agentic-qe 3.13.12 → 3.14.1

package/.claude/helpers/brain-checkpoint.cjs

@@ -17,6 +17,7 @@ const AQE_DIR = path.join(PROJECT_ROOT, '.agentic-qe');
 const RVF_PATH = path.join(AQE_DIR, 'aqe.rvf');
 const DB_PATH = path.join(AQE_DIR, 'memory.db');
 const MAX_AGE_HOURS = 24;
+const AQE_BIN = process.env.AQE_HOOK_BIN || (process.platform === 'win32' ? 'aqe.cmd' : 'aqe');
 
 // Mount-local kill switch. `brain export` (below) spawns a native RVF writer
 // that, on a macOS Docker virtiofs bind mount, deadlocks in a futex and IGNORES
@@ -37,7 +38,7 @@ function exportBrain() {
     const idmap = RVF_PATH + '.idmap.json';
     if (fs.existsSync(idmap)) fs.unlinkSync(idmap);
     const result = execFileSync(
-      'npx', ['agentic-qe', 'brain', 'export', '-o', RVF_PATH, '--format', 'rvf'],
+      AQE_BIN, ['brain', 'export', '-o', RVF_PATH, '--format', 'rvf'],
       { timeout: 60000, encoding: 'utf-8' }
     );
     const m = result.match(/Patterns:\s+(\d+)/);

package/.claude/helpers/validate-v3-config.sh

@@ -144,12 +144,13 @@ if command -v node >/dev/null 2>&1; then
   node_version=$(node --version)
   log_success "Node.js installed: $node_version"
 
-  # Check if Node.js version is 20+
+  # Check if Node.js version is 22.13+
   node_major=$(echo "$node_version" | cut -d'.' -f1 | sed 's/v//')
-  if [ "$node_major" -ge 20 ]; then
-    log_success "Node.js version meets requirements (≥20.0.0)"
+  node_minor=$(echo "$node_version" | cut -d'.' -f2)
+  if [ "$node_major" -gt 22 ] || { [ "$node_major" -eq 22 ] && [ "$node_minor" -ge 13 ]; }; then
+    log_success "Node.js version meets requirements (≥22.13.0)"
   else
-    log_error "Node.js version too old. Required: ≥20.0.0, Found: $node_version"
+    log_error "Node.js version too old. Required: ≥22.13.0, Found: $node_version"
   fi
 else
   log_error "Node.js not installed"
@@ -213,4 +214,4 @@ else
   fi
   log_error "Please fix critical errors before proceeding with V3 development."
   exit 1
-fi
+fi

package/.claude/hooks/aqe-hook.cjs

@@ -3,7 +3,7 @@
  * Resilient AQE hook shim (#510 item 5 — ports ruflo's hook-shim contract).
  *
  * Written in Node (CommonJS) so ONE file is cross-platform — Node is already a
- * hard dependency of AQE (the CLI is Node >= 20), so this runs identically on
+ * hard dependency of AQE (the CLI is Node >= 22.13), so this runs identically on
  * Windows / macOS / Linux with no POSIX `.sh` + `.cjs` twin. (It replaced an
  * earlier `aqe-hook.sh`, which forced a Windows twin and a `node_modules/.bin`
  * shell-wrapper spawn — see PR #512 discussion.)
@@ -14,9 +14,9 @@
  * polluting the transcript, and a crash/slow init can surface a hook error.
  *
  * Contract:
- *   * resolve a PROJECT-LOCAL AQE bundle and run it via THIS node (no shell, no
- *     .bin/.cmd wrapper) — or fall back to `npx agentic-qe` for npx-only installs
- *     (disable that fallback with AQE_HOOK_NPX=0);
+ *   * resolve a PROJECT-LOCAL AQE bundle and run it via THIS node (no shell),
+ *     or invoke an already-installed `aqe` binary without package-manager or
+ *     network resolution;
  *   * if nothing resolves, no-op (a hook must never block a turn);
  *   * keep stderr OUT of the transcript, but tee fatal native-init markers
  *     (e.g. better-sqlite3 `invalid ELF header`) to a throttled, durable
@@ -49,14 +49,14 @@ const args = process.argv.slice(2); // hook subcommand + its args
 //   2. local source build           (this repo: ./dist)
 //   -> run either directly via process.execPath (this node): no shell, no
 //      node_modules/.bin/aqe(.cmd) wrapper, fully cross-platform.
-//   3. npx fallback                  (npx-only installs with no project-local
-//      bundle) — `npx -y --prefer-offline agentic-qe hooks ...`. Disable with
-//      AQE_HOOK_NPX=0 (used by tests and by anyone who never wants a network
-//      reach). When disabled and no local bundle exists, we no-op.
+//   3. installed `aqe` binary        (global/managed installs without a local
+//      bundle). AQE_HOOK_BIN is a test/managed-install seam; no package manager
+//      is ever invoked from a lifecycle hook.
 const candidates = [
+  process.env.AQE_HOOK_BUNDLE,
   path.join(PROJECT, 'node_modules', 'agentic-qe', 'dist', 'cli', 'bundle.js'),
   path.join(PROJECT, 'dist', 'cli', 'bundle.js'),
-];
+].filter(Boolean);
 
 let cmd;
 let cmdArgs;
@@ -67,11 +67,9 @@ for (const p of candidates) {
 if (bundle) {
   cmd = process.execPath;
   cmdArgs = [bundle, 'hooks', ...args];
-} else if (process.env.AQE_HOOK_NPX !== '0') {
-  cmd = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-  cmdArgs = ['-y', '--prefer-offline', 'agentic-qe', 'hooks', ...args];
 } else {
-  process.exit(0); // no project-local AQE and npx disabled -> no-op, never block
+  cmd = process.env.AQE_HOOK_BIN || (process.platform === 'win32' ? 'aqe.cmd' : 'aqe');
+  cmdArgs = ['hooks', ...args];
 }
 
 // Fatal init markers that mean the hook ran but its persistence layer is dead
@@ -94,7 +92,9 @@ const FATAL_MARKERS = [
 // harness timeout vs. this shim's own admitted ~30-60s cold start left
 // routing_outcomes writes silently dropped for a month — nothing recorded
 // the mismatch because nothing was watching for it.)
-const SPAWN_TIMEOUT_MS = Number(process.env.AQE_HOOK_TIMEOUT_MS) || 18000;
+const FAST_HOOKS = new Set(['guard', 'pre-command']);
+const SPAWN_TIMEOUT_MS = Number(process.env.AQE_HOOK_TIMEOUT_MS)
+  || (FAST_HOOKS.has(args[0]) ? 2500 : 4500);
 
 function recordHookHealth(line) {
   try {

package/.claude/skills/qe-browser/evals/qe-browser.yaml

@@ -52,26 +52,18 @@ setup:
   optional_tools:
     - pixelmatch
     - pngjs
-  # NOTE: this yaml deliberately uses ONLY pinned public fixtures
-  # (httpbin.org/*) so it can be run end-to-end by CommandEvalRunner without
-  # any prerequisite services. Tests that need a local poisoned-HTML fixture
-  # (the check-injection severity path) live in scripts/smoke-test.sh, which
-  # starts fixtures/serve-skills.js out of band.
+  # The CI workflow starts fixtures/serve-skills.js on loopback before this
+  # suite runs. Keeping browser targets local removes rate limits and makes
+  # every page stable across repeated visual comparisons.
 
 fixtures:
-  public_pinned:
-    # Pinned public endpoints — chosen because they're stable, well-known, and
-    # serve predictable forms / HTML. Per feedback_no_unverified_failure_modes,
-    # these are the canonical "does the tool actually work" fixtures.
-    httpbin_form:
-      url: "https://httpbin.org/forms/post"
-      description: "Classic simple form — custname, custtel, custemail, size, toppings"
-    httpbin_html:
-      url: "https://httpbin.org/html"
-      description: "Static HTML page with known headings"
-    httpbin_status_404:
-      url: "https://httpbin.org/status/404"
-      description: "Known 404 for testing no_failed_requests"
+  local:
+    form:
+      url: "http://127.0.0.1:8088/fixtures/form.html"
+      description: "Deterministic form with an email input and submit button"
+    content:
+      url: "http://127.0.0.1:8088/fixtures/content.html"
+      description: "Deterministic static page with a known heading"
 
 test_cases:
   # -------- assert.js --------
@@ -81,10 +73,10 @@ test_cases:
     priority: critical
     input:
       setup:
-        - "vibium --headless go https://httpbin.org/forms/post"
+        - "vibium --headless go http://127.0.0.1:8088/fixtures/form.html"
       command: |
         node .claude/skills/qe-browser/scripts/assert.js --checks \
-          '[{"kind": "url_contains", "text": "httpbin.org/forms"}]'
+          '[{"kind": "url_contains", "text": "/fixtures/form.html"}]'
     expected:
       exit_code: 0
       json_fields:
@@ -98,7 +90,7 @@ test_cases:
     priority: critical
     input:
       setup:
-        - "vibium --headless go https://httpbin.org/html"
+        - "vibium --headless go http://127.0.0.1:8088/fixtures/content.html"
       command: |
         node .claude/skills/qe-browser/scripts/assert.js --checks \
           '[{"kind": "selector_visible", "selector": "h1"}]'
@@ -113,7 +105,7 @@ test_cases:
     priority: critical
     input:
       setup:
-        - "vibium --headless go https://httpbin.org/html"
+        - "vibium --headless go http://127.0.0.1:8088/fixtures/content.html"
       command: |
         node .claude/skills/qe-browser/scripts/assert.js --checks \
           '[{"kind": "url_contains", "text": "this-does-not-exist"}]'
@@ -132,10 +124,10 @@ test_cases:
       command: |
         node .claude/skills/qe-browser/scripts/batch.js --steps \
           '[
-            {"action": "go", "url": "https://httpbin.org/html"},
+            {"action": "go", "url": "http://127.0.0.1:8088/fixtures/content.html"},
             {"action": "wait_load"},
             {"action": "assert", "checks": [
-              {"kind": "url_contains", "text": "/html"},
+              {"kind": "url_contains", "text": "/fixtures/content.html"},
               {"kind": "selector_visible", "selector": "h1"}
             ]}
           ]' --summary-only
@@ -154,9 +146,11 @@ test_cases:
       command: |
         node .claude/skills/qe-browser/scripts/batch.js --steps \
           '[
-            {"action": "go", "url": "https://httpbin.org/html"},
-            {"action": "click", "selector": "#does-not-exist"},
-            {"action": "go", "url": "https://httpbin.org/forms/post"}
+            {"action": "go", "url": "http://127.0.0.1:8088/fixtures/content.html"},
+            {"action": "assert", "checks": [
+              {"kind": "url_contains", "text": "/does-not-exist"}
+            ]},
+            {"action": "go", "url": "http://127.0.0.1:8088/fixtures/form.html"}
           ]'
     expected:
       exit_code: 1
@@ -177,7 +171,7 @@ test_cases:
         # different dimensions (768×654 vs 765×672 observed), making the
         # pixel-diff in tc007 spuriously fail. Mirrors scripts/smoke-test.sh.
         - "vibium --headless viewport 1280 720"
-        - "vibium --headless go https://httpbin.org/html"
+        - "vibium --headless go http://127.0.0.1:8088/fixtures/content.html"
         - "rm -rf .aqe/visual-baselines/eval_httpbin_html*"
       command: |
         node .claude/skills/qe-browser/scripts/visual-diff.js \
@@ -195,7 +189,7 @@ test_cases:
     input:
       setup:
         - "vibium --headless viewport 1280 720"
-        - "vibium --headless go https://httpbin.org/html"
+        - "vibium --headless go http://127.0.0.1:8088/fixtures/content.html"
       command: |
         node .claude/skills/qe-browser/scripts/visual-diff.js \
           --name eval_httpbin_html --threshold 0.02
@@ -212,7 +206,7 @@ test_cases:
     priority: critical
     input:
       setup:
-        - "vibium --headless go https://httpbin.org/html"
+        - "vibium --headless go http://127.0.0.1:8088/fixtures/content.html"
       command: |
         node .claude/skills/qe-browser/scripts/check-injection.js --include-hidden
     expected:
@@ -221,15 +215,11 @@ test_cases:
         ".status": "success"
         ".output.checkInjection.severity": "none"
 
-  # GAP: the "poisoned-page detected with severity>=high" contract needs a
-  # local fixture (fixtures/injection-poisoned.html) served by
-  # fixtures/serve-skills.js. That's out of scope for this yaml — we keep
-  # CommandEvalRunner dependency-free so it can run anywhere httpbin.org
-  # is reachable. Coverage of the high-severity path is currently
+  # The "poisoned-page detected with severity>=high" contract is currently
+  # asserted outside this command suite. Coverage of the high-severity path is
   # only asserted by unit tests on check-injection.js (see
   # tests/unit/scripts/qe-browser-check-injection.test.ts). Follow-up:
-  # either teach CommandEvalRunner to spawn the fixture server, or add a
-  # tc009 to scripts/smoke-test.sh that starts/stops it out of band.
+  # add tc009 against fixtures/injection-poisoned.html.
 
   # -------- intent-score.js --------
   - id: tc010_intent_submit_form_on_httpbin
@@ -238,7 +228,7 @@ test_cases:
     priority: critical
     input:
       setup:
-        - "vibium --headless go https://httpbin.org/forms/post"
+        - "vibium --headless go http://127.0.0.1:8088/fixtures/form.html"
       command: |
         node .claude/skills/qe-browser/scripts/intent-score.js \
           --intent submit_form
@@ -255,7 +245,7 @@ test_cases:
     priority: medium
     input:
       setup:
-        - "vibium --headless go https://httpbin.org/html"
+        - "vibium --headless go http://127.0.0.1:8088/fixtures/content.html"
       command: |
         node .claude/skills/qe-browser/scripts/intent-score.js --intent fill_email
     expected:
@@ -270,5 +260,4 @@ validation:
   notes: |
     Evaluation assumes:
       - `vibium` v26.3.x+ is on PATH (from `aqe init` or `npm install -g vibium`)
-      - Network access to httpbin.org (public, stable)
-      - Local fixtures server running on :8088 (started in setup.local_docs_server)
+      - Local fixtures server running on 127.0.0.1:8088

package/.claude/skills/qe-browser/fixtures/serve-skills.js

@@ -74,6 +74,31 @@ const POISONED_HTML = `<!doctype html>
 </body>
 </html>`;
 
+const CONTENT_HTML = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>QE Browser Content Fixture</title></head>
+<body>
+  <main>
+    <h1>QE Browser Content Fixture</h1>
+    <p>This deterministic page exercises browser assertions and visual comparisons.</p>
+  </main>
+</body>
+</html>`;
+
+const FORM_HTML = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>QE Browser Form Fixture</title></head>
+<body>
+  <main>
+    <h1>Contact form</h1>
+    <form method="post" action="/fixtures/form.html">
+      <label>Email <input id="email" name="email" type="email" autocomplete="email"></label>
+      <button type="submit">Submit</button>
+    </form>
+  </main>
+</body>
+</html>`;
+
 function notFound(res, message) {
   res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
   res.end(`404 Not Found: ${message}\n`);
@@ -95,6 +120,18 @@ function serve(req, res) {
     return;
   }
 
+  if (pathname === '/fixtures/content.html') {
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(CONTENT_HTML);
+    return;
+  }
+
+  if (pathname === '/fixtures/form.html') {
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(FORM_HTML);
+    return;
+  }
+
   // Rewrite /foo/SKILL.md.html → /foo/SKILL.md (or similar) and serve wrapped.
   if (pathname.endsWith('.html')) {
     const mdPath = pathname.replace(/\.html$/, '');

package/.claude/skills/qe-browser/scripts/lib/vibium.js

@@ -292,7 +292,7 @@ function readInlineOrFile(value) {
 // "we couldn't run the test because the browser engine isn't installed."
 function emit(env) {
   process.stdout.write(`${JSON.stringify(env, null, 2)}\n`);
-  if (env.status === 'success') return 0;
+  if (env.status === 'success' || env.status === 'partial') return 0;
   if (env.status === 'skipped') return 2;
   return 1;
 }

package/.claude/skills/qe-browser/scripts/smoke-test.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # qe-browser smoke test (bash mirror of evals/qe-browser.yaml)
 #
-# Runs each helper script against pinned public fixtures (httpbin.org) and
+# Runs each helper script against deterministic local fixtures and
 # verifies the output structure. Gates PR-reopen per ADR-091 Phase 3.
 #
 # RELATIONSHIP TO evals/qe-browser.yaml
@@ -24,16 +24,25 @@
 #   2 — vibium binary not on PATH (precondition unmet)
 #
 # Per feedback_no_unverified_failure_modes.md, this is the script we
-# actually run, not just write. Per feedback_synthetic_fixtures_dont_count,
-# all fixtures are pinned public endpoints (httpbin.org) — no synthetic
-# stubs, no inline HTML.
+# actually run, not just write. The fixture pages are maintained with the
+# skill and served only on loopback, removing public-service rate limits.
 
 set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 WORK_DIR="$(mktemp -d)"
-trap 'rm -rf "$WORK_DIR"' EXIT
+FIXTURE_PORT="${QE_BROWSER_FIXTURE_PORT:-8088}"
+FIXTURE_URL="${QE_BROWSER_FIXTURE_URL:-http://127.0.0.1:${FIXTURE_PORT}}"
+FIXTURE_PID=""
+
+cleanup() {
+  if [ -n "$FIXTURE_PID" ]; then
+    kill "$FIXTURE_PID" >/dev/null 2>&1 || true
+  fi
+  rm -rf "$WORK_DIR"
+}
+trap cleanup EXIT
 
 GREEN='\033[0;32m'
 RED='\033[0;31m'
@@ -57,6 +66,28 @@ if ! command -v vibium >/dev/null 2>&1; then
   exit 2
 fi
 
+if ! curl --silent --fail "$FIXTURE_URL/fixtures/content.html" >/dev/null 2>&1; then
+  QE_BROWSER_FIXTURE_PORT="$FIXTURE_PORT" \
+    node "$SKILL_DIR/fixtures/serve-skills.js" >"$WORK_DIR/fixture-server.log" 2>&1 &
+  FIXTURE_PID=$!
+  fixture_ready=0
+  for _attempt in 1 2 3 4 5; do
+    if curl --silent --fail "$FIXTURE_URL/fixtures/content.html" >/dev/null 2>&1; then
+      fixture_ready=1
+      break
+    fi
+    sleep 1
+  done
+  if [ "$fixture_ready" != "1" ]; then
+    cat "$WORK_DIR/fixture-server.log" >&2
+    echo -e "${RED}qe-browser fixture server did not become ready${NC}" >&2
+    exit 1
+  fi
+fi
+
+CONTENT_URL="$FIXTURE_URL/fixtures/content.html"
+FORM_URL="$FIXTURE_URL/fixtures/form.html"
+
 VIBIUM_VERSION=$(vibium --version 2>&1 | head -1)
 echo "Smoke testing against $VIBIUM_VERSION"
 echo "Skill dir: $SKILL_DIR"
@@ -64,29 +95,29 @@ echo "Work dir:  $WORK_DIR"
 echo ""
 
 # ---------------------------------------------------------------------------
-# tc001 — assert.js url_contains against pinned httpbin form
+# tc001 — assert.js url_contains against the local form fixture
 # ---------------------------------------------------------------------------
-vibium --headless go https://httpbin.org/forms/post >/dev/null 2>&1 || true
+vibium --headless go "$FORM_URL" >/dev/null 2>&1 || true
 RESULT=$(node "$SKILL_DIR/scripts/assert.js" --checks \
-  '[{"kind": "url_contains", "text": "httpbin.org/forms"}]' 2>&1)
+  '[{"kind": "url_contains", "text": "/fixtures/form.html"}]' 2>&1)
 EXIT=$?
 if [ "$EXIT" = "0" ] && echo "$RESULT" | grep -q '"status": "success"'; then
-  ok "tc001 url_contains on httpbin form"
+  ok "tc001 url_contains on local form"
 else
-  bad "tc001 url_contains on httpbin form" "exit=$EXIT, result=$RESULT"
+  bad "tc001 url_contains on local form" "exit=$EXIT, result=$RESULT"
 fi
 
 # ---------------------------------------------------------------------------
-# tc002 — assert.js selector_visible against pinned httpbin /html
+# tc002 — assert.js selector_visible against the local content fixture
 # ---------------------------------------------------------------------------
-vibium --headless go https://httpbin.org/html >/dev/null 2>&1 || true
+vibium --headless go "$CONTENT_URL" >/dev/null 2>&1 || true
 RESULT=$(node "$SKILL_DIR/scripts/assert.js" --checks \
   '[{"kind": "selector_visible", "selector": "h1"}]' 2>&1)
 EXIT=$?
 if [ "$EXIT" = "0" ] && echo "$RESULT" | grep -q '"passed": true'; then
-  ok "tc002 selector_visible h1 on httpbin /html"
+  ok "tc002 selector_visible h1 on local content"
 else
-  bad "tc002 selector_visible h1 on httpbin /html" "exit=$EXIT"
+  bad "tc002 selector_visible h1 on local content" "exit=$EXIT"
 fi
 
 # ---------------------------------------------------------------------------
@@ -105,7 +136,7 @@ fi
 # tc004 — batch.js navigate + wait + assert in one call
 # ---------------------------------------------------------------------------
 RESULT=$(node "$SKILL_DIR/scripts/batch.js" --steps \
-  '[{"action":"go","url":"https://httpbin.org/html"},{"action":"wait_load"},{"action":"assert","checks":[{"kind":"url_contains","text":"/html"}]}]' \
+  "[{\"action\":\"go\",\"url\":\"$CONTENT_URL\"},{\"action\":\"wait_load\"},{\"action\":\"assert\",\"checks\":[{\"kind\":\"url_contains\",\"text\":\"/fixtures/content.html\"}]}]" \
   --summary-only 2>&1)
 EXIT=$?
 if [ "$EXIT" = "0" ] && echo "$RESULT" | grep -q '"passedSteps": 3'; then
@@ -118,7 +149,7 @@ fi
 # tc005 — batch.js stops on failure
 # ---------------------------------------------------------------------------
 RESULT=$(node "$SKILL_DIR/scripts/batch.js" --steps \
-  '[{"action":"go","url":"https://httpbin.org/html"},{"action":"click","selector":"#does-not-exist-selector"},{"action":"go","url":"https://httpbin.org/forms/post"}]' 2>&1)
+  "[{\"action\":\"go\",\"url\":\"$CONTENT_URL\"},{\"action\":\"assert\",\"checks\":[{\"kind\":\"url_contains\",\"text\":\"/does-not-exist\"}]},{\"action\":\"go\",\"url\":\"$FORM_URL\"}]" 2>&1)
 EXIT=$?
 if [ "$EXIT" = "1" ] && echo "$RESULT" | grep -q '"failedStep"'; then
   ok "tc005 batch stops on first failure"
@@ -131,19 +162,19 @@ fi
 #
 # Set explicit viewport BEFORE screenshot so the two visual-diff runs have
 # the same dimensions. Without this the chromium headless window picks
-# whatever size it likes per run, and httpbin.org/html renders at different
+# whatever size it likes per run, and pages may render at different
 # sizes between runs (768×654 vs 765×672 observed), making pixel-diff
 # spuriously fail. This is documented in references/assertion-kinds.md.
 # ---------------------------------------------------------------------------
 rm -rf "$PWD/.aqe/visual-baselines/smoke_test_baseline"*
 vibium --headless viewport 1280 720 >/dev/null 2>&1 || true
-vibium --headless go https://httpbin.org/html >/dev/null 2>&1 || true
+vibium --headless go "$CONTENT_URL" >/dev/null 2>&1 || true
 RESULT=$(node "$SKILL_DIR/scripts/visual-diff.js" --name smoke_test_baseline 2>&1)
 EXIT=$?
 if [ "$EXIT" = "0" ] && echo "$RESULT" | grep -q '"baseline_created"'; then
   ok "tc006 visual-diff baseline created"
 else
-  bad "tc006 visual-diff baseline created" "exit=$EXIT"
+  bad "tc006 visual-diff baseline created" "exit=$EXIT, result=$RESULT"
 fi
 
 # ---------------------------------------------------------------------------
@@ -157,13 +188,13 @@ EXIT=$?
 if [ "$EXIT" = "0" ] && echo "$RESULT" | grep -qE '"(match|baseline_created)"'; then
   ok "tc007 visual-diff second run matches"
 else
-  bad "tc007 visual-diff second run matches" "exit=$EXIT"
+  bad "tc007 visual-diff second run matches" "exit=$EXIT, result=$RESULT"
 fi
 
 # ---------------------------------------------------------------------------
 # tc008 — check-injection.js clean page
 # ---------------------------------------------------------------------------
-vibium --headless go https://httpbin.org/html >/dev/null 2>&1 || true
+vibium --headless go "$CONTENT_URL" >/dev/null 2>&1 || true
 RESULT=$(node "$SKILL_DIR/scripts/check-injection.js" --include-hidden 2>&1)
 EXIT=$?
 if [ "$EXIT" = "0" ] && echo "$RESULT" | grep -q '"severity": "none"'; then
@@ -173,15 +204,15 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# tc010 — intent-score.js submit_form on pinned httpbin form
+# tc010 — intent-score.js submit_form on the local form fixture
 # ---------------------------------------------------------------------------
-vibium --headless go https://httpbin.org/forms/post >/dev/null 2>&1 || true
+vibium --headless go "$FORM_URL" >/dev/null 2>&1 || true
 RESULT=$(node "$SKILL_DIR/scripts/intent-score.js" --intent submit_form 2>&1)
 EXIT=$?
 if [ "$EXIT" = "0" ] && echo "$RESULT" | grep -q '"intent": "submit_form"'; then
-  ok "tc010 intent-score submit_form on httpbin form"
+  ok "tc010 intent-score submit_form on local form"
 else
-  bad "tc010 intent-score submit_form on httpbin form" "exit=$EXIT"
+  bad "tc010 intent-score submit_form on local form" "exit=$EXIT"
 fi
 
 # ---------------------------------------------------------------------------

package/.claude/skills/qe-browser/scripts/visual-diff.js

@@ -45,11 +45,10 @@ function ensureDir(dir) {
   fs.mkdirSync(dir, { recursive: true });
 }
 
-// Vibium screenshot quirks (verified against v26.3.18 on 2026-04-09):
-//   1. `vibium screenshot -o <path>` IGNORES the directory in <path>.
-//      Only the basename is used, and the file is saved to
-//      `~/Pictures/Vibium/<basename>`. We work around this by reading from
-//      Vibium's actual output dir and copying to the requested location.
+// Vibium screenshot output changed across the supported 26.x releases.
+// Older releases ignore the directory passed to `-o` and save under
+// `~/Pictures/Vibium`; newer releases may honor the requested path. Accept
+// both behaviors so AQE init's compatible-version range stays usable.
 //   2. `--selector` flag does NOT exist on `vibium screenshot`. Selector-
 //      scoped baselines are not supported in v26.3.x. We surface a clear
 //      error if a caller passes one. Future Vibium versions may add it.
@@ -69,21 +68,31 @@ function captureScreenshot(selector, outputPath) {
     );
   }
   const basename = path.basename(outputPath);
-  const args = ['screenshot', '-o', basename, '--full-page'];
+  const candidates = [
+    outputPath,
+    path.resolve(process.cwd(), basename),
+    path.join(vibiumPicturesDir(), basename),
+  ];
+  for (const candidate of candidates) {
+    fs.rmSync(candidate, { force: true });
+  }
+  const args = ['screenshot', '-o', outputPath, '--full-page'];
   const res = vibium(args);
   if (res.status !== 0) {
     throw new Error(`vibium screenshot failed: ${res.stderr.trim() || res.stdout.trim()}`);
   }
-  // Vibium wrote the file to ~/Pictures/Vibium/<basename>, not outputPath.
-  // Copy it to where the caller asked. Use copy-then-unlink so we leave
-  // Vibium's own dir clean for the next run.
-  const vibiumPath = path.join(vibiumPicturesDir(), basename);
-  if (!fs.existsSync(vibiumPath)) {
-    throw new Error(`screenshot output not created at ${vibiumPath} (vibium said: ${res.stdout.trim()})`);
+  const screenshotPath = candidates.find((candidate) => fs.existsSync(candidate));
+  if (!screenshotPath) {
+    throw new Error(
+      `screenshot output not created at any supported path (${candidates.join(', ')}; ` +
+      `vibium said: ${res.stdout.trim()})`
+    );
+  }
+  if (screenshotPath !== outputPath) {
+    fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+    fs.copyFileSync(screenshotPath, outputPath);
+    fs.unlinkSync(screenshotPath);
   }
-  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-  fs.copyFileSync(vibiumPath, outputPath);
-  fs.unlinkSync(vibiumPath);
   return outputPath;
 }
 

package/.claude/skills/qe-court/SKILL.md

@@ -161,7 +161,7 @@ is Phase 2). To run a court now:
    the panel before seating it** — this step is not optional:
 
    ```ts
-   import { validateCourtConfig } from 'src/skills/qe-court/referee';
+   import { validateCourtConfig } from 'agentic-qe/skills/qe-court/referee';
    const violations = validateCourtConfig(config);   // [] == valid
    if (violations.length) throw new Error(`Cannot convene: ${violations.join(', ')}`);
    ```
@@ -188,9 +188,9 @@ Durable, attestable evidence — the "jury waiting for everything you ship."
 
 ## Trust tier
 
-**Tier 3 (verified).** The court's falsifiable invariants are enforced in code
-(`src/skills/qe-court/referee.ts`) and covered by an oracle suite
-(`tests/unit/skills/qe-court/referee.test.ts`) that the acceptance eval
+**Tier 3 (verified).** The court's falsifiable invariants are enforced by the
+published `agentic-qe/skills/qe-court/referee` entrypoint and covered by a
+consumer-runnable `aqe-court-referee self-test <oracle>` suite that the acceptance eval
 (`evals/qe-court.yaml`, command-eval mode) runs through the `aqe eval` CLI —
 15/15 green as of 2026-07-29. That suite now validates the **shipped `config.json`
 itself**, so a routing edit that seats a colluding panel fails in CI rather than in

package/.claude/skills/qe-court/config-schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentic-qe.dev/schemas/qe-court-config.json",
+  "title": "QE-Court configuration",
+  "type": "object",
+  "required": ["prosecutors", "overturnDepth", "routing", "options"],
+  "properties": {
+    "prosecutors": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+    "overturnDepth": { "type": "integer", "minimum": 0 },
+    "emitScore": { "type": "boolean" },
+    "routing": {
+      "type": "object",
+      "required": ["jury"],
+      "additionalProperties": {
+        "anyOf": [
+          { "type": "string" },
+          {
+            "type": "object",
+            "properties": { "provider": { "type": "string", "minLength": 1 }, "model": { "type": "string" } },
+            "additionalProperties": false
+          }
+        ]
+      }
+    },
+    "options": {
+      "type": "object",
+      "required": ["writerIsNeverJuror", "minDistinctVendors"],
+      "properties": {
+        "blindFiling": { "type": "boolean" },
+        "writerIsNeverJuror": { "const": true },
+        "minDistinctVendors": { "type": "integer", "minimum": 2 },
+        "requireDoeGatedScore": { "type": "boolean" },
+        "signCourtRecord": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    }
+  }
+}