@oomkapwn/enquire-mcp 3.7.3 → 3.7.4

package/CHANGELOG.md

@@ -2,6 +2,70 @@
 
 All notable changes to this project will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.7.4] — 2026-05-16
+
+> **TL;DR:** Round-5 audit response — **class-vs-instance recursion correction**. v3.7.3 fixed ONE instance of "post-v3.6.4 invariant lacking negative-control" (the k1-version-stamp invariant) but the CLASS had a second open instance: `tests/github-metadata-invariant.test.ts` (added in v3.7.0, also post-v3.6.4 rule, also lacked negative-control). I made the same instance-fix-not-class-fix methodological bug v3.6.4's lesson was supposed to teach. Plus a separate finding: `package.json#description` says *"5 cross-encoder reranker models"* — that count was NOT enforced by `docs-consistency.test.ts` (violates CLAUDE.md anti-pattern *"Hardcoded counts in docs without an invariant"* — Rule since v3.5.9). **+5 tests** (784 total). Both gaps closed with structural enforcement.
+
+**Patch — class-vs-instance audit response + missing-gate closure.**
+
+### Critical methodological correction — instance fix vs class fix (recurrence #2)
+
+**v3.7.3 was an instance fix, not a class fix.** I fixed the k1-version-stamp invariant's missing negative-control, but the CLASS — *"invariants added after v3.6.4 that lack negative-control"* — had at least 2 open instances:
+- `tests/k1-version-stamp-consistency.test.ts` (v3.7.2, fixed in v3.7.3)
+- `tests/github-metadata-invariant.test.ts` (v3.7.0, **STILL OPEN until this patch**)
+
+The v3.6.4 method note explicitly stated: *"when a methodological bug recurs in two consecutive releases, the fix is structural enforcement, not another instance fix."* I violated that rule between v3.7.3 and v3.7.4. The K-1 saga's class-vs-instance bug RECURRED at the methodology layer.
+
+**v3.7.4 fixes the broader class.** Both invariants now have fixture-/synthetic-input negative-control.
+
+### Added — negative-control for `tests/github-metadata-invariant.test.ts`
+
+- **Extracted** assertion logic into pure helper functions (`validateAboutLeadsWith`, `findMissingTopics`).
+- **Added 4 negative-control tests** under `describe("NEGATIVE-CONTROL: analyzers detect drift on synthetic bad inputs (v3.7.4)")`:
+  - `validateAboutLeadsWith` rejects descriptions that don't lead with the canonical phrase (5 cases: positive, 3 negatives, 1 case-insensitive).
+  - `findMissingTopics` returns all required topics when given empty input.
+  - `findMissingTopics` returns subset when given partial topic list.
+  - `findMissingTopics` returns `[]` when all required topics are present (positive control mixed with extras).
+
+If someone breaks the `ABOUT_LEADS_WITH` regex or the `REQUIRED_TOPICS` array, these negative-control tests fail loudly. The production tests no longer silent-pass on analyzer regressions.
+
+### Added — reranker count gate (closes "Hardcoded counts" anti-pattern hole)
+
+- **`docs-consistency.test.ts`** now gates the *"5 cross-encoder reranker models"* claim in `package.json#description`. Reads `RERANKER_MODELS` from `dist/embeddings.js` (the same catalog production code uses) and asserts the count matches the claim.
+
+Previous gated counts: tools (44), prompts (19), tests (784). **Now also: reranker models (5).**
+
+If `RERANKER_MODELS` grows or shrinks, the npm description claim now fails CI until the description is updated to match.
+
+### Tests
+
+**784 tests** (was 779 in v3.7.3). **+5**:
+- 4 GitHub-metadata-invariant negative-control tests.
+- 1 reranker count gate test in docs-consistency.
+
+Lint clean · `tsc` strict + `noUncheckedIndexedAccess` clean · changelog-coverage gate OK · per-file coverage floors met · all invariants now have negative-control.
+
+### Migration
+
+**No-op for every consumer.** Zero code/API/behavior/schema changes. Same npm install, same wire format.
+
+### Method note — round-5 caught a methodological RECURSION
+
+The K-1 saga produced a hierarchy of method bugs:
+- Round-1 (code): K-1 destructive bootstrap-schema → closed at v3.6.4 + AST sibling at v3.7.0.
+- Round-2 (claims): CHANGELOG overclaims → closed via retroactive corrections.
+- Round-3 (documentation): SECURITY.md / inline-comment drift → closed via structural invariants.
+- Round-4 (methodology): invariant without negative-control → CAUGHT MY OWN v3.7.2 patch.
+- **Round-5 (meta-methodology)**: my v3.7.3 fix was instance-only, the class was still open. **The methodology bug recurred at the methodology-fix layer.**
+
+Each round catches a more subtle class than the previous. Round-5 is "I made the instance-fix-not-class-fix error WHILE FIXING the negative-control violation". The audit pattern is now recursive over its own outputs.
+
+**Will round-6 surface?** If the audit pattern continues self-recursing, round-6 might catch "the class-fix-not-instance-fix lesson, but I missed level N". To prevent: this patch enforces the broader class — invariants without negative-control fail CI structurally. There's no obvious round-6 finding I can predict, meaning either the methodology saga is closed OR round-6 will catch something I can't conceive of yet.
+
+**Terminator**: the broadest possible class invariant ("every invariant test file must have a `describe("NEGATIVE-CONTROL`)` block or have its parent test cover it") would catch round-6 of this same pattern. Considered for v3.7.5 if a round-6 finding actually appears; otherwise unnecessary scope creep.
+
+---
+
 ## [3.7.3] — 2026-05-16
 
 > **TL;DR:** Self-applied compliance fix. The v3.7.2 K-1 version-stamp consistency invariant shipped **without a negative-control sibling test**, violating the CLAUDE.md anti-pattern *"Invariant test without negative-control — Rule since v3.6.4"*. A round-4 audit (~24h after v3.7.2 ship, per the "audit BEFORE ship + 24h main dogfood" rule) caught the methodological gap. v3.7.3 closes it: extracts the scanning logic into a pure `scanK1Stamps()` function + adds a fixture-based negative-control at `tests/fixtures/k1-version-stamps/drift-mixed.ts` with **3 intentionally-mixed K-1 version stamps** + 2 negative-control tests proving the analyzer detects the drift. **+2 tests** (779 total). Zero code, behavior, or schema changes.

package/README.md

@@ -11,7 +11,7 @@
 [![CI](https://github.com/oomkapwn/enquire-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/oomkapwn/enquire-mcp/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@oomkapwn/enquire-mcp.svg?label=npm&color=cb3837)](https://www.npmjs.com/package/@oomkapwn/enquire-mcp)
 [![downloads](https://img.shields.io/npm/dm/@oomkapwn/enquire-mcp.svg?color=cb3837)](https://www.npmjs.com/package/@oomkapwn/enquire-mcp)
-[![tests](https://img.shields.io/badge/tests-779%20passing-brightgreen.svg)](#trust)
+[![tests](https://img.shields.io/badge/tests-784%20passing-brightgreen.svg)](#trust)
 [![stable](https://img.shields.io/badge/v3.6.x-stable-brightgreen.svg)](./STABILITY.md)
 [![SLSA-3](https://img.shields.io/badge/SLSA-3-blue.svg)](https://slsa.dev/spec/v1.0/levels#build-l3)
 [![MCP](https://img.shields.io/badge/MCP-1.29-8A2BE2.svg)](https://modelcontextprotocol.io/)
@@ -31,7 +31,7 @@ A **production-ready MCP server** that turns your Obsidian vault into **persiste
 
 Think of it as the **open-source, MCP-native, agent-grade memory layer** that complements Claude Memory / ChatGPT Memory / Cursor memory — but stores your durable knowledge in a portable, vendor-neutral format (your Obsidian vault) any agent can read.
 
-**44 tools · 19 MCP prompts · 779 unit tests · 50+ languages · v3.6.x · semver-bound · MIT · SLSA-3.**
+**44 tools · 19 MCP prompts · 784 unit tests · 50+ languages · v3.6.x · semver-bound · MIT · SLSA-3.**
 
 ---
 
@@ -107,7 +107,7 @@ Auto-generated **[API reference at oomkapwn.github.io/enquire-mcp](https://oomka
 | **GraphRAG-light** (wikilink community detection via Louvain modularity) | ✅ **only here** | ❌ | ❌ |
 | **Standalone `.base` query execution** (works without Obsidian running) | ✅ **only here** | ❌ | ❌ delegates to Obsidian |
 | **HyDE retrieval** (Gao et al 2023) + sub-question decomposition | ✅ **only here** | ❌ | ❌ |
-| **779 unit tests · 7 required + 4 advisory CI gates per PR** | ✅ | n/a | rare |
+| **784 unit tests · 7 required + 4 advisory CI gates per PR** | ✅ | n/a | rare |
 | **SLSA-3 build provenance** | ✅ | n/a | ❌ |
 | **Semver-bound public surface** ([STABILITY.md](./STABILITY.md)) | ✅ | n/a | ❌ |
 | Standalone (no Obsidian plugin needed) | ✅ | ❌ requires Obsidian | varies |
@@ -217,7 +217,7 @@ Channel: `npm install @oomkapwn/enquire-mcp` → latest stable. Full changelog:
 ```bash
 git clone https://github.com/oomkapwn/enquire-mcp.git
 cd enquire-mcp && npm install
-npm test       # full suite (779 tests, ~5s)
+npm test       # full suite (784 tests, ~5s)
 npm run lint   # zero warnings
 npm run build  # tsc → dist/
 ```

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export declare const VERSION = "3.7.3";
+export declare const VERSION = "3.7.4";
 export { main } from "./cli.js";
 export { buildEmbedText, buildMcpServer, formatReadyBanner, prepareServerDeps, type ServeOptions, type ServerDeps, startServer } from "./server.js";
 export { parsePositiveInt, parseQuantizationMode } from "./tool-registry.js";

package/dist/index.js

@@ -32,7 +32,7 @@ import { main } from "./cli.js";
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
  * `vault-info` resource payload).
  */
-export const VERSION = "3.7.3";
+export const VERSION = "3.7.4";
 // Re-exports — preserve the v3.5.x public surface so http-transport.ts and
 // tests don't need to know about the new module layout. The set below
 // exactly matches the v3.5.x `export` declarations: `main`,

package/package.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@oomkapwn/enquire-mcp",
-  "version": "3.7.3",
-  "description": "Memory layer for AI agents over your Obsidian vault. Hybrid retrieval (BM25 + TF-IDF + multilingual ML embeddings, RRF-fused) with BGE cross-encoder reranking, HNSW + int8 quantization, late-chunking, HyDE + sub-question decomposition, agentic RAG, PDFs (with OCR), standalone Bases (.base query execution — no Obsidian needed), GraphRAG-light (Louvain wikilink community detection), wikilinks, backlinks, Dataview, frontmatter, canvas. Open-source long-term memory / second brain for Claude Code, Claude Desktop, Cursor, ChatGPT custom GPT, Codex, and any MCP client. 44 tools, 19 MCP prompts, 5 cross-encoder reranker models, 779 tests, SLSA-3, semver-bound, MIT.",
+  "version": "3.7.4",
+  "description": "Memory layer for AI agents over your Obsidian vault. Hybrid retrieval (BM25 + TF-IDF + multilingual ML embeddings, RRF-fused) with BGE cross-encoder reranking, HNSW + int8 quantization, late-chunking, HyDE + sub-question decomposition, agentic RAG, PDFs (with OCR), standalone Bases (.base query execution — no Obsidian needed), GraphRAG-light (Louvain wikilink community detection), wikilinks, backlinks, Dataview, frontmatter, canvas. Open-source long-term memory / second brain for Claude Code, Claude Desktop, Cursor, ChatGPT custom GPT, Codex, and any MCP client. 44 tools, 19 MCP prompts, 5 cross-encoder reranker models, 784 tests, SLSA-3, semver-bound, MIT.",
   "type": "module",
   "bin": {
     "enquire-mcp": "dist/index.js"