agentic-qe 3.14.0 → 3.14.2

package/dist/verification/adversarial-verify/measurement-receipt.d.ts

@@ -0,0 +1,13 @@
+import type { JudgeMeasurementReceipt } from './types.js';
+export type ReceiptIdentifierField = 'provider' | 'requestedModel' | 'resolvedModel' | 'fingerprint' | 'windowId' | 'requestId';
+export declare const RECEIPT_IDENTIFIER_PATTERN = "^(?:UNKNOWN|[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,255})$";
+export declare const RECEIPT_SENSITIVE_IDENTIFIER_PATTERN = "(?:^|[._:/@+\\-])(?:(?:[sS][kK]|[rR][kK]|[gG][hH][pPoOuUsSrR]|[gG][iI][tT][hH][uU][bB]_[pP][aA][tT]|[xX][oO][xX][bBaApPrRsS]|[nN][pP][mM]|[gG][lL][pP][aA][tT]|[pP][aA][tT])(?:[-_][A-Za-z0-9_-]*|(?=$|[.:/@+\\-]))|(?:[aA][kK][iI][aA]|[aA][sS][iI][aA]|[aA][iI][zZ][aA])[A-Za-z0-9]*)";
+export declare const RECEIPT_JWT_PATTERN = "(?:^|[^A-Za-z0-9_-])(?:eyJ[A-Za-z0-9_-]*|e30|ew[A-Za-z0-9_-]*)\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+(?:$|[^A-Za-z0-9_-])";
+export declare const RECEIPT_OPAQUE_DESCRIPTOR_PATTERN = "(?:^|[._:/@+\\-])[A-Za-z0-9]{32,}(?:$|[._:/@+\\-])";
+export declare const RECEIPT_OPAQUE_CORRELATION_PATTERN = "(?:(?:^|[.:@\\-])[A-Za-z0-9+/]{32,}={0,2}(?:$|[.:@\\-])|(?:^|[.:/@+\\-])[A-Za-z0-9_-]{48,}(?:$|[.:/@+\\-]))";
+export declare const RECEIPT_KNOWN_TIMESTAMP_PATTERN = "^\\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\\d|3[01])T(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d{1,9})?Z$";
+export declare function isSanitizedReceiptIdentifier(candidate: unknown, field: ReceiptIdentifierField): candidate is string;
+export declare function isSanitizedReceiptTimestamp(candidate: unknown): candidate is string;
+/** Convert adapter-supplied receipt evidence into the content-free public contract. */
+export declare function sanitizeJudgeMeasurementReceipt(value: unknown): JudgeMeasurementReceipt;
+//# sourceMappingURL=measurement-receipt.d.ts.map

package/dist/verification/adversarial-verify/measurement-receipt.js

@@ -0,0 +1,136 @@
+const ENDPOINT_CLASSES = new Set(['shared', 'dedicated', 'local', 'UNKNOWN']);
+const SNAPSHOT_LEVELS = new Set(['L0_UNKNOWN', 'L1_NAMED', 'L2_CONTENT_BOUND']);
+const SEMANTICS = new Set(['verified', 'provider-asserted', 'UNKNOWN']);
+const CACHE_STATUSES = new Set(['hit', 'miss', 'bypass', 'UNKNOWN']);
+export const RECEIPT_IDENTIFIER_PATTERN = '^(?:UNKNOWN|[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,255})$';
+export const RECEIPT_SENSITIVE_IDENTIFIER_PATTERN = '(?:^|[._:/@+\\-])(?:(?:[sS][kK]|[rR][kK]|[gG][hH][pPoOuUsSrR]|[gG][iI][tT][hH][uU][bB]_[pP][aA][tT]|[xX][oO][xX][bBaApPrRsS]|[nN][pP][mM]|[gG][lL][pP][aA][tT]|[pP][aA][tT])(?:[-_][A-Za-z0-9_-]*|(?=$|[.:/@+\\-]))|(?:[aA][kK][iI][aA]|[aA][sS][iI][aA]|[aA][iI][zZ][aA])[A-Za-z0-9]*)';
+export const RECEIPT_JWT_PATTERN = '(?:^|[^A-Za-z0-9_-])(?:eyJ[A-Za-z0-9_-]*|e30|ew[A-Za-z0-9_-]*)\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+(?:$|[^A-Za-z0-9_-])';
+export const RECEIPT_OPAQUE_DESCRIPTOR_PATTERN = '(?:^|[._:/@+\\-])[A-Za-z0-9]{32,}(?:$|[._:/@+\\-])';
+export const RECEIPT_OPAQUE_CORRELATION_PATTERN = '(?:(?:^|[.:@\\-])[A-Za-z0-9+/]{32,}={0,2}(?:$|[.:@\\-])|(?:^|[.:/@+\\-])[A-Za-z0-9_-]{48,}(?:$|[.:/@+\\-]))';
+export const RECEIPT_KNOWN_TIMESTAMP_PATTERN = '^\\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\\d|3[01])T(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d{1,9})?Z$';
+const SAFE_IDENTIFIER = new RegExp(RECEIPT_IDENTIFIER_PATTERN);
+const SENSITIVE_IDENTIFIER = new RegExp(RECEIPT_SENSITIVE_IDENTIFIER_PATTERN);
+const JWT = new RegExp(RECEIPT_JWT_PATTERN);
+const OPAQUE_DESCRIPTOR = new RegExp(RECEIPT_OPAQUE_DESCRIPTOR_PATTERN);
+const OPAQUE_CORRELATION = new RegExp(RECEIPT_OPAQUE_CORRELATION_PATTERN);
+const KNOWN_TIMESTAMP = new RegExp(RECEIPT_KNOWN_TIMESTAMP_PATTERN);
+const RECEIPT_HASH_FIELDS = [
+    'requestHash', 'promptHash', 'configHash', 'parserSchemaHash', 'outputHash', 'parsedVoteHash',
+];
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function looksLikeOpaqueCredential(value, field) {
+    if (SENSITIVE_IDENTIFIER.test(value) || JWT.test(value))
+        return true;
+    if (field === 'provider' || field === 'requestedModel' || field === 'resolvedModel') {
+        return OPAQUE_DESCRIPTOR.test(value);
+    }
+    return OPAQUE_CORRELATION.test(value);
+}
+export function isSanitizedReceiptIdentifier(candidate, field) {
+    return typeof candidate === 'string'
+        && SAFE_IDENTIFIER.test(candidate)
+        && !looksLikeOpaqueCredential(candidate, field);
+}
+function identifier(candidate, field) {
+    return typeof candidate === 'string'
+        && isSanitizedReceiptIdentifier(candidate, field)
+        ? candidate
+        : 'UNKNOWN';
+}
+export function isSanitizedReceiptTimestamp(candidate) {
+    if (candidate === 'UNKNOWN')
+        return true;
+    if (typeof candidate !== 'string' || !KNOWN_TIMESTAMP.test(candidate))
+        return false;
+    const [date] = candidate.split('T');
+    const [yearText, monthText, dayText] = date.split('-');
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const daysInMonth = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    return day <= daysInMonth[month - 1];
+}
+function timestamp(candidate) {
+    return isSanitizedReceiptTimestamp(candidate) ? candidate : 'UNKNOWN';
+}
+function hash(candidate) {
+    return typeof candidate === 'string' && /^(?:sha256:)?[a-f\d]{64}$/i.test(candidate)
+        ? `sha256:${candidate.replace(/^sha256:/i, '').toLowerCase()}`
+        : 'UNKNOWN';
+}
+function enumOr(candidate, allowed, fallback) {
+    return typeof candidate === 'string' && allowed.has(candidate) ? candidate : fallback;
+}
+function finiteNonNegativeOrNull(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : null;
+}
+function unitOrNull(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1 ? value : null;
+}
+function unknownReceipt() {
+    return {
+        contract: 'judge-measurement@1',
+        provider: 'UNKNOWN', requestedModel: 'UNKNOWN', resolvedModel: 'UNKNOWN',
+        endpointClass: 'UNKNOWN', snapshotIdentity: 'L0_UNKNOWN', semantics: 'UNKNOWN',
+        fingerprint: 'UNKNOWN', requestHash: 'UNKNOWN', promptHash: 'UNKNOWN', configHash: 'UNKNOWN',
+        parserSchemaHash: 'UNKNOWN', outputHash: 'UNKNOWN', parsedVoteHash: 'UNKNOWN',
+        temperature: null, topP: null, seed: null, deterministic: null, cacheStatus: 'UNKNOWN',
+        retryCount: 0, timestamp: 'UNKNOWN', windowId: 'UNKNOWN', latencyMs: null, requestId: 'UNKNOWN',
+    };
+}
+/** Convert adapter-supplied receipt evidence into the content-free public contract. */
+export function sanitizeJudgeMeasurementReceipt(value) {
+    if (!isRecord(value))
+        return unknownReceipt();
+    try {
+        const sanitized = {
+            contract: 'judge-measurement@1',
+            provider: identifier(value.provider, 'provider'),
+            requestedModel: identifier(value.requestedModel, 'requestedModel'),
+            resolvedModel: identifier(value.resolvedModel, 'resolvedModel'),
+            endpointClass: enumOr(value.endpointClass, ENDPOINT_CLASSES, 'UNKNOWN'),
+            snapshotIdentity: enumOr(value.snapshotIdentity, SNAPSHOT_LEVELS, 'L0_UNKNOWN'),
+            semantics: enumOr(value.semantics, SEMANTICS, 'UNKNOWN'),
+            fingerprint: identifier(value.fingerprint, 'fingerprint'),
+            requestHash: hash(value.requestHash),
+            promptHash: hash(value.promptHash),
+            configHash: hash(value.configHash),
+            parserSchemaHash: hash(value.parserSchemaHash),
+            outputHash: hash(value.outputHash),
+            parsedVoteHash: hash(value.parsedVoteHash),
+            temperature: finiteNonNegativeOrNull(value.temperature),
+            topP: unitOrNull(value.topP),
+            seed: typeof value.seed === 'number' && Number.isSafeInteger(value.seed) ? value.seed : null,
+            deterministic: typeof value.deterministic === 'boolean' ? value.deterministic : null,
+            cacheStatus: enumOr(value.cacheStatus, CACHE_STATUSES, 'UNKNOWN'),
+            retryCount: typeof value.retryCount === 'number' && Number.isSafeInteger(value.retryCount) && value.retryCount >= 0
+                ? value.retryCount
+                : 0,
+            timestamp: timestamp(value.timestamp),
+            windowId: identifier(value.windowId, 'windowId'),
+            latencyMs: finiteNonNegativeOrNull(value.latencyMs),
+            requestId: identifier(value.requestId, 'requestId'),
+        };
+        const contentBound = sanitized.fingerprint !== 'UNKNOWN'
+            && RECEIPT_HASH_FIELDS.every((field) => sanitized[field] !== 'UNKNOWN');
+        const namedSnapshot = sanitized.resolvedModel !== 'UNKNOWN';
+        if ((sanitized.snapshotIdentity === 'L2_CONTENT_BOUND' && !contentBound)
+            || (sanitized.snapshotIdentity === 'L1_NAMED' && !namedSnapshot)) {
+            sanitized.snapshotIdentity = 'L0_UNKNOWN';
+        }
+        if (sanitized.snapshotIdentity === 'L0_UNKNOWN'
+            || sanitized.fingerprint === 'UNKNOWN'
+            || (sanitized.semantics === 'verified'
+                && (sanitized.snapshotIdentity !== 'L2_CONTENT_BOUND' || !contentBound))) {
+            sanitized.semantics = 'UNKNOWN';
+        }
+        return sanitized;
+    }
+    catch {
+        return unknownReceipt();
+    }
+}
+//# sourceMappingURL=measurement-receipt.js.map

package/dist/verification/adversarial-verify/synthesize.js

@@ -1,3 +1,5 @@
+import { validateFindingVerdict } from '../../contracts/verdicts.js';
+import { sanitizeJudgeMeasurementReceipt } from './measurement-receipt.js';
 /** Default kill threshold: simple majority of cast votes (2-of-3, 1-of-1, 2-of-2). */
 export const majorityKill = (castVotes) => Math.ceil(castVotes / 2);
 /**
@@ -6,6 +8,9 @@ export const majorityKill = (castVotes) => Math.ceil(castVotes / 2);
  */
 export function synthesizeVerdict(finding, votes, killThreshold = majorityKill) {
     const refutations = votes.filter((v) => v.refuted).map((v) => v.reasoning);
+    const measurementReceipts = votes.flatMap((v) => v.measurementReceipt
+        ? [sanitizeJudgeMeasurementReceipt(v.measurementReceipt)]
+        : []);
     const killed = votes.length > 0 && refutations.length >= killThreshold(votes.length);
     return {
         contract: 'finding-verdict@1',
@@ -17,19 +22,11 @@ export function synthesizeVerdict(finding, votes, killThreshold = majorityKill)
         evidence: finding.evidence,
         verdict: votes.length === 0 ? 'uncertain' : killed ? 'refuted' : 'upheld',
         refutations,
+        ...(measurementReceipts.length > 0 ? { measurementReceipts } : {}),
     };
 }
 /** Runtime guard: does `x` conform to finding-verdict@1 at the boundary? */
 export function isFindingVerdict(x) {
-    if (!x || typeof x !== 'object')
-        return false;
-    const v = x;
-    return (v.contract === 'finding-verdict@1' &&
-        typeof v.id === 'string' &&
-        typeof v.title === 'string' &&
-        typeof v.confidence === 'number' &&
-        Array.isArray(v.evidence) &&
-        Array.isArray(v.refutations) &&
-        (v.verdict === 'upheld' || v.verdict === 'refuted' || v.verdict === 'uncertain'));
+    return validateFindingVerdict(x).valid;
 }
 //# sourceMappingURL=synthesize.js.map

package/dist/verification/adversarial-verify/types.d.ts

@@ -8,6 +8,10 @@
  */
 export type FindingSeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
 export type FindingOutcome = 'upheld' | 'refuted' | 'uncertain';
+export type EndpointClass = 'shared' | 'dedicated' | 'local' | 'UNKNOWN';
+export type SnapshotIdentityLevel = 'L0_UNKNOWN' | 'L1_NAMED' | 'L2_CONTENT_BOUND';
+export type ReceiptSemantics = 'verified' | 'provider-asserted' | 'UNKNOWN';
+export type CacheStatus = 'hit' | 'miss' | 'bypass' | 'UNKNOWN';
 /** A claim to be adversarially verified (input). */
 export interface Finding {
     /** Stable id; the verdict carries it verbatim (callers compose any prefix). */
@@ -23,6 +27,35 @@ export interface Finding {
 export interface RefuterVote {
     refuted: boolean;
     reasoning: string;
+    /** Optional sanitized identity/configuration evidence supplied by a real adapter. */
+    measurementReceipt?: JudgeMeasurementReceipt;
+}
+/** Hash-bound, content-free evidence for one judge request and parsed vote. */
+export interface JudgeMeasurementReceipt {
+    contract: 'judge-measurement@1';
+    provider: string;
+    requestedModel: string;
+    resolvedModel: string;
+    endpointClass: EndpointClass;
+    snapshotIdentity: SnapshotIdentityLevel;
+    semantics: ReceiptSemantics;
+    fingerprint: string;
+    requestHash: string;
+    promptHash: string;
+    configHash: string;
+    parserSchemaHash: string;
+    outputHash: string;
+    parsedVoteHash: string;
+    temperature: number | null;
+    topP: number | null;
+    seed: number | null;
+    deterministic: boolean | null;
+    cacheStatus: CacheStatus;
+    retryCount: number;
+    timestamp: string;
+    windowId: string;
+    latencyMs: number | null;
+    requestId: string;
 }
 /**
  * The injected LLM refuter. Returns a vote, or `null`/throws on failure (failed
@@ -42,6 +75,8 @@ export interface FindingVerdict {
     verdict: FindingOutcome;
     /** One entry per refuter that voted to refute (empty when none). */
     refutations: string[];
+    /** Sanitized receipts for cast votes whose adapters supplied measurement evidence. */
+    measurementReceipts?: JudgeMeasurementReceipt[];
 }
 export interface AdversarialVerifyOptions {
     /** The injected LLM refuter. Required. */

package/dist/verification/adversarial-verify/verify.js

@@ -1,10 +1,15 @@
 import { DEFAULT_LENSES, refuterPrompt } from './prompts.js';
 import { majorityKill, synthesizeVerdict } from './synthesize.js';
+import { sanitizeJudgeMeasurementReceipt } from './measurement-receipt.js';
 /** Call one refuter; a thrown/`null` result is a failed vote (excluded). */
 async function castVote(judge, finding, lens) {
     try {
         const v = await judge(refuterPrompt(finding, lens));
-        return v && typeof v.refuted === 'boolean' ? { refuted: v.refuted, reasoning: String(v.reasoning ?? '') } : null;
+        return v && typeof v.refuted === 'boolean' ? {
+            refuted: v.refuted,
+            reasoning: String(v.reasoning ?? ''),
+            ...(v.measurementReceipt ? { measurementReceipt: sanitizeJudgeMeasurementReceipt(v.measurementReceipt) } : {}),
+        } : null;
     }
     catch {
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-qe",
-  "version": "3.14.0",
+  "version": "3.14.2",
   "description": "Agentic Quality Engineering V3 - Domain-Driven Design Architecture with 13 Bounded Contexts, O(log n) coverage analysis, ReasoningBank learning, 60 specialized QE agents, mathematical Coherence verification, deep Claude Flow integration",
   "type": "module",
   "main": "./dist/index.js",
@@ -250,7 +250,8 @@
     "@opentelemetry/auto-instrumentations-node": ">=0.75.0",
     "@opentelemetry/exporter-prometheus": ">=0.217.0",
     "@hono/node-server": ">=2.0.5",
-    "sharp": ">=0.35.0"
+    "hono": ">=4.13.5",
+    "sharp": ">=0.35.4"
   },
   "devDependencies": {
     "@claude-flow/guidance": "3.0.0-alpha.1",
@@ -258,13 +259,15 @@
     "@huggingface/transformers": "^4.2.0",
     "@types/better-sqlite3": "^7.6.13",
     "@types/cli-progress": "^3.11.6",
-    "@types/node": "^25.8.0",
+    "@types/node": "^22.0.0",
     "@types/pg": "^8.16.0",
     "@types/uuid": "^10.0.0",
     "@types/ws": "^8.18.1",
     "@typescript-eslint/eslint-plugin": "^8.59.3",
     "@typescript-eslint/parser": "^8.59.3",
     "@vitest/coverage-v8": "^4.0.16",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "dotenv": "^17.2.3",
     "esbuild": "^0.28.0",
     "eslint": "^8.55.0",
@@ -275,8 +278,8 @@
     "vitest": "^4.0.16"
   },
   "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=8.0.0"
+    "node": ">=22.13.0",
+    "npm": ">=10.0.0"
   },
   "repository": {
     "type": "git",
@@ -292,6 +295,7 @@
     "dist/**/*.json",
     "dist/**/*.node",
     "assets/**",
+    "schemas/**",
     "scripts/postinstall.cjs",
     "scripts/preinstall.cjs",
     "scripts/fetch-content.cjs",

package/schemas/coverage-gap.schema.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://agentic-qe.dev/schemas/coverage-gap.schema.json",
+  "title": "CoverageGap",
+  "type": "object",
+  "required": [
+    "contract",
+    "file",
+    "riskScore",
+    "suggestedTests"
+  ],
+  "additionalProperties": true,
+  "properties": {
+    "contract": {
+      "const": "coverage-gap@1"
+    },
+    "file": {
+      "type": "string",
+      "minLength": 1
+    },
+    "rangeStart": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "rangeEnd": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "riskScore": {
+      "type": "number",
+      "minimum": 0,
+      "maximum": 1
+    },
+    "suggestedTests": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  }
+}