agentic-qe 3.14.2 → 3.14.4

package/dist/coordination/result-saver.js

@@ -6,6 +6,11 @@ import * as fs from 'fs/promises';
 import * as path from 'path';
 import { createHash } from 'crypto';
 import { safeJsonParse } from '../shared/safe-json.js';
+function securityReportExecution(data) {
+    return data.evidence?.completeness === 'complete' ? 'completed'
+        : data.evidence?.completeness === 'partial' ? 'partial'
+            : data.evidence ? 'unavailable' : 'unverified';
+}
 // ============================================================================
 // Test File Patterns by Language/Framework
 // ============================================================================
@@ -319,6 +324,8 @@ end_of_record
 `;
     }
     generateSarif(data) {
+        const status = securityReportExecution(data);
+        const findings = data.findings ?? data.topVulnerabilities;
         return JSON.stringify({
             $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
             version: '2.1.0',
@@ -330,14 +337,23 @@ end_of_record
                             informationUri: 'https://github.com/ruvnet/agentic-qe',
                         },
                     },
-                    results: data.topVulnerabilities.map((v, i) => ({
+                    properties: { securityScan: { status, evidence: data.evidence, coverage: data.coverage,
+                            limitations: data.limitations, analysisDepth: data.analysisDepth } },
+                    invocations: [{
+                            executionSuccessful: data.evidence?.completeness === 'complete',
+                            ...(data.evidence?.completeness === 'complete' ? {} : {
+                                toolExecutionNotifications: [{ level: 'warning',
+                                        message: { text: `Security analysis ${status}; findings do not establish complete coverage.` } }],
+                            }),
+                        }],
+                    results: findings.map((v, i) => ({
                         ruleId: `VULN-${String(i + 1).padStart(3, '0')}`,
                         level: v.severity === 'critical' ? 'error' : v.severity === 'high' ? 'error' : 'warning',
-                        message: { text: v.type },
+                        message: { text: v.type ?? v.title ?? 'Security finding' },
                         locations: [{
                                 physicalLocation: {
-                                    artifactLocation: { uri: v.file },
-                                    region: { startLine: v.line },
+                                    artifactLocation: { uri: v.file ?? v.location?.file ?? '' },
+                                    ...((v.line ?? v.location?.line ?? 0) > 0 ? { region: { startLine: v.line ?? v.location?.line } } : {}),
                                 },
                             }],
                     })),
@@ -411,6 +427,14 @@ ${data.gaps.length === 0 ? 'No significant gaps detected.' : data.gaps.map(g =>
 
 **Generated:** ${new Date().toISOString()}
 **Scanner:** Agentic QE v3 Security
+**Execution:** ${securityReportExecution(data)}
+
+## Execution receipts
+
+\`\`\`json
+${JSON.stringify({ evidence: data.evidence, coverage: data.coverage, limitations: data.limitations,
+            analysisDepth: data.analysisDepth }, null, 2)}
+\`\`\`
 
 ## Summary
 
@@ -430,6 +454,12 @@ ${data.topVulnerabilities.map(v => `### ${v.type}
 - **Line:** ${v.line}
 `).join('\n')}
 
+## All findings
+
+\`\`\`json
+${JSON.stringify(data.findings ?? data.topVulnerabilities, null, 2)}
+\`\`\`
+
 ## Recommendations
 
 ${data.recommendations.map((r, i) => `${i + 1}. ${r}`).join('\n')}
@@ -443,7 +473,7 @@ ${data.recommendations.map((r, i) => `${i + 1}. ${r}`).join('\n')}
 
 ## Quality Score
 
-**${data.qualityScore.toFixed(1)}** / 100
+${typeof data.qualityScore === 'number' ? `**${data.qualityScore.toFixed(1)}** / 100` : 'N/A — measured gate uses individual checks.'}
 
 ## Metrics
 
@@ -500,6 +530,7 @@ ${data.recommendations.length === 0 ? 'No recommendations - all quality gates pa
         switch (taskType) {
             case 'scan-security':
                 return {
+                    status: securityReportExecution(data),
                     vulnerabilities: data.vulnerabilities,
                     critical: data.critical,
                     high: data.high,

package/dist/coordination/task-executor.d.ts

@@ -13,7 +13,7 @@
  * Handler implementations are extracted into ./handlers/ modules.
  */
 import { DomainName } from '../shared/types';
-import { EventBus, QEKernel } from '../kernel/interfaces';
+import { EventBus, QEKernel, MemoryBackend } from '../kernel/interfaces';
 import { TaskType, QueenTask } from './queen-coordinator';
 import type { QualityFeedbackLoop } from '../feedback/feedback-loop.js';
 import type { TestGeneratorService } from '../domains/test-generation';
@@ -63,6 +63,8 @@ export declare class DomainTaskExecutor implements TaskHandlerContext {
     private coherenceActionGate;
     private readonly taskHandlers;
     constructor(kernel: QEKernel, eventBus: EventBus, config?: Partial<TaskExecutorConfig>);
+    /** Share the initialized kernel store with handlers that consume measured evidence. */
+    get memory(): MemoryBackend;
     /** Expose config to handler modules */
     get config(): {
         defaultLanguage: string;

package/dist/coordination/task-executor.js

@@ -16,6 +16,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { toErrorMessage } from '../shared/error-utils.js';
 import { createResultSaver } from './result-saver.js';
 import { createLogger } from '../logging/logger-factory.js';
+import { getClaudeModelForTier } from '../shared/llm/model-registry.js';
 // ADR-051: Agent Booster integration for Tier 0 tasks
 import { createAgentBoosterAdapter, } from '../integrations/agentic-flow/agent-booster/index.js';
 // ADR-051: Task Router for outcome recording
@@ -60,14 +61,9 @@ function resolveQualityAnalyzerService(memory) {
  * Per ADR-026: 3-tier model routing
  */
 function getModelForTier(tier) {
-    switch (tier) {
-        case 0: return 'agent-booster'; // Special case - WASM transforms
-        case 1: return 'claude-haiku-4-5-20251001';
-        case 2: return 'claude-sonnet-4-6';
-        case 3: return 'claude-sonnet-4-6'; // Extended thinking
-        case 4: return 'claude-opus-4-7';
-        default: return 'claude-sonnet-4-6';
-    }
+    if (tier === 0)
+        return 'agent-booster'; // Special case - WASM transforms
+    return getClaudeModelForTier(tier); // Tier 3 = extended thinking, same model as tier 2
 }
 /**
  * Map task type and code context to transform type for Agent Booster
@@ -150,6 +146,10 @@ export class DomainTaskExecutor {
     // ============================================================================
     // TaskHandlerContext implementation (used by handler modules)
     // ============================================================================
+    /** Share the initialized kernel store with handlers that consume measured evidence. */
+    get memory() {
+        return this.kernel.memory;
+    }
     /** Expose config to handler modules */
     get config() {
         return this._config;

package/dist/coordination/workflow-composition.d.ts

@@ -0,0 +1,19 @@
+/** Pure output-path conflict detection and payload-free composition hashing. */
+import type { ParallelCompositionReceipt, WorkflowStepDefinition } from './workflow-types.js';
+interface WritePath {
+    stepId: string;
+    path: string;
+    segments: string[];
+}
+/** Include the implicit `results[step.id]` write as well as declared mappings. */
+export declare function parallelWritePaths(step: WorkflowStepDefinition): WritePath[];
+export declare function parallelOutputConflicts(steps: WorkflowStepDefinition[]): ParallelCompositionReceipt['conflicts'];
+/** A declared read of a concurrently runnable sibling needs an explicit dependency. */
+export declare function parallelUndeclaredReads(steps: WorkflowStepDefinition[]): Array<{
+    stepId: string;
+    sourcePath: string;
+    otherStepId: string;
+}>;
+export declare function hashWorkflowValue(value: unknown): string;
+export {};
+//# sourceMappingURL=workflow-composition.d.ts.map

package/dist/coordination/workflow-composition.js

@@ -0,0 +1,114 @@
+/** Pure output-path conflict detection and payload-free composition hashing. */
+import { createHash } from 'node:crypto';
+/** Include the implicit `results[step.id]` write as well as declared mappings. */
+export function parallelWritePaths(step) {
+    if (['__proto__', 'constructor', 'prototype'].includes(step.id)) {
+        throw new Error(`parallel_output_invalid_path: unsafe step ID ${step.id}`);
+    }
+    const paths = [{ stepId: step.id, path: step.id, segments: [step.id] }];
+    for (const target of Object.values(step.outputMapping ?? {}).sort()) {
+        const segments = target.split('.');
+        if (segments.some(part => !part || ['__proto__', 'constructor', 'prototype'].includes(part))) {
+            throw new Error(`parallel_output_invalid_path: ${step.id} maps to ${target}`);
+        }
+        paths.push({ stepId: step.id, path: target, segments });
+    }
+    return paths;
+}
+export function parallelOutputConflicts(steps) {
+    const writes = steps.flatMap(parallelWritePaths);
+    const conflicts = [];
+    for (let i = 0; i < writes.length; i++) {
+        for (let j = i + 1; j < writes.length; j++) {
+            const a = writes[i];
+            const b = writes[j];
+            if (a.stepId === b.stepId)
+                continue;
+            const shared = Math.min(a.segments.length, b.segments.length);
+            if (!a.segments.slice(0, shared).every((part, index) => part === b.segments[index]))
+                continue;
+            conflicts.push({
+                pathA: a.path, stepA: a.stepId, pathB: b.path, stepB: b.stepId,
+                kind: a.segments.length === b.segments.length ? 'exact' : 'ancestor-descendant',
+            });
+        }
+    }
+    return conflicts;
+}
+/** A declared read of a concurrently runnable sibling needs an explicit dependency. */
+export function parallelUndeclaredReads(steps) {
+    const reads = [];
+    for (const step of steps) {
+        const paths = [
+            ...Object.values(step.inputMapping ?? {}),
+            step.condition?.path,
+            step.skipCondition?.path,
+        ].filter((path) => typeof path === 'string');
+        for (const sourcePath of paths) {
+            for (const sibling of steps) {
+                if (sibling.id === step.id)
+                    continue;
+                if (sourcePath === 'results') {
+                    reads.push({ stepId: step.id, sourcePath, otherStepId: sibling.id });
+                    continue;
+                }
+                if (!sourcePath.startsWith('results.'))
+                    continue;
+                const readSegments = sourcePath.slice('results.'.length).split('.');
+                const readsSiblingWrite = parallelWritePaths(sibling).some(write => {
+                    const shared = Math.min(readSegments.length, write.segments.length);
+                    return write.segments.slice(0, shared).every((segment, index) => segment === readSegments[index]);
+                });
+                if (readsSiblingWrite) {
+                    reads.push({ stepId: step.id, sourcePath, otherStepId: sibling.id });
+                }
+            }
+        }
+    }
+    return reads;
+}
+/** Canonical, cycle-detecting representation of structured-cloneable values. */
+function canonical(value, ancestors) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return ['number', String(value)];
+    if (typeof value === 'bigint')
+        return ['bigint', String(value)];
+    if (value === undefined)
+        return ['undefined'];
+    if (typeof value !== 'object')
+        throw new Error('parallel_output_unhashable');
+    if (ancestors.has(value))
+        throw new Error('parallel_output_cyclic');
+    ancestors.add(value);
+    try {
+        if (value instanceof Date)
+            return ['date', value.toISOString()];
+        if (value instanceof ArrayBuffer)
+            return ['bytes', Buffer.from(value).toString('base64')];
+        if (ArrayBuffer.isView(value)) {
+            return ['bytes', value.constructor.name, Buffer.from(value.buffer, value.byteOffset, value.byteLength).toString('base64')];
+        }
+        if (Array.isArray(value))
+            return ['array', value.map(item => canonical(item, ancestors))];
+        if (value instanceof Set) {
+            const entries = [...value].map(item => canonical(item, ancestors));
+            return ['set', entries.sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))];
+        }
+        if (value instanceof Map) {
+            const entries = [...value].map(([key, item]) => [canonical(key, ancestors), canonical(item, ancestors)]);
+            return ['map', entries.sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))];
+        }
+        const record = value;
+        return ['object', Object.keys(record).sort().map(key => [key, canonical(record[key], ancestors)])];
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+export function hashWorkflowValue(value) {
+    const payload = JSON.stringify(canonical(value, new Set()));
+    return createHash('sha256').update(payload).digest('hex');
+}
+//# sourceMappingURL=workflow-composition.js.map

package/dist/coordination/workflow-orchestrator.d.ts

@@ -10,7 +10,7 @@
 import { Result, DomainName } from '../shared/types/index.js';
 import { EventBus, MemoryBackend, AgentCoordinator } from '../kernel/interfaces.js';
 import type { BehaviorNode } from './behavior-tree/nodes.js';
-export type { StepExecutionMode, StepStatus, WorkflowStatus, ConditionOperator, StepCondition, WorkflowStepDefinition, WorkflowDefinition, WorkflowTrigger, StepExecutionResult, WorkflowContext, WorkflowExecutionStatus, WorkflowListItem, WorkflowStartedPayload, WorkflowCompletedPayload, WorkflowFailedPayload, StepEventPayload, StepAwaitingApprovalPayload, IWorkflowOrchestrator, DomainAction, DomainActionRegistry, WorkflowOrchestratorConfig, } from './workflow-types.js';
+export type { StepExecutionMode, StepStatus, WorkflowStatus, ConditionOperator, StepCondition, WorkflowStepDefinition, WorkflowDefinition, WorkflowTrigger, StepExecutionResult, ParallelCompositionReceipt, WorkflowContext, WorkflowExecutionStatus, WorkflowListItem, WorkflowStartedPayload, WorkflowCompletedPayload, WorkflowFailedPayload, StepEventPayload, StepAwaitingApprovalPayload, IWorkflowOrchestrator, DomainAction, DomainActionRegistry, WorkflowOrchestratorConfig, } from './workflow-types.js';
 export { WorkflowEvents, DEFAULT_WORKFLOW_CONFIG, } from './workflow-types.js';
 import type { WorkflowDefinition, WorkflowExecutionStatus, WorkflowListItem, IWorkflowOrchestrator, DomainAction, WorkflowOrchestratorConfig } from './workflow-types.js';
 export declare class WorkflowOrchestrator implements IWorkflowOrchestrator {
@@ -93,8 +93,9 @@ export declare class WorkflowOrchestrator implements IWorkflowOrchestrator {
     private loadPersistedWorkflows;
     private persistWorkflows;
     private persistExecution;
+    private closeApprovalGates;
     /**
-     * Wait for external approval (or auto-approve after timeout).
+     * Wait for external approval. An unanswered gate expires without approval.
      * Returns an object with approved status and optional rejection reason.
      */
     private waitForApproval;