agentic-qe 3.11.1 → 3.11.3

package/.claude/skills/.validation/templates/eval.template.yaml

@@ -333,6 +333,42 @@ test_cases:
         accuracy: 0.4
         actionability: 0.2
 
+  # ---------------------------------------------------------------------------
+  # ORACLE CASE (preferred for test-generating skills) — ADR-113
+  # ---------------------------------------------------------------------------
+  # Instead of keyword-matching the output, RUN the generated test against a
+  # reference implementation (must pass) and its operator mutants (each surviving
+  # mutant is a missed bug). Mutation kill rate is the pass signal — a test that
+  # asserts nothing scores 0 and fails. Requires the skill output to be a test
+  # that imports the impl as `../src/<module_name>.mjs`.
+  - id: tc050_oracle_generated_test
+    description: "Generated test kills mutants of a reference implementation"
+    category: oracle
+    priority: critical
+
+    input:
+      code: |
+        export function inRange(x, lo, hi) {
+          return x >= lo && x <= hi;
+        }
+      context:
+        language: javascript
+
+    expected_output: {}   # not used in oracle mode
+
+    oracle:
+      module_name: inRange
+      reference_impl: |
+        export function inRange(x, lo, hi) {
+          return x >= lo && x <= hi;
+        }
+      threshold: 0.6        # minimum mutation kill rate
+      extract: first_code_block   # pull the test from the first ```code block``` in output
+
+    validation:
+      oracle: true          # grade as an oracle, not by keyword matching
+      # mutation_score_min: 0.6   # optional override of oracle.threshold
+
 # =============================================================================
 # Success Criteria
 # =============================================================================

package/.claude/skills/qe-code-intelligence/SKILL.md

@@ -39,6 +39,9 @@ aqe code deps src/
 
 # Analyze complexity and find hotspots
 aqe code complexity src/
+
+# Generate C4 architecture diagrams (Mermaid) with a confidence score
+aqe code c4 .
 ```
 
 ## Agent Workflow

package/.claude/skills/qe-quality-assessment/SKILL.md

@@ -94,6 +94,10 @@ await qualityAnalyzer.assessCode({
 await qualityGate.evaluate({
   gates: {
     coverage: { min: 80, blocking: true },
+    // Fault detection — coverage is necessary but NOT sufficient (ADR-113).
+    // A suite can hit 90% coverage and catch no bugs; mutation score does not lie.
+    mutationScore: { min: 0.6, blocking: false },   // warn-by-default; opt-in blocking
+    regenerability: { min: 0.5, blocking: false },  // Deletion Test: durable oracle backing per module
     complexity: { max: 15, blocking: false },
     vulnerabilities: { critical: 0, high: 0, blocking: true },
     duplications: { max: 3, blocking: false },
@@ -107,6 +111,27 @@ await qualityGate.evaluate({
 });
 ```
 
+### 2a. Regenerability gate (ADR-113)
+
+Coverage measures lines executed; **mutation score** measures whether the tests would
+*notice a bug*, and **regenerability** answers the Deletion Test — "if this module were
+deleted and regenerated, would a wrong rebuild be caught?" Regenerability = mutation
+score discounted by the durability tier backing the module (durable > live > ephemeral
+> none); ephemeral-only tests score low because they don't survive a reimplementation.
+
+```typescript
+import { evaluateRegenerabilityGate } from '../../../src/feedback/regenerability-gate.js';
+
+const verdict = evaluateRegenerabilityGate(moduleProfiles, {
+  mutationScoreMin: 0.6,
+  regenerabilityMin: 0.5,
+  mode: 'warn',   // 'block' to fail CI; warn-by-default so adoption never breaks pipelines
+});
+// verdict.passed (thresholds met) · verdict.blocking (should fail CI) · verdict.failures[]
+```
+
+Surface it next to coverage in reports: `Coverage 88% ✅ / Mutation 41% ⚠️ / Regenerability: ephemeral-only ⚠️`.
+
 ### 3. Deployment Readiness
 
 ```typescript

package/.claude/skills/qe-test-generation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "qe-test-generation"
-description: "Generates unit, integration, and e2e tests from code analysis including branch coverage, error paths, and edge cases. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright."
+description: "Generates durable-first tests — invariants, contracts, and property-based tests at boundaries that survive a reimplementation — plus unit, integration, and e2e coverage. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright."
 trust_tier: 3
 validation:
   schema_path: schemas/output.json
@@ -14,6 +14,31 @@ validation:
 
 Guide the use of v3's AI-powered test generation capabilities including pattern-based test synthesis, multi-framework support, and intelligent test case derivation from code analysis.
 
+## Write durable-first (the core rule)
+
+When AI makes code cheap to regenerate, the durable asset is the test that still
+holds after the implementation is thrown away and rewritten. Generate tests in
+**durability tiers**, and lead with the durable ones (ADR-113):
+
+| Tier | What it is | Survives a rewrite? | When to write |
+|------|-----------|---------------------|---------------|
+| **Durable** | Invariants, contracts/schemas, property-based tests, behavioral e2e — specified at the module's public boundary | **Yes** | **Always — ≥1 per target** |
+| **Ephemeral** | Example-based unit tests, mock-call/interaction tests (TDD-London style) | No (coupled to impl) | For the red-green loop; label them, delete freely |
+| **Live** | Monitoring / drift / cost assertions that run against reality | Continuously | For deployed behavior |
+
+**The language-swap heuristic:** *if reimplementing this module in another language
+would invalidate the test, the test is at the wrong boundary.* Push it up a tier —
+assert on the observable contract, not on how the current code happens to work.
+
+Every generated target MUST include at least one **durable** assertion (an invariant,
+a contract check, or a property). Mock-call assertions (`toHaveBeenCalledWith`) are
+ephemeral by definition — never let them be the only thing testing a target. Tag each
+generated test `// @tier durable|ephemeral|live` so its lifetime is explicit.
+
+These tests are graded as **oracles**: a good test passes against the real code and
+*fails* against a seeded bug (mutant). A test that asserts nothing, or only the happy
+path, kills no mutants and is rejected — see `/mutation-testing` and ADR-113.
+
 ## Activation
 
 - When generating tests for new code
@@ -41,25 +66,29 @@ aqe test generate --pattern repository --target src/repositories/
 ## Agent Workflow
 
 ```typescript
-// Spawn test generation agents
-Task("Generate unit tests", `
-  Analyze src/services/PaymentService.ts and generate comprehensive Jest tests.
-  Include:
-  - Happy path tests for all public methods
-  - Edge cases and boundary conditions
-  - Error handling scenarios
-  - Mock external dependencies
+// Spawn test generation agents — durable-first
+Task("Generate durable-first tests", `
+  Analyze src/services/PaymentService.ts and generate Jest tests in tier order.
+  1. DURABLE (write these first, >=1 per public method):
+     - Invariants ("a refund never makes a balance negative")
+     - Contract/schema checks on inputs and outputs crossing the boundary
+     - Property-based tests (fast-check) over input ranges, not single examples
+  2. EPHEMERAL (the red-green loop; tag '// @tier ephemeral'):
+     - Specific happy-path examples and error paths
+     - Mock external dependencies ONLY — never let a mock-call assertion be the
+       only test for a method
+  Apply the language-swap check: if a Python rewrite of PaymentService would break
+  the test, move it up to the durable tier.
   Output to tests/unit/services/PaymentService.test.ts
-`, "qe-test-generator")
-
-// Pattern-based generation
-Task("Apply test patterns", `
-  Scan src/repositories/ and apply repository test pattern:
-  - CRUD operation tests
-  - Query builder tests
-  - Transaction tests
-  - Connection error handling
-`, "qe-pattern-matcher")
+`, "qe-test-architect")
+
+// Property + contract generation (first-class, not opt-in)
+Task("Generate property and contract tests", `
+  For src/repositories/, derive:
+  - Properties: round-trip (write→read returns same), idempotence, ordering invariants
+  - Contracts: the repository interface schema, enforced on every CRUD result
+  These survive a storage-engine swap; example-based CRUD tests do not.
+`, "qe-property-tester")
 ```
 
 ## Test Generation Strategies
@@ -122,6 +151,15 @@ await testGenerator.fillCoverageGaps({
 
 ```yaml
 quality_checks:
+  durability:                  # the primary check (ADR-113)
+    durable_assertions_per_target: 1   # >=1 invariant/contract/property each
+    language_swap_safe: true           # would survive a reimplementation
+    tier_tags_present: true            # every test tagged durable|ephemeral|live
+
+  fault_detection:             # do the tests actually catch bugs?
+    mutation_score_min: 0.6            # kill rate against seeded mutants
+    no_assertionless_tests: true       # reject tests that kill 0 mutants
+
   assertions:
     minimum_per_test: 1
     meaningful: true
@@ -134,7 +172,7 @@ quality_checks:
     descriptive: true
     follows_convention: true
 
-  coverage:
+  coverage:                    # necessary but NOT sufficient — see fault_detection
     branches: 80
     statements: 85
 ```

package/.claude/skills/qe-test-generation/evals/qe-test-generation.yaml

@@ -134,6 +134,43 @@ test_cases:
       schema_check: true
       allow_partial: true
 
+  # ORACLE CASE (ADR-113): grade the generated test by running it against a
+  # reference impl + operator mutants. Skips under the simulating runner; runs
+  # in the live eval lane (a provider must produce the test). This is what makes
+  # this eval a real oracle instead of a keyword grep.
+  - id: tc006_oracle_generated_test
+    description: "Generated test kills mutants of a reference function"
+    category: oracle
+    priority: critical
+
+    input:
+      code: |
+        export function classify(score, bonus) {
+          const total = score + bonus;
+          if (total >= 90 && bonus > 0) return 'A';
+          if (total >= 70) return 'B';
+          return 'C';
+        }
+      context:
+        language: javascript
+
+    expected_output: {}
+
+    oracle:
+      module_name: classify
+      reference_impl: |
+        export function classify(score, bonus) {
+          const total = score + bonus;
+          if (total >= 90 && bonus > 0) return 'A';
+          if (total >= 70) return 'B';
+          return 'C';
+        }
+      threshold: 0.6
+      extract: first_code_block
+
+    validation:
+      oracle: true
+
 success_criteria:
   pass_rate: 0.9
   critical_pass_rate: 1.0

package/.claude/skills/skills-manifest.json

@@ -939,7 +939,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.11.1",
+    "fleetVersion": "3.11.3",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,77 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.11.3] - 2026-06-27
+
+Tests and evals you can actually trust, cheaper model options, and a guard that
+keeps AQE's commands and outputs stable for your scripts.
+
+AQE now grades a generated test by **running it** — against the real code (it must
+pass) and against deliberately-broken versions (it must catch them) — instead of
+checking for keywords. Test generation leads with **durable tests** (invariants,
+contracts, properties) that survive a rewrite, and quality reports add a
+**mutation-score / regenerability** signal next to coverage. See the new
+[oracle-evals plan](docs/plans/oracle-evals-durable-tests-plan.md) (ADR-113) and the
+[conservation-layer policy](docs/guides/conservation-layer-policy.md) (ADR-114).
+
+### Added
+
+- **Oracle evals** — skill evals run the generated test against a reference
+  implementation plus seeded mutants; an assertion-less or wrong test is rejected.
+- **Durable-first test generation** — `qe-test-generation` now emits invariants,
+  contracts, and property-based tests first (with a "would this survive a rewrite?"
+  check), keeping happy-path/mock tests as a labeled, disposable tier.
+- **Regenerability gate** — `qe-quality-assessment` reports mutation score + a
+  per-module regenerability score alongside coverage (warn by default, opt-in blocking).
+- **Conservation guard** — `npm run verify:conservation` + `verify:skill-parity` catch
+  breaking changes to CLI commands, report output schemas, the dashboard API, and skill
+  trees, with a deprecation policy so removals are deliberate and announced.
+- **Cheaper model lanes** — pick a budget or local model for test generation and prove
+  it clears the oracle: `npm run providers:health`, `eval:models`, `eval:live:*`. See the
+  [cheaper-model guide](docs/guides/cheaper-model-eval-lanes.md).
+
+### Fixed
+
+- **OpenRouter provider** now works through the provider manager (it previously failed
+  to route because it identified itself as `openai`).
+- **Gemini provider** default model updated to a current model (`gemini-2.5-flash`); the
+  old default had been retired by Google. Supported-model list and pricing refreshed.
+
+## [3.11.2] - 2026-06-27
+
+First-class **C4 architecture diagrams** generated straight from your codebase —
+with a confidence score so you know how much to trust them. AQE detects your
+components, the external systems they depend on, and their *real* relationships
+(from the code's import/call graph), renders standard [C4](https://c4model.com/)
+Mermaid you can paste into GitHub or an IDE, and exposes it through both the CLI
+and an MCP tool.
+
+See the new [C4 architecture diagrams guide](docs/guides/c4-architecture-diagrams.md).
+
+### Added
+
+- **`aqe code c4 <path>`** — generate Context / Container / Component C4 diagrams
+  (Mermaid) for a repository, with `--level context|container|component|all`,
+  `--format text|json`, and `-o <file>`.
+- **`qe/code/c4` MCP tool** — the same generation for agents and IDEs, plus
+  semantic `search` over previously generated diagrams.
+- **Confidence gate** — every diagram is scored high / medium / low (deterministic,
+  no AI judging another AI) with the reasons, so an auto-detected diagram is never
+  presented as ground truth. Large or under-segmented repos are flagged as drafts.
+- **Real relationships from the Knowledge Graph** — component arrows now come from
+  actual import/call edges (AST), not name-based guessing.
+
+### Changed
+
+- C4 generation is consolidated onto a single engine. On a render failure it now
+  **reports the error** instead of silently falling back to a weaker diagram.
+
+### Fixed
+
+- Knowledge Graph file reads can be scoped to a project root, so analyzing a
+  repository outside the current working directory no longer trips the file-path
+  safety guard.
+
 ## [3.11.1] - 2026-06-25
 
 Benchmark-driven deepening of the opt-in "cheap-first" test generation from

package/README.md

@@ -359,6 +359,7 @@ aqe code search "authentication"     # Semantic code search
 aqe code impact src/                 # Change impact analysis
 aqe code deps src/                   # Dependency mapping
 aqe code complexity src/             # Complexity metrics and hotspots
+aqe code c4 .                        # C4 architecture diagrams (Mermaid) + confidence
 ```
 
 ---

package/assets/skills/.validation/templates/eval.template.yaml

@@ -333,6 +333,42 @@ test_cases:
         accuracy: 0.4
         actionability: 0.2
 
+  # ---------------------------------------------------------------------------
+  # ORACLE CASE (preferred for test-generating skills) — ADR-113
+  # ---------------------------------------------------------------------------
+  # Instead of keyword-matching the output, RUN the generated test against a
+  # reference implementation (must pass) and its operator mutants (each surviving
+  # mutant is a missed bug). Mutation kill rate is the pass signal — a test that
+  # asserts nothing scores 0 and fails. Requires the skill output to be a test
+  # that imports the impl as `../src/<module_name>.mjs`.
+  - id: tc050_oracle_generated_test
+    description: "Generated test kills mutants of a reference implementation"
+    category: oracle
+    priority: critical
+
+    input:
+      code: |
+        export function inRange(x, lo, hi) {
+          return x >= lo && x <= hi;
+        }
+      context:
+        language: javascript
+
+    expected_output: {}   # not used in oracle mode
+
+    oracle:
+      module_name: inRange
+      reference_impl: |
+        export function inRange(x, lo, hi) {
+          return x >= lo && x <= hi;
+        }
+      threshold: 0.6        # minimum mutation kill rate
+      extract: first_code_block   # pull the test from the first ```code block``` in output
+
+    validation:
+      oracle: true          # grade as an oracle, not by keyword matching
+      # mutation_score_min: 0.6   # optional override of oracle.threshold
+
 # =============================================================================
 # Success Criteria
 # =============================================================================

package/assets/skills/enterprise-integration-testing/SKILL.md

@@ -82,7 +82,7 @@ When testing enterprise integrations or SAP-connected systems:
 ### Tools
 - **SAP**: SAP GUI, Transaction codes (SE37, WE19, SEGW), Eclipse ADT
 - **Middleware**: IBM IIB/ACE, MuleSoft, SAP PI/PO/CPI
-- **Testing**: SoapUI, Postman, Playwright, custom harnesses
+- **Testing**: SoapUI, Postman, qe-browser (via Vibium for Fiori/web UIs), custom harnesses
 - **Monitoring**: SAP Solution Manager, Splunk, Dynatrace
 - **Data**: SAP LSMW, SECATT, eCATT
 

package/assets/skills/pentest-validation/SKILL.md

@@ -124,7 +124,7 @@ Every pentest validation run MUST:
 ### XSS Pipeline
 | Attack | Tier 1 (Pattern) | Tier 2 (Payload) | Tier 3 (Full) |
 |--------|-------------------|-------------------|----------------|
-| Reflected XSS | No output encoding | `<img onerror>` reflection | Browser JS execution via Playwright |
+| Reflected XSS | No output encoding | `<img onerror>` reflection | Browser JS execution via qe-browser (Vibium) |
 | Stored XSS | `innerHTML` assignment | Payload stored + retrieved | Cookie theft PoC |
 | DOM XSS | `document.write(location)` | Fragment injection | DOM manipulation proof |
 

package/assets/skills/qcsd-development-swarm/SKILL.md

@@ -3,7 +3,7 @@ name: qcsd-development-swarm
 description: "Use when monitoring in-sprint code quality with TDD adherence checks, complexity analysis, coverage gap detection, or defect prediction in the QCSD Development phase."
 category: qcsd-phases
 priority: critical
-version: 1.0.0
+version: 1.1.0
 tokenEstimate: 3400
 # DDD Domain Mapping (from QCSD-AGENTIC-QE-MAPPING-FRAMEWORK.md)
 domains:
@@ -34,13 +34,14 @@ agents:
   total: 10
   sub_agents: 0
 skills: [tdd-london-chicago, mutation-testing, performance-testing, security-testing]
-# Execution Models (Task Tool is PRIMARY)
+# Execution Models (Workflow is PRIMARY where the harness supports it — ADR-102)
 execution:
-  primary: task-tool
-  alternatives: [mcp-tools, cli]
+  primary: workflow
+  workflow_name: qcsd-development-review
+  alternatives: [task-tool, mcp-tools, cli]
 swarm_pattern: true
 parallel_batches: 3
-last_updated: 2026-02-03
+last_updated: 2026-06-10
 enforcement_level: strict
 tags: [qcsd, development, tdd, complexity, coverage, security, performance, mutation, defect-prediction, swarm, parallel, ddd]
 trust_tier: 3
@@ -192,10 +193,30 @@ skip to step N. Ensure you have the required prerequisite data from prior steps.
 
 | Model | When to Use | Agent Spawn |
 |-------|-------------|-------------|
-| **Task Tool** (PRIMARY) | Claude Code sessions | `Task({ subagent_type, run_in_background: true })` |
+| **Workflow** (PRIMARY, ADR-102) | Harness with the Workflow tool | `Workflow({ name: "qcsd-development-review", args: { sourcePath, testPath } })` |
+| **Task Tool** (fallback) | Claude Code sessions without Workflow support | `Task({ subagent_type, run_in_background: true })` |
 | **MCP Tools** | MCP server available | `fleet_init({})` / `task_submit({})` |
 | **CLI** | Terminal/scripts | `swarm init` / `agent spawn` |
 
+### Workflow execution (ADR-102)
+
+`.claude/workflows/qcsd-development-review.js` runs the review as a deterministic
+pipeline: one finder per quality dimension (TDD adherence, complexity, coverage
+gaps — `args.dimensions` selects a subset) → **3 blind adversarial refuters per
+finding** (Loki-mode, ADR-074: refuters see only the bare claim + evidence,
+never the finder's confidence or each other; uncertainty defaults to refuted)
+→ deterministic synthesis into `finding-verdict@1` envelopes (ADR-103,
+`schemas/finding-verdict.schema.json`). A finding survives only if fewer than
+⌈N/2⌉ refuters kill it. The final report contains ONLY confirmed findings;
+killed findings are retained under `killed` with their refutations for audit.
+
+Args: `sourcePath` (required), `testPath`, `dimensions` (subset of
+`tdd-adherence|complexity|coverage-gaps`), `maxFindings` per dimension (default 5).
+
+When the Workflow tool is unavailable, fall back to the Task-tool protocol
+below — the report format and gates are identical, minus the adversarial
+verification stage (note this in the report header as `verification: none`).
+
 ---
 
 ## Key Principle

package/assets/skills/qe-code-intelligence/SKILL.md

@@ -39,6 +39,9 @@ aqe code deps src/
 
 # Analyze complexity and find hotspots
 aqe code complexity src/
+
+# Generate C4 architecture diagrams (Mermaid) with a confidence score
+aqe code c4 .
 ```
 
 ## Agent Workflow

package/assets/skills/qe-quality-assessment/SKILL.md

@@ -94,6 +94,10 @@ await qualityAnalyzer.assessCode({
 await qualityGate.evaluate({
   gates: {
     coverage: { min: 80, blocking: true },
+    // Fault detection — coverage is necessary but NOT sufficient (ADR-113).
+    // A suite can hit 90% coverage and catch no bugs; mutation score does not lie.
+    mutationScore: { min: 0.6, blocking: false },   // warn-by-default; opt-in blocking
+    regenerability: { min: 0.5, blocking: false },  // Deletion Test: durable oracle backing per module
     complexity: { max: 15, blocking: false },
     vulnerabilities: { critical: 0, high: 0, blocking: true },
     duplications: { max: 3, blocking: false },
@@ -107,6 +111,27 @@ await qualityGate.evaluate({
 });
 ```
 
+### 2a. Regenerability gate (ADR-113)
+
+Coverage measures lines executed; **mutation score** measures whether the tests would
+*notice a bug*, and **regenerability** answers the Deletion Test — "if this module were
+deleted and regenerated, would a wrong rebuild be caught?" Regenerability = mutation
+score discounted by the durability tier backing the module (durable > live > ephemeral
+> none); ephemeral-only tests score low because they don't survive a reimplementation.
+
+```typescript
+import { evaluateRegenerabilityGate } from '../../../src/feedback/regenerability-gate.js';
+
+const verdict = evaluateRegenerabilityGate(moduleProfiles, {
+  mutationScoreMin: 0.6,
+  regenerabilityMin: 0.5,
+  mode: 'warn',   // 'block' to fail CI; warn-by-default so adoption never breaks pipelines
+});
+// verdict.passed (thresholds met) · verdict.blocking (should fail CI) · verdict.failures[]
+```
+
+Surface it next to coverage in reports: `Coverage 88% ✅ / Mutation 41% ⚠️ / Regenerability: ephemeral-only ⚠️`.
+
 ### 3. Deployment Readiness
 
 ```typescript

package/assets/skills/qe-test-generation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "qe-test-generation"
-description: "Generates unit, integration, and e2e tests from code analysis including branch coverage, error paths, and edge cases. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright."
+description: "Generates durable-first tests — invariants, contracts, and property-based tests at boundaries that survive a reimplementation — plus unit, integration, and e2e coverage. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright."
 trust_tier: 3
 validation:
   schema_path: schemas/output.json
@@ -14,6 +14,31 @@ validation:
 
 Guide the use of v3's AI-powered test generation capabilities including pattern-based test synthesis, multi-framework support, and intelligent test case derivation from code analysis.
 
+## Write durable-first (the core rule)
+
+When AI makes code cheap to regenerate, the durable asset is the test that still
+holds after the implementation is thrown away and rewritten. Generate tests in
+**durability tiers**, and lead with the durable ones (ADR-113):
+
+| Tier | What it is | Survives a rewrite? | When to write |
+|------|-----------|---------------------|---------------|
+| **Durable** | Invariants, contracts/schemas, property-based tests, behavioral e2e — specified at the module's public boundary | **Yes** | **Always — ≥1 per target** |
+| **Ephemeral** | Example-based unit tests, mock-call/interaction tests (TDD-London style) | No (coupled to impl) | For the red-green loop; label them, delete freely |
+| **Live** | Monitoring / drift / cost assertions that run against reality | Continuously | For deployed behavior |
+
+**The language-swap heuristic:** *if reimplementing this module in another language
+would invalidate the test, the test is at the wrong boundary.* Push it up a tier —
+assert on the observable contract, not on how the current code happens to work.
+
+Every generated target MUST include at least one **durable** assertion (an invariant,
+a contract check, or a property). Mock-call assertions (`toHaveBeenCalledWith`) are
+ephemeral by definition — never let them be the only thing testing a target. Tag each
+generated test `// @tier durable|ephemeral|live` so its lifetime is explicit.
+
+These tests are graded as **oracles**: a good test passes against the real code and
+*fails* against a seeded bug (mutant). A test that asserts nothing, or only the happy
+path, kills no mutants and is rejected — see `/mutation-testing` and ADR-113.
+
 ## Activation
 
 - When generating tests for new code
@@ -41,25 +66,29 @@ aqe test generate --pattern repository --target src/repositories/
 ## Agent Workflow
 
 ```typescript
-// Spawn test generation agents
-Task("Generate unit tests", `
-  Analyze src/services/PaymentService.ts and generate comprehensive Jest tests.
-  Include:
-  - Happy path tests for all public methods
-  - Edge cases and boundary conditions
-  - Error handling scenarios
-  - Mock external dependencies
+// Spawn test generation agents — durable-first
+Task("Generate durable-first tests", `
+  Analyze src/services/PaymentService.ts and generate Jest tests in tier order.
+  1. DURABLE (write these first, >=1 per public method):
+     - Invariants ("a refund never makes a balance negative")
+     - Contract/schema checks on inputs and outputs crossing the boundary
+     - Property-based tests (fast-check) over input ranges, not single examples
+  2. EPHEMERAL (the red-green loop; tag '// @tier ephemeral'):
+     - Specific happy-path examples and error paths
+     - Mock external dependencies ONLY — never let a mock-call assertion be the
+       only test for a method
+  Apply the language-swap check: if a Python rewrite of PaymentService would break
+  the test, move it up to the durable tier.
   Output to tests/unit/services/PaymentService.test.ts
-`, "qe-test-generator")
-
-// Pattern-based generation
-Task("Apply test patterns", `
-  Scan src/repositories/ and apply repository test pattern:
-  - CRUD operation tests
-  - Query builder tests
-  - Transaction tests
-  - Connection error handling
-`, "qe-pattern-matcher")
+`, "qe-test-architect")
+
+// Property + contract generation (first-class, not opt-in)
+Task("Generate property and contract tests", `
+  For src/repositories/, derive:
+  - Properties: round-trip (write→read returns same), idempotence, ordering invariants
+  - Contracts: the repository interface schema, enforced on every CRUD result
+  These survive a storage-engine swap; example-based CRUD tests do not.
+`, "qe-property-tester")
 ```
 
 ## Test Generation Strategies
@@ -122,6 +151,15 @@ await testGenerator.fillCoverageGaps({
 
 ```yaml
 quality_checks:
+  durability:                  # the primary check (ADR-113)
+    durable_assertions_per_target: 1   # >=1 invariant/contract/property each
+    language_swap_safe: true           # would survive a reimplementation
+    tier_tags_present: true            # every test tagged durable|ephemeral|live
+
+  fault_detection:             # do the tests actually catch bugs?
+    mutation_score_min: 0.6            # kill rate against seeded mutants
+    no_assertionless_tests: true       # reject tests that kill 0 mutants
+
   assertions:
     minimum_per_test: 1
     meaningful: true
@@ -134,7 +172,7 @@ quality_checks:
     descriptive: true
     follows_convention: true
 
-  coverage:
+  coverage:                    # necessary but NOT sufficient — see fault_detection
     branches: 80
     statements: 85
 ```