@surlymochan/evalid 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project are documented here. Detailed notes live in
 
 ## [Unreleased]
 
+## [0.5.6] - 2026-11-07
+
+### Changed
+- **Playwright 1.59.1 → 1.65.0 (#49)**: dev-dependency bump; paired Chromium 158.0.8127.18 (build 1254) verified locally. Test evidence: `npm test` 363 tests / 362 pass / 0 fail / 1 skipped (pre-existing); `drift:scan` + `pack:check` green.
+- **js-yaml 4.1.1 → 5.5.0 (major) (#50)**: dependency upgraded; the repo's only production use is `yaml.load` in `src/core/workflow-loader.js` (default schema) plus test-only loads of the two shipped workflows. Migration verified item by item before upgrading (2026-11-07, v4 vs v5 parsers run side by side): both `workflows/yolo.yaml` and `workflows/corps.yaml` parse deep-equal; scalar resolution is unchanged (`on`/`yes` stay strings, `017` stays decimal 17, `0o17` stays octal 15, `1:30` stays a string, anchors/aliases still resolve, duplicate keys still throw); empty input now throws `expected a document, but the input is empty` instead of returning `undefined` (the loader threw either way, the message is better). One real break, handled explicitly: v5's default CORE_SCHEMA no longer resolves the `<<` merge key — a merge key now survives as a literal `"<<"` property, and the loader rejects it with an actionable error ("Inline the merged mapping instead") instead of a confusing schema-validation failure. Pinning `YAML11_SCHEMA` was considered and rejected: it restores additive merging but flips scalars (`on`/`yes` → `true`, `017` → 15, `1:30` → 90) and throws on merge-with-override. The import form also changed with v5 (flat named exports, no default export): the four `import yaml from 'js-yaml'` sites now use `import * as yaml from 'js-yaml'`, call sites unchanged. Pinned by `test/workflow-loader-yaml5.test.js` (7 tests). No bench numbers are involved; the bench-number acceptance for P1-2 / P1-3 / P2-1 / P2-3 still awaits the MiniMax full-matrix batch.
+
+## [0.5.5] - 2026-11-07
+
+### Fixed
+- **Missing package main entry `src/index.js` (#46)**: the published package had no main entry file, so `import '@surlymochan/evalid'` / `require('@surlymochan/evalid')` could not resolve. The entry module is added and pinned by `test/package-entry.test.js`.
+
+### Changed
+- **Dead code removed (#47)**: `writePlanMarkdown` (+ its only caller `buildPlanCommands`), `readPendingGate`, `getLatestMissionSession`, and `resolveAtom` — 51 lines deleted, 0 added. Each was verified dead by repo-wide grep (src, bin, test, docs, scripts, including string-form references): only the definition site remained, with no documentation references. None of the four was part of the public `src/index.js` export surface. Test evidence: full `npm run verify` exit 0 on the merged tree.
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2 / P1-3 / P2-1 / P2-3 still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is running — no bench numbers are claimed in this release.
+
 ## [0.5.4] - 2026-11-07
 
 ### Fixed

package/RELEASE_NOTES.md

@@ -1,5 +1,25 @@
 # Release Notes
 
+## 0.5.6 - Playwright 1.65.0; js-yaml 5.5.0
+
+Patch release. Two dependency upgrades since 0.5.5, both verified by the full test suite (`npm run verify` exit 0 on the merged tree).
+
+**Playwright 1.59.1 → 1.65.0 (#49).** Dev-dependency bump; paired Chromium 158.0.8127.18 (build 1254) verified locally.
+
+**js-yaml 4.1.1 → 5.5.0 (#50).** Major upgrade, verified item by item before merging: both shipped workflows parse deep-equal under v4 and v5, scalar resolution is unchanged, and the one real break — v5 no longer resolves the `<<` merge key — is handled explicitly: the workflow loader now rejects a literal `<<` key with an actionable error telling the author to inline the merged mapping, instead of a confusing schema-validation failure. Pinned by `test/workflow-loader-yaml5.test.js` (7 tests).
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2, P1-3, P2-1 and P2-3 — the wall-clock/token/resolved lines from issue #5 — still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is running. No bench numbers are claimed in this release.
+
+## 0.5.5 - Package entry restored; dead code removed
+
+Patch release. Two small fixes since 0.5.4, both verified by the full test suite (`npm run verify` exit 0 on the merged tree).
+
+**Missing package main entry (#46).** The published package had no main entry file, so importing the package by name could not resolve. `src/index.js` is now present as the package entry and is pinned by `test/package-entry.test.js`.
+
+**Dead code removed (#47).** Four exported functions with zero callers are deleted (51 lines, 0 added): `writePlanMarkdown` (plus `buildPlanCommands`, which only it called), `readPendingGate`, `getLatestMissionSession`, and `resolveAtom`. Each was verified dead by repo-wide grep across src, bin, test, docs, and scripts, including string-form references — only the definition site remained in every case. None of the four was exported from the public `src/index.js` surface, so this is not a public API change. The modules themselves stay: their other exports (`load` / `dryRun`, `listPendingGates` / `ackPendingGate`, `getLatestPhaseRun`, `writeReviewArtifact`) are still used.
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2, P1-3, P2-1 and P2-3 — the wall-clock/token/resolved lines from issue #5 — still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is running. No bench numbers are claimed in this release.
+
 ## 0.5.4 - Phase-cost drift test stops flaking under load
 
 Patch release. One test-only fix: `npm run verify` was red on main because the phase-cost drift test tripped its 5% bound at 5.7% while the MiniMax batch was running, then went 7/7 green on a quiet re-run of the same file.

package/docs/launch-dossier.md

@@ -1,6 +1,6 @@
 # evalid Launch Dossier
 
-Generated: 2026-11-07T07:29:35.000Z
+Generated: 2026-11-07T15:22:52.000Z
 Mode: post_publish
 Verdict: conditionally ready: engine and adoption evidence are strong, registry publication remains required for a splash launch
 Launch ready: not yet
@@ -117,7 +117,7 @@ Evidence:
 - Adoption records: 1; status: pass
 - Goal audit: pass; goal: Keep evalid credible as an open-source agent delivery runtime: repo-owned workflow contracts, executable verification gates, durable project context, and honest benchmark evidence.
 - Package evidence: missing; source: registry_json
-- Package name/version: @surlymochan/evalid@0.5.4
+- Package name/version: @surlymochan/evalid@0.5.6
 
 ## Passing Evidence
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surlymochan/evalid",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Claimed != verified: a runtime verification layer for coding agents. It seals each test run and replays it from a clean snapshot, with a zero-judge gate pipeline (spec clarification, code review, TDD proof) and the xflow CLI.",
   "keywords": [
     "ai-agents",
@@ -77,9 +77,9 @@
   },
   "dependencies": {
     "ajv": "^8.12.0",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^5.5.0"
   },
   "devDependencies": {
-    "playwright": "^1.59.1"
+    "playwright": "^1.65.0"
   }
 }

package/src/agent_team/common.js

@@ -271,32 +271,6 @@ export async function synthesizePhaseArtifact(input = {}, context = {}, options
   };
 }
 
-export function buildPlanCommands(projectRoot) {
-  const packageJsonPath = resolve(projectRoot, 'package.json');
-  const packageJson = readJsonFile(packageJsonPath, null);
-  if (packageJson?.scripts?.test) {
-    return ['npm test'];
-  }
-  return ['echo "no test script configured"'];
-}
-
-export function writePlanMarkdown(projectRoot, changeId, phase = 'plan') {
-  const commands = buildPlanCommands(projectRoot);
-  const mdPath = resolveChangePath(projectRoot, changeId, `${phase}.md`);
-  const lines = [
-    '# Plan',
-    '',
-    '## Verification',
-    '',
-    '```bash',
-    ...commands,
-    '```',
-    '',
-  ];
-  writeTextFile(mdPath, lines.join('\n'));
-  return mdPath;
-}
-
 export function writeReviewArtifact(projectRoot, changeId, summary, findings = []) {
   const outputPath = resolveChangePath(projectRoot, changeId, 'review.json');
   writeJsonFile(outputPath, {

package/src/core/pending-gates.js

@@ -34,15 +34,6 @@ export function listPendingGates(projectRoot = process.cwd()) {
     .sort((left, right) => String(right.created_at || '').localeCompare(String(left.created_at || '')));
 }
 
-export function readPendingGate(projectRoot = process.cwd(), phase) {
-  const gateFile = resolve(resolvePendingGatesDir(projectRoot), `${phase}.json`);
-  if (!existsSync(gateFile)) {
-    return null;
-  }
-  const gate = readGateFile(gateFile);
-  return gate ? { ...gate, gate_file: gateFile } : null;
-}
-
 export function ackPendingGate(projectRoot = process.cwd(), phase, options = {}) {
   const gateFile = resolve(resolvePendingGatesDir(projectRoot), `${phase}.json`);
   if (!existsSync(gateFile)) {

package/src/core/phase-run-read.js

@@ -1,5 +1,3 @@
-import { listPhaseRunSessions } from './mission-state.js';
-
 function ensureArray(value) {
   return Array.isArray(value) ? value : [];
 }
@@ -21,7 +19,3 @@ export function getLatestPhaseEntry(phaseRun, phase) {
   const entries = ensureArray(phaseRun.phases).filter((entry) => entry.phase === phase);
   return entries.sort((left, right) => String(right.updated_at || '').localeCompare(String(left.updated_at || '')))[0] || null;
 }
-
-export function getLatestMissionSession(state, missionId) {
-  return listPhaseRunSessions(state, missionId)[0] || null;
-}

package/src/core/workflow-loader.js

@@ -16,7 +16,7 @@
 import { readFileSync, existsSync } from 'fs';
 import { resolve, dirname } from 'path';
 import { fileURLToPath } from 'url';
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 import Ajv from 'ajv';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -54,6 +54,13 @@ export function load(workflowPath, { skipRuntimeChecks = false } = {}) {
   const raw = readFileSync(absPath, 'utf8');
   const workflow = yaml.load(raw);
 
+  // js-yaml 5 loads with CORE_SCHEMA, which no longer resolves the `<<`
+  // merge key: a merge key now survives parsing as a literal "<<" property
+  // instead of merging. The schema below (additionalProperties: false)
+  // would reject it with a confusing validation error, so fail here with
+  // an actionable one. Anchors/aliases still work; only `<<` is affected.
+  assertNoMergeKeys(workflow, absPath);
+
   // 1. Schema validation
   const schema = loadSchema();
   const ajv = new Ajv({ allErrors: true });
@@ -108,6 +115,29 @@ export function load(workflowPath, { skipRuntimeChecks = false } = {}) {
 
 // ─── Runtime checks ──────────────────────────────────────────────────────────
 
+/**
+ * Reject literal `<<` keys left behind by js-yaml 5's CORE_SCHEMA default,
+ * which no longer resolves YAML merge keys. A workflow that relied on
+ * merging must inline the merged mapping instead. Walks the whole parsed
+ * document so the error names the exact location.
+ */
+function assertNoMergeKeys(value, workflowPath, trail = '$') {
+  if (Array.isArray(value)) {
+    value.forEach((item, i) => assertNoMergeKeys(item, workflowPath, `${trail}[${i}]`));
+    return;
+  }
+  if (value && typeof value === 'object') {
+    for (const [key, child] of Object.entries(value)) {
+      if (key === '<<') {
+        throw new Error(
+          `Workflow uses a YAML merge key ("<<") at ${trail} in ${workflowPath}, which js-yaml 5 no longer resolves. Inline the merged mapping instead.`
+        );
+      }
+      assertNoMergeKeys(child, workflowPath, `${trail}.${key}`);
+    }
+  }
+}
+
 import { spawnSync } from 'child_process';
 
 function checkBinOnPath(bin, description) {
@@ -151,13 +181,3 @@ export function dryRun(workflowPath, input = {}) {
 
   return { workflow, phases };
 }
-
-/**
- * Resolve a single atom from the registry to its invocation descriptor.
- * Used by the execution layer to dispatch atoms.
- */
-export function resolveAtom(atomId, registry) {
-  const def = registry.atoms[atomId];
-  if (!def) throw new Error(`Unknown atom: ${atomId}`);
-  return { ...def, id: atomId };
-}

package/src/index.js

@@ -0,0 +1,12 @@
+/**
+ * Programmatic entry point for @surlymochan/evalid.
+ *
+ * This is the file package.json "main" points to. It used to not exist at
+ * all, so `import '@surlymochan/evalid'` / `require('@surlymochan/evalid')`
+ * failed with MODULE_NOT_FOUND even though the published tarball shipped
+ * "main": "src/index.js". The package is CLI-first (bin: xflow), but the
+ * control-plane server is the one documented programmatic surface, so this
+ * module re-exports its starter. Importing this module has no side effects:
+ * it does not start a server.
+ */
+export { default, default as startServer } from './server.js';