agentic-qe 3.11.4 → 3.12.0

package/dist/validation/gate-reexecute.js

@@ -0,0 +1,255 @@
+/**
+ * gateReExecutes — re-execute a frozen acceptance rule from sealed inputs
+ * on every promotion path (ADR-120).
+ *
+ * The July 2026 remediation exposed the A8-EXT fake-`applied`-counter: a
+ * promotion path that logged success without doing the work — a logged verdict
+ * that lied. The fix (from MetaHarness `verifyReplayBundle`): trust the re-run,
+ * not the log. At verification time, re-execute a VERSIONED FROZEN acceptance
+ * rule against the decision's SEALED inputs; a recorded PROMOTE the frozen rule
+ * would not grant is a forgery.
+ *
+ * Two checks, both required (mirrors MetaHarness `replay.ts:66-90`):
+ *   - gateUnchanged   — the recorded rule fingerprint matches the current rule
+ *                       version's fingerprint (a swapped rule is caught).
+ *   - gateReExecutes  — re-running the frozen rule on the sealed inputs
+ *                       reproduces the recorded verdict.
+ * Plus sealIntact (ADR-116 composition) — the sealed inputs were not mutated
+ * after the decision. Re-execution on tampered inputs is meaningless.
+ *
+ * The acceptance rule is a PURE function of sealed inputs. `accept/v1` composes
+ * the cluster: ADR-121 provenance tier gate + ADR-118 held-out-beats-baseline +
+ * ADR-117 anchor no-regression. Changing a rule is a new VERSION, never an
+ * in-place edit (which gateUnchanged flags).
+ */
+import { createHash } from 'node:crypto';
+import { meetsNoRegression } from './anchor-set.js';
+import { tierAllowsPromotion } from '../learning/provenance-tier.js';
+/** Tag domain-separating the rule fingerprint hash. */
+const RULE_TAG = 'aqe:accept-rule:v1+sig';
+/**
+ * accept/v1 — the conjunctive frozen gate. Promotes only when ALL hold:
+ *   1. provenance tier is strong enough (ADR-121),
+ *   2. held-out strictly beats baseline (ADR-118),
+ *   3. the anchor mean does not regress (ADR-117).
+ */
+const acceptV1 = (s) => {
+    if (!tierAllowsPromotion(s.provenanceTier, { allowJudgeTier: s.allowJudgeTier })) {
+        return { promote: false, reason: `provenance tier '${s.provenanceTier}' not allowed to promote` };
+    }
+    if (!(s.candidateHeldOut > s.baselineHeldOut)) {
+        return { promote: false, reason: `held-out ${s.candidateHeldOut} did not beat baseline ${s.baselineHeldOut}` };
+    }
+    if (!meetsNoRegression(s.candidateAnchorMean, s.baselineAnchorMean, s.anchorTol)) {
+        return { promote: false, reason: `anchor regression: ${s.candidateAnchorMean} < ${s.baselineAnchorMean} - ${s.anchorTol}` };
+    }
+    return { promote: true, reason: 'held-out gain, no anchor regression, oracle-tier evidence' };
+};
+/** Registry of versioned frozen rules. Add a NEW key to change a rule; never edit in place. */
+export const ACCEPTANCE_RULES = Object.freeze({
+    'accept/v1': acceptV1,
+});
+/**
+ * Canonical (sorted-key) JSON — same discipline as ADR-116 proof-gate. Keys
+ * whose value is `undefined` are OMITTED, matching JSON.stringify, so a sealed
+ * input's hash is stable across a JSON serialize/parse roundtrip (e.g. persisting
+ * a receipt to the DB and reloading it — an optional field like `allowJudgeTier`
+ * that is undefined must not change the hash).
+ */
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const rec = value;
+    const keys = Object.keys(rec).filter((k) => rec[k] !== undefined).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(rec[k])}`).join(',')}}`;
+}
+/** SHA-256 content hash of the sealed inputs (ADR-116 canonical form). */
+export function sealedHash(sealed) {
+    return createHash('sha256').update(canonicalJson(sealed)).digest('hex');
+}
+/**
+ * Fingerprint of a rule VERSION. Because a rule change is a version bump
+ * (ADR-120 §5), fingerprinting the version string is the contract — an edited
+ * rule ships under a new version and thus a new fingerprint. Throws for an
+ * unknown version so a missing rule can never silently pass verification.
+ */
+export function gateFingerprint(ruleVersion) {
+    if (!(ruleVersion in ACCEPTANCE_RULES)) {
+        throw new Error(`Unknown acceptance rule version '${ruleVersion}' — cannot fingerprint an unregistered rule.`);
+    }
+    return createHash('sha256').update(RULE_TAG).update('\0').update(ruleVersion).digest('hex');
+}
+/** Re-execute a frozen rule on sealed inputs. Throws for an unknown version. */
+export function reExecuteGate(ruleVersion, sealed) {
+    const rule = ACCEPTANCE_RULES[ruleVersion];
+    if (!rule) {
+        throw new Error(`Unknown acceptance rule version '${ruleVersion}' — refusing to re-execute an unregistered rule.`);
+    }
+    return rule(sealed);
+}
+/**
+ * Verify a promotion by re-executing its frozen rule on its sealed inputs.
+ * The logged verdict is trusted only insofar as the re-run reproduces it.
+ *
+ * @param opts.pinnedRuleFingerprint - if supplied, the receipt's fingerprint
+ *   must also equal this pinned value (an externally-anchored rule identity).
+ */
+export function verifyPromotion(receipt, opts = {}) {
+    const failures = [];
+    // sealIntact — recompute the sealed content hash (ADR-116).
+    const sealIntact = sealedHash(receipt.sealed) === receipt.sealedHash;
+    if (!sealIntact)
+        failures.push('sealIntact');
+    // gateUnchanged — recorded fingerprint matches the current rule version, and
+    // the pinned fingerprint if one was supplied. Unknown version ⇒ not unchanged.
+    let gateUnchanged = false;
+    try {
+        const currentFp = gateFingerprint(receipt.ruleVersion);
+        gateUnchanged =
+            receipt.ruleFingerprint === currentFp &&
+                (opts.pinnedRuleFingerprint === undefined || receipt.ruleFingerprint === opts.pinnedRuleFingerprint);
+    }
+    catch {
+        gateUnchanged = false; // unregistered rule version
+    }
+    if (!gateUnchanged)
+        failures.push('gateUnchanged');
+    // gateReExecutes — only meaningful if the inputs are intact and the rule is
+    // the same one. Re-run must reproduce the recorded verdict; a logged PROMOTE
+    // the frozen rule would reject (the A8-EXT forgery class) fails here.
+    let gateReExecutes = false;
+    if (sealIntact && gateUnchanged) {
+        const rerun = reExecuteGate(receipt.ruleVersion, receipt.sealed);
+        const rerunVerdict = rerun.promote ? 'promote' : 'reject';
+        gateReExecutes = rerunVerdict === receipt.recordedVerdict;
+    }
+    if (!gateReExecutes)
+        failures.push('gateReExecutes');
+    const valid = failures.length === 0;
+    return {
+        valid,
+        checks: { sealIntact, gateUnchanged, gateReExecutes },
+        failures,
+        reason: valid
+            ? 'promotion verified: sealed inputs intact, rule unchanged, frozen rule re-execution reproduces the recorded verdict'
+            : `promotion INVALID (failed: ${failures.join(', ')}) — the recorded verdict is not reproducible under the frozen rule`,
+    };
+}
+/** Tag domain-separating the path-rule fingerprint (distinct from the accept tag). */
+const PATH_RULE_TAG = 'aqe:promotion-path-rule:v1+sig';
+/**
+ * pattern-promote/v1 — the P1 conjunctive gate (short-term → long-term).
+ * Promotes only when ALL hold: evidence tier allows promotion (ADR-121),
+ * reward / occurrences / success-rate clear their sealed thresholds, and the
+ * pattern was active within the promotion window (anti-stale).
+ */
+const patternPromoteV1 = (s) => {
+    if (!tierAllowsPromotion(s.provenanceTier, { allowJudgeTier: s.allowJudgeTier })) {
+        return { promote: false, reason: `provenance tier '${s.provenanceTier}' not allowed to promote` };
+    }
+    if (s.reward === undefined || s.rewardThreshold === undefined || !(s.reward >= s.rewardThreshold)) {
+        return { promote: false, reason: `reward ${s.reward} below threshold ${s.rewardThreshold}` };
+    }
+    if (s.occurrences === undefined || s.occurrenceThreshold === undefined || !(s.occurrences >= s.occurrenceThreshold)) {
+        return { promote: false, reason: `occurrences ${s.occurrences} below threshold ${s.occurrenceThreshold}` };
+    }
+    if (s.successRate === undefined || s.successRateThreshold === undefined || !(s.successRate >= s.successRateThreshold)) {
+        return { promote: false, reason: `success rate ${s.successRate} below threshold ${s.successRateThreshold}` };
+    }
+    if (s.withinActivityWindow !== true) {
+        return { promote: false, reason: 'pattern outside promotion activity window (stale)' };
+    }
+    return { promote: true, reason: 'tier allowed; reward/occurrence/success-rate thresholds met; within activity window' };
+};
+/**
+ * dream-apply/v1 — the P2 gate (the A8-EXT fake-`applied`-counter home).
+ * An insight is countable as applied only when: its evidence tier allows a
+ * fleet-changing apply (ADR-121), its confidence clears the sealed threshold,
+ * and it produced a real reorganization action (not `no_action`).
+ */
+const dreamApplyV1 = (s) => {
+    if (!tierAllowsPromotion(s.provenanceTier, { allowJudgeTier: s.allowJudgeTier })) {
+        return { promote: false, reason: `provenance tier '${s.provenanceTier}' not allowed to apply` };
+    }
+    if (s.insightConfidence === undefined ||
+        s.insightConfidenceThreshold === undefined ||
+        !(s.insightConfidence >= s.insightConfidenceThreshold)) {
+        return { promote: false, reason: `insight confidence ${s.insightConfidence} below threshold ${s.insightConfidenceThreshold}` };
+    }
+    if (s.insightActionable !== true) {
+        return { promote: false, reason: 'insight produced no actionable reorganization' };
+    }
+    return { promote: true, reason: 'tier allowed; insight confidence meets threshold; actionable' };
+};
+/**
+ * Registry of versioned frozen promotion-path rules. Add a NEW key to change a
+ * rule; never edit in place (a rule change is a version bump — ADR-120 §5).
+ * Kept separate from `ACCEPTANCE_RULES` so the flywheel accept gate and its
+ * locked test are untouched.
+ */
+export const PROMOTION_PATH_RULES = Object.freeze({
+    'pattern-promote/v1': patternPromoteV1,
+    'dream-apply/v1': dreamApplyV1,
+});
+/** SHA-256 content hash of path sealed inputs (ADR-116 canonical form). */
+export function pathSealedHash(sealed) {
+    return createHash('sha256').update(canonicalJson(sealed)).digest('hex');
+}
+/** Fingerprint of a path-rule VERSION. Throws for an unregistered rule. */
+export function pathGateFingerprint(ruleVersion) {
+    if (!(ruleVersion in PROMOTION_PATH_RULES)) {
+        throw new Error(`Unknown promotion-path rule version '${ruleVersion}' — cannot fingerprint an unregistered rule.`);
+    }
+    return createHash('sha256').update(PATH_RULE_TAG).update('\0').update(ruleVersion).digest('hex');
+}
+/** Re-execute a frozen path rule on sealed inputs. Throws for an unknown version. */
+export function reExecutePathGate(ruleVersion, sealed) {
+    const rule = PROMOTION_PATH_RULES[ruleVersion];
+    if (!rule) {
+        throw new Error(`Unknown promotion-path rule version '${ruleVersion}' — refusing to re-execute an unregistered rule.`);
+    }
+    return rule(sealed);
+}
+/**
+ * Verify a promotion-path decision by re-executing its frozen rule on its
+ * sealed inputs. Identical semantics to {@link verifyPromotion}: the logged
+ * verdict is trusted only insofar as the re-run reproduces it on intact inputs.
+ */
+export function verifyPathPromotion(receipt, opts = {}) {
+    const failures = [];
+    const sealIntact = pathSealedHash(receipt.sealed) === receipt.sealedHash;
+    if (!sealIntact)
+        failures.push('sealIntact');
+    let gateUnchanged = false;
+    try {
+        const currentFp = pathGateFingerprint(receipt.ruleVersion);
+        gateUnchanged =
+            receipt.ruleFingerprint === currentFp &&
+                (opts.pinnedRuleFingerprint === undefined || receipt.ruleFingerprint === opts.pinnedRuleFingerprint);
+    }
+    catch {
+        gateUnchanged = false; // unregistered rule version
+    }
+    if (!gateUnchanged)
+        failures.push('gateUnchanged');
+    let gateReExecutes = false;
+    if (sealIntact && gateUnchanged) {
+        const rerun = reExecutePathGate(receipt.ruleVersion, receipt.sealed);
+        const rerunVerdict = rerun.promote ? 'promote' : 'reject';
+        gateReExecutes = rerunVerdict === receipt.recordedVerdict;
+    }
+    if (!gateReExecutes)
+        failures.push('gateReExecutes');
+    const valid = failures.length === 0;
+    return {
+        valid,
+        checks: { sealIntact, gateUnchanged, gateReExecutes },
+        failures,
+        reason: valid
+            ? 'promotion verified: sealed inputs intact, rule unchanged, frozen rule re-execution reproduces the recorded verdict'
+            : `promotion INVALID (failed: ${failures.join(', ')}) — the recorded verdict is not reproducible under the frozen rule`,
+    };
+}
+//# sourceMappingURL=gate-reexecute.js.map

package/dist/validation/quality-gate-runner.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Quality-gate orchestrator (ADR-119 / ADR-120).
+ *
+ * The ONE code path both the `aqe quality-gate` CLI subcommand and the
+ * `qe/quality/gate` MCP tool call, so the two surfaces stay in exact parity
+ * (the CLI/MCP divergence CLAUDE.md warns about). It:
+ *
+ *   1. loads the pinned, hash-checked ADR-117 anchor via `loadAnchorSet` (which
+ *      throws on drift — the frozen checklist can't be silently edited),
+ *   2. selects the constant-denominator checklist for `checklistId`,
+ *   3. runs the two-gate, three-valued `computeQualityVerdict` with the injected
+ *      frontier judge.
+ *
+ * The oracle result and the judge are injected — this module owns no LLM and no
+ * mutation runner, so it is deterministic and unit-testable with a fake judge.
+ */
+import { type Judge, type QualityVerdictResult, type RequirementChecklist } from './quality-verdict.js';
+import type { OracleResult } from './oracle-eval.js';
+/** Default frozen anchor location, relative to the project root (ADR-117). */
+export declare const DEFAULT_ANCHOR_RELATIVE_PATH = "verification/anchors/qe-anchor-v1.json";
+export interface QualityGateRequest {
+    /**
+     * Mechanical-gate result from the ADR-113 oracle. `null` ⇒ the oracle did not
+     * run at all — treated as a non-executed test ⇒ mechanical fail.
+     */
+    oracleResult: Pick<OracleResult, 'passed' | 'baselinePassed'> | null;
+    /** The artifact under judgement (produced test source / spec output). */
+    artifact: string;
+    /** Anchor item id whose pinned checklist to grade against (e.g. "A1-inRange"). */
+    checklistId: string;
+    /** The frontier judge (injected — ALWAYS frontier-tier, ADR-111). */
+    judge: Judge;
+    /** Override the frozen anchor path (absolute, or relative to project root). */
+    anchorPath?: string;
+}
+/**
+ * Run the two-gate quality gate for one artifact against one pinned checklist.
+ * Throws only for caller error (unknown checklist id, unloadable/drifted anchor);
+ * every judgement outcome is returned as a three-valued `QualityVerdictResult`.
+ */
+export declare function runQualityGate(req: QualityGateRequest): Promise<QualityVerdictResult>;
+/**
+ * Load the pinned checklist for `checklistId` from the frozen anchor. Exposed so
+ * callers (CLI/MCP) can list valid ids or pre-validate before building a judge.
+ */
+export declare function loadChecklist(checklistId: string, anchorPath?: string): RequirementChecklist;
+/** List every checklist id in the frozen anchor (for CLI/MCP discoverability). */
+export declare function listChecklistIds(anchorPath?: string): string[];
+//# sourceMappingURL=quality-gate-runner.d.ts.map

package/dist/validation/quality-gate-runner.js

@@ -0,0 +1,62 @@
+/**
+ * Quality-gate orchestrator (ADR-119 / ADR-120).
+ *
+ * The ONE code path both the `aqe quality-gate` CLI subcommand and the
+ * `qe/quality/gate` MCP tool call, so the two surfaces stay in exact parity
+ * (the CLI/MCP divergence CLAUDE.md warns about). It:
+ *
+ *   1. loads the pinned, hash-checked ADR-117 anchor via `loadAnchorSet` (which
+ *      throws on drift — the frozen checklist can't be silently edited),
+ *   2. selects the constant-denominator checklist for `checklistId`,
+ *   3. runs the two-gate, three-valued `computeQualityVerdict` with the injected
+ *      frontier judge.
+ *
+ * The oracle result and the judge are injected — this module owns no LLM and no
+ * mutation runner, so it is deterministic and unit-testable with a fake judge.
+ */
+import path from 'node:path';
+import { loadAnchorSet } from './anchor-set.js';
+import { computeQualityVerdict, } from './quality-verdict.js';
+import { findProjectRoot } from '../kernel/unified-memory.js';
+/** Default frozen anchor location, relative to the project root (ADR-117). */
+export const DEFAULT_ANCHOR_RELATIVE_PATH = 'verification/anchors/qe-anchor-v1.json';
+/**
+ * Run the two-gate quality gate for one artifact against one pinned checklist.
+ * Throws only for caller error (unknown checklist id, unloadable/drifted anchor);
+ * every judgement outcome is returned as a three-valued `QualityVerdictResult`.
+ */
+export async function runQualityGate(req) {
+    const checklist = loadChecklist(req.checklistId, req.anchorPath);
+    return computeQualityVerdict({
+        oracle: req.oracleResult,
+        artifact: req.artifact,
+        checklist,
+        judge: req.judge,
+    });
+}
+/**
+ * Load the pinned checklist for `checklistId` from the frozen anchor. Exposed so
+ * callers (CLI/MCP) can list valid ids or pre-validate before building a judge.
+ */
+export function loadChecklist(checklistId, anchorPath) {
+    const resolved = resolveAnchorPath(anchorPath);
+    const anchor = loadAnchorSet(resolved); // throws on hash drift (ADR-117 §2)
+    const item = anchor.items.find((it) => it.id === checklistId);
+    if (!item) {
+        const available = anchor.items.map((it) => it.id).join(', ');
+        throw new Error(`Unknown checklist id "${checklistId}" in anchor ${resolved}. Available: ${available}`);
+    }
+    return { id: item.id, requirements: item.requirements };
+}
+/** List every checklist id in the frozen anchor (for CLI/MCP discoverability). */
+export function listChecklistIds(anchorPath) {
+    const anchor = loadAnchorSet(resolveAnchorPath(anchorPath));
+    return anchor.items.map((it) => it.id);
+}
+function resolveAnchorPath(anchorPath) {
+    if (anchorPath && path.isAbsolute(anchorPath))
+        return anchorPath;
+    const root = findProjectRoot();
+    return path.resolve(root, anchorPath ?? DEFAULT_ANCHOR_RELATIVE_PATH);
+}
+//# sourceMappingURL=quality-gate-runner.js.map

package/dist/validation/quality-verdict.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Two-gate, three-valued quality verdict (ADR-119).
+ *
+ * A single, two-valued quality verdict lies in three ways: it can pass tests
+ * that never executed, a single LLM judge is noisy (retort measured Haiku
+ * swinging 0.33↔1.0 on identical code), and pass/fail can't tell a genuine gap
+ * from an inconclusive run. This composes retort's design:
+ *
+ *   1. Mechanical gate — reuse the ADR-113 oracle. Tests that did not execute
+ *      ⇒ `fail`. No judge is consulted until the mechanical gate is satisfied.
+ *   2. Spec gate — a FRONTIER-tier judge (never the cheap writer lane, ADR-111)
+ *      scores the artifact against the ADR-117 pinned, constant-denominator
+ *      checklist; two-attempt second opinion; pass only at coverage 1.0.
+ *   3. Judge preflight — refuse to report success if the judge never ran.
+ *
+ * Verdict ∈ {pass, fail, inconclusive}. `inconclusive` (retort's `None`) keeps
+ * an infra hiccup from masquerading as a spec failure — ADR-118's accept()
+ * records neither a promotion nor a rejection on `inconclusive`.
+ *
+ * The judge and checklist are injected so this logic is testable without a live
+ * frontier model or the frozen anchor file (which is authored under ADR-117).
+ */
+import type { OracleResult } from './oracle-eval.js';
+export type QualityVerdict = 'pass' | 'fail' | 'inconclusive';
+/**
+ * A pinned, constant-denominator requirement checklist (ADR-117 anchor).
+ * The denominator (requirement count) is authored ONCE per artifact type so
+ * coverage scores are comparable across runs — retort's fix for non-comparable
+ * per-run extraction.
+ */
+export interface RequirementChecklist {
+    /** Stable id of the pinned checklist (e.g. the ADR-117 anchor id). */
+    id: string;
+    /** The requirements — the constant denominator. Must be non-empty. */
+    requirements: string[];
+}
+/** One judge attempt's opinion. */
+export interface JudgeOpinion {
+    /**
+     * Whether the judge tooling actually ran and produced a real grade. `false`
+     * means usage-limit / timeout / tooling failure — NOT a real opinion, so it
+     * can never contribute to a `fail`.
+     */
+    ran: boolean;
+    /** Fraction of checklist requirements satisfied, in [0, 1]. */
+    coverage: number;
+    /** Requirements judged unmet (for reporting; empty when coverage is 1.0). */
+    unmet: string[];
+}
+/**
+ * The frontier judge. ALWAYS top-tier (ADR-111 — the oracle is the one place
+ * you never economize). Implementations wrap the frontier model + credentials.
+ */
+export interface Judge {
+    /** ADR-119 §4: verify the judge tooling/credentials before grading. */
+    preflight(): Promise<boolean> | boolean;
+    /** Grade the artifact against the pinned checklist. */
+    grade(artifact: string, checklist: RequirementChecklist): Promise<JudgeOpinion> | JudgeOpinion;
+}
+export interface QualityVerdictInput {
+    /**
+     * Mechanical-gate result from the ADR-113 oracle. `null` means the oracle did
+     * not run at all — treated as a non-executed test ⇒ mechanical fail.
+     */
+    oracle: Pick<OracleResult, 'passed' | 'baselinePassed'> | null;
+    /** The artifact under judgement (e.g. produced test source / spec output). */
+    artifact: string;
+    /** The pinned checklist to grade against. */
+    checklist: RequirementChecklist;
+    /** The frontier judge (injected). */
+    judge: Judge;
+}
+export interface QualityVerdictResult {
+    verdict: QualityVerdict;
+    /** Mechanical gate outcome (execution). */
+    mechanical: 'pass' | 'fail';
+    /** Best spec-gate coverage observed across attempts (null if judge never ran). */
+    specCoverage: number | null;
+    /** Unmet requirements from the best real attempt (empty on pass). */
+    unmet: string[];
+    /** Number of spec-gate attempts actually made. */
+    attempts: number;
+    reason: string;
+}
+/**
+ * Compute the two-gate, three-valued quality verdict.
+ *
+ * Order is strict: mechanical gate first (a non-executing test is `fail`
+ * regardless of judge opinion), then judge preflight, then the two-attempt spec
+ * gate. `fail` requires TWO real short opinions; fewer than two real opinions ⇒
+ * `inconclusive` (never a silent pass, never a spec-fail from infra).
+ */
+export declare function computeQualityVerdict(input: QualityVerdictInput): Promise<QualityVerdictResult>;
+//# sourceMappingURL=quality-verdict.d.ts.map

package/dist/validation/quality-verdict.js

@@ -0,0 +1,120 @@
+/**
+ * Two-gate, three-valued quality verdict (ADR-119).
+ *
+ * A single, two-valued quality verdict lies in three ways: it can pass tests
+ * that never executed, a single LLM judge is noisy (retort measured Haiku
+ * swinging 0.33↔1.0 on identical code), and pass/fail can't tell a genuine gap
+ * from an inconclusive run. This composes retort's design:
+ *
+ *   1. Mechanical gate — reuse the ADR-113 oracle. Tests that did not execute
+ *      ⇒ `fail`. No judge is consulted until the mechanical gate is satisfied.
+ *   2. Spec gate — a FRONTIER-tier judge (never the cheap writer lane, ADR-111)
+ *      scores the artifact against the ADR-117 pinned, constant-denominator
+ *      checklist; two-attempt second opinion; pass only at coverage 1.0.
+ *   3. Judge preflight — refuse to report success if the judge never ran.
+ *
+ * Verdict ∈ {pass, fail, inconclusive}. `inconclusive` (retort's `None`) keeps
+ * an infra hiccup from masquerading as a spec failure — ADR-118's accept()
+ * records neither a promotion nor a rejection on `inconclusive`.
+ *
+ * The judge and checklist are injected so this logic is testable without a live
+ * frontier model or the frozen anchor file (which is authored under ADR-117).
+ */
+/** Coverage at or above this is a spec-gate pass (pinned checklist ⇒ pass only at 1.0). */
+const PASS_COVERAGE = 1.0;
+/** ADR-119 §3: at most two attempts (second opinion). */
+const MAX_ATTEMPTS = 2;
+/**
+ * Compute the two-gate, three-valued quality verdict.
+ *
+ * Order is strict: mechanical gate first (a non-executing test is `fail`
+ * regardless of judge opinion), then judge preflight, then the two-attempt spec
+ * gate. `fail` requires TWO real short opinions; fewer than two real opinions ⇒
+ * `inconclusive` (never a silent pass, never a spec-fail from infra).
+ */
+export async function computeQualityVerdict(input) {
+    if (input.checklist.requirements.length === 0) {
+        throw new Error('RequirementChecklist must have a non-empty, constant denominator (ADR-117).');
+    }
+    // 1. Mechanical gate (ADR-113). Non-execution ⇒ fail, no judge consulted.
+    const mechanicalPass = input.oracle != null && input.oracle.baselinePassed && input.oracle.passed;
+    if (!mechanicalPass) {
+        const why = input.oracle == null
+            ? 'oracle did not run'
+            : !input.oracle.baselinePassed
+                ? 'tests did not execute against the reference implementation'
+                : 'mutation score below threshold';
+        return {
+            verdict: 'fail',
+            mechanical: 'fail',
+            specCoverage: null,
+            unmet: [],
+            attempts: 0,
+            reason: `mechanical gate failed: ${why}`,
+        };
+    }
+    // 2. Judge preflight (ADR-119 §4). If the judge tooling can't run, the verdict
+    // is inconclusive — never a silent pass.
+    const ready = await input.judge.preflight();
+    if (!ready) {
+        return {
+            verdict: 'inconclusive',
+            mechanical: 'pass',
+            specCoverage: null,
+            unmet: [],
+            attempts: 0,
+            reason: 'judge preflight failed: judge tooling did not run — refusing to report success',
+        };
+    }
+    // 3. Two-attempt spec gate (retort protocol). Pass on the first attempt that
+    // reaches 1.0; otherwise collect real opinions.
+    const realOpinions = [];
+    let bestCoverage = null;
+    let bestUnmet = [];
+    let attempts = 0;
+    for (let i = 0; i < MAX_ATTEMPTS; i++) {
+        attempts++;
+        const op = await input.judge.grade(input.artifact, input.checklist);
+        if (!op.ran) {
+            continue; // not a real opinion — cannot contribute to a fail
+        }
+        realOpinions.push(op);
+        if (bestCoverage == null || op.coverage > bestCoverage) {
+            bestCoverage = op.coverage;
+            bestUnmet = op.unmet;
+        }
+        if (op.coverage >= PASS_COVERAGE) {
+            return {
+                verdict: 'pass',
+                mechanical: 'pass',
+                specCoverage: op.coverage,
+                unmet: [],
+                attempts,
+                reason: `spec gate passed at coverage ${op.coverage.toFixed(3)} on attempt ${attempts}`,
+            };
+        }
+    }
+    // No attempt reached 1.0. Fail ONLY on two real short opinions; otherwise
+    // inconclusive (fewer than two real opinions = usage limit / timeout).
+    if (realOpinions.length >= 2) {
+        return {
+            verdict: 'fail',
+            mechanical: 'pass',
+            specCoverage: bestCoverage,
+            unmet: bestUnmet,
+            attempts,
+            reason: `spec gate failed: ${realOpinions.length} real opinions, best coverage `
+                + `${(bestCoverage ?? 0).toFixed(3)} < ${PASS_COVERAGE} (${bestUnmet.length} unmet)`,
+        };
+    }
+    return {
+        verdict: 'inconclusive',
+        mechanical: 'pass',
+        specCoverage: bestCoverage,
+        unmet: bestUnmet,
+        attempts,
+        reason: `spec gate inconclusive: only ${realOpinions.length} real opinion(s) obtainable `
+            + `(need 2 to fail) — retry later, record neither pass nor fail`,
+    };
+}
+//# sourceMappingURL=quality-verdict.js.map

package/dist/workers/workers/learning-consolidation.js

@@ -17,11 +17,12 @@ import { ALL_DOMAINS } from '../../shared/types';
 import { TimeRange } from '../../shared/value-objects/index.js';
 import { DreamEngine } from '../../learning/dream/index.js';
 import { createPatternLifecycleManager, } from '../../learning/pattern-lifecycle.js';
-import { getUnifiedMemory } from '../../kernel/unified-memory.js';
+import { getUnifiedMemory, findProjectRoot } from '../../kernel/unified-memory.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
 import { ExperienceConsolidator } from '../../learning/experience-consolidation.js';
 import { recordLoopHealth } from '../../learning/loop-health.js';
 import { pruneStaleDreamInsights } from '../../learning/dream/dream-insights-pruner.js';
+import { createLearningMetricsTracker } from '../../learning/metrics-tracker.js';
 const CONFIG = {
     id: 'learning-consolidation',
     name: 'Learning Consolidation',
@@ -202,6 +203,25 @@ export class LearningConsolidationWorker extends BaseWorker {
                     error: recordErr instanceof Error ? recordErr.message : String(recordErr),
                 });
             }
+            // A18: learning_daily_snapshots previously only populated via the
+            // manual `aqe learning dashboard --save-snapshot` flag — it never
+            // advanced on its own. Piggyback on this worker's existing ~30-min
+            // cadence instead of adding a new timer. Best-effort, own DB handle
+            // closed every tick (LearningMetricsTracker opens a connection
+            // separate from the shared unified-memory one context.memory uses).
+            const tracker = createLearningMetricsTracker(findProjectRoot());
+            try {
+                await tracker.initialize();
+                await tracker.saveSnapshot();
+            }
+            catch (snapshotErr) {
+                context.logger.warn('learning_daily_snapshots saveSnapshot failed (non-fatal)', {
+                    error: snapshotErr instanceof Error ? snapshotErr.message : String(snapshotErr),
+                });
+            }
+            finally {
+                tracker.close();
+            }
         }
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-qe",
-  "version": "3.11.4",
+  "version": "3.12.0",
   "description": "Agentic Quality Engineering V3 - Domain-Driven Design Architecture with 13 Bounded Contexts, O(log n) coverage analysis, ReasoningBank learning, 60 specialized QE agents, mathematical Coherence verification, deep Claude Flow integration",
   "type": "module",
   "main": "./dist/index.js",

package/dist/cli/chunks/adapter-2HMUXHWY.js

@@ -1,2 +0,0 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.4");process.exit(0)}
-import{a,b,c}from"./chunk-N2BJN6AO.js";import"./chunk-6JUOH6L4.js";import"./chunk-AYGEWPN4.js";import"./chunk-VJGHRWMH.js";import"./chunk-PEIQDQXN.js";import"./chunk-Y4AXOHW4.js";export{a as AgentBoosterAdapter,b as createAgentBoosterAdapter,c as createAgentBoosterAdapterSync};

package/dist/cli/chunks/aqe-learning-engine-M2NKRVRE.js

@@ -1,2 +0,0 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.4");process.exit(0)}
-import{a,b,c,d,e,f}from"./chunk-3SRPFBU7.js";import"./chunk-QEVX4GWF.js";import"./chunk-HWBMYR5W.js";import"./chunk-QSDIY3E2.js";import"./chunk-MYMIEQSZ.js";import"./chunk-DNOU2HVQ.js";import"./chunk-2WPSMQIL.js";import"./chunk-IF3HPQNV.js";import"./chunk-HT6WAYIR.js";import"./chunk-HJO4RNOW.js";import"./chunk-5AQ7FXYG.js";import"./chunk-YNK6SUPU.js";import"./chunk-YKSWC7I4.js";import"./chunk-54B6P2WS.js";import"./chunk-TPMBFARK.js";import"./chunk-LW5DHT3Z.js";import"./chunk-XXRTWG7O.js";import"./chunk-6GYGAW53.js";import"./chunk-LLUPRGOR.js";import"./chunk-VJGHRWMH.js";import"./chunk-IB3ZPLFA.js";import"./chunk-TSWF3AGQ.js";import"./chunk-NSPCZPTB.js";import"./chunk-O7PVZ32A.js";import"./chunk-PEIQDQXN.js";import"./chunk-BMQDELPA.js";import"./chunk-TCWR6TDN.js";import"./chunk-YUHM72VQ.js";import"./chunk-PQUXFSN6.js";import"./chunk-7AWK43JN.js";import"./chunk-VCUCD3B5.js";import"./chunk-QJ5NCYJ3.js";import"./chunk-TQ373GGI.js";import"./chunk-7QTB5XIQ.js";import"./chunk-7ADD2ZQL.js";import"./chunk-Y4AXOHW4.js";export{b as AQELearningEngine,a as DEFAULT_ENGINE_CONFIG,c as DEFAULT_META_LEARNING_CONFIG,d as MetaLearningEngine,e as createAQELearningEngine,f as createDefaultLearningEngine};

package/dist/cli/chunks/audit-EPB7ETMT.js

@@ -1,3 +0,0 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.4");process.exit(0)}
-import{d as c,e as u,f as h,g as m}from"./chunk-BRLUNIR4.js";import{m as p}from"./chunk-TPMBFARK.js";import"./chunk-LW5DHT3Z.js";import"./chunk-XXRTWG7O.js";import"./chunk-6GYGAW53.js";import{b as s}from"./chunk-LLUPRGOR.js";import"./chunk-VJGHRWMH.js";import"./chunk-NSPCZPTB.js";import"./chunk-PEIQDQXN.js";import"./chunk-TCWR6TDN.js";import{p as l,q as d}from"./chunk-YUHM72VQ.js";import"./chunk-PQUXFSN6.js";import"./chunk-7AWK43JN.js";import"./chunk-VCUCD3B5.js";import"./chunk-QJ5NCYJ3.js";import"./chunk-TQ373GGI.js";import"./chunk-7QTB5XIQ.js";import"./chunk-7ADD2ZQL.js";import{g as f}from"./chunk-Y4AXOHW4.js";import{Command as g}from"commander";import a from"chalk";p();import{existsSync as y}from"node:fs";import b from"node:path";function C(n,i){let t=[];t.push(a.bold("Witness Chain Audit Verification")),t.push("");let e=i?a.green("ENABLED"):a.yellow("DISABLED");t.push(`  Feature Flag: ${e}`),t.push(`  Chain Length:  ${n.length} receipts`);let r=n.valid?a.green("VALID"):a.red("BROKEN");return t.push(`  Integrity:    ${r}`),n.length>0&&t.push(`  Last Hash:    ${n.lastHash.slice(0,16)}...`),!n.valid&&n.brokenAt>=0&&(t.push(""),t.push(a.red(`  Break detected at index ${n.brokenAt}`)),t.push(a.red(`  ${n.message}`))),t.push(""),t.join(`
-`)}function x(){try{let n=s(),i=b.join(n,".agentic-qe","memory.db");if(!y(i))return null;let t=(d(),f(l)),e=new t(i),r=c(e),o=h(r);return e.close(),o}catch{return null}}async function A(n){let i=m(),e=(x()??u()).verifyChain(),r={featureEnabled:i,chainLength:e.length,integrity:e.valid,brokenAt:e.brokenAt,lastHash:e.lastHash,message:e.message};return n.format==="json"?console.log(JSON.stringify(r,null,2)):console.log(C(e,i)),r}function v(n,i,t){let e=new g("audit").description("Witness chain audit trail management");return e.command("verify").description("Verify witness chain integrity").option("-F, --format <format>","Output format (json|text)","text").action(async r=>{try{await A({format:r.format}),await i(0)}catch(o){console.error("Failed to verify witness chain:",o),await i(1)}}),e}export{v as createAuditCommand,C as formatVerificationText,A as handleAuditVerify};

package/dist/cli/chunks/base-CCHC2DAC.js

@@ -1,2 +0,0 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.11.4");process.exit(0)}
-import{a,b,c,d,e,f,g,h,i,j,k}from"./chunk-ZSA6V5FH.js";import"./chunk-IQBZBUP5.js";import"./chunk-TPMBFARK.js";import"./chunk-LW5DHT3Z.js";import"./chunk-XXRTWG7O.js";import"./chunk-6GYGAW53.js";import"./chunk-LLUPRGOR.js";import"./chunk-VJGHRWMH.js";import"./chunk-NSPCZPTB.js";import"./chunk-PEIQDQXN.js";import"./chunk-BMQDELPA.js";import"./chunk-ICCTQ5LO.js";import"./chunk-TCWR6TDN.js";import"./chunk-YUHM72VQ.js";import"./chunk-PQUXFSN6.js";import"./chunk-7AWK43JN.js";import"./chunk-VCUCD3B5.js";import"./chunk-QJ5NCYJ3.js";import"./chunk-TQ373GGI.js";import"./chunk-7QTB5XIQ.js";import"./chunk-7ADD2ZQL.js";import"./chunk-Y4AXOHW4.js";export{k as MCPToolBase,j as defaultToolLogger,i as getLLMRouter,e as getMemoryBackend,g as getSharedLLMRouter,c as getSharedMemoryBackend,a as isMemoryOnlyMode,b as registerRvfResetFn,h as resetSharedLLMRouter,d as resetSharedMemoryBackend,f as setSharedLLMRouter};