@ruso-0/nreki 8.0.1 → 8.3.0

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 All notable changes to NREKI will be documented in this file.
 
+## 8.0.2 (2026-04-09) — Firewall Verification Test
+
+### Fixed (Test Coverage Gap)
+- **Numerical Sanity Firewall regression test:** v8.0.1 introduced an 8-layer
+  defense in depth against IEEE 754 NaN/Infinity propagation in the spectral
+  solver, but the firewall itself had no dedicated regression test — none of
+  the 712 existing tests constructed a graph that triggered real overflow in
+  the power iteration. This release adds a single test that builds a star
+  graph with extreme weights (1e150 × 1000 nodes), demonstrably overflows the
+  `norm` accumulator (`val² ≈ 1e306` × 1000 = `1e309 > Number.MAX_VALUE`),
+  and verifies that the Hot-Loop Thermal Guard catches `Infinity` in `norm`,
+  the λ₂ short-circuit catches the resulting `NaN`, and the function falls
+  back to the degenerate variant of the discriminated union (no `v2`,
+  `lambda3`, or `v3`). Defense without verification was half a defense; this
+  closes that gap.
+
+### Notes
+- **Tests:** 712 → 713 (the new firewall regression test).
+- **Behavioral change:** none. This is purely a coverage addition.
+- **No breaking changes.** No API surface modified.
+- The 3 deferred items from v8.0.1 remain deferred:
+  - **Kahan summation:** rejected (precision obliterated by `toFixed(4)`)
+  - **PageRank FP audit:** rejected (mathematically immune via L1 simplex)
+  - **God Object kernel refactor:** deferred to v8.1 (SRE rule: never mix
+    architectural refactors with critical patches)
+
+---
+
 ## 8.0.1 (2026-04-08) — IEEE 754 Hardening: NaN Sink Eradication
 
 ### Fixed (Critical — Mathematical Soundness)

package/README.md

@@ -2,7 +2,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/npm/v/@ruso-0/nreki?style=for-the-badge&color=blue" alt="npm version">
-  <img src="https://img.shields.io/badge/Tests-712-brightgreen?style=for-the-badge" alt="712 Tests">
+  <img src="https://img.shields.io/badge/Tests-713-brightgreen?style=for-the-badge" alt="713 Tests">
   <img src="https://img.shields.io/badge/AHI-9.7%2F10-brightgreen?style=for-the-badge" alt="AHI 9.7/10">
   <img src="https://img.shields.io/badge/Languages-TS%20%7C%20JS%20%7C%20Go%20%7C%20Python-blue?style=for-the-badge" alt="Multi-language">
   <img src="https://img.shields.io/badge/Cloud-Zero-orange?style=for-the-badge" alt="Zero Cloud">
@@ -24,7 +24,7 @@ AI proposes edit -> NREKI intercepts in RAM -> Compiler/LSP validates
   |              Some remain? ------> Full rollback. Disk untouched. Errors returned to agent.
 ```
 
-3 tools. 712 tests. 4 languages. Works with any MCP-compatible agent. Apache 2.0.
+3 tools. 713 tests. 4 languages. Works with any MCP-compatible agent. Apache 2.0.
 
 ---
 
@@ -147,6 +147,47 @@ True topological circuit rank via Union-Find on the type constraint graph. `beta
 
 ---
 
+## What's New in v8.3
+
+### Kernel Decomposition (v8.1)
+
+The 2,080-line God Object `nreki-kernel.ts` was decomposed into 4 focused modules:
+
+- `mutex.ts` — AsyncMutex FIFO with timeout protection
+- `types.ts` — All interfaces + IoC contracts (`TsHealingContext`, `LspHealingContext`)
+- `ttrd.ts` — Pure functions: `extractRawSignatures`, `detectSignatureRegression`, `isToxicType`
+- `healer.ts` — Both healers rewritten with Inversion of Control — healers no longer touch VFS, vfsClock, or tsBackend directly. Testable in isolation.
+
+### Production Hardening (v8.2)
+
+- **Token Drift Heartbeat** — Replaced call-count heuristic (15 calls) with token-physics (15,000 tokens default). ENV override: `NREKI_DRIFT_THRESHOLD`. Telemetry injected into header: `(Drift: X tokens | Limit: Y)`.
+- **Search Engine Segregation** — `VectorIndex` and `KeywordIndex` extracted to `src/search/`. Pure JavaScript, zero SQLite coupling. Ready for `node:sqlite` migration in v9.0.
+- **Handler Barrel Pattern** — 1,119-line `handlers/code.ts` split into `code/kernel-bridge.ts`, `code/read.ts`, `code/edit.ts`, `code/utils.ts`. Rate limiter stays in router (correct layer separation).
+- **WASM Deps Frozen** — `sql.js` and `tree-sitter-wasms` pinned to exact versions. No silent breakage from upstream updates.
+
+### Rayleigh Residual Guard (v8.3)
+
+Added a 4th defense layer to the spectral power iteration. Post-convergence, the solver computes `||Mv - μv||∞` and dies with `NaN` if the residual exceeds `1e-3`. This traps silent IEEE 754 drift that slips past the 3 existing guards (thermal, divergence, numerical sanity firewall).
+
+### interceptAtomicBatch Phase Extraction (v8.3)
+
+The 520-line ACID orchestrator was flattened into 3 private methods within `NrekiKernel`:
+
+- `phase1_injectVfs` — Path jail + VFS injection
+- `phase2_validateSidecars` — Go/Python LSP validation
+- `phase4_healingCascade` — Dual healer cascade (TS CodeFix API + LSP codeAction)
+
+Catch path untouched. ACID rollback semantics intact. The orchestrator now reads like a document.
+
+### engine.ts Flattening (v8.3)
+
+- **SessionTracker class** — Session state (`sessionSavings`) encapsulated. Saves one `Embedder.estimateTokens(content)` call per compression.
+- **`indexFile` split** — 124-line method → 28-line orchestrator + `indexPlaintextFallback` + `indexAstChunks`.
+- **`search` split** — 93-line method → 27-line orchestrator + `applyTectonicRelevanceScoring`.
+- **DB Facade grouping** — Delegation wrappers visually grouped under explicit `Facade` section headers.
+
+---
+
 ## The Architecture
 
 NREKI has 3 validation layers with multi-language support:
@@ -324,7 +365,7 @@ Re-injects 4-layer session state every ~15 tool calls to survive context compact
 
 | Metric | Value |
 |--------|-------|
-| Tests | 712 (44 suites) |
+| Tests | 713 (44 suites) |
 | Architecture Health Index | 9.7/10 (self-scored) |
 | Languages | 4 (TypeScript, JavaScript, Go, Python) |
 | Failure modes sealed | 32 (P1-P32) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ruso-0/nreki",
-  "version": "8.0.1",
+  "version": "8.3.0",
   "description": "MCP plugin that validates AI agent edits in RAM before they touch disk. Spectral clustering, architecture diffs, bridge detection, dead code oracle, and cross-file semantic checks for TypeScript, Go (gopls), and Python (pyright). Zero cloud dependencies.",
   "main": "dist/index.js",
   "type": "module",
@@ -60,8 +60,8 @@
     "@modelcontextprotocol/sdk": "^1.12.1",
     "chokidar": "^4.0.3",
     "picomatch": "^4.0.3",
-    "sql.js": "^1.12.0",
-    "tree-sitter-wasms": "^0.1.13",
+    "sql.js": "1.14.1",
+    "tree-sitter-wasms": "0.1.13",
     "web-tree-sitter": "^0.24.7",
     "zod": "^3.24.2"
   },