agentic-qe 3.11.4 → 3.12.0

package/.claude/helpers/.helpers-version

@@ -0,0 +1 @@
+3.25.4

package/.claude/helpers/auto-memory-hook.mjs

@@ -27,10 +27,23 @@ const CYAN = '\x1b[0;36m';
 const DIM = '\x1b[2m';
 const RESET = '\x1b[0m';
 
+const YELLOW = '\x1b[0;33m';
 const log = (msg) => console.log(`${CYAN}[AutoMemory] ${msg}${RESET}`);
 const success = (msg) => console.log(`${GREEN}[AutoMemory] ✓ ${msg}${RESET}`);
 const dim = (msg) => console.log(`  ${DIM}${msg}${RESET}`);
 
+// #2545: fail LOUD instead of a silent dim skip. When @claude-flow/memory cannot
+// be resolved, self-learning imports are a no-op — the user must see this and be
+// told exactly how to fix it (on both stdout, so it shows in the Claude Code hook
+// transcript, and stderr, per the issue's requested channel).
+function warnMemoryUnavailable() {
+  const line1 = `[AutoMemory] @claude-flow/memory not resolvable from ${PROJECT_ROOT} — self-learning imports are DISABLED.`;
+  const line2 = '             Fix: npm i -D @claude-flow/memory   (or re-run: npx ruflo@latest init, then npx ruflo@latest doctor --fix)';
+  console.log(`${YELLOW}${line1}${RESET}`);
+  console.log(`${YELLOW}${line2}${RESET}`);
+  process.stderr.write(`${line1}\n${line2}\n`);
+}
+
 const DEBUG = !!(process.env.RUFLO_DEBUG || process.env.DEBUG);
 
 // ── Graceful shutdown (FIX 3) ───────────────────────────────────────────────
@@ -152,6 +165,21 @@ class JsonFileBackend {
 // ============================================================================
 
 async function loadMemoryPackage() {
+  // Strategy 0 (#2545): sidecar recorded by `init` / `doctor --fix`. On the
+  // documented `npx ruflo` path @claude-flow/memory (an optionalDependency of
+  // the CLI) lands in the npx cache, which is NOT on the walk-up path from the
+  // project — so init resolves it from the CLI's own context and records the
+  // absolute path here. This is the only strategy that works on that install.
+  try {
+    const sidecar = join(PROJECT_ROOT, '.claude-flow', 'memory-package.json');
+    if (existsSync(sidecar)) {
+      const rec = JSON.parse(readFileSync(sidecar, 'utf-8'));
+      if (rec?.distPath && existsSync(rec.distPath)) {
+        return await import(`file://${rec.distPath}`);
+      }
+    }
+  } catch { /* fall through */ }
+
   // Strategy 1: Local dev (built dist)
   const localDist = join(PROJECT_ROOT, 'v3/@claude-flow/memory/dist/index.js');
   if (existsSync(localDist)) {
@@ -235,7 +263,7 @@ async function doImport() {
 
   const memPkg = await loadMemoryPackage();
   if (!memPkg || !memPkg.AutoMemoryBridge) {
-    dim('Memory package not available — skipping auto memory import');
+    warnMemoryUnavailable();
     return;
   }
 
@@ -288,7 +316,7 @@ async function doSync() {
 
   const memPkg = await loadMemoryPackage();
   if (!memPkg || !memPkg.AutoMemoryBridge) {
-    dim('Memory package not available — skipping sync');
+    warnMemoryUnavailable();
     return;
   }
 
@@ -346,8 +374,12 @@ async function doStatus() {
   const memPkg = await loadMemoryPackage();
   const config = readConfig();
 
+  const sidecar = join(PROJECT_ROOT, '.claude-flow', 'memory-package.json');
+  const hasSidecar = existsSync(sidecar);
+
   console.log('\n=== Auto Memory Bridge Status ===\n');
-  console.log(`  Package:        ${memPkg ? '✅ Available' : '❌ Not found'}`);
+  console.log(`  Package:        ${memPkg ? '✅ Available' : '❌ Not found — self-learning DISABLED (fix: npm i -D @claude-flow/memory)'}`);
+  console.log(`  Resolver:       ${hasSidecar ? '✅ .claude-flow/memory-package.json' : '⏸ no sidecar (run: npx ruflo@latest doctor --fix)'}`);
   console.log(`  Store:          ${existsSync(STORE_PATH) ? '✅ ' + STORE_PATH : '⏸ Not initialized'}`);
   console.log(`  LearningBridge: ${config.learningBridge.enabled ? '✅ Enabled' : '⏸ Disabled'}`);
   console.log(`  MemoryGraph:    ${config.memoryGraph.enabled ? '✅ Enabled' : '⏸ Disabled'}`);

package/.claude/helpers/brain-checkpoint.cjs

@@ -18,6 +18,16 @@ const RVF_PATH = path.join(AQE_DIR, 'aqe.rvf');
 const DB_PATH = path.join(AQE_DIR, 'memory.db');
 const MAX_AGE_HOURS = 24;
 
+// Mount-local kill switch. `brain export` (below) spawns a native RVF writer
+// that, on a macOS Docker virtiofs bind mount, deadlocks in a futex and IGNORES
+// the SIGTERM that execFileSync's timeout sends — so the 60s timeout can't reap
+// it and orphaned exporters pile up (~1.5GB RSS observed 2026-07-08). Disable
+// via env `AQE_DISABLE_BRAIN_CHECKPOINT=1` or a `.agentic-qe/DISABLE_BRAIN_CHECKPOINT`
+// marker file. Opt-in: shipped installs without the flag behave exactly as before.
+const CHECKPOINT_DISABLED =
+  process.env.AQE_DISABLE_BRAIN_CHECKPOINT === '1' ||
+  fs.existsSync(path.join(AQE_DIR, 'DISABLE_BRAIN_CHECKPOINT'));
+
 function log(msg) { process.stderr.write('[brain-checkpoint] ' + msg + '\n'); }
 
 function exportBrain() {
@@ -54,5 +64,10 @@ function verifyBrain() {
 }
 
 const cmd = process.argv[2] || 'verify';
-const result = cmd === 'export' ? exportBrain() : verifyBrain();
+let result;
+if (CHECKPOINT_DISABLED) {
+  result = { disabled: true, reason: 'brain-checkpoint disabled on this mount' };
+} else {
+  result = cmd === 'export' ? exportBrain() : verifyBrain();
+}
 if (process.argv.includes('--json')) process.stdout.write(JSON.stringify(result));

package/.claude/helpers/helpers.manifest.json

@@ -0,0 +1,12 @@
+{
+  "manifest": {
+    "version": "3.25.4",
+    "files": {
+      "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
+      "hook-handler.cjs": "bc4d2d26823d49b3ab1dded2946b66369f1f67bd76b4c30dca9f3b6df3cca8f0",
+      "intelligence.cjs": "bd1f8e4b034944aee1df0391dc47ac2e8cc4b3aa542c65407a59d49620bbf76b"
+    }
+  },
+  "signature": "F3TIRoNcQTCkNeMEk5Isah5CWkV/zddUKR/6pieOlAWoYgI2BEUO7avQj8B8UP4vhvgT9TSgbYsis2UnnnQyBg==",
+  "algorithm": "ed25519"
+}

package/.claude/helpers/hook-handler.cjs

@@ -124,6 +124,25 @@ async function main() {
   const prompt = hookInput.prompt || hookInput.command || toolInput.command
     || process.env.PROMPT || process.env.TOOL_INPUT_command || args.join(' ') || '';
 
+  // ADR-174: capture FAILURES so the learning substrate has negative examples.
+  // Claude Code's PostToolUse payload carries the tool result; a failed
+  // Write/Edit/Bash surfaces as tool_response.is_error / an error string /
+  // a non-zero exit code. Conservative — only a positive error signal counts
+  // as failure (mirrors isToolFailure() in helpers-generator.ts).
+  const toolFailed = (function (hi) {
+    if (!hi || typeof hi !== 'object') return false;
+    const tr = hi.tool_response != null ? hi.tool_response : (hi.toolResponse != null ? hi.toolResponse : hi.result);
+    if (tr == null) return false;
+    if (typeof tr === 'string') return /\b(error|failed|failure|exception|not found|no such|permission denied|traceback)\b/i.test(tr);
+    if (typeof tr === 'object') {
+      if (tr.is_error === true || tr.isError === true || tr.success === false || tr.error != null) return true;
+      const code = tr.exit_code != null ? tr.exit_code : (tr.exitCode != null ? tr.exitCode : tr.code);
+      if (typeof code === 'number' && code !== 0) return true;
+      if (Array.isArray(tr.content) && tr.is_error === true) return true;
+    }
+    return false;
+  })(hookInput);
+
 const handlers = {
   'route': () => {
     // Inject ranked intelligence context before routing
@@ -178,10 +197,10 @@ const handlers = {
       try {
         const file = hookInput.file_path || toolInput.file_path
           || process.env.TOOL_INPUT_file_path || args[0] || '';
-        intelligence.recordEdit(file);
+        intelligence.recordEdit(file, !toolFailed);
       } catch (e) { /* non-fatal */ }
     }
-    console.log('[OK] Edit recorded');
+    console.log(toolFailed ? '[LEARN] Edit FAILURE recorded' : '[OK] Edit recorded');
   },
 
   'session-restore': async () => {
@@ -246,13 +265,15 @@ const handlers = {
   },
 
   'post-task': () => {
-    // Implicit success feedback for intelligence
+    // ADR-174: feed the REAL outcome (feedback() boosts confidence on success,
+    // decays it on failure) instead of a hardcoded true — no more all-positive
+    // signal that the substrate can't learn from.
     if (intelligence && intelligence.feedback) {
       try {
-        intelligence.feedback(true);
+        intelligence.feedback(!toolFailed);
       } catch (e) { /* non-fatal */ }
     }
-    console.log('[OK] Task completed');
+    console.log(toolFailed ? '[LEARN] Task FAILURE recorded' : '[OK] Task completed');
   },
 
   'stats': () => {

package/.claude/helpers/intelligence.cjs

@@ -575,15 +575,28 @@ function getContext(prompt) {
  * recordEdit(file) — Called from post-edit. Budget: <2ms.
  * Appends to pending-insights.jsonl.
  */
-function recordEdit(file) {
+function recordEdit(file, success) {
   ensureDataDir();
   const entry = JSON.stringify({
     type: 'edit',
     file: file || 'unknown',
+    // ADR-174: record failures too, not just successes — the learning substrate
+    // needs negative examples. Defaults true; an explicit false is a failed edit.
+    success: success !== false,
     timestamp: Date.now(),
     sessionId: sessionGet('sessionId') || null,
   });
   fs.appendFileSync(PENDING_PATH, entry + '\n', 'utf-8');
+  // Runaway-storage guard: pending-insights is append-only and only drained by
+  // consolidation. If it grows past ~512KB (thousands of un-consolidated edits
+  // — e.g. the daemon never ran), keep only the most recent 2000 lines so it
+  // can never grow unbounded. Cheap (a statSync per edit; rewrite only when over).
+  try {
+    if (fs.statSync(PENDING_PATH).size > 512 * 1024) {
+      const lines = fs.readFileSync(PENDING_PATH, 'utf-8').split('\n').filter(Boolean);
+      if (lines.length > 2000) fs.writeFileSync(PENDING_PATH, lines.slice(-2000).join('\n') + '\n', 'utf-8');
+    }
+  } catch (e) { /* non-fatal */ }
 }
 
 /**

package/.claude/hooks/aqe-hook.cjs

@@ -87,21 +87,24 @@ const FATAL_MARKERS = [
   'was compiled against a different Node.js version',
 ];
 
-function recordHookHealth(stderr) {
+// Internal timeout for the spawned bundle process. Kept BELOW the harness's
+// own hook timeout (settings.json) so THIS script observes and logs a stall
+// itself — if the harness timeout fires first, this whole process is killed
+// too and never gets to write the log line. (2026-06-02 postmortem: a 5s
+// harness timeout vs. this shim's own admitted ~30-60s cold start left
+// routing_outcomes writes silently dropped for a month — nothing recorded
+// the mismatch because nothing was watching for it.)
+const SPAWN_TIMEOUT_MS = Number(process.env.AQE_HOOK_TIMEOUT_MS) || 18000;
+
+function recordHookHealth(line) {
   try {
-    if (!stderr) return;
-    const hit = FATAL_MARKERS.find((m) => stderr.includes(m));
-    if (!hit) return;
     const logPath = path.join(PROJECT, '.agentic-qe', 'hooks-health.log');
     // Throttle: skip if we logged within the last 5 min (avoid a line/turn).
     try {
       const st = fs.statSync(logPath);
       if (Date.now() - st.mtimeMs < 5 * 60 * 1000) return;
     } catch { /* no log yet — fall through and create it */ }
-    const subcmd = args[0] || 'unknown';
-    const line = `[${new Date().toISOString()}] FATAL hook persistence failure `
-      + `(cmd=${subcmd}): "${hit}". Learning is NOT being captured. `
-      + `Fix: \`npm rebuild better-sqlite3\` (host/container native-binary mismatch).\n`;
+    fs.mkdirSync(path.dirname(logPath), { recursive: true });
     fs.appendFileSync(logPath, line);
   } catch { /* health logging must never block a turn */ }
 }
@@ -109,12 +112,56 @@ function recordHookHealth(stderr) {
 let out = '';
 try {
   const res = spawnSync(cmd, cmdArgs, {
-    stdio: ['ignore', 'pipe', 'pipe'], // swallow stdin; capture stderr to scan
+    // Claude Code delivers hook event data (prompt, tool_input, etc.) as JSON
+    // on stdin — `$PROMPT`/`$TOOL_INPUT_*` env-var substitution is NOT
+    // reliable on every hook surface (see hooks-shared.ts:readStdinJsonEvent's
+    // own docstring). Discarding stdin here silently broke the CLI's
+    // existing, already-safe stdin fallback (500ms internal timeout, never
+    // hangs) — inherit it instead so that fallback can actually run.
+    stdio: ['inherit', 'pipe', 'pipe'],
     encoding: 'utf8',
     maxBuffer: 16 * 1024 * 1024,
+    timeout: SPAWN_TIMEOUT_MS,
   });
   out = (res && res.stdout) || '';
-  recordHookHealth((res && res.stderr) || ''); // tee fatal markers to health log
+  const subcmd = args[0] || 'unknown';
+  const stderr = (res && res.stderr) || '';
+  const hit = FATAL_MARKERS.find((m) => stderr.includes(m));
+  const ts = () => new Date().toISOString();
+  if (hit) {
+    // The fix depends on WHICH failure hit. A native-binary marker (invalid ELF
+    // header / ERR_DLOPEN_FAILED / wrong Node version) is a real rebuild case.
+    // But "Failed to initialize UnifiedMemoryManager" is almost always LOCK
+    // CONTENTION — another AQE process (MCP server, daemon, hooks) holding
+    // memory.db, often amplified by a WAL-hostile bind mount — NOT a bad binary.
+    // Suggesting `npm rebuild` there sends people down the wrong path (verified
+    // 2026-07-08: better-sqlite3 loaded fine while this marker still fired).
+    const nativeMismatch = /invalid ELF header|ERR_DLOPEN_FAILED|different Node\.js version/.test(hit);
+    const fix = nativeMismatch
+      ? '`npm rebuild better-sqlite3` (host/container native-binary mismatch).'
+      : 'lock contention — check for concurrent AQE processes holding memory.db '
+        + '(MCP server / daemon / other hooks) and WAL safety on bind mounts '
+        + '(AQE_DISABLE_WAL); NOT a native-binary rebuild.';
+    recordHookHealth(`[${ts()}] FATAL hook persistence failure `
+      + `(cmd=${subcmd}): "${hit}". Learning is NOT being captured. `
+      + `Fix: ${fix}\n`);
+  } else if (res && res.signal) {
+    // Killed by our own SPAWN_TIMEOUT_MS (or another signal) before finishing.
+    // No output means no persistence happened for this invocation.
+    recordHookHealth(`[${ts()}] TIMEOUT hook did not complete `
+      + `(cmd=${subcmd}, signal=${res.signal}, budget=${SPAWN_TIMEOUT_MS}ms). `
+      + `Learning for this invocation was NOT captured.\n`);
+  } else if (res && res.error) {
+    // spawnSync couldn't even launch the child (ENOENT/EACCES/etc).
+    recordHookHealth(`[${ts()}] SPAWN-FAILED hook could not start `
+      + `(cmd=${subcmd}): ${res.error.message || res.error}. `
+      + `Learning for this invocation was NOT captured.\n`);
+  } else if (res && res.status !== 0 && !out.includes('{')) {
+    // Child exited non-zero with no JSON payload — e.g. an empty-task throw
+    // when the harness didn't populate $PROMPT/$TOOL_INPUT_*.
+    recordHookHealth(`[${ts()}] EMPTY-RESULT hook exited status=${res.status} `
+      + `with no JSON output (cmd=${subcmd}). stderr: ${stderr.slice(0, 300)}\n`);
+  }
 } catch { /* never block a turn */ }
 
 // Emit only the top-level JSON object: the first line beginning with '{' through

package/.claude/skills/skills-manifest.json

@@ -939,7 +939,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.11.4",
+    "fleetVersion": "3.12.0",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,116 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.12.0] - 2026-07-10
+
+Adds a **learning-integrity layer** so the self-learning system can only promote
+what it can prove. Test-quality is now measured against a frozen, hash-pinned
+oracle benchmark; promotions are gated by the *quality of their evidence*
+(real test execution beats an LLM judge beats a structural heuristic), recorded
+as cryptographically-signed, replayable receipts, and re-checked against the
+exact frozen rule before they take effect. A new two-gate quality command
+(mechanical checks + an independent frontier-model judge) is exposed on both the
+CLI and MCP. Ships with a designed-experiment tool that measures — with real
+statistics — whether a given harness feature actually improves test quality or
+just adds cost. See ADRs
+[117](docs/implementation/adrs/ADR-117-frozen-oracle-anchor-set.md)–[122](docs/implementation/adrs/ADR-122-designed-experiment-harness-gate.md)
+and [v3.12.0 release notes](docs/releases/v3.12.0.md).
+
+### Added
+
+- **`aqe quality-gate` CLI command and `qe/quality/gate` MCP tool** — a two-gate
+  quality verdict: a mechanical gate (the code must actually run and kill
+  mutations) plus an independent frontier-model judge that checks the test
+  against the spec. Returns a three-valued verdict (pass / fail / inconclusive)
+  and degrades honestly to "inconclusive" when the judge is unavailable rather
+  than guessing.
+- **Frozen oracle anchor set** — a hash-pinned benchmark of graded test items
+  with a constant denominator, so a drop in the learning system's test-quality
+  is detectable as a real regression instead of being hidden by a moving target.
+- **Provenance-tiered promotion** — every learning promotion now carries an
+  evidence tier (test-execution > LLM-judge > structural heuristic), and a
+  policy can require a minimum tier before anything is promoted.
+- **Receipt-gated policy flywheel** — retrieval-policy improvements are recorded
+  as Ed25519-signed, replayable receipts with a compounding lineage, so every
+  promotion is auditable, re-verifiable offline, and reversible.
+- **Gate re-execution on promotion paths** — before a promotion takes effect the
+  frozen accept-rule is re-run on the sealed inputs, catching any promotion that
+  was logged but that the rule would actually reject.
+- **Designed-experiment harness tool** (`scripts/doe-run.ts` +
+  `scripts/doe-aggregate.mjs`) — runs a factorial screen (model × prompt ×
+  retrieval × scaffold) with replicates and a real main-effects ANOVA, so you
+  can tell whether a harness feature helps reliability or is just cost. First
+  screen found that heavy scaffolding *lowers* reliability and that retrieval
+  adds no measurable quality on already-known tasks.
+
+### Fixed
+
+- **Brain-export hook no longer leaks** deadlocked background exports that could
+  respawn, and database backups are hardened for virtiofs bind-mounts (a
+  VACUUM-INTO backup path that avoids the WAL-corruption failure mode).
+- **`AQE_DISABLE_WAL` / `AQE_JOURNAL_MODE` env override** for SQLite journal mode,
+  so environments prone to bind-mount WAL corruption can opt into a safer mode.
+- **Pattern-lifecycle promotion** now records and gates on provenance tier
+  (additive column migration, conservative backfill).
+
+## [3.11.5] - 2026-07-07
+
+A system-integrity sweep of the self-learning loop: dream-cycle insights now
+genuinely turn into reusable patterns instead of silently piling up, pattern
+usage stats are accurate again (no more double-counting or mid-session
+regressions), and the witness-chain audit trail, agent-topology tracking, GOAP
+plan execution, and SONA continual learning all had real dormant-code or
+data-integrity bugs fixed. See
+[SYSTEM-INTEGRITY-AUDIT-2026-07-04](docs/analysis/SYSTEM-INTEGRITY-AUDIT-2026-07-04.md)
+and the [remediation plan](docs/plans/SYSTEM-INTEGRITY-REMEDIATION-GOAP-PLAN-2026-07-04.md)
+for full findings and verification evidence.
+
+### Fixed
+
+- **Dream-cycle insights now genuinely become reusable patterns** — a gate in
+  the concept-loading path meant the fix that lets `detectGaps`/
+  `detectOptimizations`/`detectPatternMerges` see real failure/success data
+  only ever ran in manual tests, never in real scheduled dream cycles. Also
+  fixed the mechanism that marks an insight "applied": it previously
+  incremented a counter on the 3 newest insights on every successful task
+  regardless of whether anything was actually promoted (proven live in
+  production, with counts as high as 16) — it now only marks an insight
+  applied when it's genuinely turned into a new pattern.
+- **`aqe learning stats` reported the wrong pattern counts** — Total and "By
+  Domain" now come from the real pattern store instead of an incomplete
+  vector-index count that silently excluded any pattern without an embedding.
+- **Pattern usage was recorded twice per outcome**, inflating usage counts and
+  success-rate stats 2x; now written once.
+- **Pattern lookups could silently fail after a name collision** ("Pattern not
+  found") because an internal id could go out of sync between the in-memory
+  cache and the database; fixed for both pattern-store backends.
+- **Learning stats could regress mid-session** — reported totals could drop
+  below the real historical count right after the first pattern-usage event
+  in a session; now always reports the correct, non-decreasing total.
+- **Witness-chain audit trail** — cryptographic signing now covers all new
+  entries, and a bug that silently broke chain verification for every entry
+  after an archival operation is fixed, plus a new CI gate to catch
+  regressions.
+- **Agent-topology tracking (mincut)** now reflects real agent activity
+  instead of a constant placeholder reading, removing a false "critical"
+  routing state that could occur on an empty graph.
+- **GOAP plan execution** now dispatches real domain-API calls for the
+  majority of actions instead of always simulating (mocking) results.
+- **SONA continual-learning cold start** — the self-learning weight-update
+  mechanism no longer needs 100 requests to accumulate within a single
+  process lifetime before it can save its first update; progress now
+  persists across restarts.
+- Assorted smaller integrity fixes: pattern-null (failure record) capture
+  wasn't wired into the production learning path; a stale/expired daemon
+  process could look "healthy"; a TTL bug caused several cache entries to
+  live 1000x longer than intended.
+
+### Changed
+
+- Cleaned up dead data left over from now-fixed bugs (degenerate agent-topology
+  snapshots, orphaned GOAP test-fixture rows, a corrupted insight-tracking
+  counter) — internal only, no user-facing behavior change.
+
 ## [3.11.4] - 2026-07-01
 
 Better free local-model support, a tamper-evident guard for AQE's learning

package/assets/skills/skills-manifest.json

@@ -939,7 +939,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.11.0",
+    "fleetVersion": "3.12.0",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/dist/adapters/a2a/auth/routes.js

@@ -421,41 +421,72 @@ export function createOAuthRoutes(config) {
  * @returns True if URI is allowed
  */
 export function validateRedirectUri(uri, allowedUris) {
+    let target;
     try {
-        const parsed = new URL(uri);
-        for (const allowed of allowedUris) {
-            // Exact match
-            if (allowed === uri) {
-                return true;
-            }
-            // Wildcard match (e.g., "https://*.example.com/callback")
-            if (allowed.includes('*')) {
-                const pattern = allowed
-                    .replace(/[.+?^${}()|[\]\\]/g, '\\$&')
-                    .replace(/\*/g, '.*');
-                const regex = new RegExp(`^${pattern}$`);
-                if (regex.test(uri)) {
-                    return true;
-                }
-            }
-            // Same origin match
+        target = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    for (const allowed of allowedUris) {
+        // Exact match
+        if (allowed === uri) {
+            return true;
+        }
+        // Wildcard match (e.g., "https://*.example.com/callback"). Compared
+        // STRUCTURALLY on parsed URL components — NEVER by building a RegExp from a
+        // URL string. A regex approach (`.replace(/\*/g, '.*')`) let an attacker
+        // spoof the host via the PATH, e.g. "https://evil.com/x.example.com/cb"
+        // satisfied "^https://.*\.example\.com/cb$" (open redirect; also the CodeQL
+        // js/incomplete-hostname-regexp finding). Here only the single leftmost
+        // subdomain label may be wildcarded, and it must be a non-empty, dot-free
+        // label — so the host cannot be spoofed via extra dots or path segments.
+        if (allowed.includes('*')) {
+            const MARKER = 'wildcardlabelplaceholder';
+            let pattern;
             try {
-                const allowedParsed = new URL(allowed);
-                if (parsed.protocol === allowedParsed.protocol &&
-                    parsed.host === allowedParsed.host &&
-                    parsed.pathname.startsWith(allowedParsed.pathname)) {
-                    return true;
-                }
+                // Replace EVERY '*' (global) — a first-occurrence-only replace would leave
+                // later '*' chars in the string. Any multi-wildcard pattern still gets
+                // rejected below because its suffix would then contain MARKER, which no
+                // real host can end with.
+                pattern = new URL(allowed.replace(/\*/g, MARKER));
             }
             catch {
-                // Invalid allowed URI, skip
+                continue; // malformed wildcard entry — skip
             }
+            if (pattern.protocol !== target.protocol)
+                continue;
+            if (pattern.port !== target.port)
+                continue;
+            // The wildcard must be the leftmost host label: "<MARKER>.<suffix>".
+            if (!pattern.hostname.startsWith(`${MARKER}.`))
+                continue;
+            const suffix = pattern.hostname.slice(MARKER.length); // ".example.com"
+            if (!target.hostname.endsWith(suffix))
+                continue;
+            const label = target.hostname.slice(0, target.hostname.length - suffix.length);
+            if (label.length === 0 || label.includes('.'))
+                continue; // exactly one label
+            // Path matches exactly or as a prefix (same semantics as the same-origin case).
+            if (target.pathname === pattern.pathname || target.pathname.startsWith(pattern.pathname)) {
+                return true;
+            }
+            continue;
+        }
+        // Same origin match (exact protocol + host, path-prefix)
+        try {
+            const allowedParsed = new URL(allowed);
+            if (target.protocol === allowedParsed.protocol &&
+                target.host === allowedParsed.host &&
+                target.pathname.startsWith(allowedParsed.pathname)) {
+                return true;
+            }
+        }
+        catch {
+            // Invalid allowed URI, skip
         }
-        return false;
-    }
-    catch {
-        return false;
     }
+    return false;
 }
 /**
  * Generate PKCE code challenge from verifier

package/dist/audit/witness-chain.d.ts

@@ -31,6 +31,15 @@ export interface WitnessFilter {
 export interface VerifyOptions {
     /** Also verify Ed25519 signatures. Requires keyManager on the chain. */
     checkSignatures?: boolean;
+    /**
+     * Also walk `witness_chain_archive` and validate it as part of the same
+     * hash chain (archived rows are hash-linked to each other and to the live
+     * table exactly like un-archived rows). Off by default: the live-only walk
+     * is enough to catch tampering with current data and already correctly
+     * bridges the archival boundary; this option adds full historical coverage
+     * for a deep CI gate at the cost of reading the (potentially large) archive.
+     */
+    includeArchive?: boolean;
 }
 export interface VerifyResult {
     valid: boolean;
@@ -62,6 +71,22 @@ export declare class WitnessChain {
     private addColumnIfMissing;
     /** Append a new SHAKE-256-hashed entry, optionally Ed25519-signed. */
     append(actionType: WitnessActionType, actionData: Record<string, unknown>, actor: string): WitnessEntry;
+    /**
+     * Find the entry with the given id, checking the live table first and then
+     * the archive. Used to recover a predecessor that array-adjacency can't
+     * see directly (it was archived, possibly by an earlier archival run than
+     * the one that affects the entry currently being checked).
+     */
+    private findEntryById;
+    /**
+     * Check one entry's self-hash and chain link. `arrayAdjacent` is whatever
+     * entry sits immediately before `current` in the array currently being
+     * scanned (undefined at the start of that array) — it's tried first since
+     * it's free (already fetched); a cross-table lookup by id only runs on a
+     * mismatch, e.g. because the true predecessor was moved to the archive by
+     * a *different* archival run than the one this scan is walking.
+     */
+    private checkEntryLink;
     /** Verify chain integrity. Supports mixed SHA-256/SHAKE-256 and optional signature checks. */
     verify(options?: VerifyOptions): VerifyResult;
     /** Query entries with optional filters. */