agentic-qe 3.11.2 → 3.11.4

package/.claude/skills/.validation/templates/eval.template.yaml

@@ -333,6 +333,42 @@ test_cases:
         accuracy: 0.4
         actionability: 0.2
 
+  # ---------------------------------------------------------------------------
+  # ORACLE CASE (preferred for test-generating skills) — ADR-113
+  # ---------------------------------------------------------------------------
+  # Instead of keyword-matching the output, RUN the generated test against a
+  # reference implementation (must pass) and its operator mutants (each surviving
+  # mutant is a missed bug). Mutation kill rate is the pass signal — a test that
+  # asserts nothing scores 0 and fails. Requires the skill output to be a test
+  # that imports the impl as `../src/<module_name>.mjs`.
+  - id: tc050_oracle_generated_test
+    description: "Generated test kills mutants of a reference implementation"
+    category: oracle
+    priority: critical
+
+    input:
+      code: |
+        export function inRange(x, lo, hi) {
+          return x >= lo && x <= hi;
+        }
+      context:
+        language: javascript
+
+    expected_output: {}   # not used in oracle mode
+
+    oracle:
+      module_name: inRange
+      reference_impl: |
+        export function inRange(x, lo, hi) {
+          return x >= lo && x <= hi;
+        }
+      threshold: 0.6        # minimum mutation kill rate
+      extract: first_code_block   # pull the test from the first ```code block``` in output
+
+    validation:
+      oracle: true          # grade as an oracle, not by keyword matching
+      # mutation_score_min: 0.6   # optional override of oracle.threshold
+
 # =============================================================================
 # Success Criteria
 # =============================================================================

package/.claude/skills/qe-quality-assessment/SKILL.md

@@ -94,6 +94,10 @@ await qualityAnalyzer.assessCode({
 await qualityGate.evaluate({
   gates: {
     coverage: { min: 80, blocking: true },
+    // Fault detection — coverage is necessary but NOT sufficient (ADR-113).
+    // A suite can hit 90% coverage and catch no bugs; mutation score does not lie.
+    mutationScore: { min: 0.6, blocking: false },   // warn-by-default; opt-in blocking
+    regenerability: { min: 0.5, blocking: false },  // Deletion Test: durable oracle backing per module
     complexity: { max: 15, blocking: false },
     vulnerabilities: { critical: 0, high: 0, blocking: true },
     duplications: { max: 3, blocking: false },
@@ -107,6 +111,27 @@ await qualityGate.evaluate({
 });
 ```
 
+### 2a. Regenerability gate (ADR-113)
+
+Coverage measures lines executed; **mutation score** measures whether the tests would
+*notice a bug*, and **regenerability** answers the Deletion Test — "if this module were
+deleted and regenerated, would a wrong rebuild be caught?" Regenerability = mutation
+score discounted by the durability tier backing the module (durable > live > ephemeral
+> none); ephemeral-only tests score low because they don't survive a reimplementation.
+
+```typescript
+import { evaluateRegenerabilityGate } from '../../../src/feedback/regenerability-gate.js';
+
+const verdict = evaluateRegenerabilityGate(moduleProfiles, {
+  mutationScoreMin: 0.6,
+  regenerabilityMin: 0.5,
+  mode: 'warn',   // 'block' to fail CI; warn-by-default so adoption never breaks pipelines
+});
+// verdict.passed (thresholds met) · verdict.blocking (should fail CI) · verdict.failures[]
+```
+
+Surface it next to coverage in reports: `Coverage 88% ✅ / Mutation 41% ⚠️ / Regenerability: ephemeral-only ⚠️`.
+
 ### 3. Deployment Readiness
 
 ```typescript

package/.claude/skills/qe-test-generation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "qe-test-generation"
-description: "Generates unit, integration, and e2e tests from code analysis including branch coverage, error paths, and edge cases. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright."
+description: "Generates durable-first tests — invariants, contracts, and property-based tests at boundaries that survive a reimplementation — plus unit, integration, and e2e coverage. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright."
 trust_tier: 3
 validation:
   schema_path: schemas/output.json
@@ -14,6 +14,31 @@ validation:
 
 Guide the use of v3's AI-powered test generation capabilities including pattern-based test synthesis, multi-framework support, and intelligent test case derivation from code analysis.
 
+## Write durable-first (the core rule)
+
+When AI makes code cheap to regenerate, the durable asset is the test that still
+holds after the implementation is thrown away and rewritten. Generate tests in
+**durability tiers**, and lead with the durable ones (ADR-113):
+
+| Tier | What it is | Survives a rewrite? | When to write |
+|------|-----------|---------------------|---------------|
+| **Durable** | Invariants, contracts/schemas, property-based tests, behavioral e2e — specified at the module's public boundary | **Yes** | **Always — ≥1 per target** |
+| **Ephemeral** | Example-based unit tests, mock-call/interaction tests (TDD-London style) | No (coupled to impl) | For the red-green loop; label them, delete freely |
+| **Live** | Monitoring / drift / cost assertions that run against reality | Continuously | For deployed behavior |
+
+**The language-swap heuristic:** *if reimplementing this module in another language
+would invalidate the test, the test is at the wrong boundary.* Push it up a tier —
+assert on the observable contract, not on how the current code happens to work.
+
+Every generated target MUST include at least one **durable** assertion (an invariant,
+a contract check, or a property). Mock-call assertions (`toHaveBeenCalledWith`) are
+ephemeral by definition — never let them be the only thing testing a target. Tag each
+generated test `// @tier durable|ephemeral|live` so its lifetime is explicit.
+
+These tests are graded as **oracles**: a good test passes against the real code and
+*fails* against a seeded bug (mutant). A test that asserts nothing, or only the happy
+path, kills no mutants and is rejected — see `/mutation-testing` and ADR-113.
+
 ## Activation
 
 - When generating tests for new code
@@ -41,25 +66,29 @@ aqe test generate --pattern repository --target src/repositories/
 ## Agent Workflow
 
 ```typescript
-// Spawn test generation agents
-Task("Generate unit tests", `
-  Analyze src/services/PaymentService.ts and generate comprehensive Jest tests.
-  Include:
-  - Happy path tests for all public methods
-  - Edge cases and boundary conditions
-  - Error handling scenarios
-  - Mock external dependencies
+// Spawn test generation agents — durable-first
+Task("Generate durable-first tests", `
+  Analyze src/services/PaymentService.ts and generate Jest tests in tier order.
+  1. DURABLE (write these first, >=1 per public method):
+     - Invariants ("a refund never makes a balance negative")
+     - Contract/schema checks on inputs and outputs crossing the boundary
+     - Property-based tests (fast-check) over input ranges, not single examples
+  2. EPHEMERAL (the red-green loop; tag '// @tier ephemeral'):
+     - Specific happy-path examples and error paths
+     - Mock external dependencies ONLY — never let a mock-call assertion be the
+       only test for a method
+  Apply the language-swap check: if a Python rewrite of PaymentService would break
+  the test, move it up to the durable tier.
   Output to tests/unit/services/PaymentService.test.ts
-`, "qe-test-generator")
-
-// Pattern-based generation
-Task("Apply test patterns", `
-  Scan src/repositories/ and apply repository test pattern:
-  - CRUD operation tests
-  - Query builder tests
-  - Transaction tests
-  - Connection error handling
-`, "qe-pattern-matcher")
+`, "qe-test-architect")
+
+// Property + contract generation (first-class, not opt-in)
+Task("Generate property and contract tests", `
+  For src/repositories/, derive:
+  - Properties: round-trip (write→read returns same), idempotence, ordering invariants
+  - Contracts: the repository interface schema, enforced on every CRUD result
+  These survive a storage-engine swap; example-based CRUD tests do not.
+`, "qe-property-tester")
 ```
 
 ## Test Generation Strategies
@@ -122,6 +151,15 @@ await testGenerator.fillCoverageGaps({
 
 ```yaml
 quality_checks:
+  durability:                  # the primary check (ADR-113)
+    durable_assertions_per_target: 1   # >=1 invariant/contract/property each
+    language_swap_safe: true           # would survive a reimplementation
+    tier_tags_present: true            # every test tagged durable|ephemeral|live
+
+  fault_detection:             # do the tests actually catch bugs?
+    mutation_score_min: 0.6            # kill rate against seeded mutants
+    no_assertionless_tests: true       # reject tests that kill 0 mutants
+
   assertions:
     minimum_per_test: 1
     meaningful: true
@@ -134,7 +172,7 @@ quality_checks:
     descriptive: true
     follows_convention: true
 
-  coverage:
+  coverage:                    # necessary but NOT sufficient — see fault_detection
     branches: 80
     statements: 85
 ```

package/.claude/skills/qe-test-generation/evals/qe-test-generation.yaml

@@ -134,6 +134,43 @@ test_cases:
       schema_check: true
       allow_partial: true
 
+  # ORACLE CASE (ADR-113): grade the generated test by running it against a
+  # reference impl + operator mutants. Skips under the simulating runner; runs
+  # in the live eval lane (a provider must produce the test). This is what makes
+  # this eval a real oracle instead of a keyword grep.
+  - id: tc006_oracle_generated_test
+    description: "Generated test kills mutants of a reference function"
+    category: oracle
+    priority: critical
+
+    input:
+      code: |
+        export function classify(score, bonus) {
+          const total = score + bonus;
+          if (total >= 90 && bonus > 0) return 'A';
+          if (total >= 70) return 'B';
+          return 'C';
+        }
+      context:
+        language: javascript
+
+    expected_output: {}
+
+    oracle:
+      module_name: classify
+      reference_impl: |
+        export function classify(score, bonus) {
+          const total = score + bonus;
+          if (total >= 90 && bonus > 0) return 'A';
+          if (total >= 70) return 'B';
+          return 'C';
+        }
+      threshold: 0.6
+      extract: first_code_block
+
+    validation:
+      oracle: true
+
 success_criteria:
   pass_rate: 0.9
   critical_pass_rate: 1.0

package/.claude/skills/skills-manifest.json

@@ -939,7 +939,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.11.2",
+    "fleetVersion": "3.11.4",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,90 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.11.4] - 2026-07-01
+
+Better free local-model support, a tamper-evident guard for AQE's learning
+database, and a self-running dependency-security system — so known CVEs surface
+on their own instead of sitting unnoticed.
+
+Local test generation now defaults to a **code-tuned** local model and skips the
+paid path when a cached pattern already fits. A new opt-in **proof-gate** lets you
+cryptographically verify that nothing tampered with `memory.db` across a sync or
+migration. And AQE now audits its own dependencies on a schedule and opens
+in-range security-fix PRs automatically. See
+[ADR-116](docs/implementation/adrs/ADR-116-proof-gate-memory-integrity.md) (proof-gate),
+[ADR-115](docs/implementation/adrs/ADR-115-dependency-security-system.md) (dependency security),
+and the [free-tier local-models guide](docs/guides/free-tier-local-models.md).
+
+### Added
+
+- **Free-tier local test generation** — run test generation on a local Ollama
+  model (default `qwen3-coder:30b`), with an objective "is this a real test?"
+  check and a repair loop; a ruvLLM-style **pattern cache** skips the model
+  entirely when a prior result fits, and the paid path is used only as fallback.
+- **Local-model plumbing** — unified `AQE_OLLAMA_URL`, adaptive Ollama timeouts,
+  registered qwen3 models, and a capability-aware tool-routing guard so a model
+  is only asked to use tools it actually supports.
+- **Proof-gate (opt-in)** — a tamper-evident SHA-256 hash chain over the
+  `memory.db` kv write path: enable it for a sync/migration/publish window
+  (`AQE_PROOF_GATE=1`) and `verifyMemoryIntegrity()` proves no write was mutated,
+  reordered, or dropped. Off by default, fail-soft, single-store (ADR-116).
+- **Dependency-security system** — a daily scheduled consumer-POV `npm audit`
+  that files a tracking issue on new HIGH/CRITICAL CVEs (even against unchanged,
+  pinned deps), plus a weekly updater that opens small in-range security-fix PRs
+  and refuses to drop optional platform binaries. `npm run deps:audit` /
+  `deps:update` locally (ADR-115).
+
+### Fixed
+
+- **`@grpc/grpc-js` HIGH CVE** (CVE-2026-48068 / -48069, server-crash DoS)
+  resolved by an in-range bump to 1.14.4.
+- **Reduced advisory noise** — in-range dependency updates cut moderate
+  advisories from 29 to 7 (OpenTelemetry W3C-Baggage family and others), with all
+  15 optional platform dependencies preserved.
+
+### Changed
+
+- **Default local test-gen model** is now `qwen3-coder:30b` (code-tuned MoE),
+  replacing the general-purpose `qwen3:30b-a3b` — lower latency and more reliable
+  test output.
+
+## [3.11.3] - 2026-06-27
+
+Tests and evals you can actually trust, cheaper model options, and a guard that
+keeps AQE's commands and outputs stable for your scripts.
+
+AQE now grades a generated test by **running it** — against the real code (it must
+pass) and against deliberately-broken versions (it must catch them) — instead of
+checking for keywords. Test generation leads with **durable tests** (invariants,
+contracts, properties) that survive a rewrite, and quality reports add a
+**mutation-score / regenerability** signal next to coverage. See the new
+[oracle-evals plan](docs/plans/oracle-evals-durable-tests-plan.md) (ADR-113) and the
+[conservation-layer policy](docs/guides/conservation-layer-policy.md) (ADR-114).
+
+### Added
+
+- **Oracle evals** — skill evals run the generated test against a reference
+  implementation plus seeded mutants; an assertion-less or wrong test is rejected.
+- **Durable-first test generation** — `qe-test-generation` now emits invariants,
+  contracts, and property-based tests first (with a "would this survive a rewrite?"
+  check), keeping happy-path/mock tests as a labeled, disposable tier.
+- **Regenerability gate** — `qe-quality-assessment` reports mutation score + a
+  per-module regenerability score alongside coverage (warn by default, opt-in blocking).
+- **Conservation guard** — `npm run verify:conservation` + `verify:skill-parity` catch
+  breaking changes to CLI commands, report output schemas, the dashboard API, and skill
+  trees, with a deprecation policy so removals are deliberate and announced.
+- **Cheaper model lanes** — pick a budget or local model for test generation and prove
+  it clears the oracle: `npm run providers:health`, `eval:models`, `eval:live:*`. See the
+  [cheaper-model guide](docs/guides/cheaper-model-eval-lanes.md).
+
+### Fixed
+
+- **OpenRouter provider** now works through the provider manager (it previously failed
+  to route because it identified itself as `openai`).
+- **Gemini provider** default model updated to a current model (`gemini-2.5-flash`); the
+  old default had been retired by Google. Supported-model list and pricing refreshed.
+
 ## [3.11.2] - 2026-06-27
 
 First-class **C4 architecture diagrams** generated straight from your codebase —

package/assets/skills/.validation/templates/eval.template.yaml

@@ -333,6 +333,42 @@ test_cases:
         accuracy: 0.4
         actionability: 0.2
 
+  # ---------------------------------------------------------------------------
+  # ORACLE CASE (preferred for test-generating skills) — ADR-113
+  # ---------------------------------------------------------------------------
+  # Instead of keyword-matching the output, RUN the generated test against a
+  # reference implementation (must pass) and its operator mutants (each surviving
+  # mutant is a missed bug). Mutation kill rate is the pass signal — a test that
+  # asserts nothing scores 0 and fails. Requires the skill output to be a test
+  # that imports the impl as `../src/<module_name>.mjs`.
+  - id: tc050_oracle_generated_test
+    description: "Generated test kills mutants of a reference implementation"
+    category: oracle
+    priority: critical
+
+    input:
+      code: |
+        export function inRange(x, lo, hi) {
+          return x >= lo && x <= hi;
+        }
+      context:
+        language: javascript
+
+    expected_output: {}   # not used in oracle mode
+
+    oracle:
+      module_name: inRange
+      reference_impl: |
+        export function inRange(x, lo, hi) {
+          return x >= lo && x <= hi;
+        }
+      threshold: 0.6        # minimum mutation kill rate
+      extract: first_code_block   # pull the test from the first ```code block``` in output
+
+    validation:
+      oracle: true          # grade as an oracle, not by keyword matching
+      # mutation_score_min: 0.6   # optional override of oracle.threshold
+
 # =============================================================================
 # Success Criteria
 # =============================================================================

package/assets/skills/enterprise-integration-testing/SKILL.md

@@ -82,7 +82,7 @@ When testing enterprise integrations or SAP-connected systems:
 ### Tools
 - **SAP**: SAP GUI, Transaction codes (SE37, WE19, SEGW), Eclipse ADT
 - **Middleware**: IBM IIB/ACE, MuleSoft, SAP PI/PO/CPI
-- **Testing**: SoapUI, Postman, Playwright, custom harnesses
+- **Testing**: SoapUI, Postman, qe-browser (via Vibium for Fiori/web UIs), custom harnesses
 - **Monitoring**: SAP Solution Manager, Splunk, Dynatrace
 - **Data**: SAP LSMW, SECATT, eCATT
 

package/assets/skills/pentest-validation/SKILL.md

@@ -124,7 +124,7 @@ Every pentest validation run MUST:
 ### XSS Pipeline
 | Attack | Tier 1 (Pattern) | Tier 2 (Payload) | Tier 3 (Full) |
 |--------|-------------------|-------------------|----------------|
-| Reflected XSS | No output encoding | `<img onerror>` reflection | Browser JS execution via Playwright |
+| Reflected XSS | No output encoding | `<img onerror>` reflection | Browser JS execution via qe-browser (Vibium) |
 | Stored XSS | `innerHTML` assignment | Payload stored + retrieved | Cookie theft PoC |
 | DOM XSS | `document.write(location)` | Fragment injection | DOM manipulation proof |
 

package/assets/skills/qcsd-development-swarm/SKILL.md

@@ -3,7 +3,7 @@ name: qcsd-development-swarm
 description: "Use when monitoring in-sprint code quality with TDD adherence checks, complexity analysis, coverage gap detection, or defect prediction in the QCSD Development phase."
 category: qcsd-phases
 priority: critical
-version: 1.0.0
+version: 1.1.0
 tokenEstimate: 3400
 # DDD Domain Mapping (from QCSD-AGENTIC-QE-MAPPING-FRAMEWORK.md)
 domains:
@@ -34,13 +34,14 @@ agents:
   total: 10
   sub_agents: 0
 skills: [tdd-london-chicago, mutation-testing, performance-testing, security-testing]
-# Execution Models (Task Tool is PRIMARY)
+# Execution Models (Workflow is PRIMARY where the harness supports it — ADR-102)
 execution:
-  primary: task-tool
-  alternatives: [mcp-tools, cli]
+  primary: workflow
+  workflow_name: qcsd-development-review
+  alternatives: [task-tool, mcp-tools, cli]
 swarm_pattern: true
 parallel_batches: 3
-last_updated: 2026-02-03
+last_updated: 2026-06-10
 enforcement_level: strict
 tags: [qcsd, development, tdd, complexity, coverage, security, performance, mutation, defect-prediction, swarm, parallel, ddd]
 trust_tier: 3
@@ -192,10 +193,30 @@ skip to step N. Ensure you have the required prerequisite data from prior steps.
 
 | Model | When to Use | Agent Spawn |
 |-------|-------------|-------------|
-| **Task Tool** (PRIMARY) | Claude Code sessions | `Task({ subagent_type, run_in_background: true })` |
+| **Workflow** (PRIMARY, ADR-102) | Harness with the Workflow tool | `Workflow({ name: "qcsd-development-review", args: { sourcePath, testPath } })` |
+| **Task Tool** (fallback) | Claude Code sessions without Workflow support | `Task({ subagent_type, run_in_background: true })` |
 | **MCP Tools** | MCP server available | `fleet_init({})` / `task_submit({})` |
 | **CLI** | Terminal/scripts | `swarm init` / `agent spawn` |
 
+### Workflow execution (ADR-102)
+
+`.claude/workflows/qcsd-development-review.js` runs the review as a deterministic
+pipeline: one finder per quality dimension (TDD adherence, complexity, coverage
+gaps — `args.dimensions` selects a subset) → **3 blind adversarial refuters per
+finding** (Loki-mode, ADR-074: refuters see only the bare claim + evidence,
+never the finder's confidence or each other; uncertainty defaults to refuted)
+→ deterministic synthesis into `finding-verdict@1` envelopes (ADR-103,
+`schemas/finding-verdict.schema.json`). A finding survives only if fewer than
+⌈N/2⌉ refuters kill it. The final report contains ONLY confirmed findings;
+killed findings are retained under `killed` with their refutations for audit.
+
+Args: `sourcePath` (required), `testPath`, `dimensions` (subset of
+`tdd-adherence|complexity|coverage-gaps`), `maxFindings` per dimension (default 5).
+
+When the Workflow tool is unavailable, fall back to the Task-tool protocol
+below — the report format and gates are identical, minus the adversarial
+verification stage (note this in the report header as `verification: none`).
+
 ---
 
 ## Key Principle

package/assets/skills/qe-quality-assessment/SKILL.md

@@ -94,6 +94,10 @@ await qualityAnalyzer.assessCode({
 await qualityGate.evaluate({
   gates: {
     coverage: { min: 80, blocking: true },
+    // Fault detection — coverage is necessary but NOT sufficient (ADR-113).
+    // A suite can hit 90% coverage and catch no bugs; mutation score does not lie.
+    mutationScore: { min: 0.6, blocking: false },   // warn-by-default; opt-in blocking
+    regenerability: { min: 0.5, blocking: false },  // Deletion Test: durable oracle backing per module
     complexity: { max: 15, blocking: false },
     vulnerabilities: { critical: 0, high: 0, blocking: true },
     duplications: { max: 3, blocking: false },
@@ -107,6 +111,27 @@ await qualityGate.evaluate({
 });
 ```
 
+### 2a. Regenerability gate (ADR-113)
+
+Coverage measures lines executed; **mutation score** measures whether the tests would
+*notice a bug*, and **regenerability** answers the Deletion Test — "if this module were
+deleted and regenerated, would a wrong rebuild be caught?" Regenerability = mutation
+score discounted by the durability tier backing the module (durable > live > ephemeral
+> none); ephemeral-only tests score low because they don't survive a reimplementation.
+
+```typescript
+import { evaluateRegenerabilityGate } from '../../../src/feedback/regenerability-gate.js';
+
+const verdict = evaluateRegenerabilityGate(moduleProfiles, {
+  mutationScoreMin: 0.6,
+  regenerabilityMin: 0.5,
+  mode: 'warn',   // 'block' to fail CI; warn-by-default so adoption never breaks pipelines
+});
+// verdict.passed (thresholds met) · verdict.blocking (should fail CI) · verdict.failures[]
+```
+
+Surface it next to coverage in reports: `Coverage 88% ✅ / Mutation 41% ⚠️ / Regenerability: ephemeral-only ⚠️`.
+
 ### 3. Deployment Readiness
 
 ```typescript

package/assets/skills/qe-test-generation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "qe-test-generation"
-description: "Generates unit, integration, and e2e tests from code analysis including branch coverage, error paths, and edge cases. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright."
+description: "Generates durable-first tests — invariants, contracts, and property-based tests at boundaries that survive a reimplementation — plus unit, integration, and e2e coverage. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright."
 trust_tier: 3
 validation:
   schema_path: schemas/output.json
@@ -14,6 +14,31 @@ validation:
 
 Guide the use of v3's AI-powered test generation capabilities including pattern-based test synthesis, multi-framework support, and intelligent test case derivation from code analysis.
 
+## Write durable-first (the core rule)
+
+When AI makes code cheap to regenerate, the durable asset is the test that still
+holds after the implementation is thrown away and rewritten. Generate tests in
+**durability tiers**, and lead with the durable ones (ADR-113):
+
+| Tier | What it is | Survives a rewrite? | When to write |
+|------|-----------|---------------------|---------------|
+| **Durable** | Invariants, contracts/schemas, property-based tests, behavioral e2e — specified at the module's public boundary | **Yes** | **Always — ≥1 per target** |
+| **Ephemeral** | Example-based unit tests, mock-call/interaction tests (TDD-London style) | No (coupled to impl) | For the red-green loop; label them, delete freely |
+| **Live** | Monitoring / drift / cost assertions that run against reality | Continuously | For deployed behavior |
+
+**The language-swap heuristic:** *if reimplementing this module in another language
+would invalidate the test, the test is at the wrong boundary.* Push it up a tier —
+assert on the observable contract, not on how the current code happens to work.
+
+Every generated target MUST include at least one **durable** assertion (an invariant,
+a contract check, or a property). Mock-call assertions (`toHaveBeenCalledWith`) are
+ephemeral by definition — never let them be the only thing testing a target. Tag each
+generated test `// @tier durable|ephemeral|live` so its lifetime is explicit.
+
+These tests are graded as **oracles**: a good test passes against the real code and
+*fails* against a seeded bug (mutant). A test that asserts nothing, or only the happy
+path, kills no mutants and is rejected — see `/mutation-testing` and ADR-113.
+
 ## Activation
 
 - When generating tests for new code
@@ -41,25 +66,29 @@ aqe test generate --pattern repository --target src/repositories/
 ## Agent Workflow
 
 ```typescript
-// Spawn test generation agents
-Task("Generate unit tests", `
-  Analyze src/services/PaymentService.ts and generate comprehensive Jest tests.
-  Include:
-  - Happy path tests for all public methods
-  - Edge cases and boundary conditions
-  - Error handling scenarios
-  - Mock external dependencies
+// Spawn test generation agents — durable-first
+Task("Generate durable-first tests", `
+  Analyze src/services/PaymentService.ts and generate Jest tests in tier order.
+  1. DURABLE (write these first, >=1 per public method):
+     - Invariants ("a refund never makes a balance negative")
+     - Contract/schema checks on inputs and outputs crossing the boundary
+     - Property-based tests (fast-check) over input ranges, not single examples
+  2. EPHEMERAL (the red-green loop; tag '// @tier ephemeral'):
+     - Specific happy-path examples and error paths
+     - Mock external dependencies ONLY — never let a mock-call assertion be the
+       only test for a method
+  Apply the language-swap check: if a Python rewrite of PaymentService would break
+  the test, move it up to the durable tier.
   Output to tests/unit/services/PaymentService.test.ts
-`, "qe-test-generator")
-
-// Pattern-based generation
-Task("Apply test patterns", `
-  Scan src/repositories/ and apply repository test pattern:
-  - CRUD operation tests
-  - Query builder tests
-  - Transaction tests
-  - Connection error handling
-`, "qe-pattern-matcher")
+`, "qe-test-architect")
+
+// Property + contract generation (first-class, not opt-in)
+Task("Generate property and contract tests", `
+  For src/repositories/, derive:
+  - Properties: round-trip (write→read returns same), idempotence, ordering invariants
+  - Contracts: the repository interface schema, enforced on every CRUD result
+  These survive a storage-engine swap; example-based CRUD tests do not.
+`, "qe-property-tester")
 ```
 
 ## Test Generation Strategies
@@ -122,6 +151,15 @@ await testGenerator.fillCoverageGaps({
 
 ```yaml
 quality_checks:
+  durability:                  # the primary check (ADR-113)
+    durable_assertions_per_target: 1   # >=1 invariant/contract/property each
+    language_swap_safe: true           # would survive a reimplementation
+    tier_tags_present: true            # every test tagged durable|ephemeral|live
+
+  fault_detection:             # do the tests actually catch bugs?
+    mutation_score_min: 0.6            # kill rate against seeded mutants
+    no_assertionless_tests: true       # reject tests that kill 0 mutants
+
   assertions:
     minimum_per_test: 1
     meaningful: true
@@ -134,7 +172,7 @@ quality_checks:
     descriptive: true
     follows_convention: true
 
-  coverage:
+  coverage:                    # necessary but NOT sufficient — see fault_detection
     branches: 80
     statements: 85
 ```

package/assets/skills/qe-test-generation/evals/qe-test-generation.yaml

@@ -134,6 +134,43 @@ test_cases:
       schema_check: true
       allow_partial: true
 
+  # ORACLE CASE (ADR-113): grade the generated test by running it against a
+  # reference impl + operator mutants. Skips under the simulating runner; runs
+  # in the live eval lane (a provider must produce the test). This is what makes
+  # this eval a real oracle instead of a keyword grep.
+  - id: tc006_oracle_generated_test
+    description: "Generated test kills mutants of a reference function"
+    category: oracle
+    priority: critical
+
+    input:
+      code: |
+        export function classify(score, bonus) {
+          const total = score + bonus;
+          if (total >= 90 && bonus > 0) return 'A';
+          if (total >= 70) return 'B';
+          return 'C';
+        }
+      context:
+        language: javascript
+
+    expected_output: {}
+
+    oracle:
+      module_name: classify
+      reference_impl: |
+        export function classify(score, bonus) {
+          const total = score + bonus;
+          if (total >= 90 && bonus > 0) return 'A';
+          if (total >= 70) return 'B';
+          return 'C';
+        }
+      threshold: 0.6
+      extract: first_code_block
+
+    validation:
+      oracle: true
+
 success_criteria:
   pass_rate: 0.9
   critical_pass_rate: 1.0