@ivorycanvas/qamap 0.3.3 → 0.3.5

package/CHANGELOG.md

@@ -2,6 +2,60 @@
 
 ## Unreleased
 
+## 0.3.5 - 2026-07-11
+
+### Added
+
+- `manifest init` now creates reusable manual API contract flows for common server route, controller, handler, and framework-backed service modules. Each inferred flow carries API file anchors plus success-contract and invalid-request checks, so a baseline can shape later service changes instead of containing domains only.
+- The public benchmark can generate an external verification manifest from a fixture's base commit and assert manifest matches and manifest-backed QA flows against the head commit. API contract and reverse-import fixtures now protect this feedback loop in CI without executing fixture code.
+
+### Changed
+
+- A changed file that matches a declared manifest domain but no flow anchor now keeps manifest provenance on the best overlapping inferred flow. QAMap does not invent manifest checks or merge unrelated flows; it preserves the code-derived steps, selectors, and entrypoint while explaining the domain-level evidence.
+- Private repository smoke output is treated as local-only diagnostic data. Public regression coverage uses minimized synthetic fixtures and neutral sample vocabulary.
+
+### Fixed
+
+- Replaced legacy real-world-derived example vocabulary with neutral synthetic examples in tests and documentation.
+
+## 0.3.4 - 2026-07-10
+
+### Added
+
+- Added a committed Benchmark Contract v1: eight synthetic `base`/`head` PR fixtures cover testless web, existing Playwright, Expo/Maestro, API service, design tokens, reverse-imported shared components, native configuration-only changes, and Maestro test-only changes. `pnpm bench:ci` materializes each fixture as a temporary Git repository and fails when runner choice, affected-flow reach, product naming, draft paths, selectors, evidence, commands, blank actions, generic titles, or agent payload limits regress. The gate now runs in CI and `release:check`; private pinned repositories remain an optional local smoke layer.
+- Agent-format flows now carry compact `changedFiles`, `reviewQuestion`, `successSignal`, and `evidence` fields. These are additive `qamap.qa` v1 fields, documented in the public contract and JSON Schema, so an agent can see why a flow was selected without re-reading the repository.
+- The `--format agent` output is now a documented, versioned contract. A machine-readable JSON Schema ships at `schema/qamap-agent.schema.json`, the field-by-field spec with a stability policy lives at `docs/agent-format.md` (within `qamap.qa` version 1, fields are only ever added — never removed or retyped; breaking changes bump `schema.version`), and the test suite validates real CLI output against the published schema so the contract cannot drift silently.
+- `qamap manifest init` now reports how many files it scanned and warns explicitly when the scan stopped at the `--max-files` cap (with the exact rerun command), instead of silently producing an empty-looking baseline on large repositories. The JSON result carries a `scan` block (`files`, `maxFiles`, `truncated`), and `manifest validate`'s "No domains" advice now points at `--max-files` instead of circularly suggesting the same `manifest init` run that produced the empty manifest.
+- Manifest validation commands now come from ground truth first: verification-shaped `package.json` scripts (`test`, `lint`, `typecheck`, `check`, `e2e`, `coverage`, `build`, …, invoked via the detected package manager) and a detected pytest setup (`pytest.ini`, `conftest.py`, `[tool.pytest]`) are listed ahead of commands found in instruction docs. Scripts that block, open a UI, or mutate state (`test:watch`, `test:debug`, `e2e:open`, `test:update`, `lint:fix`, npm-init placeholder tests) are excluded, while segment lookalikes such as `test:server`, `e2e:device`, and `check:fixtures` survive.
+- `manifest init` now derives domains from Django-style backend structure: an app directory carrying two or more framework markers (`models`, `views`, `urls`, `serializers`, `forms`, `admin`, `apps`, `tasks`) becomes a product domain. Only Python files count as markers (a Rails `app/models/user.rb` fabricates nothing), apps are recognized at any nesting depth (`backend/orders/models.py`), and a Django-derived domain merges into a same-id domain from the JS pass instead of duplicating it. A Django monolith that previously produced an empty manifest now yields its real app areas.
+- Manifest flow selection is ranked instead of alphabetical: navigable routes score above component matches, product-signal paths (login, signup, payment, checkout, orders, onboarding, …) get a boost, flows are interleaved across domains so one large area cannot fill every slot, and generic UI plumbing (bare structural nouns like `Modal.tsx`, `Error*`-style wrappers, icon sets, `constants/`/`hooks/` files) no longer becomes a flow, while funnel components ending in `Success`/`Confirmation` count as flows the same way `Checkout`/`Complete` ones do. Route inference maps the repo root correctly (`pages/index.*` and `app/page.*` → `/`), rewrites Nuxt-style dynamic segments (`_orderId` → `:orderId`), and excludes HTTP handlers from UI flows: `pages/api/**`, `app/api/**`, and App Router `route.*` files anywhere.
+- Manifest anchors and checks got concrete: component anchors carry the real exported identifier (parsed from the source, omitted when unresolvable) instead of a humanized guess, and the happy-path check picks up a `data-testid` observed in the flow's source as its selector. `.vue`/`.svelte` files are now readable by the project walk, so Vue single-file components get the same treatment.
+- Manifest domains stopped pretending: structural directory names (`components`, `hooks`, `providers`, `navigations`, `layout`, `styles`, …) are no longer domains, the candidate search continues past structural directory segments to the first product-shaped one (but never descends into a file basename unless the file sits directly under the route directory, so colocated `components/`/`hooks/`/`utils/` files cannot mint garbage domains), `pages/api`/`app/api` trees are never domains, child path globs already covered by a parent are dropped, and `criticality` is inferred (revenue/identity areas → `high`, internal design tooling → `low`) instead of a flat `medium`.
+- Manifest runner inference reads dependency keys across every collected `package.json` (workspace members included) instead of raw root text: `react` in a description or an `eslint-plugin-react` entry no longer forces `playwright`, and an `app.json` only counts as mobile evidence when it has a top-level `expo` key.
+
+- Reports are colorized when printed to an interactive terminal: headings, the At a Glance keys, status words and stage labels, priority tags, and inline commands get ANSI styling with zero dependencies. Files written with `--output`, pipes, CI logs, and machine formats (`json`, `agent`, `sarif`) are byte-identical to before; the standard `NO_COLOR` and `FORCE_COLOR` environment variables are honored.
+- Mock/fixture file detection now matches whole name tokens instead of substrings, and a bare `handler` filename no longer counts as mock evidence outside mock-style directories. Files like `useSeedlingCatalog.ts` or `errorHandler.ts` stop being misreported as fixtures, which also stops branches from being marked `ready` on the strength of ordinary source files.
+- Fixture guidance now names the concrete thing to do instead of assigning homework. QAMap statically reads the contents of discovered mock/fixture/seed files (up to 24 per plan) and extracts exports, handled routes (MSW, Mirage, express-style, Playwright `route(...)`), and response keys. Next actions name the reusable fixture and uncovered endpoint; generated Playwright mock bodies reuse observed response keys instead of the `ok: true` placeholder; and fixture action-item titles carry the endpoints so the compact agent format keeps the target. Matched insights are exposed as an optional `mockInsights` array on `fixtureReadiness` in JSON output.
+- `qamap init --agent` gives agent onboarding a single command: it adds a marked `Pre-PR QA (QAMap)` section to `AGENTS.md` (created if missing, appended if present, refreshed in place on re-runs without touching surrounding content), installs the packaged skill to `.claude/skills/qamap-pr-qa/SKILL.md`, and creates a starter `qamap.config.json` when none exists. Every step is idempotent, and a locally modified skill copy is never replaced without `--force`.
+- Korean action labels now qualify for flow and scenario naming: labels like `저장하기` or `신청하기` (36 common action stems, with `~하기/~합니다`-style endings) name the journey the same way English action words do, draft filenames keep Hangul instead of collapsing to an empty slug, and Korean submit-like labels drive `Submit` steps. This closes the known limit noted in 0.3.3.
+
+### Changed
+
+- `qamap qa` now opens with the affected behavior, a concrete reviewer question, repository evidence, proposed draft path, next command, and missing trust requirements. Diff-visible outcome copy such as `Order confirmed` or `Profile saved` is preferred over generic success wording; simple React state output (`setStatus("Orders refreshed")` rendered through `{status}`) is recognized as visible evidence; and stable action selectors are shown ahead of plain input placeholders.
+- Verification-only diffs no longer enter the product-journey bootstrap loop. Configuration, documentation, generated artifacts, and changed tests expose a compact `verificationMode`; configuration changes prefer existing platform build scripts, while changed test files are returned as `existingEvidence` to run directly. The agent payload omits `firstDraftCommand` and treats the backward-compatible `draft` field as a fallback artifact path when generating a new E2E would duplicate or invent coverage.
+- Shared component changes that reach a page through imports are named after the consuming surface and retain both the changed component and reached page as evidence, instead of producing duplicate `primary journey`/`UI smoke flow` drafts named after the component.
+- API-service route modules under `routes/` stay in contract analysis instead of being mistaken for frontend route surfaces.
+- The project file walk skips mobile vendor/derived trees (`Pods`, `.expo`, `.gradle`, `DerivedData`, `Carthage`). On React Native and Expo repositories these directories could exhaust the capped alphabetical scan before it ever reached `src/`, which made `manifest init` produce zero domains and zero flows.
+- Manifest context extraction got precision-first rules: bare command lines in instruction docs only count inside fenced code blocks (prose sentences that start with a tool name are no longer "commands"), commands containing commas, parentheses, or Hangul prose are rejected, redundant `a && b` compounds are dropped when both halves are already listed, and safety rules are only harvested from prose prohibition/obligation lines — code blocks, CI YAML fragments, mermaid edges, and topic words like `커밋`/`token` alone no longer produce fake team rules.
+- Build-output directories (`out/`, `.output/`, `storybook-static/`, `__generated__/`) are excluded from manifest domain/flow inference, so exported build artifacts with hashed filenames no longer surface as product-domain key paths.
+- Human reports now describe draft readiness as a stage on a fixed four-step journey (`Stage: setup needed (1 of 4) — readiness 0/100`) instead of a verdict (`Readiness: blocked (0/100)`), and the blocked-level recommendation says "keep these drafts review-only and start with X" instead of "do not treat these drafts as runnable". A fresh repository reads as being at the start of a path, not as failing. Machine formats are unchanged: `readiness.level` keeps the `blocked`/`needs-work`/`near-runnable`/`ready` values, and the stage-to-level mapping is documented in `docs/commands.md`.
+- Slimmed the README from ~640 lines to ~100: it now carries only the demo, quick start, agent usage, positioning, and a documentation index. The full command reference moved to `docs/commands.md`, the guardrails scanner section to `docs/guardrails.md`, and positioning tables into `docs/adoption.md`.
+
+### Fixed
+
+- Expo native version and build metadata changes are grouped into one `Mobile build configuration verification checklist` instead of filename-derived user journeys such as `Build Gradle primary journey` or `Info Plist primary journey`. Native project files no longer fabricate screen entrypoints or selector requirements.
+- `.maestro/*.yaml` changes are recognized as existing test evidence. QAMap recommends `maestro test .maestro`, names the changed flow files, and no longer asks for duplicate fixtures, selectors, entrypoints, manifest promotion, or a second generated Maestro journey.
+
 ## 0.3.3 - 2026-07-05
 
 ### Changed