@goodandready/dsh-moa 0.2.76 → 0.2.77

package/README.md

@@ -54,6 +54,8 @@ Single-model AI generation often suffers from blind spots, single-perspective bi
 11. **Interactive Workbench (File Scoring 1–10, User Pick & Mix, Top-Model Glue & Judge Re-Check)**: Judge scores each candidate file (1–10) with pros and cons. Users can mix and match files across proposals in the WebUI. The turn's top-performing reference model harmonizes cross-file imports and contracts, followed by a final judge re-audit before promotion. Companion integration with [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) for safe pre-promotion rollback checkpoints.
 12. **Adversarial White-Hat Security Fuzzing Gate (#302)**: Red Team security audit scanning candidate code for SQLi, XSS, Command Injection, Path Traversal, ReDoS, and Prototype Pollution with blocking `SECURITY_VETO`.
 13. **Chain-of-Verification (CoVe) Fact-Checking Gate for Code (#314)**: Independent pre-judge verification formulating factual API questions, validating modules and functions against standard library and project manifests to eliminate hallucinated methods.
+14. **Runtime CPU & Memory Profiler Gate (#315)**: Sandboxed micro-benchmarking of candidate execution duration, ops/sec throughput, and heap usage with hard timeout protection to select algorithmically optimal code.
+15. **Mutation Testing Gate for Candidate Tests (#316)**: Injects AST-level fault mutations to compute Mutation Score (killed vs survived mutants), weeding out tautological assertions and fake test suites.
 
 ---
 

package/README.ru.md

@@ -54,6 +54,8 @@
 11. **Интерактивный воркбенч (Оценка файлов 1–10, выбор в UI, склейка лучшей моделью и повторный аудит)**: Судья оценивает каждый сгенерированный файл каждого кандидата (1–10) с указанием ключевых плюсов и минусов. Пользователь комбинирует желаемый набор файлов в WebUI; лучшая модель раунда вызывается для гармонизации импортов и контрактов, после чего судья выполняет финальную валидацию перед промоушеном. Совместимо с [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) для безопасных теневых снимков Git.
 12. **Состязательный White-Hat фильтр безопасности (#302)**: Red Team аудит безопасности перед арбитражем судьи, выявляющий SQLi, XSS, инъекции команд, Path Traversal, ReDoS и Prototype Pollution с блокирующим вердиктом `SECURITY_VETO`.
 13. **Фильтр верификации фактов и API (CoVe) (#314)**: Автономная цепочка верификации (Chain-of-Verification), формулирующая проверочные вопросы по вызовам методов и пакетам, исключающая галлюцинированные и несуществующие API библиотек.
+14. **Профайлер производительности CPU и памяти (#315)**: Изолированный бенчмаркинг времени выполнения кандидатов, пропускной способности (ops/sec) и потребления heap-памяти с защитой от зависаний для выбора алгоритмически оптимального кода.
+15. **Мутационное тестирование тестов кандидатов (#316)**: Внедрение AST-мутаций кода для расчёта Mutation Score (убитые vs выжившие мутанты), устраняющее ложноположительные и тавтологические тесты.
 
 ---
 

package/README.zh.md

@@ -54,6 +54,8 @@
 11. **交互式工作台 (1-10分文件打分、自由混搭、最优模型粘合与裁判复审)**：裁判对每个候选模型生成的每个文件进行 1–10 分打分并列出优缺点。用户可在 WebUI 中自由勾选组合所需文件；当轮最高分模型被调用以粘合协同跨文件导入与类型接口，随后由裁判进行最终复审。支持配套插件 [`dsh-time-machine`](https://github.com/goodandready/dsh-time-machine) 在文件提升前创建影子 Git 回滚快照。
 12. **对抗性白帽安全模糊测试关卡 (#302)**：红队安全审计器在裁判前检查 SQLi、XSS、命令注入、路径穿越、ReDoS 和原型污染漏洞，发现严重漏洞时触发 `SECURITY_VETO` 否决。
 13. **代码事实与 API 验证链关卡 (CoVe) (#314)**：独立的裁判前事实核验，生成针对性 API 问题并对照标准库及项目配置清单，杜绝调用虚构不存在的幻觉方法。
+14. **运行期 CPU 与内存性能分析关卡 (#315)**：在隔离沙箱中微基准测试候选方案执行延迟、吞吐量（ops/sec）与堆内存占用，带有硬超时保护，指引裁判挑选算法最优代码。
+15. **候选测试套件变异测试关卡 (#316)**：注入 AST 级别故障变异以计算变异得分（消灭 vs 存活变异体），剔除恒真废测试与虚假测试套件。
 
 ---
 

package/lib/client.js

@@ -232,7 +232,11 @@ window.__ModuleLoader__.load({
       "aggregator.security_gate_title": "\u{1F6E1}\uFE0F Adversarial White-Hat Security Fuzzing Gate",
       "aggregator.security_gate_desc": "Red-team security auditor checks candidate proposals for SQLi, XSS, ReDoS, Command Injection and Path Traversal with blocking SECURITY_VETO.",
       "aggregator.cove_gate_title": "\u{1F50D} Chain-of-Verification (CoVe) Fact-Checking Gate",
-      "aggregator.cove_gate_desc": "Formulates API existence & method signature verification questions, disqualifying candidates that use hallucinated methods."
+      "aggregator.cove_gate_desc": "Formulates API existence & method signature verification questions, disqualifying candidates that use hallucinated methods.",
+      "aggregator.profiler_gate_title": "\u26A1 Automated Runtime Memory & CPU Profiler Gate",
+      "aggregator.profiler_gate_desc": "Runs isolated micro-benchmarks measuring execution latency, throughput (ops/sec), and heap memory usage.",
+      "aggregator.mutation_gate_title": "\u{1F9EC} Runtime Mutation Testing Gate for Candidate Tests",
+      "aggregator.mutation_gate_desc": "Injects synthetic faults into candidate code to test test-suite robustness, eliminating tautological and weak tests."
     };
     const zh = {
       title: "\u667A\u80FD\u4F53\u6DF7\u5408 (MoA)",
@@ -455,7 +459,11 @@ window.__ModuleLoader__.load({
       "aggregator.security_gate_title": "\u{1F6E1}\uFE0F \u5BF9\u6297\u6027\u767D\u5E3D\u5B89\u5168\u6A21\u7CCA\u6D4B\u8BD5\u5173\u5361",
       "aggregator.security_gate_desc": "\u7EA2\u961F\u5B89\u5168\u5BA1\u8BA1\u5668\u68C0\u67E5\u5019\u9009\u65B9\u6848\u4E2D\u7684 SQLi\u3001XSS\u3001ReDoS\u3001\u547D\u4EE4\u6CE8\u5165\u548C\u8DEF\u5F84\u7A7F\u8D8A\u6F0F\u6D1E\uFF0C\u5E76\u5728\u53D1\u73B0\u4E25\u91CD\u6F0F\u6D1E\u65F6\u89E6\u53D1 SECURITY_VETO \u5426\u51B3\u3002",
       "aggregator.cove_gate_title": "\u{1F50D} \u9A8C\u8BC1\u94FE (CoVe) \u4EE3\u7801\u4E8B\u5B9E\u4E0E API \u6838\u67E5\u5173\u5361",
-      "aggregator.cove_gate_desc": "\u751F\u6210 API \u5B58\u5728\u6027\u4E0E\u65B9\u6CD5\u7B7E\u540D\u6838\u9A8C\u95EE\u9898\uFF0C\u81EA\u52A8\u60E9\u7F5A\u6216\u53D6\u6D88\u4F7F\u7528\u865A\u6784\u5E7B\u89C9\u65B9\u6CD5\u7684\u5019\u9009\u65B9\u6848\u3002"
+      "aggregator.cove_gate_desc": "\u751F\u6210 API \u5B58\u5728\u6027\u4E0E\u65B9\u6CD5\u7B7E\u540D\u6838\u9A8C\u95EE\u9898\uFF0C\u81EA\u52A8\u60E9\u7F5A\u6216\u53D6\u6D88\u4F7F\u7528\u865A\u6784\u5E7B\u89C9\u65B9\u6CD5\u7684\u5019\u9009\u65B9\u6848\u3002",
+      "aggregator.profiler_gate_title": "\u26A1 \u81EA\u52A8\u8FD0\u884C\u65F6 CPU \u4E0E\u5185\u5B58\u6027\u80FD\u5206\u6790\u5173\u5361",
+      "aggregator.profiler_gate_desc": "\u5728\u9694\u79BB\u6C99\u7BB1\u4E2D\u8FD0\u884C\u5FAE\u57FA\u51C6\u6D4B\u8BD5\uFF0C\u7CBE\u786E\u5EA6\u91CF\u6267\u884C\u5EF6\u8FDF\u3001\u541E\u5410\u91CF (ops/sec) \u548C\u5806\u5185\u5B58\u5206\u914D\u3002",
+      "aggregator.mutation_gate_title": "\u{1F9EC} \u5019\u9009\u6D4B\u8BD5\u5957\u4EF6\u8FD0\u884C\u65F6\u53D8\u5F02\u6D4B\u8BD5\u5173\u5361",
+      "aggregator.mutation_gate_desc": "\u5411\u4EE3\u7801\u6CE8\u5165\u5408\u6210\u6545\u969C\u5E76\u9A8C\u8BC1\u6D4B\u8BD5\u7684\u6355\u83B7\u80FD\u529B\uFF0C\u5254\u9664\u540C\u4E49\u53CD\u590D\u4E0E\u65E0\u6548\u7684\u865A\u5047\u6D4B\u8BD5\u3002"
     };
     function makeT(dict, fallback) {
       return function t(key, vars) {
@@ -2660,6 +2668,48 @@ window.__ModuleLoader__.load({
                   t("aggregator.cove_gate_desc") || "Formulates API existence & method signature verification questions, disqualifying candidates that use hallucinated methods."
                 )
               ),
+              /* Automated Runtime Memory & CPU Profiler Gate (#315) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.profiler_gate_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, profiler_gate_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.profiler_gate_title") || "\u26A1 Automated Runtime Memory & CPU Profiler Gate"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.profiler_gate_desc") || "Runs isolated micro-benchmarks measuring execution latency, throughput (ops/sec), and heap memory usage."
+                )
+              ),
+              /* Runtime Mutation Testing Gate (#316) */
+              React.createElement(
+                "div",
+                { style: { display: "flex", flexDirection: "column", gap: 6, padding: "8px 12px", background: "var(--dsw-alias-bg-layer-2)", borderRadius: 8, border: "1px solid var(--dsw-alias-border-l2)", marginTop: 8 } },
+                React.createElement(
+                  "label",
+                  { style: { display: "flex", alignItems: "center", gap: 8, cursor: "pointer", fontSize: 13, fontWeight: 500 } },
+                  React.createElement("input", {
+                    type: "checkbox",
+                    checked: Boolean(currentPreset.mutation_testing_enabled),
+                    onChange: (e) => updateCurrentPreset((p) => ({ ...p, mutation_testing_enabled: e.target.checked })),
+                    style: { accentColor: "var(--dsw-alias-state-brand-primary, var(--dsw-alias-label-primary))", cursor: "pointer" }
+                  }),
+                  t("aggregator.mutation_gate_title") || "\u{1F9EC} Runtime Mutation Testing Gate for Candidate Tests"
+                ),
+                React.createElement(
+                  "div",
+                  { style: { fontSize: 12, color: "var(--dsw-alias-label-secondary)", marginLeft: 22 } },
+                  t("aggregator.mutation_gate_desc") || "Injects synthetic faults into candidate code to test test-suite robustness, eliminating tautological and weak tests."
+                )
+              ),
               /* Fallback Judges Chain */
               React.createElement(
                 "div",

package/lib/events.js

@@ -13,6 +13,8 @@ export const MOA_EVENTS = {
   PREFERENCES_APPLIED: 'moa/preferences-applied',
   SECURITY_AUDIT: 'moa/security-audit',
   COVE_VERIFIED: 'moa/cove-verified',
+  PROFILER_COMPLETE: 'moa/profiler-complete',
+  MUTATION_COMPLETE: 'moa/mutation-complete',
   CRITIQUE_COMPLETE: 'moa/critique-complete',
   JUDGE_VERDICT: 'moa/judge-verdict',
   CONTEXT_PRUNING: 'moa/context-pruning',

package/lib/moa-schema.js

@@ -95,6 +95,11 @@ export const PresetSchema = z.object({
   security_gate_strict_veto: z.boolean().default(true),
   cove_verification_enabled: z.boolean().default(false),
   cove_max_questions: z.number().default(5),
+  profiler_gate_enabled: z.boolean().default(false),
+  profiler_iterations: z.number().default(100),
+  profiler_timeout_ms: z.number().default(2000),
+  mutation_testing_enabled: z.boolean().default(false),
+  min_mutation_score: z.number().default(0.70),
 })
 
 export const Config = z.object({
@@ -136,6 +141,11 @@ export const Config = z.object({
   security_gate_strict_veto: z.boolean().default(true).volatile(),
   cove_verification_enabled: z.boolean().default(false).volatile(),
   cove_max_questions: z.number().default(5).volatile(),
+  profiler_gate_enabled: z.boolean().default(false).volatile(),
+  profiler_iterations: z.number().default(100).volatile(),
+  profiler_timeout_ms: z.number().default(2000).volatile(),
+  mutation_testing_enabled: z.boolean().default(false).volatile(),
+  min_mutation_score: z.number().default(0.70).volatile(),
   smart_routing_model: ModelSlotSchema.default({ provider: '', model: '' }).volatile(),
   prices: z.dict(PriceRow).default({}).volatile(),
   presets: z.array(PresetSchema).default([

package/lib/pipeline/mutation-tester.js

@@ -0,0 +1,323 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Mutation Testing Gate for Candidate Tests (#316)
+ *
+ * Injects deterministic AST-level fault mutations into candidate implementations and evaluates
+ * candidate test suites against mutants to calculate Mutation Score (killed vs survived mutants),
+ * eliminating false-positive and tautological tests before Judge arbitration.
+ */
+
+import vm from 'node:vm'
+import { MOA_EVENTS, emitEvent } from '../events.js'
+import { extractExecutableCode } from './runtime-profiler.js'
+
+/**
+ * Mutation operator patterns.
+ */
+export const MUTATION_OPERATORS = [
+  {
+    name: 'invert_strict_equality',
+    regex: /===/g,
+    replacement: '!==',
+    description: 'Replaced strict equality (===) with inequality (!==)',
+  },
+  {
+    name: 'invert_relational_lt',
+    regex: /<(?!=)/g,
+    replacement: '>=',
+    description: 'Replaced less-than (<) with greater-or-equal (>=)',
+  },
+  {
+    name: 'invert_relational_gt',
+    regex: />(?!=)/g,
+    replacement: '<=',
+    description: 'Replaced greater-than (>) with less-or-equal (<=)',
+  },
+  {
+    name: 'invert_logical_and',
+    regex: /&&/g,
+    replacement: '||',
+    description: 'Replaced logical AND (&&) with logical OR (||)',
+  },
+  {
+    name: 'invert_arithmetic_plus',
+    regex: /(?<=\w\s*)\+(?=\s*\w)/g,
+    replacement: '-',
+    description: 'Replaced addition (+) with subtraction (-)',
+  },
+  {
+    name: 'invert_boolean_true',
+    regex: /\btrue\b/g,
+    replacement: 'false',
+    description: 'Replaced literal true with false',
+  },
+  {
+    name: 'mutate_return_zero',
+    regex: /return\s+0;/g,
+    replacement: 'return 1;',
+    description: 'Mutated return 0 to return 1',
+  },
+]
+
+/**
+ * Generates an array of mutant variations from a single source code string.
+ *
+ * @param {string} sourceCode
+ * @param {object} [options]
+ * @returns {Array<object>} Up to maxMutants mutant objects
+ */
+export function generateMutants(sourceCode, options = {}) {
+  const maxMutants = Math.min(10, Math.max(1, options.maxMutants || 5))
+  const mutants = []
+  if (!sourceCode || typeof sourceCode !== 'string') return mutants
+
+  for (const op of MUTATION_OPERATORS) {
+    let match
+    const re = new RegExp(op.regex.source, op.regex.flags)
+    while ((match = re.exec(sourceCode)) !== null) {
+      const idx = match.index
+      const len = match[0].length
+      const mutantCode = sourceCode.slice(0, idx) + op.replacement + sourceCode.slice(idx + len)
+
+      mutants.push({
+        id: mutants.length + 1,
+        operator: op.name,
+        description: op.description,
+        originalSnippet: match[0],
+        replacementSnippet: op.replacement,
+        mutantCode,
+      })
+
+      if (mutants.length >= maxMutants) return mutants
+    }
+  }
+
+  return mutants
+}
+
+/**
+ * Runs a test script against an implementation in an isolated VM context.
+ *
+ * @param {string} codeToExecute
+ * @param {number} [timeoutMs=1000]
+ * @returns {{ ok: boolean, error: string | null }}
+ */
+function executeScript(codeToExecute, timeoutMs = 1000) {
+  const sandbox = {
+    console: { log: () => {}, warn: () => {}, error: () => {} },
+    assert: (cond, msg) => { if (!cond) throw new Error(msg || 'Assertion failed'); },
+    Math, Date, Array, Object, String, Number, Boolean, Set, Map, JSON,
+  }
+  sandbox.assert.equal = (a, b) => { if (a !== b) throw new Error(`Assertion failed: ${a} !== ${b}`); }
+  sandbox.assert.strictEqual = (a, b) => { if (a !== b) throw new Error(`Assertion failed: ${a} !== ${b}`); }
+  sandbox.assert.ok = (v) => { if (!v) throw new Error('Assertion failed: falsy value'); }
+
+  try {
+    const context = vm.createContext(sandbox)
+    const script = new vm.Script(codeToExecute)
+    script.runInContext(context, { timeout: timeoutMs })
+    return { ok: true, error: null }
+  } catch (err) {
+    return { ok: false, error: err.message }
+  }
+}
+
+/**
+ * Evaluates a candidate's implementation against generated mutants.
+ *
+ * @param {string} rawText - Candidate text containing code or tests
+ * @param {object} [options]
+ * @returns {object} Mutation testing report
+ */
+export function auditCandidateMutations(rawText, options = {}) {
+  const { minMutationScore = 0.7, maxMutants = 5, timeoutMs = 1000 } = options
+  const code = extractExecutableCode(rawText)
+
+  if (!code || !code.trim()) {
+    return {
+      passed: true,
+      mutationScore: 100,
+      totalMutants: 0,
+      killedCount: 0,
+      survivedCount: 0,
+      mutants: [],
+      summary: 'Mutation Testing: No code to mutate.',
+    }
+  }
+
+  // 1. Verify baseline executes cleanly
+  const baseline = executeScript(code, timeoutMs)
+  if (!baseline.ok) {
+    return {
+      passed: false,
+      mutationScore: 0,
+      totalMutants: 0,
+      killedCount: 0,
+      survivedCount: 0,
+      mutants: [],
+      error: `Baseline test execution failed: ${baseline.error}`,
+      summary: `Baseline execution failed (${baseline.error}).`,
+    }
+  }
+
+  // 2. Generate mutations on the code
+  const mutants = generateMutants(code, { maxMutants })
+  if (mutants.length === 0) {
+    return {
+      passed: true,
+      mutationScore: 100,
+      totalMutants: 0,
+      killedCount: 0,
+      survivedCount: 0,
+      mutants: [],
+      summary: 'Mutation Testing: Code contains no mutable operators.',
+    }
+  }
+
+  // 3. Test each mutant
+  let killedCount = 0
+  let survivedCount = 0
+  const evaluatedMutants = []
+
+  for (const m of mutants) {
+    const res = executeScript(m.mutantCode, timeoutMs)
+    if (!res.ok) {
+      // Mutant was killed (good! The test broke as expected)
+      killedCount++
+      evaluatedMutants.push({
+        ...m,
+        status: 'KILLED',
+        reason: res.error,
+      })
+    } else {
+      // Mutant survived (bad! Code was broken but test passed anyway)
+      survivedCount++
+      evaluatedMutants.push({
+        ...m,
+        status: 'SURVIVED',
+        reason: 'Test suite passed despite injected fault.',
+      })
+    }
+  }
+
+  const mutationRatio = Number((killedCount / mutants.length).toFixed(2))
+  const mutationScore = Math.round(mutationRatio * 100)
+  const passed = mutationRatio >= minMutationScore
+
+  const summary = passed
+    ? `🧬 Mutation Testing: PASSED (Score ${mutationScore}%). Killed ${killedCount}/${mutants.length} mutant(s).`
+    : `⚠️ Mutation Testing: WEAK TESTS (Score ${mutationScore}% < ${Math.round(minMutationScore * 100)}%). ${survivedCount} mutant(s) survived undetected.`
+
+  return {
+    passed,
+    mutationScore,
+    mutationRatio,
+    totalMutants: mutants.length,
+    killedCount,
+    survivedCount,
+    mutants: evaluatedMutants,
+    summary,
+  }
+}
+
+/**
+ * Runs the Mutation Testing Gate across all candidate solutions.
+ *
+ * @param {Array<object>} candidates
+ * @param {object} [options]
+ * @returns {object} Mutation gate report
+ */
+export function runMutationGate(candidates, options = {}) {
+  const { ctx, runId, onProgress, minMutationScore = 0.70 } = options
+  const results = []
+
+  if (!Array.isArray(candidates) || candidates.length === 0) {
+    return {
+      results: [],
+      passedCount: 0,
+      mutationDirective: null,
+    }
+  }
+
+  for (let i = 0; i < candidates.length; i++) {
+    const cand = candidates[i]
+    const text = typeof cand === 'string' ? cand : cand.output || cand.text || cand.code || ''
+    const report = auditCandidateMutations(text, { minMutationScore, ...options })
+
+    if (typeof cand === 'object' && cand !== null) {
+      cand.mutationReport = report
+      cand.mutationScore = report.mutationScore
+    }
+
+    results.push({
+      candidateIndex: i,
+      model: cand?.model || `Candidate ${i + 1}`,
+      report,
+    })
+
+    if (ctx) {
+      emitEvent(ctx, MOA_EVENTS.MUTATION_COMPLETE, {
+        runId,
+        candidateIndex: i,
+        mutationScore: report.mutationScore,
+        killedCount: report.killedCount,
+        totalMutants: report.totalMutants,
+        passed: report.passed,
+      })
+    }
+  }
+
+  const passedCount = results.filter((r) => r.report.passed).length
+
+  if (typeof onProgress === 'function' && results.length > 0) {
+    const summaryList = results.map((r) => `Ref ${r.candidateIndex + 1}: ${r.report.mutationScore}%`).join(', ')
+    onProgress(`🧬 *Mutation Testing Gate*: ${summaryList}\n`)
+  }
+
+  const mutationDirective = formatMutationDirective(results)
+
+  return {
+    results,
+    passedCount,
+    mutationDirective,
+  }
+}
+
+/**
+ * Formats mutation testing results into a prompt directive for the Judge.
+ *
+ * @param {Array<object>} results
+ * @returns {string|null}
+ */
+export function formatMutationDirective(results) {
+  if (!Array.isArray(results) || results.length === 0) return null
+
+  const lines = [
+    '### 🧬 RUNTIME MUTATION TESTING & FAULT INJECTION REPORT',
+    'Evaluation of test robustness against synthetic fault injection (killing code mutants):',
+  ]
+
+  for (const r of results) {
+    const label = `Candidate ${r.candidateIndex + 1}`
+    const rep = r.report
+    if (rep.totalMutants === 0) {
+      lines.push(`- **${label}**: ℹ️ No mutable operators found in test suite.`)
+    } else if (rep.passed) {
+      lines.push(
+        `- **${label}**: ✅ **RESILIENT TESTS** (Score ${rep.mutationScore}%) — Killed ${rep.killedCount}/${rep.totalMutants} fault mutants.`
+      )
+    } else {
+      lines.push(
+        `- **${label}**: ⚠️ **WEAK/TAUTOLOGICAL TESTS** (Score ${rep.mutationScore}%) — ${rep.survivedCount}/${rep.totalMutants} mutant(s) survived! The tests pass even when logic is inverted.`
+      )
+      for (const m of (rep.mutants || []).filter((m) => m.status === 'SURVIVED')) {
+        lines.push(`  * ${m.description} [Survived]`)
+      }
+    }
+  }
+
+  lines.push(
+    '\n**Judge Quality Mandate**: Prefer solutions whose test suites have a high Mutation Score. Solutions with surviving mutants have weak or tautological tests that do not genuinely verify behavior.'
+  )
+
+  return lines.join('\n')
+}

package/lib/pipeline/runner.js

@@ -20,6 +20,8 @@ import { applySyntaxFilter, formatSyntaxDirective } from './syntax-filter.js'
 import { stageEarlyConsensus } from './early-consensus.js'
 import { runSecurityAuditGate } from './security-fuzzer.js'
 import { runCoveVerificationGate } from './cove-verifier.js'
+import { runProfilerGate } from './runtime-profiler.js'
+import { runMutationGate } from './mutation-tester.js'
 import { emitEvent, MOA_EVENTS } from '../events.js'
 
 export async function runMoAPipeline({
@@ -234,6 +236,39 @@ export async function runMoAPipeline({
     securityDirective = securityGateResult.securityDirective
   }
 
+  // Pre-Stage 5.10: Runtime CPU & Memory Profiler Gate (#315)
+  let profilerDirective = null
+  let profilerGateResult = null
+  if (preset?.profiler_gate_enabled) {
+    profilerGateResult = runProfilerGate(
+      syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs,
+      {
+        ctx,
+        runId,
+        onProgress,
+        iterations: preset.profiler_iterations || 100,
+        timeoutMs: preset.profiler_timeout_ms || 2000,
+      }
+    )
+    profilerDirective = profilerGateResult.profilerDirective
+  }
+
+  // Pre-Stage 5.11: Mutation Testing & Fault Injection Gate (#316)
+  let mutationDirective = null
+  let mutationGateResult = null
+  if (preset?.mutation_testing_enabled) {
+    mutationGateResult = runMutationGate(
+      syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs,
+      {
+        ctx,
+        runId,
+        onProgress,
+        minMutationScore: preset.min_mutation_score ?? 0.70,
+      }
+    )
+    mutationDirective = mutationGateResult.mutationDirective
+  }
+
   // Pre-Stage 6: Dynamic Consensus Threshold & Multi-Judge Escalation (#300)
   const escalationResult = evaluateJudgeEscalation({
     candidateOutputs: syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs,
@@ -284,7 +319,7 @@ export async function runMoAPipeline({
     preset: effectivePreset,
     successfulRefs: syntaxResult.validCandidates.length > 0 ? syntaxResult.validCandidates : successfulRefs,
     referenceOutputs, primaryJudge: effectivePrimaryJudge,
-    userPrompt, judgeCriteria: [ctxStage.judgeCriteria, coveDirective, securityDirective].filter(Boolean).join('\n\n'), prices, maxTokens: ctxStage.maxTokens,
+    userPrompt, judgeCriteria: [ctxStage.judgeCriteria, coveDirective, securityDirective, profilerDirective, mutationDirective].filter(Boolean).join('\n\n'), prices, maxTokens: ctxStage.maxTokens,
     callLlm, signal, onProgress, cwd, runId, isRefinement: ctxStage.isRefinement,
     isFastMode: ctxStage.isFastMode, collectedCtx: ctxStage.collectedCtx, startTime,
   })
@@ -342,7 +377,7 @@ export async function runMoAPipeline({
     }
   }
 
-  const fileScoringDirective = [rawFileDirective, visualResult?.directive, adversarialTddResult?.directive, syntaxDirective, coveDirective, securityDirective, pruningDirective, ctxStage.stackAwareDirective, ctxStage.developerPreferencesDirective].filter(Boolean).join("\n\n") || null
+  const fileScoringDirective = [rawFileDirective, visualResult?.directive, adversarialTddResult?.directive, syntaxDirective, coveDirective, securityDirective, profilerDirective, mutationDirective, pruningDirective, ctxStage.stackAwareDirective, ctxStage.developerPreferencesDirective].filter(Boolean).join("\n\n") || null
 
   // Stage 7: Synthesis Phase
   const synthRes = await stageSynthesis({

package/lib/pipeline/runtime-profiler.js

@@ -0,0 +1,270 @@
+/**
+ * DeepSeek Harness Mixture of Agents (MoA) — Runtime CPU & Memory Profiler Gate (#315)
+ *
+ * Micro-benchmarks candidate code execution duration, ops/sec throughput, and heap memory usage
+ * in an isolated sandbox with hard timeout protection to guide Judge selection towards
+ * algorithmically optimal solutions.
+ */
+
+import vm from 'node:vm'
+import { MOA_EVENTS, emitEvent } from '../events.js'
+
+/**
+ * Extracts executable JavaScript code from markdown fences or raw code.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+export function extractExecutableCode(text) {
+  if (!text || typeof text !== 'string') return ''
+  const jsFenceMatch = text.match(/```(?:javascript|js|node)\s*\n([\s\S]*?)\n```/i)
+  if (jsFenceMatch && jsFenceMatch[1]) {
+    return jsFenceMatch[1]
+  }
+  const anyFenceMatch = text.match(/```\w*\s*\n([\s\S]*?)\n```/)
+  if (anyFenceMatch && anyFenceMatch[1]) {
+    return anyFenceMatch[1]
+  }
+  return text
+}
+
+/**
+ * Profiles code execution in an isolated VM sandbox.
+ *
+ * @param {string} rawCode - Candidate source code or markdown
+ * @param {object} [options]
+ * @returns {object} Profiler report
+ */
+export function profileCodeExecution(rawCode, options = {}) {
+  const {
+    iterations = 100,
+    timeoutMs = 2000,
+  } = options
+
+  const code = extractExecutableCode(rawCode)
+  if (!code || !code.trim()) {
+    return {
+      passed: false,
+      durationMs: 0,
+      heapBytesUsed: 0,
+      opsPerSec: 0,
+      iterations: 0,
+      error: 'Empty or unexecutable code provided for profiling.',
+      summary: 'Profiler skipped: no executable code.',
+    }
+  }
+
+  // Initial sandbox built-ins to ignore when scanning for user functions
+  const initialKeys = new Set([
+    'console', 'Math', 'Date', 'Array', 'Object', 'String', 'Number',
+    'Boolean', 'Set', 'Map', 'JSON', 'parseInt', 'parseFloat',
+    'globalThis', 'global', '__mainFn', '__benchFn', '__benchArg'
+  ])
+
+  const sandbox = {
+    console: { log: () => {}, warn: () => {}, error: () => {} },
+    Math,
+    Date,
+    Array,
+    Object,
+    String,
+    Number,
+    Boolean,
+    Set,
+    Map,
+    JSON,
+    parseInt,
+    parseFloat,
+  }
+  sandbox.globalThis = sandbox
+  sandbox.global = sandbox
+
+  // Convert export declarations to var / global assignments
+  const cleanCode = code
+    .replace(/^\s*export\s+default\s+/gm, 'globalThis.__mainFn = ')
+    .replace(/^\s*export\s+(?:async\s+)?function\s+([a-zA-Z0-9_]+)/gm, 'function $1')
+    .replace(/^\s*export\s+const\s+([a-zA-Z0-9_]+)/gm, 'var $1')
+    .replace(/^\s*import\s+.*?;?\s*$/gm, '// [import stripped for benchmark]')
+
+  try {
+    const context = vm.createContext(sandbox)
+    // Run candidate code once to evaluate top-level declarations
+    const setupScript = new vm.Script(cleanCode)
+    setupScript.runInContext(context, { timeout: Math.min(1000, timeoutMs) })
+
+    // Find entrypoint function: either __mainFn or any user-defined function on sandbox
+    let targetFn = sandbox.__mainFn
+    if (typeof targetFn !== 'function') {
+      const userKeys = Object.keys(sandbox).filter((k) => !initialKeys.has(k) && typeof sandbox[k] === 'function')
+      if (userKeys.length > 0) {
+        targetFn = sandbox[userKeys[userKeys.length - 1]]
+      }
+    }
+
+    sandbox.__benchFn = targetFn || null
+    sandbox.__benchArg = 10
+
+    let benchScript
+    if (typeof sandbox.__benchFn === 'function') {
+      benchScript = new vm.Script(`
+        try {
+          __benchFn();
+        } catch (_) {
+          try { __benchFn(__benchArg); } catch (__) {}
+        }
+      `)
+    } else {
+      benchScript = new vm.Script(`(() => { ${cleanCode} })()`)
+    }
+
+    // Warm-up run
+    benchScript.runInContext(context, { timeout: Math.min(1000, timeoutMs) })
+
+    // Measure memory and time
+    const startMem = process.memoryUsage().heapUsed
+    const startHr = process.hrtime.bigint()
+
+    for (let i = 0; i < iterations; i++) {
+      benchScript.runInContext(context, { timeout: Math.min(500, timeoutMs) })
+    }
+
+    const endHr = process.hrtime.bigint()
+    const endMem = process.memoryUsage().heapUsed
+
+    const totalNs = Number(endHr - startHr)
+    const durationMs = Number((totalNs / 1_000_000).toFixed(3))
+    const avgLatencyMs = Number((durationMs / iterations).toFixed(4))
+    const heapBytesUsed = Math.max(0, endMem - startMem)
+    const opsPerSec = durationMs > 0 ? Math.round((iterations / (durationMs / 1000))) : 0
+
+    return {
+      passed: true,
+      durationMs,
+      avgLatencyMs,
+      heapBytesUsed,
+      opsPerSec,
+      iterations,
+      error: null,
+      summary: `⚡ Profiler: ${iterations} iter in ${durationMs}ms (${opsPerSec.toLocaleString()} ops/sec, ~${Math.round(heapBytesUsed / 1024)}KB heap).`,
+    }
+  } catch (err) {
+    const isTimeout = err.code === 'ERR_SCRIPT_EXECUTION_TIMEOUT' || err.message?.includes('timed out')
+    return {
+      passed: false,
+      durationMs: isTimeout ? timeoutMs : 0,
+      avgLatencyMs: 0,
+      heapBytesUsed: 0,
+      opsPerSec: 0,
+      iterations: 0,
+      error: isTimeout ? `Execution timed out after ${timeoutMs}ms (possible infinite loop or catastrophic complexity)` : err.message,
+      summary: isTimeout ? `🚨 Profiler: TIMEOUT (${timeoutMs}ms exceeded)` : `⚠️ Profiler Error: ${err.message}`,
+    }
+  }
+}
+
+/**
+ * Runs runtime performance profiling across all candidate solutions.
+ *
+ * @param {Array<object>} candidates
+ * @param {object} [options]
+ * @returns {object} Profiler gate result
+ */
+export function runProfilerGate(candidates, options = {}) {
+  const {
+    ctx,
+    runId,
+    onProgress,
+    iterations = 100,
+    timeoutMs = 2000,
+  } = options
+
+  const results = []
+  if (!Array.isArray(candidates) || candidates.length === 0) {
+    return {
+      results: [],
+      fastestCandidate: null,
+      profilerDirective: null,
+    }
+  }
+
+  for (let i = 0; i < candidates.length; i++) {
+    const cand = candidates[i]
+    const text = typeof cand === 'string' ? cand : cand.output || cand.text || cand.code || ''
+    const report = profileCodeExecution(text, { iterations, timeoutMs })
+
+    if (typeof cand === 'object' && cand !== null) {
+      cand.profilerReport = report
+    }
+
+    results.push({
+      candidateIndex: i,
+      model: cand?.model || `Candidate ${i + 1}`,
+      report,
+    })
+
+    if (ctx) {
+      emitEvent(ctx, MOA_EVENTS.PROFILER_COMPLETE, {
+        runId,
+        candidateIndex: i,
+        durationMs: report.durationMs,
+        heapBytesUsed: report.heapBytesUsed,
+        opsPerSec: report.opsPerSec,
+        passed: report.passed,
+        error: report.error,
+      })
+    }
+  }
+
+  // Sort passing candidates by throughput (opsPerSec) descending
+  const valid = results.filter((r) => r.report.passed).sort((a, b) => b.report.opsPerSec - a.report.opsPerSec)
+  const fastestCandidate = valid[0] || null
+
+  if (typeof onProgress === 'function' && results.length > 0) {
+    const summaryList = results.map((r) => `Ref ${r.candidateIndex + 1}: ${r.report.passed ? `${r.report.durationMs}ms` : 'TIMEOUT'}`).join(', ')
+    onProgress(`⚡ *Runtime Profiler Gate*: ${summaryList}\n`)
+  }
+
+  const profilerDirective = formatProfilerDirective(results)
+
+  return {
+    results,
+    fastestCandidate,
+    profilerDirective,
+  }
+}
+
+/**
+ * Formats profiler benchmarks into a clear prompt directive for the Judge.
+ *
+ * @param {Array<object>} results
+ * @returns {string|null}
+ */
+export function formatProfilerDirective(results) {
+  if (!Array.isArray(results) || results.length === 0) return null
+
+  const lines = [
+    '### ⚡ RUNTIME PERFORMANCE & CPU/MEMORY PROFILER REPORT',
+    'Objective micro-benchmarks across candidates (100 iterations in isolated sandbox):',
+  ]
+
+  for (const r of results) {
+    const label = `Candidate ${r.candidateIndex + 1}`
+    const rep = r.report
+    if (rep.passed) {
+      const kb = Math.round(rep.heapBytesUsed / 1024)
+      lines.push(
+        `- **${label}**: ⏱️ **${rep.durationMs}ms** total (~${rep.avgLatencyMs}ms/op) | **${rep.opsPerSec.toLocaleString()} ops/sec** | Heap: ~${kb} KB`
+      )
+    } else {
+      lines.push(
+        `- **${label}**: ❌ **PERFORMANCE FAILURE**: ${rep.error}`
+      )
+    }
+  }
+
+  lines.push(
+    '\n**Judge Performance Guideline**: Penalize solutions with excessive latency or timeout failures. Prefer implementations demonstrating clean algorithmic scalability and minimal memory footprint.'
+  )
+
+  return lines.join('\n')
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-moa",
-  "version": "0.2.76",
+  "version": "0.2.77",
   "description": "Mixture of Agents (MoA) plugin for DeepSeek Harness with /moa slash command",
   "type": "module",
   "main": "lib/index.js",