler_gate_title": "\u26A1 Automated Runtime Memory & CPU Profiler Gate",
+      "aggregator.profiler_gate_desc": "Runs isolated micro-benchmarks measuring execution latency, throughput (ops/sec), and heap memory usage.",
+      "aggregator.mutation_gate_title": "\u{1F9EC} Runtime Mutation Testing Gate for Candidate Tests",
+      "aggregator.mutation_gate_desc": "Injects synthetic faults into candidate code to test test-suite robustness, eliminating tautological and weak tests."
     };
     const zh = {
       title: "\u667A\u80FD\u4F53\u6DF7\u5408 (MoA)",
@@ -447,7 +455,15 @@ window.__ModuleLoader__.load({
       "aggregator.stack_personas_title": "\u{1F4E6} \u57FA\u4E8E\u9879\u76EE\u914D\u7F6E\u6E05\u5355\u7684\u611F\u77E5\u89D2\u8272\u6F14\u5316 (Stack-Aware Personas)",
       "aggregator.stack_personas_desc": "\u81EA\u52A8\u626B\u63CF\u9879\u76EE\u6E05\u5355 (package.json, Cargo.toml, pyproject.toml, go.mod) \u5E76\u4E3A\u5404\u5019\u9009\u69FD\u4F4D\u6307\u6D3E\u4E13\u5C5E\u4E13\u4E1A\u89D2\u8272\u3002",
       "aggregator.preferences_title": "\u{1F9E0} \u81EA\u5B66\u4E60\u5F00\u53D1\u8005\u4EE3\u7801\u504F\u597D\u5143\u63D0\u793A\u8BCD (Developer Preferences)",
-      "aggregator.preferences_desc": "\u5C06\u5F00\u53D1\u8005\u504F\u597D\uFF08\u4E25\u683C\u7C7B\u578B\u3001\u51FD\u6570\u4E0D\u53EF\u53D8\u6027\u3001\u9632\u5FA1\u6027\u9519\u8BEF\u5904\u7406\u7B49\uFF09\u6CE8\u5165\u88C1\u5224\u7EFC\u5408\u8BC4\u5BA1\u9636\u6BB5\u3002"
+      "aggregator.preferences_desc": "\u5C06\u5F00\u53D1\u8005\u504F\u597D\uFF08\u4E25\u683C\u7C7B\u578B\u3001\u51FD\u6570\u4E0D\u53EF\u53D8\u6027\u3001\u9632\u5FA1\u6027\u9519\u8BEF\u5904\u7406\u7B49\uFF09\u6CE8\u5165\u88C1\u5224\u7EFC\u5408\u8BC4\u5BA1\u9636\u6BB5\u3002",
+      "aggregator.security_gate_title": "\u{1F6E1}\uFE0F \u5BF9\u6297\u6027\u767D\u5E3D\u5B89\u5168\u6A21\u7CCA\u6D4B\u8BD5\u5173\u5361",
+      "aggregator.security_gate_desc": "\u7EA2\u961F\u5B89\u5168\u5BA1\u8BA1\u5668\u68C0\u67E5\u5019\u9009\u65B9\u6848\u4E2D\u7684 SQLi\u3001XSS\u3001ReDoS\u3001\u547D\u4EE4\u6CE8\u5165\u548C\u8DEF\u5F84\u7A7F\u8D8A\u6F0F\u6D1E\uFF0C\u5E76\u5728\u53D1\u73B0\u4E25\u91CD\u6F0F\u6D1E\u65F6\u89E6\u53D1 SECURITY_VETO \u5426\u51B3\u3002",
+      "aggregator.cove_gate_title": "\u{1F50D} \u9A8C\u8BC1\u94FE (CoVe) \u4EE3\u7801\u4E8B\u5B9E\u4E0E API \u6838\u67E5\u5173\u5361",
+      "aggregator.cove_gate_desc": "\u751F\u6210 API \u5B58\u5728\u6027\u4E0E\u65B9\u6CD5\u7B7E\u540D\u6838\u9A8C\u95EE\u9898\uFF0C\u81EA\u52A8\u60E9\u7F5A\u6216\u53D6\u6D88\u4F7F\u7528\u865A\u6784\u5E7B\u89C9\u65B9\u6CD5\u7684\u5019\u9009\u65B9\u6848\u3002",
+      "aggregator.profiler_gate_title": "\u26A1 \u81EA\u52A8\u8FD0\u884C\u65F6 CPU \u4E0E\u5185\u5B58\u6027\u80FD\u5206\u6790\u5173\u5361",
+      "aggregator.profiler_gate_desc": "\u5728\u9694\u79BB\u6C99\u7BB1\u4E2D\u8FD0\u884C\u5FAE\u57FA\u51C6\u6D4B\u8BD5\uFF0C\u7CBE\u786E\u5EA6\u91CF\u6267\u884C\u5EF6\u8FDF\u3001\u541E\u5410\u91CF (ops/sec) \u548C\u5806\u5185\u5B58\u5206\u914D\u3002",
+      "aggregator.mutation_gate_title": "\u{1F9EC} \u5019\u9009\u6D4B\u8BD5\u5957\u4EF6\u8FD0\u884C\u65F6\u53D8\u5F02\u6D4B\u8BD5\u5173\u5361",
+      "aggregator.mutation_gate_desc": "\u5411\u4EE3\u7801\u6CE8\u5165\u5408\u6210\u6545\u969C\u5E76\u9A8C\u8BC1\u6D4B\u8BD5\u7684\u6355\u83B7\u80FD\u529B\uFF0C\u5254\u9664\u540C\u4E49\u53CD\u590D\u4E0E\u65E0\u6548\u7684\u865A\u5047\u6D4B\u8BD5\u3002"
     };
     function makeT(dict, fallback) {
       return function t(key, vars) {
@@ -2610,6 +2626,90 @@ window.__ModuleLoader__.load({
                   t("aggregator.preferences_desc") || "Injects learned developer preferences (strict typing, functional immutability, error boundaries) to guide Judge synthesis."
                 )
               ),
+              /* Adversarial White-Hat Security Fuzzing Gate (#302) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.security_gate_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, security_gate_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.security_gate_title") || "\u{1F6E1}\uFE0F Adversarial White-Hat Security Fuzzing Gate"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.security_gate_desc") || "Red-team security auditor checks candidate proposals for SQLi, XSS, ReDoS, Command Injection and Path Traversal with blocking SECURITY_VETO."
+                )
+              ),
+              /* Chain-of-Verification (CoVe) Fact-Checking Gate (#314) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.cove_verification_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, cove_verification_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.cove_gate_title") || "\u{1F50D} Chain-of-Verification (CoVe) Fact-Checking Gate"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.cove_gate_desc") || "Formulates API existence & method signature verification questions, disqualifying candidates that use hallucinated methods."
+                )
+              ),
+              /* Automated Runtime Memory & CPU Profiler Gate (#315) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.profiler_gate_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, profiler_gate_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.profiler_gate_title") || "\u26A1 Automated Runtime Memory & CPU Profiler Gate"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.profiler_gate_desc") || "Runs isolated micro-benchmarks measuring execution latency, throughput (ops/sec), and heap memory usage."
+                )
+              ),
+              /* Runtime Mutation Testing Gate (#316) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.mutation_testing_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, mutation_testing_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.mutation_gate_title") || "\u{1F9EC} Runtime Mutation Testing Gate for Candidate Tests"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.mutation_gate_desc") || "Injects synthetic faults into candidate code to test test-suite robustness, eliminating tautological and weak tests."
+                )
+              ),
               /* Fallback Judges Chain */
               React.createElement(
                 "div",

package/lib/events.js

@@ -11,6 +11,10 @@ export const MOA_EVENTS = {
   SELF_CONSISTENCY_EXPAND: 'moa/self-consistency-expand',
   STACK_DETECTED: 'moa/stack-detected',
   PREFERENCES_APPLIED: 'moa/preferences-applied',
+  SECURITY_AUDIT: 'moa/security-audit',
+  COVE_VERIFIED: 'moa/cove-verified',
+  PROFILER_COMPLETE: 'moa/profiler-complete',
+  MUTATION_COMPLETE: 'moa/mutation-complete',
   CRITIQUE_COMPLETE: 'moa/critique-complete',
   JUDGE_VERDICT: 'moa/judge-verdict',
   CONTEXT_PRUNING: 'moa/context-pruning',
@@ -36,4 +40,3 @@ export function emitEvent(ctx, eventName, payload) {
     /* best-effort event dispatch: listener exceptions must never abort pipeline */
   }
 }
-

package/lib/moa-schema.js

@@ -91,6 +91,15 @@ export const PresetSchema = z.object({
   escalation_judge: ModelSlotSchema.default({ provider: '', model: '' }),
   stack_aware_personas_enabled: z.boolean().default(false),
   developer_preferences_enabled: z.boolean().default(false),
+  security_gate_enabled: z.boolean().default(false),
+  security_gate_strict_veto: z.boolean().default(true),
+  cove_verification_enabled: z.boolean().default(false),
+  cove_max_questions: z.number().default(5),
+  profiler_gate_enabled: z.boolean().default(false),
+  profiler_iterations: z.number().default(100),
+  profiler_timeout_ms: z.number().default(2000),
+  mutation_testing_enabled: z.boolean().default(false),
+  min_mutation_score: z.number().default(0.70),
 })
 
 export const Config = z.object({
@@ -128,6 +137,15 @@ export const Config = z.object({
   escalation_judge: ModelSlotSchema.default({ provider: '', model: '' }).volatile(),
   stack_aware_personas_enabled: z.boolean().default(false).volatile(),
   developer_preferences_enabled: z.boolean().default(false).volatile(),
+  security_gate_enabled: z.boolean().default(false).volatile(),
+  security_gate_strict_veto: z.boolean().default(true).volatile(),
+  cove_verification_enabled: z.boolean().default(false).volatile(),
+  cove_max_questions: z.number().default(5).volatile(),
+  profiler_gate_enabled: z.boolean().default(false).volatile(),
+  profiler_iterations: z.number().default(100).volatile(),
+  profiler_timeout_ms: z.number().default(2000).volatile(),
+  mutation_testing_enabled: z.boolean().default(false).volatile(),
+  min_mutation_score: z.number().default(0.70).volatile(),
   smart_routing_model: ModelSlotSchema.default({ provider: '', model: '' }).volatile(),
   prices: z.dict(PriceRow).default({}).volatile(),
   presets: z.array(PresetSchema).default([
@@ -197,4 +215,3 @@ export function plainConfig(value) {
   }
   return value
 }
-

package/lib/pipeline/cove-verifier.js

@@ -0,0 +1,401 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Chain-of-Verification (CoVe) Fact-Checking Gate (#314)
+ *
+ * Pre-Judge verification gate that analyzes candidate proposals, formulates 3-5 factual API & syntax
+ * verification questions, audits them against standard libraries & project context, and flags
+ * hallucinated methods or nonexistent modules before arbitration.
+ */
+
+import { MOA_EVENTS, emitEvent } from '../events.js'
+
+/**
+ * Standard Node.js built-in modules.
+ */
+export const NODE_STDLIB_MODULES = new Set([
+  'assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console',
+  'constants', 'crypto', 'dgram', 'diagnostics_channel', 'dns', 'domain',
+  'events', 'fs', 'fs/promises', 'http', 'http2', 'https', 'inspector',
+  'module', 'net', 'os', 'path', 'path/posix', 'path/win32', 'perf_hooks',
+  'process', 'punycode', 'querystring', 'readline', 'repl', 'stream',
+  'stream/promises', 'stream/web', 'string_decoder', 'test', 'timers',
+  'timers/promises', 'tls', 'trace_events', 'tty', 'url', 'util',
+  'v8', 'vm', 'wasi', 'worker_threads', 'zlib',
+])
+
+/**
+ * Common hallucinated APIs and their real replacements.
+ */
+export const KNOWN_HALLUCINATIONS = [
+  {
+    regex: /fs\.(?:readAllText|readTextFile|readText|readAsString)\s*\(/i,
+    hallucination: 'fs.readAllText / fs.readTextFile',
+    correction: 'fs.readFileSync(path, "utf8") or fs.promises.readFile(path, "utf8")',
+    reason: 'Method does not exist in Node.js fs module (often hallucinated from C# .NET or Deno).',
+  },
+  {
+    regex: /fs\.(?:writeAllText|writeTextFile|writeText|writeAsString)\s*\(/i,
+    hallucination: 'fs.writeAllText / fs.writeTextFile',
+    correction: 'fs.writeFileSync(path, data, "utf8") or fs.promises.writeFile(path, data, "utf8")',
+    reason: 'Method does not exist in Node.js fs module.',
+  },
+  {
+    regex: /fs\.readFileAsync\s*\(/i,
+    hallucination: 'fs.readFileAsync',
+    correction: 'fs.promises.readFile(...) or util.promisify(fs.readFile)',
+    reason: 'Legacy Bluebird promise naming is not a native Node.js fs method.',
+  },
+  {
+    regex: /path\.(?:normalizeUrl|combine|joinPath)\s*\(/i,
+    hallucination: 'path.combine / path.normalizeUrl',
+    correction: 'path.join(...) or new URL(...)',
+    reason: 'Method does not exist in Node.js path module.',
+  },
+  {
+    regex: /crypto\.(?:generateRandomUuidString|randomString|generateUuid)\s*\(/i,
+    hallucination: 'crypto.generateRandomUuidString',
+    correction: 'crypto.randomUUID() or crypto.randomBytes(...)',
+    reason: 'Nonexistent crypto helper hallucinated by language models.',
+  },
+  {
+    regex: /JSON\.(?:toObject|fromObject|encode|decode)\s*\(/i,
+    hallucination: 'JSON.toObject / JSON.fromObject / JSON.encode',
+    correction: 'JSON.parse(...) or JSON.stringify(...)',
+    reason: 'Invalid JSON global methods hallucinated from other ecosystems.',
+  },
+  {
+    regex: /Promise\.(?:wait|sleep|delay)\s*\(/i,
+    hallucination: 'Promise.sleep / Promise.wait / Promise.delay',
+    correction: 'new Promise(resolve => setTimeout(resolve, ms)) or timers/promises setTimeout',
+    reason: 'Native JavaScript Promise does not feature sleep/delay directly on Promise constructor.',
+  },
+]
+
+/**
+ * Extracts candidate imports, requires, and method calls to formulate verification questions.
+ *
+ * @param {string} code
+ * @param {object} [options]
+ * @returns {Array<object>} Up to maxQuestions questions
+ */
+export function generateCoveQuestions(code, options = {}) {
+  const maxQuestions = Math.min(10, Math.max(1, options.maxQuestions || 5))
+  const questions = []
+  if (!code || typeof code !== 'string') return questions
+
+  // 1. Check imports/requires
+  const importRegex = /(?:import\s+(?:\{[^}]+\}|\*\s+as\s+\w+|\w+)\s+from\s+['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\))/g
+  let match
+  const seenModules = new Set()
+  while ((match = importRegex.exec(code)) !== null) {
+    const mod = match[1] || match[2]
+    if (mod && !seenModules.has(mod) && !mod.startsWith('.') && !mod.startsWith('/')) {
+      seenModules.add(mod)
+      const cleanMod = mod.replace(/^node:/, '')
+      questions.push({
+        id: questions.length + 1,
+        type: 'module_resolution',
+        subject: mod,
+        cleanSubject: cleanMod,
+        question: `Is module '${mod}' available in standard library or project dependencies?`,
+      })
+      if (questions.length >= maxQuestions) return questions
+    }
+  }
+
+  // 2. Check for known hallucination method calls
+  for (const h of KNOWN_HALLUCINATIONS) {
+    if (h.regex.test(code)) {
+      questions.push({
+        id: questions.length + 1,
+        type: 'api_existence',
+        subject: h.hallucination,
+        hallucinationDef: h,
+        question: `Does API '${h.hallucination}' exist and is it valid in the target runtime?`,
+      })
+      if (questions.length >= maxQuestions) return questions
+    }
+  }
+
+  // 3. Check general API calls (fs, path, crypto, child_process)
+  const apiCallRegex = /\b(fs|path|crypto|os|child_process|JSON|Promise)\.([a-zA-Z0-9_]+)\s*\(/g
+  const seenApis = new Set()
+  while ((match = apiCallRegex.exec(code)) !== null) {
+    const obj = match[1]
+    const method = match[2]
+    const full = `${obj}.${method}`
+    if (!seenApis.has(full)) {
+      seenApis.add(full)
+      questions.push({
+        id: questions.length + 1,
+        type: 'method_signature',
+        subject: full,
+        object: obj,
+        method,
+        question: `Does method '${method}' natively exist on standard global '${obj}'?`,
+      })
+      if (questions.length >= maxQuestions) return questions
+    }
+  }
+
+  // Fallback question if code has no special calls
+  if (questions.length === 0) {
+    questions.push({
+      id: 1,
+      type: 'syntax_coherence',
+      subject: 'code_structure',
+      question: 'Are all functions and return types syntactically aligned and verifiable?',
+    })
+  }
+
+  return questions.slice(0, maxQuestions)
+}
+
+/**
+ * Verifies a single CoVe factual question against stdlib and project dependencies.
+ *
+ * @param {object} q - Question object from generateCoveQuestions
+ * @param {object} [projectContext]
+ * @returns {object} Verification result
+ */
+export function verifyCoveQuestion(q, projectContext = {}) {
+  const deps = {
+    ...(projectContext.dependencies || {}),
+    ...(projectContext.devDependencies || {}),
+    ...(projectContext.stackInfo?.manifestDependencies || {}),
+  }
+
+  if (q.type === 'module_resolution') {
+    const isNode = NODE_STDLIB_MODULES.has(q.cleanSubject)
+    const isDep = Boolean(deps[q.cleanSubject] || deps[q.subject])
+    if (isNode || isDep) {
+      return {
+        verified: true,
+        confidence: 1.0,
+        rationale: isNode
+          ? `Module '${q.subject}' is a verified Node.js standard library module.`
+          : `Module '${q.subject}' is defined in project manifest dependencies.`,
+        hallucination: null,
+      }
+    }
+    return {
+      verified: false,
+      confidence: 0.85,
+      rationale: `Module '${q.subject}' is not found in Node.js stdlib or declared project dependencies.`,
+      hallucination: {
+        api: q.subject,
+        reason: `Module '${q.subject}' was referenced without declaration in package.json or stdlib.`,
+      },
+    }
+  }
+
+  if (q.type === 'api_existence') {
+    // Matched a known hallucination pattern
+    const h = q.hallucinationDef
+    return {
+      verified: false,
+      confidence: 0.95,
+      rationale: `Invalid API detected: ${h.reason} Suggested fix: ${h.correction}`,
+      hallucination: {
+        api: h.hallucination,
+        reason: h.reason,
+        correction: h.correction,
+      },
+    }
+  }
+
+  if (q.type === 'method_signature') {
+    // Verify common valid methods on known objects
+    const validFs = new Set(['readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'existsSync', 'statSync', 'stat', 'mkdirSync', 'mkdir', 'unlinkSync', 'unlink', 'readdirSync', 'readdir', 'createReadStream', 'createWriteStream', 'promises'])
+    const validPath = new Set(['join', 'resolve', 'basename', 'dirname', 'extname', 'relative', 'normalize', 'isAbsolute', 'parse', 'format', 'sep', 'posix', 'win32'])
+    const validCrypto = new Set(['randomUUID', 'randomBytes', 'createHash', 'createHmac', 'createCipheriv', 'createDecipheriv', 'timingSafeEqual', 'scryptSync', 'pbkdf2Sync'])
+    const validJson = new Set(['parse', 'stringify'])
+    const validPromise = new Set(['all', 'allSettled', 'race', 'any', 'resolve', 'reject'])
+
+    let isValid = true
+    if (q.object === 'fs') isValid = validFs.has(q.method)
+    else if (q.object === 'path') isValid = validPath.has(q.method)
+    else if (q.object === 'crypto') isValid = validCrypto.has(q.method)
+    else if (q.object === 'JSON') isValid = validJson.has(q.method)
+    else if (q.object === 'Promise') isValid = validPromise.has(q.method)
+
+    if (isValid) {
+      return {
+        verified: true,
+        confidence: 0.95,
+        rationale: `'${q.subject}' is a verified standard method.`,
+        hallucination: null,
+      }
+    }
+    return {
+      verified: false,
+      confidence: 0.9,
+      rationale: `'${q.method}' does not exist on global '${q.object}'.`,
+      hallucination: {
+        api: q.subject,
+        reason: `Method '${q.method}' does not exist on '${q.object}'.`,
+      },
+    }
+  }
+
+  return {
+    verified: true,
+    confidence: 0.9,
+    rationale: 'Verified general syntax structure.',
+    hallucination: null,
+  }
+}
+
+/**
+ * Audits a single candidate solution using Chain-of-Verification (CoVe).
+ *
+ * @param {string} code
+ * @param {object} [projectContext]
+ * @param {object} [options]
+ * @returns {object}
+ */
+export function auditCandidateCove(code, projectContext = {}, options = {}) {
+  const questions = generateCoveQuestions(code, options)
+  const verifications = []
+  const hallucinations = []
+
+  for (const q of questions) {
+    const v = verifyCoveQuestion(q, projectContext)
+    verifications.push({
+      ...q,
+      verified: v.verified,
+      confidence: v.confidence,
+      rationale: v.rationale,
+    })
+    if (!v.verified && v.hallucination) {
+      hallucinations.push(v.hallucination)
+    }
+  }
+
+  const penalty = hallucinations.length * 35
+  const coveScore = Math.max(0, 100 - penalty)
+  const passed = hallucinations.length === 0
+
+  let summary = ''
+  if (passed) {
+    summary = `🔍 CoVe Fact-Checking: PASSED (Score 100/100). Verified ${questions.length} factual API/module question(s).`
+  } else {
+    summary = `⚠️ CoVe Hallucination Detected (Score ${coveScore}/100): ${hallucinations.length} non-existent or unverified API(s) found.`
+  }
+
+  return {
+    passed,
+    coveScore,
+    questions: verifications,
+    hallucinations,
+    summary,
+  }
+}
+
+/**
+ * Runs the Chain-of-Verification Gate across all candidates.
+ *
+ * @param {Array<object>} candidates
+ * @param {object} [projectContext]
+ * @param {object} [options]
+ * @returns {object}
+ */
+export function runCoveVerificationGate(candidates, projectContext = {}, options = {}) {
+  const { ctx, runId, onProgress } = options
+  const results = []
+  let totalHallucinations = 0
+
+  if (!Array.isArray(candidates) || candidates.length === 0) {
+    return {
+      results: [],
+      passedCount: 0,
+      hallucinationCount: 0,
+      coveDirective: null,
+    }
+  }
+
+  for (let i = 0; i < candidates.length; i++) {
+    const cand = candidates[i]
+    const text = typeof cand === 'string' ? cand : cand.output || cand.text || cand.code || ''
+    const report = auditCandidateCove(text, projectContext, options)
+
+    if (typeof cand === 'object' && cand !== null) {
+      cand.coveReport = report
+      cand.coveScore = report.coveScore
+      cand.coveHallucinations = report.hallucinations
+    }
+
+    totalHallucinations += report.hallucinations.length
+    results.push({
+      candidateIndex: i,
+      model: cand?.model || `Candidate ${i + 1}`,
+      report,
+    })
+
+    if (ctx) {
+      emitEvent(ctx, MOA_EVENTS.COVE_VERIFIED, {
+        runId,
+        candidateIndex: i,
+        coveScore: report.coveScore,
+        passed: report.passed,
+        questionsCount: report.questions.length,
+        hallucinationsCount: report.hallucinations.length,
+      })
+    }
+  }
+
+  const passedCount = results.filter((r) => r.report.passed).length
+
+  if (typeof onProgress === 'function') {
+    if (totalHallucinations === 0) {
+      onProgress(`🔍 *CoVe Fact-Check Passed*: All APIs and modules verified against project context.\n`)
+    } else {
+      onProgress(`⚠️ *CoVe Fact-Check Alert*: Found ${totalHallucinations} unverified or hallucinated API(s) across candidate solutions.\n`)
+    }
+  }
+
+  const coveDirective = formatCoveDirective(results)
+
+  return {
+    results,
+    passedCount,
+    hallucinationCount: totalHallucinations,
+    coveDirective,
+  }
+}
+
+/**
+ * Formats CoVe fact-checking verification findings into a prompt directive for Judge/Synthesis.
+ *
+ * @param {Array<object>} results
+ * @returns {string|null}
+ */
+export function formatCoveDirective(results) {
+  if (!Array.isArray(results) || results.length === 0) return null
+
+  const hasAnyHallucinations = results.some((r) => r.report && r.report.hallucinations.length > 0)
+  if (!hasAnyHallucinations) {
+    return '### 🔍 CHAIN-OF-VERIFICATION (CoVe): ALL CANDIDATE APIS VERIFIED FACTUAL\nNo hallucinated APIs, phantom modules, or broken native signatures detected.'
+  }
+
+  const lines = [
+    '### 🔍 CHAIN-OF-VERIFICATION (CoVe) FACT-CHECK DIRECTIVE',
+    'Independent factual audit of API calls and module imports has been completed:',
+  ]
+
+  for (const r of results) {
+    const label = `Candidate ${r.candidateIndex + 1}`
+    const rep = r.report || {}
+    if (!rep.passed && rep.hallucinations.length > 0) {
+      lines.push(`- **${label}**: ❌ **FACT-CHECK FAILURE** (Score ${rep.coveScore}/100) — Hallucinated APIs detected:`)
+      for (const h of rep.hallucinations) {
+        lines.push(`  * \`${h.api}\`: ${h.reason}${h.correction ? ` (Correction: ${h.correction})` : ''}`)
+      }
+    } else {
+      lines.push(`- **${label}**: ✅ VERIFIED (Score 100/100) — All ${rep.questions?.length || 0} API checks confirmed valid.`)
+    }
+  }
+
+  lines.push('\n**Judge Fact-Checking Rule**: Do not award winning status to solutions that rely on hallucinated methods or nonexistent packages. Prefer solutions with 100/100 verified API accuracy.')
+
+  return lines.join('\n')
+}