agentic-qe 3.14.2 → 3.14.3

package/dist/cli/chunks/witness-chain-QGKMHCNW.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.3");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i}from"./chunk-SJPZSCZP.js";import"./chunk-OV5EZO3U.js";import"./chunk-TFHQE6NK.js";import"./chunk-4RP5VUBI.js";import"./chunk-5F6DWHQG.js";import"./chunk-L2GKMBDP.js";import"./chunk-72UJXEKQ.js";import"./chunk-Y5SQBI2F.js";import"./chunk-YAKS3CAB.js";import"./chunk-HRUU7E3D.js";import"./chunk-MXMFGSWR.js";import"./chunk-VIDBBB6F.js";import"./chunk-PI74GOE4.js";import"./chunk-5IAB5NRZ.js";import"./chunk-OVDKWCD7.js";import"./chunk-XA7CG3LH.js";import"./chunk-YEXPFHV6.js";import"./chunk-IP7NSFQQ.js";import"./chunk-T35GZXTU.js";import"./chunk-Y2DVFVGI.js";export{a as GENESIS_PREV_HASH,f as WitnessChain,i as _resetWitnessChainForTests,h as createWitnessChain,g as getWitnessChain,d as hashWith,e as serializeEntry,b as sha256,c as shake256};

package/dist/cli/chunks/{witness-chain-VRSH2F36.js → witness-chain-RPZ2SE2V.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.2");process.exit(0)}
-import{a,b,c,d,e,f,g}from"./chunk-K574FLVB.js";import"./chunk-PHHXHG2W.js";import"./chunk-ICKLBATY.js";import"./chunk-GHQ5PUOV.js";import"./chunk-6VKJAMZY.js";export{c as PersistentWitnessChain,a as SPRTAccumulator,b as WitnessChain,f as createPersistentWitnessChain,e as createWitnessChain,d as createWitnessChainSQLitePersistence,g as isWitnessChainFeatureEnabled};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.3");process.exit(0)}
+import{a,b,c,d,e,f,g}from"./chunk-RTJ2M6V6.js";import"./chunk-L2GKMBDP.js";import"./chunk-72UJXEKQ.js";import"./chunk-T35GZXTU.js";import"./chunk-Y2DVFVGI.js";export{c as PersistentWitnessChain,a as SPRTAccumulator,b as WitnessChain,f as createPersistentWitnessChain,e as createWitnessChain,d as createWitnessChainSQLitePersistence,g as isWitnessChainFeatureEnabled};

package/dist/cli/chunks/{witness-key-manager-GFHRDKQ4.js → witness-key-manager-LXG2VBQQ.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.2");process.exit(0)}
-import{a,b,c}from"./chunk-YF5OP6CR.js";import"./chunk-JDXLCNKV.js";import"./chunk-6VKJAMZY.js";export{a as WitnessKeyManager,c as _resetDefaultWitnessKeyManagerForTests,b as getDefaultWitnessKeyManager};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.3");process.exit(0)}
+import{a,b,c}from"./chunk-OV5EZO3U.js";import"./chunk-Y5SQBI2F.js";import"./chunk-Y2DVFVGI.js";export{a as WitnessKeyManager,c as _resetDefaultWitnessKeyManagerForTests,b as getDefaultWitnessKeyManager};

package/dist/cli/chunks/{workflow-HAZ6YKOG.js → workflow-2OYNO7UU.js}

@@ -1,5 +1,5 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.2");process.exit(0)}
-import{b as $}from"./chunk-4RT7I7PI.js";import"./chunk-WXMSRBQF.js";import{d as R}from"./chunk-2EHFEMRU.js";import{b as k,c as C,d as b}from"./chunk-QW4LN5NK.js";import{c as W}from"./chunk-QXTW7XCS.js";import"./chunk-CIESXO73.js";import"./chunk-D4RCV4LY.js";import"./chunk-6VKJAMZY.js";import{Command as O}from"commander";import o from"chalk";function P(d,a){let m=d.indexOf("=");return m>0&&(a[d.substring(0,m)]=d.substring(m+1)),a}function x(d,a,m){let y=new O("workflow").description("Manage QE workflows and pipelines (ADR-041)");return y.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(t,l)=>{if(!await m())return;let e=await import("fs"),c=(await import("path")).resolve(t);try{console.log(o.blue(`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.3");process.exit(0)}
+import{b as $}from"./chunk-G5C2XVZC.js";import"./chunk-XXCYQXK3.js";import{d as R}from"./chunk-4Q35TI6Z.js";import{b as k,c as C,d as b}from"./chunk-JBB7E26R.js";import{c as W}from"./chunk-YAKS3CAB.js";import"./chunk-C46DMCWF.js";import"./chunk-HRUU7E3D.js";import"./chunk-Y2DVFVGI.js";import{Command as O}from"commander";import o from"chalk";function P(d,a){let m=d.indexOf("=");return m>0&&(a[d.substring(0,m)]=d.substring(m+1)),a}function x(d,a,m){let y=new O("workflow").description("Manage QE workflows and pipelines (ADR-041)");return y.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(t,l)=>{if(!await m())return;let e=await import("fs"),c=(await import("path")).resolve(t);try{console.log(o.blue(`
  Running workflow from: ${t}
 `));let s=k(c);if(!s.success||!s.workflow){console.log(o.red("Failed to parse pipeline:"));for(let w of s.errors)console.log(o.red(`   ${w}`));await a(1)}let r={...W(l.params,"params")};if(s.pipeline){for(let w of s.pipeline.stages)if(w.params)for(let[S,h]of Object.entries(w.params))r[S]=h}if(!d.workflowOrchestrator.getWorkflow(s.workflow.id)){let w=d.workflowOrchestrator.registerWorkflow(s.workflow);w.success||(console.log(o.red(`Failed to register workflow: ${w.error.message}`)),await a(1))}let n=await d.workflowOrchestrator.executeWorkflow(s.workflow.id,r);if(!n.success){console.log(o.red(`Failed to start workflow: ${n.error.message}`)),await a(1);return}let p=n.value;if(console.log(o.cyan(`  Execution ID: ${p}`)),console.log(o.gray(`  Workflow: ${s.workflow.name}`)),console.log(o.gray(`  Stages: ${s.workflow.steps.length}`)),console.log(""),l.watch){console.log(o.blue(`Workflow Progress:
 `));let w,S=Date.now();for(;;){let g=d.workflowOrchestrator.getWorkflowStatus(p);if(!g)break;if(!w||w.progress!==g.progress||w.status!==g.status||JSON.stringify(w.currentSteps)!==JSON.stringify(g.currentSteps)){process.stdout.write("\r\x1B[K");let v="\u2588".repeat(Math.floor(g.progress/5))+"\u2591".repeat(20-Math.floor(g.progress/5)),D=g.status==="completed"?o.green:g.status==="failed"?o.red:g.status==="running"?o.yellow:o.gray;console.log(`  [${v}] ${g.progress}% - ${D(g.status)}`),g.currentSteps.length>0&&l.verbose&&console.log(o.gray(`    Running: ${g.currentSteps.join(", ")}`)),w=g}if(g.status==="completed"||g.status==="failed"||g.status==="cancelled")break;await new Promise(v=>setTimeout(v,500))}let h=d.workflowOrchestrator.getWorkflowStatus(p);if(h){console.log("");let g=h.duration||Date.now()-S;h.status==="completed"?(console.log(o.green("Workflow completed successfully")),console.log(o.gray(`   Duration: ${$(g)}`)),console.log(o.gray(`   Completed: ${h.completedSteps.length} stages`)),h.skippedSteps.length>0&&console.log(o.yellow(`   Skipped: ${h.skippedSteps.length} stages`))):h.status==="failed"?(console.log(o.red("Workflow failed")),console.log(o.red(`   Error: ${h.error}`)),console.log(o.gray(`   Failed stages: ${h.failedSteps.join(", ")}`))):console.log(o.yellow(`Workflow ${h.status}`))}}else console.log(o.green("Workflow execution started")),console.log(o.gray(`   Use 'aqe workflow status ${p}' to check progress`));console.log(""),await a(0)}catch(s){console.error(o.red(`
@@ -35,10 +35,10 @@ Workflow cancelled: ${t}
 `)):console.log(o.red(`
 Failed to cancel workflow: ${l.error.message}
 `)),await a(l.success?0:1)}catch(l){console.error(o.red(`
-Failed to cancel workflow:`),l),await a(1)}}),y.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:t}=await import("./browser-workflow-NPM4FUPI.js"),e=await new t().invoke({});if(e.success&&e.data){console.log(o.blue(`
+Failed to cancel workflow:`),l),await a(1)}}),y.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:t}=await import("./browser-workflow-ADK54DOE.js"),e=await new t().invoke({});if(e.success&&e.data){console.log(o.blue(`
  Browser Workflow Templates:
 `));for(let u of e.data.availableTemplates)console.log(`  ${o.cyan(u)}`);console.log("")}else console.log(o.red(`Failed: ${e.error||"Unknown error"}`));await a(0)}catch(t){console.error(o.red(`
-Failed:`),t),await a(1)}}),y.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",P,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(t,l)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-NPM4FUPI.js"),{writeOutput:u,toJSON:c}=await import("./ci-output-F57RSD35.js"),s=new e,f={variables:l.var||{}};if(l.yaml)f.workflowYaml=l.yaml;else if(t)if(t.endsWith(".yaml")||t.endsWith(".yml")){let i=await import("fs"),p=(await import("path")).resolve(t);i.existsSync(p)||(console.log(o.red(`
+Failed:`),t),await a(1)}}),y.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",P,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(t,l)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-ADK54DOE.js"),{writeOutput:u,toJSON:c}=await import("./ci-output-LK3MBXLZ.js"),s=new e,f={variables:l.var||{}};if(l.yaml)f.workflowYaml=l.yaml;else if(t)if(t.endsWith(".yaml")||t.endsWith(".yml")){let i=await import("fs"),p=(await import("path")).resolve(t);i.existsSync(p)||(console.log(o.red(`
 File not found: ${p}
 `)),await a(1)),f.workflowYaml=i.readFileSync(p,"utf-8")}else f.templateName=t;else console.log(o.red(`
 Provide a template name or --yaml. Use "workflow browser-list" to see templates.

package/dist/cli/chunks/workflow-orchestrator-KWHIJMFV.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.3");process.exit(0)}
+import{a,b,c,d}from"./chunk-4OUPCTBS.js";import"./chunk-N4H2QOT5.js";import"./chunk-TFHQE6NK.js";import"./chunk-4RP5VUBI.js";import"./chunk-5F6DWHQG.js";import"./chunk-L2GKMBDP.js";import"./chunk-72UJXEKQ.js";import"./chunk-Y5SQBI2F.js";import"./chunk-YAKS3CAB.js";import"./chunk-C46DMCWF.js";import"./chunk-HRUU7E3D.js";import"./chunk-OYMLHX2B.js";import"./chunk-MXMFGSWR.js";import"./chunk-VIDBBB6F.js";import"./chunk-PI74GOE4.js";import"./chunk-5IAB5NRZ.js";import"./chunk-OVDKWCD7.js";import"./chunk-XA7CG3LH.js";import"./chunk-YEXPFHV6.js";import"./chunk-IP7NSFQQ.js";import"./chunk-T35GZXTU.js";import"./chunk-Y2DVFVGI.js";export{b as DEFAULT_WORKFLOW_CONFIG,a as WorkflowEvents,c as WorkflowOrchestrator,d as createWorkflowOrchestrator};

package/dist/cli/chunks/{wrappers-5LLLT7GM.js → wrappers-DIJNNFU6.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.2");process.exit(0)}
-import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-57TNBR2P.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-6LMLN5R2.js";import"./chunk-W2FLULF4.js";import"./chunk-N3RN4QTC.js";import"./chunk-T46LOLW3.js";import"./chunk-PHHXHG2W.js";import"./chunk-ICKLBATY.js";import"./chunk-JDXLCNKV.js";import"./chunk-QXTW7XCS.js";import"./chunk-D4RCV4LY.js";import"./chunk-N5ZRUOMR.js";import"./chunk-HBTC4L53.js";import"./chunk-RVCWSAXI.js";import"./chunk-T4C56HBW.js";import"./chunk-JQ2ZD3WO.js";import"./chunk-CJCT452S.js";import"./chunk-S7N4BKI3.js";import"./chunk-JIUF6NV6.js";import"./chunk-GHQ5PUOV.js";import"./chunk-6VKJAMZY.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.3");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-TTMHIOQ3.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-F67AV5P2.js";import"./chunk-TFHQE6NK.js";import"./chunk-4RP5VUBI.js";import"./chunk-5F6DWHQG.js";import"./chunk-L2GKMBDP.js";import"./chunk-72UJXEKQ.js";import"./chunk-Y5SQBI2F.js";import"./chunk-YAKS3CAB.js";import"./chunk-HRUU7E3D.js";import"./chunk-MXMFGSWR.js";import"./chunk-VIDBBB6F.js";import"./chunk-PI74GOE4.js";import"./chunk-5IAB5NRZ.js";import"./chunk-OVDKWCD7.js";import"./chunk-XA7CG3LH.js";import"./chunk-YEXPFHV6.js";import"./chunk-IP7NSFQQ.js";import"./chunk-T35GZXTU.js";import"./chunk-Y2DVFVGI.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};

package/dist/cli/commands/security.js

@@ -5,7 +5,8 @@
  */
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { walkSourceFiles } from '../utils/file-discovery.js';
+import { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
+import { FilePath } from '../../shared/value-objects/index.js';
 import { writeOutput, toJSON, toSARIF, securityToMarkdown } from '../utils/ci-output.js';
 export function createSecurityCommand(context, cleanupAndExit, ensureInitialized) {
     const securityCmd = new Command('security')
@@ -84,126 +85,192 @@ export function createSecurityCommand(context, cleanupAndExit, ensureInitialized
             }
             return; // Don't fall through to SAST/DAST path
         }
+        const format = options.format;
+        const runSAST = options.sast || (!options.dast && !options.compliance);
+        const frameworks = options.compliance
+            ? options.compliance.split(',').map((value) => value.trim()).filter(Boolean)
+            : [];
+        const scanResult = {
+            vulnerabilities: [], target: options.target,
+            scanType: [runSAST && 'SAST', options.dast && 'DAST', frameworks.length > 0 && 'Compliance'].filter(Boolean).join('+'),
+            checks: [], status: 'not-run',
+        };
+        const checks = scanResult.checks;
         try {
-            const format = options.format;
-            if (format === 'text') {
-                console.log(chalk.blue(`\n Running security scan on ${options.target}...\n`));
-            }
             const securityAPI = await context.kernel.getDomainAPIAsync('security-compliance');
             if (!securityAPI) {
-                console.log(chalk.red('Security domain not available'));
-                return;
-            }
-            const path = await import('path');
-            const targetPath = path.resolve(options.target);
-            // Fix #280: Use shared file discovery supporting all languages
-            const files = walkSourceFiles(targetPath, { includeTests: true });
-            if (files.length === 0) {
-                console.log(chalk.yellow('No files found to scan'));
-                return;
-            }
-            if (format === 'text') {
-                console.log(chalk.gray(`  Scanning ${files.length} files...\n`));
+                checks.push({ name: scanResult.scanType, status: 'failed', reason: 'Security domain not available' });
             }
-            const scanResult = {
-                vulnerabilities: [],
-                target: options.target,
-                scanType: [options.sast && 'SAST', options.dast && 'DAST', options.compliance && 'Compliance'].filter(Boolean).join('+') || 'SAST',
-            };
-            // Run SAST if requested
-            if (options.sast) {
-                if (format === 'text')
-                    console.log(chalk.blue(' SAST Scan:'));
-                const sastResult = await securityAPI.runSASTScan(files);
-                if (sastResult.success && sastResult.value) {
-                    const result = sastResult.value;
-                    const vulns = result.vulnerabilities || [];
-                    scanResult.vulnerabilities = vulns;
-                    if (format === 'text') {
-                        if (vulns.length === 0) {
-                            console.log(chalk.green('  * No vulnerabilities found'));
-                        }
-                        else {
-                            console.log(chalk.yellow(`  ! Found ${vulns.length} potential issues:`));
-                            for (const v of vulns.slice(0, 10)) {
-                                const color = v.severity === 'high' ? chalk.red : v.severity === 'medium' ? chalk.yellow : chalk.gray;
-                                console.log(color(`    [${v.severity}] ${v.type}: ${v.file}:${v.line}`));
-                                console.log(chalk.gray(`           ${v.message}`));
+            else {
+                if (runSAST) {
+                    const { files, discovery } = await discoverSecurityFiles(options.target);
+                    scanResult.discovery = discovery;
+                    if (files.length === 0) {
+                        checks.push({ name: 'SAST', status: 'not-run', reason: 'No analyzable input was discovered; no SAST scan ran.' });
+                    }
+                    else {
+                        try {
+                            const sastResult = await securityAPI.runSASTScan(files.map(file => FilePath.create(file)));
+                            if (sastResult.success && sastResult.value) {
+                                const result = sastResult.value;
+                                scanResult.vulnerabilities = result.vulnerabilities.map(formatVulnerability);
+                                scanResult.coverage = result.evidence ? result.coverage : undefined;
+                                scanResult.evidence = result.evidence;
+                                checks.push({
+                                    name: 'SAST', status: result.evidence?.completeness ?? 'unverified',
+                                    ...(!result.evidence ? { reason: 'The scanner returned no execution receipts.' } : {}),
+                                });
                             }
-                            if (vulns.length > 10) {
-                                console.log(chalk.gray(`    ... and ${vulns.length - 10} more`));
+                            else {
+                                checks.push({ name: 'SAST', status: 'failed', reason: !sastResult.success ? securityFailureReason('SAST scan', sastResult.error) : 'SAST scan returned no result' });
                             }
                         }
+                        catch (error) {
+                            checks.push({ name: 'SAST', status: 'failed', reason: securityFailureReason('SAST scan', error) });
+                        }
+                    }
+                    if (discovery.status !== 'complete') {
+                        checks.push({ name: 'Source discovery', status: discovery.status, reason: 'Requested source discovery did not complete; inspect discovery issues.' });
                     }
                 }
-                else if (format === 'text') {
-                    console.log(chalk.red(`  x SAST failed: ${sastResult.error?.message || 'Unknown error'}`));
-                }
-                if (format === 'text')
-                    console.log('');
-            }
-            // Run compliance check if requested
-            if (options.compliance) {
-                const frameworks = options.compliance.split(',');
-                if (format === 'text')
-                    console.log(chalk.blue(` Compliance Check (${frameworks.join(', ')}):`));
-                // Run compliance check for each framework
-                const compResults = await Promise.all(frameworks.map((f) => securityAPI.runComplianceCheck(f.trim())));
-                const compResult = compResults[0]; // Primary result for display
-                if (compResult.success && compResult.value) {
-                    const result = compResult.value;
-                    scanResult.compliance = result;
-                    if (format === 'text') {
-                        if (result.compliant) {
-                            console.log(chalk.green('  * Compliant with all frameworks'));
-                        }
-                        else {
-                            console.log(chalk.yellow('  ! Compliance issues found:'));
-                            for (const issue of (result.issues || []).slice(0, 5)) {
-                                console.log(chalk.yellow(`    [${issue.framework}] ${issue.issue}`));
+                if (frameworks.length > 0) {
+                    const issues = [];
+                    let compliant = true;
+                    for (const framework of frameworks) {
+                        try {
+                            const outcome = await securityAPI.runComplianceCheck(framework);
+                            if (!outcome.success || !outcome.value) {
+                                compliant = false;
+                                checks.push({ name: `Compliance:${framework}`, status: 'failed', reason: !outcome.success ? securityFailureReason('Compliance check', outcome.error) : 'Compliance check returned no result' });
+                                continue;
                             }
+                            const report = outcome.value;
+                            const legacy = report;
+                            const violations = report.violations ?? [];
+                            const skipped = report.skippedRules ?? [];
+                            const passed = report.passedRules ?? [];
+                            const measured = Array.isArray(report.violations) && Array.isArray(report.passedRules) && Array.isArray(report.skippedRules);
+                            const status = !measured ? 'unverified' : skipped.length > 0 ? 'partial' : passed.length + violations.length > 0 ? 'complete' : 'none';
+                            checks.push({ name: `Compliance:${framework}`, status, ...(skipped.length ? { reason: `${skipped.length} compliance rules were skipped.` } : {}) });
+                            issues.push(...violations.map(violation => ({ framework, issue: violation.details })));
+                            if (legacy.issues)
+                                issues.push(...legacy.issues);
+                            if (status !== 'complete' || violations.length > 0 || legacy.compliant === false)
+                                compliant = false;
+                        }
+                        catch (error) {
+                            compliant = false;
+                            checks.push({ name: `Compliance:${framework}`, status: 'failed', reason: securityFailureReason('Compliance check', error) });
                         }
                     }
+                    scanResult.compliance = { compliant, issues };
                 }
-                else if (format === 'text') {
-                    console.log(chalk.red(`  x Compliance check failed: ${compResult.error?.message || 'Unknown error'}`));
-                }
-                if (format === 'text')
-                    console.log('');
             }
-            // DAST note
-            if (options.dast && format === 'text') {
-                console.log(chalk.gray('Note: DAST requires running application URLs. Use --target with URLs for DAST scanning.'));
+            if (options.dast) {
+                checks.push({ name: 'DAST', status: 'not-run', reason: 'This CLI command does not execute DAST. A running application URL and DAST execution path are required.' });
             }
-            // Format-aware output
-            if (format === 'json') {
+        }
+        catch (error) {
+            checks.push({ name: scanResult.scanType, status: 'failed', reason: securityFailureReason('Security scan', error) });
+        }
+        scanResult.status = summarizeChecks(checks);
+        try {
+            if (format === 'json')
                 writeOutput(toJSON(scanResult), options.output);
-            }
-            else if (format === 'sarif') {
+            else if (format === 'sarif')
                 writeOutput(toSARIF(scanResult), options.output);
-            }
-            else if (format === 'markdown') {
+            else if (format === 'markdown')
                 writeOutput(securityToMarkdown(scanResult), options.output);
-            }
-            else {
-                console.log(chalk.green(' Security scan complete\n'));
-            }
-            // Exit codes: 1 = critical/high vulns, 2 = medium-only vulns, 0 = low/none
-            const hasHighSeverity = scanResult.vulnerabilities.some(v => v.severity === 'high' || v.severity === 'critical');
-            const hasMediumSeverity = scanResult.vulnerabilities.some(v => v.severity === 'medium');
-            if (hasHighSeverity) {
-                await cleanupAndExit(1);
-            }
-            else if (hasMediumSeverity) {
-                await cleanupAndExit(2);
-            }
-            await cleanupAndExit(0);
+            else
+                printSecurityResult(scanResult);
         }
-        catch (err) {
-            console.error(chalk.red('\nFailed:'), err);
-            await cleanupAndExit(1);
+        catch (error) {
+            console.error(chalk.red('Failed to write security report:'), error);
+            return cleanupAndExit(1);
         }
+        // Incomplete execution never has a clean exit, even if it found no vulnerabilities.
+        if (scanResult.status !== 'complete' || scanResult.compliance?.compliant === false)
+            return cleanupAndExit(1);
+        if (scanResult.vulnerabilities.some(v => v.severity === 'high' || v.severity === 'critical'))
+            return cleanupAndExit(1);
+        if (scanResult.vulnerabilities.some(v => v.severity === 'medium'))
+            return cleanupAndExit(2);
+        return cleanupAndExit(0);
     });
     return securityCmd;
 }
+/** Provider exceptions can contain credentials or source; expose only an operation and errno. */
+function securityFailureReason(operation, error) {
+    const code = error && typeof error === 'object' && 'code' in error ? error.code : undefined;
+    return typeof code === 'string' && /^[A-Z0-9_]{1,32}$/.test(code)
+        ? `${operation} failed (${code}).`
+        : `${operation} failed.`;
+}
+function summarizeChecks(checks) {
+    if (checks.length === 0)
+        return 'not-run';
+    if (checks.every(check => check.status === 'complete'))
+        return 'complete';
+    if (checks.some(check => check.status === 'partial' || check.status === 'complete'))
+        return 'partial';
+    if (checks.some(check => check.status === 'failed'))
+        return 'failed';
+    if (checks.some(check => check.status === 'unverified'))
+        return 'unverified';
+    if (checks.some(check => check.status === 'none'))
+        return 'none';
+    return 'not-run';
+}
+function formatVulnerability(value) {
+    if ('location' in value) {
+        return {
+            severity: value.severity, type: value.title || value.category,
+            file: value.location.file, line: value.location.line ?? 1,
+            message: value.description,
+        };
+    }
+    return value;
+}
+function printSecurityResult(result) {
+    console.log(chalk.blue(`\n Security scan on ${result.target}\n`));
+    for (const check of result.checks ?? []) {
+        const color = check.status === 'complete' ? chalk.green : chalk.yellow;
+        console.log(color(`  ${check.name}: ${check.status}${check.reason ? ` — ${check.reason}` : ''}`));
+    }
+    if (result.coverage) {
+        console.log(`  Analyzed ${result.coverage.filesScanned} files, ${result.coverage.linesScanned} lines; ${result.coverage.rulesApplied} rules applied${result.coverage.rulesAppliedScope ? ` (${result.coverage.rulesAppliedScope})` : ''}.`);
+    }
+    if (result.vulnerabilities.length === 0) {
+        console.log(result.status === 'complete'
+            ? '  No vulnerabilities found in completed checks.'
+            : '  No vulnerabilities reported; requested analysis is incomplete or unverified.');
+    }
+    else {
+        console.log(chalk.yellow(`  Found ${result.vulnerabilities.length} potential issues:`));
+        for (const vulnerability of result.vulnerabilities.slice(0, 10)) {
+            console.log(`    [${vulnerability.severity}] ${vulnerability.type}: ${vulnerability.file}:${vulnerability.line}`);
+            console.log(`           ${vulnerability.message}`);
+        }
+        if (result.vulnerabilities.length > 10)
+            console.log(`    ... and ${result.vulnerabilities.length - 10} more`);
+    }
+    if (result.compliance) {
+        console.log(`  Compliance: ${result.compliance.compliant ? 'compliant in completed checks' : 'failed or incomplete'}`);
+        for (const issue of result.compliance.issues ?? [])
+            console.log(`    [${issue.framework}] ${issue.issue}`);
+    }
+    const limitations = [
+        ...(result.evidence?.limitations ?? []),
+        ...(result.evidence?.engines.flatMap(engine => engine.status === 'completed' ? [] : [`${engine.id}: ${engine.status}`, ...engine.errors]) ?? []),
+        ...(result.evidence?.files.filter(file => file.status !== 'analyzed' && file.status !== 'excluded').map(file => `${file.path}: ${file.status}${file.reason ? ` (${file.reason})` : ''}`) ?? []),
+        ...(result.discovery?.issues.map(issue => `${issue.path}: ${issue.reason}`) ?? []),
+    ];
+    for (const limitation of limitations.slice(0, 10))
+        console.log(chalk.yellow(`  ${limitation}`));
+    if (limitations.length > 10)
+        console.log(`  ... ${limitations.length - 10} additional limitations; use JSON, Markdown, or SARIF for full receipts.`);
+    if (result.evidence)
+        console.log('  Scope: completed checks of the declared required engines; this is not full SAST assurance.');
+    console.log(`\n Security analysis: ${result.status}\n`);
+}
 //# sourceMappingURL=security.js.map

package/dist/cli/commands/test.js

@@ -179,6 +179,7 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                 }
                 else {
                     console.log(chalk.red(`Failed: ${result.error?.message || 'Unknown error'}`));
+                    await cleanupAndExit(1);
                 }
             }
             else if (action === 'schedule') {

package/dist/cli/utils/ci-output.d.ts

@@ -4,6 +4,9 @@
  * Provides structured output formatting for CI/CD pipeline integration.
  * Supports: text (default), json, sarif, junit, markdown
  */
+import type { SecurityCoverage } from '../../domains/security-compliance/interfaces.js';
+import type { SecurityScanEvidence } from '../../domains/security-compliance/scan-evidence.js';
+import type { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
 export type OutputFormat = 'text' | 'json' | 'sarif' | 'junit' | 'markdown';
 export interface CIOutputOptions {
     format: OutputFormat;
@@ -29,7 +32,21 @@ export interface SecurityScanResult {
     };
     target: string;
     scanType: string;
+    /** Execution completeness is independent of finding severity. */
+    status?: SecurityExecutionStatus;
+    checks?: SecurityCheckResult[];
+    coverage?: SecurityCoverage;
+    evidence?: SecurityScanEvidence;
+    discovery?: Awaited<ReturnType<typeof discoverSecurityFiles>>['discovery'];
 }
+export type SecurityExecutionStatus = 'complete' | 'partial' | 'none' | 'failed' | 'not-run' | 'unverified';
+export interface SecurityCheckResult {
+    name: string;
+    status: SecurityExecutionStatus;
+    reason?: string;
+}
+/** Legacy finding-only reports carry no evidence that the requested work ran. */
+export declare function securityExecutionStatus(result: SecurityScanResult): SecurityExecutionStatus;
 export interface TestResult {
     name: string;
     passed: boolean;

package/dist/cli/utils/ci-output.js

@@ -29,6 +29,10 @@ function getPackageVersion() {
     catch { /* fallback */ }
     return 'unknown';
 }
+/** Legacy finding-only reports carry no evidence that the requested work ran. */
+export function securityExecutionStatus(result) {
+    return result.status ?? result.evidence?.completeness ?? 'unverified';
+}
 // ============================================================================
 // Commander Option Helpers
 // ============================================================================
@@ -70,6 +74,7 @@ export function toJSON(data) {
 // ============================================================================
 const SARIF_SCHEMA = 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json';
 export function toSARIF(result) {
+    const status = securityExecutionStatus(result);
     const severityToLevel = (severity) => {
         switch (severity.toLowerCase()) {
             case 'critical':
@@ -124,9 +129,20 @@ export function toSARIF(result) {
                     },
                 },
                 results,
+                properties: {
+                    securityScan: {
+                        status, target: result.target, scanType: result.scanType, coverage: result.evidence ? result.coverage : undefined,
+                        evidence: result.evidence, discovery: result.discovery, checks: result.checks,
+                    },
+                },
                 invocations: [{
-                        executionSuccessful: true,
-                        commandLine: `aqe security --sast --format sarif -t ${result.target}`,
+                        executionSuccessful: status === 'complete',
+                        ...(status === 'complete' ? {} : {
+                            toolExecutionNotifications: [{
+                                    level: 'warning',
+                                    message: { text: `Security analysis ${status}; findings do not establish complete coverage.` },
+                                }],
+                        }),
                     }],
             }],
     };
@@ -236,7 +252,23 @@ export function securityToMarkdown(result) {
     let md = `# Security Scan Report\n\n`;
     md += `**Target:** ${result.target}\n`;
     md += `**Scan Type:** ${result.scanType}\n`;
+    md += `**Execution:** ${securityExecutionStatus(result)}\n`;
     md += `**Vulnerabilities Found:** ${result.vulnerabilities.length}\n\n`;
+    if (result.checks?.length) {
+        md += `## Check execution\n\n`;
+        for (const check of result.checks) {
+            md += `- **${check.name}:** ${check.status}${check.reason ? ` — ${check.reason}` : ''}\n`;
+        }
+        md += '\n';
+    }
+    if (result.coverage && result.evidence) {
+        md += `**Analyzed files:** ${result.coverage.filesScanned}\n`;
+        md += `**Analyzed lines:** ${result.coverage.linesScanned}\n`;
+        md += `**Rules applied:** ${result.coverage.rulesApplied}${result.coverage.rulesAppliedScope ? ` (${result.coverage.rulesAppliedScope})` : ''}\n\n`;
+    }
+    if (result.evidence || result.discovery) {
+        md += `## Execution receipts\n\n\`\`\`json\n${toJSON({ evidence: result.evidence, discovery: result.discovery })}\n\`\`\`\n\n`;
+    }
     if (result.vulnerabilities.length > 0) {
         md += `## Vulnerabilities\n\n`;
         md += `| Severity | Type | File | Line | Message |\n`;

package/dist/coordination/handlers/handler-types.d.ts

@@ -5,6 +5,7 @@
  * of DomainTaskExecutor needed to register and implement handlers.
  */
 import type { Result } from '../../shared/types';
+import type { MemoryBackend } from '../../kernel/interfaces.js';
 import type { QueenTask, TaskType } from '../queen-coordinator';
 import type { CoverageAnalyzerService } from '../../domains/coverage-analysis';
 import type { SecurityScannerService } from '../../domains/security-compliance';
@@ -20,6 +21,8 @@ export type InstanceTaskHandler = (task: QueenTask) => Promise<Result<unknown, E
 export interface TaskHandlerContext {
     /** Register a handler for a given task type */
     registerHandler(type: TaskType, handler: InstanceTaskHandler): void;
+    /** Initialized kernel memory, including canonical measured quality evidence. */
+    readonly memory: MemoryBackend;
     /** Lazy service getters */
     getCoverageAnalyzer(): CoverageAnalyzerService;
     getSecurityScanner(): SecurityScannerService;

package/dist/coordination/handlers/quality-handlers.js

@@ -7,11 +7,21 @@
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
 import { discoverSourceFiles } from './handler-utils.js';
+import { evaluateQualityEvidence, loadQualityEvidence, } from '../../domains/quality-assessment/quality-evidence.js';
 export function registerQualityHandlers(ctx) {
     // Register quality assessment handler - REAL IMPLEMENTATION
     ctx.registerHandler('assess-quality', async (task) => {
         const payload = task.payload;
         try {
+            // An explicit gate evaluates the same measured, timestamped evidence as
+            // `aqe quality --gate`. Static source scores cannot substitute for it.
+            if (payload.runGate === true) {
+                const measured = await loadQualityEvidence(ctx.memory);
+                return ok({
+                    ...evaluateQualityEvidence(measured),
+                    metrics: measured,
+                });
+            }
             const analyzer = ctx.getQualityAnalyzer();
             const threshold = payload.threshold || 80;
             // Determine source files to analyze