@surlymochan/evalid 0.5.5 → 0.5.7

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project are documented here. Detailed notes live in
 
 ## [Unreleased]
 
+## [0.5.7] - 2026-11-08
+
+### Added
+- **c8 coverage config (#52)**: the repo previously had no coverage tooling. Added `c8` (^12.0.0) as a dev-dependency, `.c8rc.json` (covers `src/**` and `bin/**`, excludes `test/**`, reports to `coverage/`), and `npm run coverage`; `test/coverage-config.test.js` pins the wiring with 3 assertions; `coverage/` added to `.gitignore`; README dev-commands block gains one line. No runtime behavior changes. Test evidence: `npm run coverage` 372 tests / 372 pass / 0 fail (baseline 369, +3 new); measured coverage 84.64% statements / 62.73% branches / 94.02% functions, `coverage/lcov.info` generated. No bench numbers are involved; the bench-number acceptance for P1-2 / P1-3 / P2-1 / P2-3 still awaits the MiniMax full-matrix batch.
+
+## [0.5.6] - 2026-11-07
+
+### Changed
+- **Playwright 1.59.1 → 1.65.0 (#49)**: dev-dependency bump; paired Chromium 158.0.8127.18 (build 1254) verified locally. Test evidence: `npm test` 363 tests / 362 pass / 0 fail / 1 skipped (pre-existing); `drift:scan` + `pack:check` green.
+- **js-yaml 4.1.1 → 5.5.0 (major) (#50)**: dependency upgraded; the repo's only production use is `yaml.load` in `src/core/workflow-loader.js` (default schema) plus test-only loads of the two shipped workflows. Migration verified item by item before upgrading (2026-11-07, v4 vs v5 parsers run side by side): both `workflows/yolo.yaml` and `workflows/corps.yaml` parse deep-equal; scalar resolution is unchanged (`on`/`yes` stay strings, `017` stays decimal 17, `0o17` stays octal 15, `1:30` stays a string, anchors/aliases still resolve, duplicate keys still throw); empty input now throws `expected a document, but the input is empty` instead of returning `undefined` (the loader threw either way, the message is better). One real break, handled explicitly: v5's default CORE_SCHEMA no longer resolves the `<<` merge key — a merge key now survives as a literal `"<<"` property, and the loader rejects it with an actionable error ("Inline the merged mapping instead") instead of a confusing schema-validation failure. Pinning `YAML11_SCHEMA` was considered and rejected: it restores additive merging but flips scalars (`on`/`yes` → `true`, `017` → 15, `1:30` → 90) and throws on merge-with-override. The import form also changed with v5 (flat named exports, no default export): the four `import yaml from 'js-yaml'` sites now use `import * as yaml from 'js-yaml'`, call sites unchanged. Pinned by `test/workflow-loader-yaml5.test.js` (7 tests). No bench numbers are involved; the bench-number acceptance for P1-2 / P1-3 / P2-1 / P2-3 still awaits the MiniMax full-matrix batch.
+
 ## [0.5.5] - 2026-11-07
 
 ### Fixed

package/README.md

@@ -304,6 +304,7 @@ evalid aims to complement prompt-level workflow kits and spec tools, not replace
 npm ci
 npx playwright install chromium   # browser-evidence tests
 npm test                          # 270+ tests
+npm run coverage                  # same suite with a c8 coverage report in coverage/
 npm run drift:scan                # docs/skill/workflow drift checks
 npm run pack:check                # what would be published
 ```

package/RELEASE_NOTES.md

@@ -1,5 +1,23 @@
 # Release Notes
 
+## 0.5.7 - Coverage config (c8)
+
+Patch release. One addition since 0.5.6, verified by the full test suite.
+
+**c8 coverage config (#52).** The repo previously had no coverage tooling. Added `c8` (^12.0.0) as a dev-dependency, `.c8rc.json` (covers `src/**` and `bin/**`, excludes `test/**`), and `npm run coverage`, pinned by `test/coverage-config.test.js` (3 assertions). Measured on the merged tree: 372 tests / 372 pass / 0 fail; coverage 84.64% statements / 62.73% branches / 94.02% functions. No runtime behavior changes.
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2, P1-3, P2-1 and P2-3 — the wall-clock/token/resolved lines from issue #5 — still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is stopped on MiniMax Token Plan quota exhaustion. No bench numbers are claimed in this release.
+
+## 0.5.6 - Playwright 1.65.0; js-yaml 5.5.0
+
+Patch release. Two dependency upgrades since 0.5.5, both verified by the full test suite (`npm run verify` exit 0 on the merged tree).
+
+**Playwright 1.59.1 → 1.65.0 (#49).** Dev-dependency bump; paired Chromium 158.0.8127.18 (build 1254) verified locally.
+
+**js-yaml 4.1.1 → 5.5.0 (#50).** Major upgrade, verified item by item before merging: both shipped workflows parse deep-equal under v4 and v5, scalar resolution is unchanged, and the one real break — v5 no longer resolves the `<<` merge key — is handled explicitly: the workflow loader now rejects a literal `<<` key with an actionable error telling the author to inline the merged mapping, instead of a confusing schema-validation failure. Pinned by `test/workflow-loader-yaml5.test.js` (7 tests).
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2, P1-3, P2-1 and P2-3 — the wall-clock/token/resolved lines from issue #5 — still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is running. No bench numbers are claimed in this release.
+
 ## 0.5.5 - Package entry restored; dead code removed
 
 Patch release. Two small fixes since 0.5.4, both verified by the full test suite (`npm run verify` exit 0 on the merged tree).

package/docs/launch-dossier.md

@@ -1,6 +1,6 @@
 # evalid Launch Dossier
 
-Generated: 2026-11-07T11:18:35.000Z
+Generated: 2026-11-07T17:29:14.617Z
 Mode: post_publish
 Verdict: conditionally ready: engine and adoption evidence are strong, registry publication remains required for a splash launch
 Launch ready: not yet
@@ -117,7 +117,7 @@ Evidence:
 - Adoption records: 1; status: pass
 - Goal audit: pass; goal: Keep evalid credible as an open-source agent delivery runtime: repo-owned workflow contracts, executable verification gates, durable project context, and honest benchmark evidence.
 - Package evidence: missing; source: registry_json
-- Package name/version: @surlymochan/evalid@0.5.5
+- Package name/version: @surlymochan/evalid@0.5.7
 
 ## Passing Evidence
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surlymochan/evalid",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Claimed != verified: a runtime verification layer for coding agents. It seals each test run and replays it from a clean snapshot, with a zero-judge gate pipeline (spec clarification, code review, TDD proof) and the xflow CLI.",
   "keywords": [
     "ai-agents",
@@ -62,6 +62,7 @@
   "scripts": {
     "start": "node bin/xflow.js serve",
     "test": "node scripts/run-tests.mjs",
+    "coverage": "c8 node scripts/run-tests.mjs",
     "drift:scan": "node --test test/workflow-drift-scan.test.js",
     "doctor": "node bin/xflow.js doctor",
     "verify": "npm test",
@@ -77,9 +78,10 @@
   },
   "dependencies": {
     "ajv": "^8.12.0",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^5.5.0"
   },
   "devDependencies": {
-    "playwright": "^1.59.1"
+    "c8": "^12.0.0",
+    "playwright": "^1.65.0"
   }
 }

package/src/core/workflow-loader.js

@@ -16,7 +16,7 @@
 import { readFileSync, existsSync } from 'fs';
 import { resolve, dirname } from 'path';
 import { fileURLToPath } from 'url';
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 import Ajv from 'ajv';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -54,6 +54,13 @@ export function load(workflowPath, { skipRuntimeChecks = false } = {}) {
   const raw = readFileSync(absPath, 'utf8');
   const workflow = yaml.load(raw);
 
+  // js-yaml 5 loads with CORE_SCHEMA, which no longer resolves the `<<`
+  // merge key: a merge key now survives parsing as a literal "<<" property
+  // instead of merging. The schema below (additionalProperties: false)
+  // would reject it with a confusing validation error, so fail here with
+  // an actionable one. Anchors/aliases still work; only `<<` is affected.
+  assertNoMergeKeys(workflow, absPath);
+
   // 1. Schema validation
   const schema = loadSchema();
   const ajv = new Ajv({ allErrors: true });
@@ -108,6 +115,29 @@ export function load(workflowPath, { skipRuntimeChecks = false } = {}) {
 
 // ─── Runtime checks ──────────────────────────────────────────────────────────
 
+/**
+ * Reject literal `<<` keys left behind by js-yaml 5's CORE_SCHEMA default,
+ * which no longer resolves YAML merge keys. A workflow that relied on
+ * merging must inline the merged mapping instead. Walks the whole parsed
+ * document so the error names the exact location.
+ */
+function assertNoMergeKeys(value, workflowPath, trail = '$') {
+  if (Array.isArray(value)) {
+    value.forEach((item, i) => assertNoMergeKeys(item, workflowPath, `${trail}[${i}]`));
+    return;
+  }
+  if (value && typeof value === 'object') {
+    for (const [key, child] of Object.entries(value)) {
+      if (key === '<<') {
+        throw new Error(
+          `Workflow uses a YAML merge key ("<<") at ${trail} in ${workflowPath}, which js-yaml 5 no longer resolves. Inline the merged mapping instead.`
+        );
+      }
+      assertNoMergeKeys(child, workflowPath, `${trail}.${key}`);
+    }
+  }
+}
+
 import { spawnSync } from 'child_process';
 
 function checkBinOnPath(bin, description) {