@qulib/core 0.7.0 → 0.9.0

package/dist/cli/score-automation-run.js

@@ -0,0 +1,123 @@
+/**
+ * `qulib score-automation` — score a local repo's test-automation maturity.
+ *
+ * Wraps `computeAutomationMaturity(repo)` (../tools/scoring/automation-maturity.js)
+ * as a first-class CLI surface. Until now the maturity score was only produced as a
+ * side-effect of `analyze --repo`; this exposes it standalone so an agent or CI can
+ * score a repo's automation directly, without a deployed URL to crawl.
+ *
+ * How a RepoAnalysis is obtained (smallest honest path, no duplicated logic):
+ *   `scanRepo(repoPath)` (../tools/repo/scan.js) is a pure static scan — it infers
+ *   routes, test files, test-id hygiene, CI presence and Cypress structure straight
+ *   from the repo layout, with no browser/URL dependency. We reuse it (root CLAUDE.md:
+ *   shared logic lives in core, never duplicate) and then call computeAutomationMaturity
+ *   on its result so the printed report reflects a freshly-computed maturity object.
+ *
+ * Output honesty (root design principle — no false confidence):
+ *   Per-dimension applicability (`applicable | not_applicable | unknown`) is surfaced
+ *   verbatim. A `not_applicable` or `unknown` dimension reads as honest uncertainty
+ *   with its reason/guidance — it is NEVER rendered as a "0/100" that looks like a
+ *   real failing score. The overall score is normalized over applicable dimensions
+ *   only (see computeAutomationMaturity), so absent capabilities don't drag it down.
+ *
+ * This file owns the `score-automation` subcommand end-to-end and is registered from
+ * cli/index.ts via `registerScoreAutomationCommand(program)`, so this command's build
+ * never edits index.ts (avoids collision with the parallel scaffold command).
+ */
+import { resolve } from 'node:path';
+import { existsSync, statSync } from 'node:fs';
+import { scanRepo } from '../tools/repo/scan.js';
+import { computeAutomationMaturity } from '../tools/scoring/automation-maturity.js';
+/**
+ * Resolve `--repo` to an absolute path and assert it is an existing directory.
+ * Fails fast with a clear, actionable message rather than letting glob silently
+ * scan nothing and report a falsely-confident "everything is uncovered" score.
+ */
+export function resolveRepoPath(repoOption, cwd = process.cwd()) {
+    if (!repoOption || !repoOption.trim()) {
+        throw new Error('score-automation requires --repo <path> pointing at a local repository to score.');
+    }
+    const abs = resolve(cwd, repoOption.trim());
+    if (!existsSync(abs)) {
+        throw new Error(`--repo path does not exist: ${abs}`);
+    }
+    if (!statSync(abs).isDirectory()) {
+        throw new Error(`--repo path is not a directory: ${abs}`);
+    }
+    return abs;
+}
+/** Single-letter glyph + word for a dimension's applicability, for the human report. */
+function applicabilityTag(dim) {
+    const applicability = dim.applicability ?? 'applicable';
+    switch (applicability) {
+        case 'not_applicable':
+            return 'n/a';
+        case 'unknown':
+            return 'unknown';
+        default:
+            return 'applicable';
+    }
+}
+/**
+ * Render one dimension line. For applicable dimensions we show the score; for
+ * not_applicable / unknown we show the word and the reason — NOT a misleading "0".
+ */
+function formatDimensionLine(dim) {
+    const applicability = dim.applicability ?? 'applicable';
+    const weightPct = `${Math.round(dim.weight * 100)}%`;
+    const head = `  - ${dim.dimension} [w=${weightPct}]`;
+    if (applicability === 'applicable') {
+        return `${head}: ${dim.score}/100`;
+    }
+    // Honest-uncertainty rendering: surface the label + reason, never a bare 0.
+    const reason = dim.reason ? ` — ${dim.reason}` : '';
+    return `${head}: ${applicabilityTag(dim)} (excluded from overall)${reason}`;
+}
+/** Build the human-readable report as a single string (kept pure so tests can assert on it). */
+export function formatHumanReport(maturity) {
+    const lines = [];
+    lines.push(`[qulib] Automation maturity for ${maturity.repoPath}`);
+    lines.push(`  overall: ${maturity.overallScore}/100  —  ${maturity.label} (level ${maturity.level})`);
+    lines.push('  dimensions:');
+    for (const dim of maturity.dimensions) {
+        lines.push(formatDimensionLine(dim));
+    }
+    if (maturity.topRecommendations.length > 0) {
+        lines.push('  top recommendations:');
+        for (const rec of maturity.topRecommendations) {
+            lines.push(`    • ${rec}`);
+        }
+    }
+    else {
+        lines.push('  top recommendations: none — applicable dimensions are at/above target.');
+    }
+    return lines.join('\n');
+}
+/**
+ * Core of the command, factored out of the action handler so node:test can drive it
+ * directly against a fixture repo without spawning a process.
+ *
+ * Reuses scanRepo (static repo intelligence) then computes maturity explicitly.
+ */
+export async function runScoreAutomation(options, out = (line) => console.log(line)) {
+    const repoPath = resolveRepoPath(options.repo);
+    const repo = await scanRepo(repoPath);
+    const maturity = computeAutomationMaturity(repo);
+    if (options.json) {
+        out(JSON.stringify(maturity, null, 2));
+    }
+    else {
+        out(formatHumanReport(maturity));
+    }
+    return maturity;
+}
+export function registerScoreAutomationCommand(program) {
+    program
+        .command('score-automation')
+        .description("Score a local repo's test-automation maturity (overall + per-dimension, with honest applicability)")
+        .requiredOption('--repo <path>', 'Path to the local repository to score')
+        .option('--json', 'Emit the full AutomationMaturity object as JSON to stdout', false)
+        .action(async (options) => {
+        await runScoreAutomation({ repo: options.repo, json: Boolean(options.json) });
+    });
+}

package/dist/examples/notquality-dogfood/fixture.d.ts

@@ -0,0 +1,166 @@
+/**
+ * notquality DOGFOOD — real delivery signals fixture.
+ *
+ * P5 — qulib ingests notquality's own delivery signals → Release Confidence.
+ *
+ * PROVENANCE (all signals gathered 2026-06-04 via `gh` CLI against TapeshN/notquality):
+ *
+ *   E2E run:  gh run view 26931370208 -R TapeshN/notquality
+ *             branch: notquality-app/prod-migrate
+ *             sha:    5732ed5a37ba46c503d1319da83c5c6f4c8e5cb6
+ *             workflow: E2E (playwright job, job ID 79451559555)
+ *             completed: 2026-06-04T04:46:20Z  (duration: ~6m4s)
+ *             conclusion: success
+ *             test files: 29 spec files on origin/main (git ls-tree -r origin/main)
+ *             test cases: 194 total test() calls across 29 spec files
+ *             fixme/skip: 26 test.fixme / test.skip markers
+ *             active (non-fixme): 194 - 26 = 168 runnable tests
+ *             all passed (CI conclusion: success)
+ *
+ *   CI run:   gh run view 26931370215 -R TapeshN/notquality
+ *             branch: notquality-app/prod-migrate
+ *             sha:    5732ed5a37ba46c503d1319da83c5c6f4c8e5cb6
+ *             workflow: CI (validate job, job ID 79451559554)
+ *             completed: 2026-06-04T04:46:20Z  (duration: ~1m13s)
+ *             conclusion: success
+ *             steps: typecheck, lint, validate:bugs, prisma generate, build — all green
+ *
+ *   PR:       gh pr view 52 -R TapeshN/notquality --json number,url,reviewDecision,mergeable,statusCheckRollup
+ *             title: "Run prisma migrate deploy before build on Vercel"
+ *             branch: notquality-app/prod-migrate
+ *             number: 52
+ *             url: https://github.com/TapeshN/notquality/pull/52
+ *             reviewDecision: "" (no review assigned — open PR, no blocking change requests)
+ *             mergeable: MERGEABLE
+ *             status checks: CI validate → SUCCESS, E2E playwright → SUCCESS, Vercel → SUCCESS
+ *
+ *   Repo inventory (gh ls-tree -r origin/main, 2026-06-04):
+ *             29 spec files, 77 source .ts/.tsx files (excl. e2e), 19 route pages
+ *             playwright.config.ts present (.github/workflows/e2e.yml present)
+ *             CI: .github/workflows/ci.yml present (typecheck + lint + validate:bugs + build)
+ *             auth: dual auth (iron-session playground + NextAuth platform)
+ *             test-id hygiene: data-testid used in app/ + e2e/ (29 spec files use getByTestId)
+ *             challenges: 1 seeded (legacy-bug-hunt-1); 16-card static list page (P5 truth-fix target)
+ *
+ * COLLECTION TIMESTAMP: 2026-06-04T09:00:00.000Z
+ *
+ * This fixture is intentionally FROZEN at this point in time. When real delivery
+ * signals are updated, create a NEW fixture version (fixture-v2.ts, etc.) and
+ * update the integration tests to use the latest. Never silently mutate this file —
+ * the provenance citation is load-bearing for the eval/audit trail.
+ */
+export declare const FIXTURE_COLLECTION_TS = "2026-06-04T09:00:00.000Z";
+/**
+ * Real CI run data from notquality E2E workflow (run #26931370208).
+ * Source: gh run view 26931370208 -R TapeshN/notquality
+ */
+export declare const NOTQUALITY_E2E_RUN: {
+    /** ISO-8601 timestamp of run completion. */
+    readonly completedAt: "2026-06-04T04:46:20.000Z";
+    /** CI build step succeeded (typecheck, lint, validate:bugs, prisma generate, build). */
+    readonly buildPassed: true;
+    /**
+     * 168 runnable tests (194 total test() calls − 26 test.fixme/test.skip markers).
+     * All 168 passed in this run. Source: spec-file grep + run conclusion=success.
+     */
+    readonly testsPassed: 168;
+    readonly testsFailed: 0;
+    readonly testsErrored: 0;
+    /**
+     * 26 tests marked test.fixme or test.skip across 16 spec files.
+     * These are known quarantined defects (color-contrast a11y, label regression,
+     * EVT-001, duplicate challenge-title) — intentional, not infra failures.
+     */
+    readonly testsFlaky: 0;
+    readonly runUrl: "https://github.com/TapeshN/notquality/actions/runs/26931370208";
+    readonly workflowName: "E2E (playwright)";
+};
+/**
+ * Real CI validate-job data from notquality CI workflow (run #26931370215).
+ * Source: gh run view 26931370215 -R TapeshN/notquality
+ */
+export declare const NOTQUALITY_CI_RUN: {
+    readonly completedAt: "2026-06-04T04:46:20.000Z";
+    readonly buildPassed: true;
+    readonly testsPassed: 0;
+    readonly testsFailed: 0;
+    readonly testsErrored: 0;
+    readonly runUrl: "https://github.com/TapeshN/notquality/actions/runs/26931370215";
+    readonly workflowName: "CI (validate)";
+};
+/**
+ * Real PR #52 metadata from notquality.
+ * Source: gh pr view 52 -R TapeshN/notquality --json number,url,reviewDecision,mergeable,statusCheckRollup
+ */
+export declare const NOTQUALITY_PR_52: {
+    readonly number: 52;
+    readonly url: "https://github.com/TapeshN/notquality/pull/52";
+    readonly reviewDecision: null;
+    readonly mergeable: "MERGEABLE";
+    readonly statusCheckRollup: readonly [{
+        readonly state: "SUCCESS";
+        readonly name: "validate";
+        readonly targetUrl: "https://github.com/TapeshN/notquality/actions/runs/26931370215/job/79451559554";
+    }, {
+        readonly state: "SUCCESS";
+        readonly name: "playwright";
+        readonly targetUrl: "https://github.com/TapeshN/notquality/actions/runs/26931370208/job/79451559555";
+    }, {
+        readonly state: "SUCCESS";
+        readonly name: "Vercel";
+        readonly targetUrl: "https://vercel.com/tapeshnagarwal-7364s-projects/notquality-app/5mSLRhKKEdwvnqMoTY4XWxSePFYB";
+    }, {
+        readonly state: "SUCCESS";
+        readonly name: "Vercel Preview Comments";
+        readonly targetUrl: "https://vercel.com/github";
+    }];
+    readonly noPr: false;
+};
+/**
+ * Repo-level automation maturity facts (from static scan of origin/main, 2026-06-04).
+ * These facts drive the test-automation EvidenceItem used when qulib_score_automation
+ * is held (no live local scan in this fixture — see HELD note below).
+ *
+ * HELD: The live qulib_score_automation(repoPath) call requires the notquality
+ * repo to be available at an absolute path on the build machine and needs the full
+ * qulib CLI. The integration test uses these pre-scored facts instead of a live scan.
+ * The live scan is operator-gated (run `qulib score-automation <path>` locally).
+ */
+export declare const NOTQUALITY_AUTOMATION_MATURITY: {
+    /**
+     * Estimated overall automation maturity score (0–100).
+     * Basis: Playwright present (framework-adoption ✓), 29 spec files covering 19 routes
+     * (test-coverage-breadth ~72%), e2e.yml + ci.yml present (ci-integration ✓),
+     * auth-test-coverage present (iron-session + NextAuth both tested ✓),
+     * data-testid used in spec files (test-id-hygiene present but not perfect — duplicate
+     * challenge-title test-id is a known defect, P5 truth-fix target), no component/unit
+     * tests yet (component-test-ratio = 0). Estimated L3 (60–79 range).
+     * Conservative estimate: 65/100.
+     */
+    readonly overallScore: 65;
+    readonly level: 3;
+    readonly label: "L3 — building maturity";
+    /**
+     * Key facts cited (no live scan was run; these are statically-derived):
+     * - framework: Playwright (playwright.config.ts present on origin/main)
+     * - specFiles: 29 (git ls-tree origin/main | grep "e2e/" | grep "spec.ts")
+     * - routePages: 19 (git ls-tree origin/main | grep "app/" | grep "page.tsx")
+     * - ciWorkflows: 2 (.github/workflows/ci.yml + e2e.yml)
+     * - authTests: yes (e2e/specs/auth/ — 3 spec files, 18 test() calls)
+     * - testIdHygiene: partial (data-testid used; duplicate challenge-title known defect)
+     * - componentTests: 0 (no vitest/jest unit tests in repo)
+     */
+    readonly topRecommendations: readonly ["Add vitest/jest unit tests for lib/ (scoring, API helpers) to raise component-test-ratio.", "Fix duplicate data-testid=\"challenge-title\" (breadcrumb vs h1) for unambiguous E2E selectors.", "Add dedicated challenges list + attempt E2E specs once fake list page is replaced with DB truth."];
+    readonly computedAt: "2026-06-04T09:00:00.000Z";
+    readonly repoPath: "TapeshN/notquality@5732ed5a (origin/main, 2026-06-04)";
+};
+/**
+ * Repository context for the ConfidenceSubject.
+ * ref: the commit SHA + branch context; tenantId: 'notquality' (multi-tenant from day one).
+ */
+export declare const NOTQUALITY_SUBJECT: {
+    readonly kind: "release";
+    readonly ref: "TapeshN/notquality@5732ed5a (notquality-app/prod-migrate)";
+    readonly tenantId: "notquality";
+};
+//# sourceMappingURL=fixture.d.ts.map

package/dist/examples/notquality-dogfood/fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture.d.ts","sourceRoot":"","sources":["../../../src/examples/notquality-dogfood/fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,kBAAkB;IAC7B,4CAA4C;;IAE5C,wFAAwF;;IAExF;;;OAGG;;;;IAIH;;;;OAIG;;;;CAIK,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;CAQpB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;6BAGH,IAAI;;;;;;;;;;;;;;;;;;;;CAyBpB,CAAC;AAEX;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B;IACzC;;;;;;;;;OASG;;;;IAIH;;;;;;;;;OASG;;;;CAQK,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC"}

package/dist/examples/notquality-dogfood/fixture.js

@@ -0,0 +1,174 @@
+/**
+ * notquality DOGFOOD — real delivery signals fixture.
+ *
+ * P5 — qulib ingests notquality's own delivery signals → Release Confidence.
+ *
+ * PROVENANCE (all signals gathered 2026-06-04 via `gh` CLI against TapeshN/notquality):
+ *
+ *   E2E run:  gh run view 26931370208 -R TapeshN/notquality
+ *             branch: notquality-app/prod-migrate
+ *             sha:    5732ed5a37ba46c503d1319da83c5c6f4c8e5cb6
+ *             workflow: E2E (playwright job, job ID 79451559555)
+ *             completed: 2026-06-04T04:46:20Z  (duration: ~6m4s)
+ *             conclusion: success
+ *             test files: 29 spec files on origin/main (git ls-tree -r origin/main)
+ *             test cases: 194 total test() calls across 29 spec files
+ *             fixme/skip: 26 test.fixme / test.skip markers
+ *             active (non-fixme): 194 - 26 = 168 runnable tests
+ *             all passed (CI conclusion: success)
+ *
+ *   CI run:   gh run view 26931370215 -R TapeshN/notquality
+ *             branch: notquality-app/prod-migrate
+ *             sha:    5732ed5a37ba46c503d1319da83c5c6f4c8e5cb6
+ *             workflow: CI (validate job, job ID 79451559554)
+ *             completed: 2026-06-04T04:46:20Z  (duration: ~1m13s)
+ *             conclusion: success
+ *             steps: typecheck, lint, validate:bugs, prisma generate, build — all green
+ *
+ *   PR:       gh pr view 52 -R TapeshN/notquality --json number,url,reviewDecision,mergeable,statusCheckRollup
+ *             title: "Run prisma migrate deploy before build on Vercel"
+ *             branch: notquality-app/prod-migrate
+ *             number: 52
+ *             url: https://github.com/TapeshN/notquality/pull/52
+ *             reviewDecision: "" (no review assigned — open PR, no blocking change requests)
+ *             mergeable: MERGEABLE
+ *             status checks: CI validate → SUCCESS, E2E playwright → SUCCESS, Vercel → SUCCESS
+ *
+ *   Repo inventory (gh ls-tree -r origin/main, 2026-06-04):
+ *             29 spec files, 77 source .ts/.tsx files (excl. e2e), 19 route pages
+ *             playwright.config.ts present (.github/workflows/e2e.yml present)
+ *             CI: .github/workflows/ci.yml present (typecheck + lint + validate:bugs + build)
+ *             auth: dual auth (iron-session playground + NextAuth platform)
+ *             test-id hygiene: data-testid used in app/ + e2e/ (29 spec files use getByTestId)
+ *             challenges: 1 seeded (legacy-bug-hunt-1); 16-card static list page (P5 truth-fix target)
+ *
+ * COLLECTION TIMESTAMP: 2026-06-04T09:00:00.000Z
+ *
+ * This fixture is intentionally FROZEN at this point in time. When real delivery
+ * signals are updated, create a NEW fixture version (fixture-v2.ts, etc.) and
+ * update the integration tests to use the latest. Never silently mutate this file —
+ * the provenance citation is load-bearing for the eval/audit trail.
+ */
+export const FIXTURE_COLLECTION_TS = '2026-06-04T09:00:00.000Z';
+/**
+ * Real CI run data from notquality E2E workflow (run #26931370208).
+ * Source: gh run view 26931370208 -R TapeshN/notquality
+ */
+export const NOTQUALITY_E2E_RUN = {
+    /** ISO-8601 timestamp of run completion. */
+    completedAt: '2026-06-04T04:46:20.000Z',
+    /** CI build step succeeded (typecheck, lint, validate:bugs, prisma generate, build). */
+    buildPassed: true,
+    /**
+     * 168 runnable tests (194 total test() calls − 26 test.fixme/test.skip markers).
+     * All 168 passed in this run. Source: spec-file grep + run conclusion=success.
+     */
+    testsPassed: 168,
+    testsFailed: 0,
+    testsErrored: 0,
+    /**
+     * 26 tests marked test.fixme or test.skip across 16 spec files.
+     * These are known quarantined defects (color-contrast a11y, label regression,
+     * EVT-001, duplicate challenge-title) — intentional, not infra failures.
+     */
+    testsFlaky: 0,
+    runUrl: 'https://github.com/TapeshN/notquality/actions/runs/26931370208',
+    workflowName: 'E2E (playwright)',
+};
+/**
+ * Real CI validate-job data from notquality CI workflow (run #26931370215).
+ * Source: gh run view 26931370215 -R TapeshN/notquality
+ */
+export const NOTQUALITY_CI_RUN = {
+    completedAt: '2026-06-04T04:46:20.000Z',
+    buildPassed: true,
+    testsPassed: 0, // CI job runs lint/typecheck/validate:bugs — no Jest/Vitest unit tests yet
+    testsFailed: 0,
+    testsErrored: 0,
+    runUrl: 'https://github.com/TapeshN/notquality/actions/runs/26931370215',
+    workflowName: 'CI (validate)',
+};
+/**
+ * Real PR #52 metadata from notquality.
+ * Source: gh pr view 52 -R TapeshN/notquality --json number,url,reviewDecision,mergeable,statusCheckRollup
+ */
+export const NOTQUALITY_PR_52 = {
+    number: 52,
+    url: 'https://github.com/TapeshN/notquality/pull/52',
+    reviewDecision: null, // no review assigned — open PR, no blocking changes_requested
+    mergeable: 'MERGEABLE',
+    statusCheckRollup: [
+        {
+            state: 'SUCCESS',
+            name: 'validate',
+            targetUrl: 'https://github.com/TapeshN/notquality/actions/runs/26931370215/job/79451559554',
+        },
+        {
+            state: 'SUCCESS',
+            name: 'playwright',
+            targetUrl: 'https://github.com/TapeshN/notquality/actions/runs/26931370208/job/79451559555',
+        },
+        {
+            state: 'SUCCESS',
+            name: 'Vercel',
+            targetUrl: 'https://vercel.com/tapeshnagarwal-7364s-projects/notquality-app/5mSLRhKKEdwvnqMoTY4XWxSePFYB',
+        },
+        {
+            state: 'SUCCESS',
+            name: 'Vercel Preview Comments',
+            targetUrl: 'https://vercel.com/github',
+        },
+    ],
+    noPr: false,
+};
+/**
+ * Repo-level automation maturity facts (from static scan of origin/main, 2026-06-04).
+ * These facts drive the test-automation EvidenceItem used when qulib_score_automation
+ * is held (no live local scan in this fixture — see HELD note below).
+ *
+ * HELD: The live qulib_score_automation(repoPath) call requires the notquality
+ * repo to be available at an absolute path on the build machine and needs the full
+ * qulib CLI. The integration test uses these pre-scored facts instead of a live scan.
+ * The live scan is operator-gated (run `qulib score-automation <path>` locally).
+ */
+export const NOTQUALITY_AUTOMATION_MATURITY = {
+    /**
+     * Estimated overall automation maturity score (0–100).
+     * Basis: Playwright present (framework-adoption ✓), 29 spec files covering 19 routes
+     * (test-coverage-breadth ~72%), e2e.yml + ci.yml present (ci-integration ✓),
+     * auth-test-coverage present (iron-session + NextAuth both tested ✓),
+     * data-testid used in spec files (test-id-hygiene present but not perfect — duplicate
+     * challenge-title test-id is a known defect, P5 truth-fix target), no component/unit
+     * tests yet (component-test-ratio = 0). Estimated L3 (60–79 range).
+     * Conservative estimate: 65/100.
+     */
+    overallScore: 65,
+    level: 3,
+    label: 'L3 — building maturity',
+    /**
+     * Key facts cited (no live scan was run; these are statically-derived):
+     * - framework: Playwright (playwright.config.ts present on origin/main)
+     * - specFiles: 29 (git ls-tree origin/main | grep "e2e/" | grep "spec.ts")
+     * - routePages: 19 (git ls-tree origin/main | grep "app/" | grep "page.tsx")
+     * - ciWorkflows: 2 (.github/workflows/ci.yml + e2e.yml)
+     * - authTests: yes (e2e/specs/auth/ — 3 spec files, 18 test() calls)
+     * - testIdHygiene: partial (data-testid used; duplicate challenge-title known defect)
+     * - componentTests: 0 (no vitest/jest unit tests in repo)
+     */
+    topRecommendations: [
+        'Add vitest/jest unit tests for lib/ (scoring, API helpers) to raise component-test-ratio.',
+        'Fix duplicate data-testid="challenge-title" (breadcrumb vs h1) for unambiguous E2E selectors.',
+        'Add dedicated challenges list + attempt E2E specs once fake list page is replaced with DB truth.',
+    ],
+    computedAt: FIXTURE_COLLECTION_TS,
+    repoPath: 'TapeshN/notquality@5732ed5a (origin/main, 2026-06-04)',
+};
+/**
+ * Repository context for the ConfidenceSubject.
+ * ref: the commit SHA + branch context; tenantId: 'notquality' (multi-tenant from day one).
+ */
+export const NOTQUALITY_SUBJECT = {
+    kind: 'release',
+    ref: 'TapeshN/notquality@5732ed5a (notquality-app/prod-migrate)',
+    tenantId: 'notquality',
+};

package/dist/examples/notquality-dogfood/run.d.ts

@@ -0,0 +1,34 @@
+/**
+ * notquality DOGFOOD — runnable example.
+ *
+ * P5: qulib scoring a real app we own. This is the confidence-layer thesis
+ * proven on a live delivery pipeline: qulib ingests notquality's CI results,
+ * PR metadata, and automation maturity, then emits a real Release Confidence
+ * score + verdict.
+ *
+ * Run with:
+ *   npx tsx packages/core/src/examples/notquality-dogfood/run.ts
+ *
+ * What it does:
+ *   1. Loads DATED real-sample fixture (provenance: gh CLI, 2026-06-04).
+ *   2. Maps CI run → ciResultsToEvidence (EvidenceItem, source='ci-results').
+ *   3. Maps PR metadata → prMetadataToEvidence (EvidenceItem, source='deploy-metadata').
+ *   4. Builds a test-automation EvidenceItem from the pre-scored maturity facts.
+ *   5. Calls computeReleaseConfidence → fused score + verdict.
+ *   6. Prints a structured JSON report to stdout.
+ *
+ * HELD signals (operator-gated, not run here):
+ *   - qulib_score_automation live scan (requires local notquality checkout + qulib CLI).
+ *     Instead this example uses the statically-derived NOTQUALITY_AUTOMATION_MATURITY
+ *     from the fixture (documented, conservative, clearly labelled as pre-scored).
+ *   - analyze_app deployed crawl (external HTTP + optional LLM cost).
+ *     The live-app-quality and accessibility EvidenceItems are omitted here; the
+ *     pipeline runs correctly with a subset of evidence (partial-evidence honesty).
+ *
+ * Output format: NDJSON line appended to stdout (one JSON object per run).
+ * The rubricVersion field versions the roll-up formula so it can evolve without
+ * silently changing meaning (P5 stopgap formula; retires when qulib's own aggregator
+ * ships in P3/P4 roadmap).
+ */
+export {};
+//# sourceMappingURL=run.d.ts.map

package/dist/examples/notquality-dogfood/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/examples/notquality-dogfood/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG"}

package/dist/examples/notquality-dogfood/run.js

@@ -0,0 +1,139 @@
+/**
+ * notquality DOGFOOD — runnable example.
+ *
+ * P5: qulib scoring a real app we own. This is the confidence-layer thesis
+ * proven on a live delivery pipeline: qulib ingests notquality's CI results,
+ * PR metadata, and automation maturity, then emits a real Release Confidence
+ * score + verdict.
+ *
+ * Run with:
+ *   npx tsx packages/core/src/examples/notquality-dogfood/run.ts
+ *
+ * What it does:
+ *   1. Loads DATED real-sample fixture (provenance: gh CLI, 2026-06-04).
+ *   2. Maps CI run → ciResultsToEvidence (EvidenceItem, source='ci-results').
+ *   3. Maps PR metadata → prMetadataToEvidence (EvidenceItem, source='deploy-metadata').
+ *   4. Builds a test-automation EvidenceItem from the pre-scored maturity facts.
+ *   5. Calls computeReleaseConfidence → fused score + verdict.
+ *   6. Prints a structured JSON report to stdout.
+ *
+ * HELD signals (operator-gated, not run here):
+ *   - qulib_score_automation live scan (requires local notquality checkout + qulib CLI).
+ *     Instead this example uses the statically-derived NOTQUALITY_AUTOMATION_MATURITY
+ *     from the fixture (documented, conservative, clearly labelled as pre-scored).
+ *   - analyze_app deployed crawl (external HTTP + optional LLM cost).
+ *     The live-app-quality and accessibility EvidenceItems are omitted here; the
+ *     pipeline runs correctly with a subset of evidence (partial-evidence honesty).
+ *
+ * Output format: NDJSON line appended to stdout (one JSON object per run).
+ * The rubricVersion field versions the roll-up formula so it can evolve without
+ * silently changing meaning (P5 stopgap formula; retires when qulib's own aggregator
+ * ships in P3/P4 roadmap).
+ */
+import { ciResultsToEvidence } from '../../adapters/ci-results-adapter.js';
+import { prMetadataToEvidence } from '../../adapters/pr-metadata-adapter.js';
+import { computeReleaseConfidence } from '../../tools/scoring/confidence.js';
+import { FIXTURE_COLLECTION_TS, NOTQUALITY_E2E_RUN, NOTQUALITY_PR_52, NOTQUALITY_AUTOMATION_MATURITY, NOTQUALITY_SUBJECT, } from './fixture.js';
+// ---------------------------------------------------------------------------
+// Build the evidence bundle from real notquality delivery signals
+// ---------------------------------------------------------------------------
+/**
+ * E2E CI run → ci-results evidence item.
+ * Source: run #26931370208, E2E workflow, 2026-06-04.
+ */
+const e2eEvidence = ciResultsToEvidence(NOTQUALITY_E2E_RUN, FIXTURE_COLLECTION_TS);
+/**
+ * PR #52 metadata → deploy-metadata evidence item.
+ * Source: gh pr view 52 -R TapeshN/notquality, 2026-06-04.
+ */
+const prEvidence = prMetadataToEvidence({
+    ...NOTQUALITY_PR_52,
+    statusCheckRollup: NOTQUALITY_PR_52.statusCheckRollup.map((c) => ({ ...c })),
+}, FIXTURE_COLLECTION_TS);
+/**
+ * Automation maturity → test-automation evidence item.
+ * Source: static scan of origin/main, 2026-06-04.
+ * NOTE: This is a pre-scored estimate. Live qulib_score_automation(repoPath)
+ * is the authoritative signal; this is the operator-held substitute.
+ */
+const automationEvidence = {
+    source: 'test-automation',
+    score: NOTQUALITY_AUTOMATION_MATURITY.overallScore,
+    weight: 0.22,
+    applicability: 'applicable',
+    blocking: false,
+    evidence: [
+        `Automation maturity: ${NOTQUALITY_AUTOMATION_MATURITY.label} (score ${NOTQUALITY_AUTOMATION_MATURITY.overallScore})`,
+        `Source: static scan of ${NOTQUALITY_AUTOMATION_MATURITY.repoPath}`,
+        '29 E2E spec files, 168 runnable tests (26 fixme/skip quarantined), Playwright + CI wired.',
+        'No vitest/jest unit tests yet (component-test-ratio = 0).',
+    ],
+    recommendations: NOTQUALITY_AUTOMATION_MATURITY.topRecommendations.slice(),
+    reason: undefined,
+    collectedAt: FIXTURE_COLLECTION_TS,
+    collector: {
+        tool: 'qulib_score_automation.pre-scored',
+        inputRef: NOTQUALITY_AUTOMATION_MATURITY.repoPath,
+    },
+};
+// ---------------------------------------------------------------------------
+// Assemble ConfidenceInput and compute the score
+// ---------------------------------------------------------------------------
+const input = {
+    subject: NOTQUALITY_SUBJECT,
+    evidence: [e2eEvidence, prEvidence, automationEvidence],
+    policy: {
+        passThreshold: 80,
+        failThreshold: 30,
+        maxListLength: 5,
+        requiredSources: [],
+        // Default weights apply; explicit ci-results weight already on the EvidenceItem.
+    },
+};
+const result = computeReleaseConfidence(input);
+// ---------------------------------------------------------------------------
+// Emit the structured report
+// ---------------------------------------------------------------------------
+const report = {
+    rubricVersion: 'p5-dogfood-v1',
+    collectionTimestamp: FIXTURE_COLLECTION_TS,
+    tenantId: NOTQUALITY_SUBJECT.tenantId,
+    subject: NOTQUALITY_SUBJECT.ref,
+    sources: {
+        e2eRun: NOTQUALITY_E2E_RUN.runUrl,
+        ciRun: 'https://github.com/TapeshN/notquality/actions/runs/26931370215',
+        pr: NOTQUALITY_PR_52.url,
+        automationMaturity: `pre-scored from ${NOTQUALITY_AUTOMATION_MATURITY.repoPath}`,
+    },
+    heldSignals: [
+        'qulib_score_automation live scan (operator-gated: requires local notquality checkout)',
+        'analyze_app deployed crawl (operator-gated: external HTTP + optional LLM cost)',
+    ],
+    confidence: {
+        score: result.confidenceScore,
+        verdict: result.verdict,
+        level: result.level,
+        label: result.label,
+    },
+    contributions: result.contributions.map((c) => ({
+        source: c.source,
+        score: c.score,
+        effectiveWeight: c.effectiveWeight,
+        applicability: c.applicability,
+    })),
+    topRisks: result.topRisks,
+    recommendations: result.recommendedNextChecks,
+    honestyNotes: result.honestyNotes,
+    scoreFormula: result.scoreFormula,
+};
+// eslint-disable-next-line no-console
+console.log(JSON.stringify(report, null, 2));
+// Print a human-readable summary line on stderr for quick reading in CI.
+const verdictEmoji = {
+    ship: 'SHIP',
+    caution: 'CAUTION',
+    hold: 'HOLD',
+    block: 'BLOCK',
+};
+const v = verdictEmoji[result.verdict] ?? result.verdict.toUpperCase();
+process.stderr.write(`[notquality dogfood] confidence=${result.confidenceScore ?? 'null'} verdict=${v} (${result.label})\n`);