agentic-qe 3.14.5 → 3.14.7

package/dist/audit/witness-chain-verifier.js

@@ -0,0 +1,293 @@
+/**
+ * Witness Chain verification with break classification (ADR-070, issue #753).
+ *
+ * Before v3.14.5, two AQE processes appending at once could both read the
+ * same tail and write a row whose `prev_hash` points at an older row: an
+ * accidental FORK. `verify()` used to stop at the first such break, so the
+ * rows after it were never checked and a forked store looked exactly like a
+ * tampered one.
+ *
+ * Every row is now classified:
+ *
+ * - linked: `prev_hash` is the hash of its predecessor (array-adjacent row,
+ *   or row `id - 1` in either table, which covers the archival boundary), and
+ *   no id between the two is missing from live ∪ archive.
+ * - fork: the row's own `action_hash` recomputes, its `prev_hash` is the exact
+ *   hash of an EARLIER row that still exists (live or archive), every id
+ *   between that parent and the row still exists (no deleted history), and,
+ *   when the row is signed with a key this verifier holds, the Ed25519
+ *   signature verifies. The walk records the fork and CONTINUES, checking the
+ *   next row against the fork row exactly as before.
+ * - tamper: anything else. The walk stops there.
+ *
+ * A fork alone does not make the chain valid: it is only accepted once a later,
+ * normally linked `CHAIN_REANCHOR` entry (written by `aqe audit repair`) lists
+ * that exact row (id + prev_hash + action_hash + parent id). Forks that appear
+ * after a re-anchor are unacknowledged again. The re-anchor also pins the hash
+ * of every dead-end row (a losing race sibling that no later row links to), so
+ * editing or deleting one after the repair is reported as tampering.
+ *
+ * Limits (documented in ADR-070): for UNSIGNED rows the fork class is
+ * structural, not cryptographic. A row whose prev_hash is the genesis sentinel
+ * mid-chain (the legacy #759 brain-import splice) is reported as tamper: the
+ * sentinel proves nothing about this chain and is exactly what a forged or
+ * history-deleting edit produces.
+ */
+import { GENESIS_PREV_HASH, hashWith, serializeEntry, signaturePayload } from './witness-chain-hash.js';
+export const CHAIN_REANCHOR_ACTION = 'CHAIN_REANCHOR';
+/** Row hash under the row's own algorithm (how pins are recorded). */
+export function ownHash(row) {
+    return hashWith(row.hash_algo || 'sha256', serializeEntry(row));
+}
+/** Stateful single-use walker; see file header for the classification rules. */
+export class WitnessChainVerifier {
+    db;
+    keyManager;
+    options;
+    archiveRows = null;
+    parentIndex = new Map();
+    acks = new Map();
+    pins = [];
+    forks = [];
+    tamper;
+    signatureFailures = 0;
+    firstSignatureFailure;
+    entriesChecked = 0;
+    archiveExists;
+    constructor(db, keyManager, options = {}) {
+        this.db = db;
+        this.keyManager = keyManager;
+        this.options = options;
+    }
+    run() {
+        const live = tableExists(this.db, 'witness_chain')
+            ? this.db.prepare('SELECT * FROM witness_chain ORDER BY id ASC').all()
+            : [];
+        if (live.length === 0) {
+            // Archiving never moves genesis (id 1) out of the live table, so archived
+            // rows with no live chain mean the live table was emptied or dropped.
+            if (this.getArchive().length > 0) {
+                this.tamper = { id: 1, reason: 'live-chain-missing' };
+                return this.result(1);
+            }
+            return { valid: true, entriesChecked: 0, status: 'valid', tampered: false, forks: [], acknowledgedForks: [], forkDetails: [] };
+        }
+        // Live table first, then the archive as its own contiguous slice — NOT a
+        // merged id-sorted array, which would wrongly treat an archived row as the
+        // predecessor of a live row appended (and chained to the live tail) after
+        // that row was archived.
+        if (this.walk(live, 'live') && this.options.includeArchive)
+            this.walk(this.getArchive(), 'archive');
+        if (!this.tamper)
+            this.checkPins();
+        return this.result(live[0].id);
+    }
+    walk(rows, table) {
+        for (let i = 0; i < rows.length; i++) {
+            const current = rows[i];
+            this.entriesChecked++;
+            const link = this.classify(current, i > 0 ? rows[i - 1] : undefined);
+            if (link.kind === 'tamper') {
+                this.tamper = { id: current.id, reason: link.reason };
+                return false;
+            }
+            if (link.kind === 'fork') {
+                this.forks.push({
+                    id: current.id, parentId: link.parentId, prevHash: current.prev_hash,
+                    actionHash: current.action_hash, table, acknowledged: false,
+                });
+            }
+            else if (current.action_type === CHAIN_REANCHOR_ACTION) {
+                if (this.checkSignature(current) === 'invalid') {
+                    this.tamper = { id: current.id, reason: 'reanchor-signature-invalid' };
+                    return false;
+                }
+                this.registerReanchor(current);
+            }
+            this.checkAllSignatures(current);
+        }
+        return true;
+    }
+    classify(current, arrayAdjacent) {
+        const algo = current.hash_algo || 'sha256';
+        if (current.action_hash !== hashWith(algo, current.action_data)) {
+            return { kind: 'tamper', reason: 'action-hash-mismatch' };
+        }
+        if (current.id === 1) {
+            return current.prev_hash === GENESIS_PREV_HASH
+                ? { kind: 'linked' } : { kind: 'tamper', reason: 'genesis-link-mismatch' };
+        }
+        if (arrayAdjacent && current.prev_hash === hashWith(algo, serializeEntry(arrayAdjacent))) {
+            // Array-adjacent may skip ids that were archived; it may not skip ids that are gone.
+            return this.idsContiguous(arrayAdjacent.id, current.id)
+                ? { kind: 'linked' } : { kind: 'tamper', reason: 'id-gap' };
+        }
+        const predecessor = this.findEntryById(current.id - 1);
+        if (predecessor && current.prev_hash === hashWith(algo, serializeEntry(predecessor))) {
+            return { kind: 'linked' };
+        }
+        const parentId = this.lookupParent(algo, current.prev_hash);
+        if (parentId !== undefined && parentId < current.id) {
+            if (!this.idsContiguous(parentId, current.id))
+                return { kind: 'tamper', reason: 'id-gap' };
+            if (this.checkSignature(current) === 'invalid')
+                return { kind: 'tamper', reason: 'fork-signature-invalid' };
+            return { kind: 'fork', parentId };
+        }
+        return {
+            kind: 'tamper',
+            reason: current.prev_hash === GENESIS_PREV_HASH ? 'unlinked-genesis-prev-hash' : 'unlinked-prev-hash',
+        };
+    }
+    findEntryById(id) {
+        return this.db.prepare('SELECT * FROM witness_chain WHERE id = ?').get(id)
+            ?? (this.hasArchive()
+                ? this.db.prepare('SELECT * FROM witness_chain_archive WHERE id = ?').get(id)
+                : undefined);
+    }
+    getArchive() {
+        if (!this.archiveRows) {
+            this.archiveRows = this.hasArchive()
+                ? this.db.prepare('SELECT * FROM witness_chain_archive ORDER BY id ASC').all()
+                : [];
+        }
+        return this.archiveRows;
+    }
+    /** Stores written before archiving existed (or opened read-only) may lack the archive table. */
+    hasArchive() {
+        if (this.archiveExists === undefined)
+            this.archiveExists = tableExists(this.db, 'witness_chain_archive');
+        return this.archiveExists;
+    }
+    /** hash → id over every row (live + archive), built lazily per hash algo on the first fork candidate. */
+    lookupParent(algo, prevHash) {
+        let index = this.parentIndex.get(algo);
+        if (!index) {
+            index = new Map();
+            const live = this.db.prepare('SELECT * FROM witness_chain').iterate();
+            for (const row of live)
+                index.set(hashWith(algo, serializeEntry(row)), row.id);
+            for (const row of this.getArchive()) {
+                const h = hashWith(algo, serializeEntry(row));
+                if (!index.has(h))
+                    index.set(h, row.id);
+            }
+            this.parentIndex.set(algo, index);
+        }
+        return index.get(prevHash);
+    }
+    /**
+     * True when every id strictly between `from` and `to` exists in live ∪
+     * archive. AUTOINCREMENT ids are never reused and a rolled-back insert does
+     * not consume one, so a missing id means a row was deleted.
+     */
+    idsContiguous(from, to) {
+        const expected = to - from - 1;
+        if (expected <= 0)
+            return true;
+        const row = (this.hasArchive()
+            ? this.db.prepare(`SELECT COUNT(*) AS n FROM (
+           SELECT id FROM witness_chain WHERE id > ? AND id < ?
+           UNION SELECT id FROM witness_chain_archive WHERE id > ? AND id < ?)`).get(from, to, from, to)
+            : this.db.prepare('SELECT COUNT(*) AS n FROM witness_chain WHERE id > ? AND id < ?').get(from, to));
+        return row.n === expected;
+    }
+    /**
+     * Signature status of one row against the keys this verifier holds. A row
+     * signed by a key it does not hold is `unverifiable` (e.g. a key from before
+     * persistent key storage) — classified on structure alone, like unsigned rows.
+     */
+    checkSignature(entry) {
+        if (!entry.signature || !entry.signer_key_id)
+            return 'unsigned';
+        if (!this.keyManager || !this.keyManager.hasKey(entry.signer_key_id))
+            return 'unverifiable';
+        return this.keyManager.verify(signaturePayload(entry), Buffer.from(entry.signature, 'hex'), entry.signer_key_id)
+            ? 'ok' : 'invalid';
+    }
+    /** Legacy `checkSignatures` option: every signed row must verify (unknown key = failure). */
+    checkAllSignatures(entry) {
+        if (this.options.checkSignatures !== true || !this.keyManager)
+            return;
+        if (!entry.signature || !entry.signer_key_id)
+            return;
+        const ok = this.keyManager.verify(signaturePayload(entry), Buffer.from(entry.signature, 'hex'), entry.signer_key_id);
+        if (!ok) {
+            this.signatureFailures++;
+            this.firstSignatureFailure ??= entry.id;
+        }
+    }
+    registerReanchor(entry) {
+        let data;
+        try {
+            data = JSON.parse(entry.action_data) ?? {};
+        }
+        catch {
+            return;
+        }
+        if (Array.isArray(data.forks)) {
+            for (const f of data.forks) {
+                if (typeof f?.id !== 'number' || f.id >= entry.id)
+                    continue;
+                if (typeof f.parentId !== 'number' || typeof f.prevHash !== 'string' || typeof f.actionHash !== 'string')
+                    continue;
+                const list = this.acks.get(f.id) ?? [];
+                list.push({ id: f.id, parentId: f.parentId, prevHash: f.prevHash, actionHash: f.actionHash });
+                this.acks.set(f.id, list);
+            }
+        }
+        if (Array.isArray(data.pins)) {
+            for (const p of data.pins) {
+                if (typeof p?.id === 'number' && typeof p.hash === 'string')
+                    this.pins.push({ id: p.id, hash: p.hash });
+            }
+        }
+    }
+    /** Rows frozen by a verified re-anchor must still exist with the same hash. */
+    checkPins() {
+        for (const pin of this.pins) {
+            const row = this.findEntryById(pin.id);
+            if (!row || ownHash(row) !== pin.hash) {
+                this.tamper = { id: pin.id, reason: 'reanchored-row-changed' };
+                return;
+            }
+        }
+    }
+    result(firstLiveId) {
+        for (const fork of this.forks) {
+            fork.acknowledged = (this.acks.get(fork.id) ?? []).some((a) => a.parentId === fork.parentId && a.prevHash === fork.prevHash && a.actionHash === fork.actionHash);
+        }
+        const unacknowledged = this.forks.filter((f) => !f.acknowledged);
+        const tampered = this.tamper !== undefined || this.signatureFailures > 0;
+        const status = tampered ? 'tampered'
+            : unacknowledged.length > 0 ? 'forked'
+                : this.forks.length > 0 ? 'valid-with-forks' : 'valid';
+        const valid = status === 'valid' || status === 'valid-with-forks';
+        // Legacy: a signature failure alone reported brokenAt = first live id.
+        const brokenAt = unacknowledged[0]?.id ?? this.tamper?.id
+            ?? (this.signatureFailures > 0 ? firstLiveId : undefined);
+        return {
+            valid,
+            entriesChecked: this.entriesChecked,
+            signatureFailures: this.signatureFailures,
+            status,
+            tampered,
+            forks: this.forks.map((f) => f.id),
+            acknowledgedForks: this.forks.filter((f) => f.acknowledged).map((f) => f.id),
+            forkDetails: this.forks,
+            ...(brokenAt !== undefined && !valid ? { brokenAt } : {}),
+            ...(tampered ? {
+                tamperedAt: this.tamper?.id ?? this.firstSignatureFailure,
+                tamperReason: this.tamper?.reason ?? 'signature-invalid',
+            } : {}),
+        };
+    }
+}
+export function verifyWitnessChain(db, keyManager, options) {
+    return new WitnessChainVerifier(db, keyManager, options).run();
+}
+/** True when `name` is a table in the connected database. */
+export function tableExists(db, name) {
+    return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(name) !== undefined;
+}
+//# sourceMappingURL=witness-chain-verifier.js.map

package/dist/audit/witness-chain.d.ts

@@ -7,7 +7,11 @@
  */
 import { type Database as DatabaseType } from 'better-sqlite3';
 import { type WitnessKeyManager } from './witness-key-manager.js';
-export type WitnessActionType = 'PATTERN_CREATE' | 'PATTERN_UPDATE' | 'PATTERN_PROMOTE' | 'PATTERN_QUARANTINE' | 'DREAM_MERGE' | 'DREAM_DISCARD' | 'QUALITY_GATE_PASS' | 'QUALITY_GATE_FAIL' | 'ROUTING_DECISION' | 'FINDING_DELIVERED' | 'FINDING_BLOCKED' | 'BRANCH_MERGE' | 'BRANCH_DISCARD' | 'HEBBIAN_PENALTY' | 'KEY_ROTATION' | 'BRAIN_IMPORT';
+import { GENESIS_PREV_HASH, sha256, shake256, hashWith, serializeEntry, signaturePayload } from './witness-chain-hash.js';
+import { type VerifyOptions, type VerifyResult } from './witness-chain-verifier.js';
+export type { VerifyOptions, VerifyResult, ChainStatus, TamperReason, WitnessForkInfo, ReanchorForkRecord, } from './witness-chain-verifier.js';
+export { CHAIN_REANCHOR_ACTION } from './witness-chain-verifier.js';
+export type WitnessActionType = 'PATTERN_CREATE' | 'PATTERN_UPDATE' | 'PATTERN_PROMOTE' | 'PATTERN_QUARANTINE' | 'DREAM_MERGE' | 'DREAM_DISCARD' | 'QUALITY_GATE_PASS' | 'QUALITY_GATE_FAIL' | 'ROUTING_DECISION' | 'FINDING_DELIVERED' | 'FINDING_BLOCKED' | 'BRANCH_MERGE' | 'BRANCH_DISCARD' | 'HEBBIAN_PENALTY' | 'KEY_ROTATION' | 'BRAIN_IMPORT' | 'CHAIN_REANCHOR';
 export interface WitnessEntry {
     id: number;
     prev_hash: string;
@@ -28,32 +32,6 @@ export interface WitnessFilter {
     limit?: number;
     offset?: number;
 }
-export interface VerifyOptions {
-    /** Also verify Ed25519 signatures. Requires keyManager on the chain. */
-    checkSignatures?: boolean;
-    /**
-     * Also walk `witness_chain_archive` and validate it as part of the same
-     * hash chain (archived rows are hash-linked to each other and to the live
-     * table exactly like un-archived rows). Off by default: the live-only walk
-     * is enough to catch tampering with current data and already correctly
-     * bridges the archival boundary; this option adds full historical coverage
-     * for a deep CI gate at the cost of reading the (potentially large) archive.
-     */
-    includeArchive?: boolean;
-}
-export interface VerifyResult {
-    valid: boolean;
-    brokenAt?: number;
-    entriesChecked: number;
-    signatureFailures?: number;
-}
-declare const GENESIS_PREV_HASH: string;
-declare function sha256(data: string): string;
-/** SHAKE-256 (32-byte output) with SHA-256 fallback for older Node.js runtimes. */
-declare function shake256(data: string): string;
-declare function hashWith(algo: string, data: string): string;
-/** Serialize a WitnessEntry to a deterministic string (original 7-field format). */
-declare function serializeEntry(entry: WitnessEntry): string;
 /**
  * Hash-chained append-only audit log with optional Ed25519 signing.
  * New entries use SHAKE-256. Existing SHA-256 entries remain valid.
@@ -72,22 +50,11 @@ export declare class WitnessChain {
     /** Append a new SHAKE-256-hashed entry, optionally Ed25519-signed. */
     append(actionType: WitnessActionType, actionData: Record<string, unknown>, actor: string): WitnessEntry;
     /**
-     * Find the entry with the given id, checking the live table first and then
-     * the archive. Used to recover a predecessor that array-adjacency can't
-     * see directly (it was archived, possibly by an earlier archival run than
-     * the one that affects the entry currently being checked).
-     */
-    private findEntryById;
-    /**
-     * Check one entry's self-hash and chain link. `arrayAdjacent` is whatever
-     * entry sits immediately before `current` in the array currently being
-     * scanned (undefined at the start of that array) — it's tried first since
-     * it's free (already fetched); a cross-table lookup by id only runs on a
-     * mismatch, e.g. because the true predecessor was moved to the archive by
-     * a *different* archival run than the one this scan is walking.
+     * Verify chain integrity. Supports mixed SHA-256/SHAKE-256 and optional
+     * signature checks. Classifies every break as a fork (pre-3.14.5 concurrent
+     * append, #753) or tampering, and keeps walking past forks so later rows are
+     * still checked; see witness-chain-verifier.ts for the exact rules.
      */
-    private checkEntryLink;
-    /** Verify chain integrity. Supports mixed SHA-256/SHAKE-256 and optional signature checks. */
     verify(options?: VerifyOptions): VerifyResult;
     /** Query entries with optional filters. */
     getEntries(filter?: WitnessFilter): WitnessEntry[];
@@ -117,5 +84,5 @@ export declare function createWitnessChain(db: DatabaseType, keyManager?: Witnes
  * memory growth doesn't compound across the file (issue #448 step 3).
  */
 export declare function _resetWitnessChainForTests(): void;
-export { GENESIS_PREV_HASH, sha256, shake256, hashWith, serializeEntry };
+export { GENESIS_PREV_HASH, sha256, shake256, hashWith, serializeEntry, signaturePayload };
 //# sourceMappingURL=witness-chain.d.ts.map

package/dist/audit/witness-chain.js

@@ -5,34 +5,11 @@
  * SHAKE-256 / SHA-256 hash-chained append-only log with optional Ed25519 signing.
  * Tamper-evident: modifying any entry breaks the hash chain, detectable by verify().
  */
-import { createHash } from 'crypto';
 import { getUnifiedMemory } from '../kernel/unified-memory.js';
 import { getDefaultWitnessKeyManager } from './witness-key-manager.js';
-// --- Constants & Hash Functions ---
-const GENESIS_PREV_HASH = '0'.repeat(64);
-function sha256(data) {
-    return createHash('sha256').update(data, 'utf-8').digest('hex');
-}
-/** SHAKE-256 (32-byte output) with SHA-256 fallback for older Node.js runtimes. */
-function shake256(data) {
-    try {
-        return createHash('shake256', { outputLength: 32 }).update(data, 'utf-8').digest('hex');
-    }
-    catch {
-        return sha256(data);
-    }
-}
-function hashWith(algo, data) {
-    return algo === 'shake256' ? shake256(data) : sha256(data);
-}
-/** Serialize a WitnessEntry to a deterministic string (original 7-field format). */
-function serializeEntry(entry) {
-    return JSON.stringify({
-        id: entry.id, prev_hash: entry.prev_hash, action_hash: entry.action_hash,
-        action_type: entry.action_type, action_data: entry.action_data,
-        timestamp: entry.timestamp, actor: entry.actor,
-    });
-}
+import { GENESIS_PREV_HASH, sha256, shake256, hashWith, serializeEntry, signaturePayload, } from './witness-chain-hash.js';
+import { verifyWitnessChain } from './witness-chain-verifier.js';
+export { CHAIN_REANCHOR_ACTION } from './witness-chain-verifier.js';
 // --- WitnessChain ---
 /**
  * Hash-chained append-only audit log with optional Ed25519 signing.
@@ -66,6 +43,10 @@ export class WitnessChain {
     ensureTable() {
         if (!this.db)
             throw new Error('Database not initialized');
+        // A read-only connection (e.g. `aqe audit verify`) must not create or
+        // migrate the schema; readers treat missing tables as empty instead.
+        if (this.db.readonly)
+            return;
         this.db.exec(`
       CREATE TABLE IF NOT EXISTS witness_chain (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -120,8 +101,9 @@ export class WitnessChain {
             let signature = null;
             let signerKeyId = null;
             if (this.keyManager) {
-                const sigData = Buffer.from(prevHash + actionHash + actionType + timestamp + actor, 'utf-8');
-                const result = this.keyManager.sign(sigData);
+                const result = this.keyManager.sign(signaturePayload({
+                    prev_hash: prevHash, action_hash: actionHash, action_type: actionType, timestamp, actor,
+                }));
                 signature = result.signature.toString('hex');
                 signerKeyId = result.keyId;
             }
@@ -137,87 +119,15 @@ export class WitnessChain {
         return appendEntry.immediate();
     }
     /**
-     * Find the entry with the given id, checking the live table first and then
-     * the archive. Used to recover a predecessor that array-adjacency can't
-     * see directly (it was archived, possibly by an earlier archival run than
-     * the one that affects the entry currently being checked).
-     */
-    findEntryById(id) {
-        if (!this.db)
-            return undefined;
-        return this.db.prepare('SELECT * FROM witness_chain WHERE id = ?').get(id)
-            ?? this.db.prepare('SELECT * FROM witness_chain_archive WHERE id = ?').get(id);
-    }
-    /**
-     * Check one entry's self-hash and chain link. `arrayAdjacent` is whatever
-     * entry sits immediately before `current` in the array currently being
-     * scanned (undefined at the start of that array) — it's tried first since
-     * it's free (already fetched); a cross-table lookup by id only runs on a
-     * mismatch, e.g. because the true predecessor was moved to the archive by
-     * a *different* archival run than the one this scan is walking.
+     * Verify chain integrity. Supports mixed SHA-256/SHAKE-256 and optional
+     * signature checks. Classifies every break as a fork (pre-3.14.5 concurrent
+     * append, #753) or tampering, and keeps walking past forks so later rows are
+     * still checked; see witness-chain-verifier.ts for the exact rules.
      */
-    checkEntryLink(current, arrayAdjacent) {
-        const algo = current.hash_algo || 'sha256';
-        if (current.action_hash !== hashWith(algo, current.action_data))
-            return false;
-        if (current.id === 1)
-            return current.prev_hash === GENESIS_PREV_HASH; // genesis, never archived
-        if (arrayAdjacent && current.prev_hash === hashWith(algo, serializeEntry(arrayAdjacent))) {
-            return true;
-        }
-        const predecessor = this.findEntryById(current.id - 1);
-        return predecessor !== undefined && current.prev_hash === hashWith(algo, serializeEntry(predecessor));
-    }
-    /** Verify chain integrity. Supports mixed SHA-256/SHAKE-256 and optional signature checks. */
     verify(options) {
         if (!this.db)
             throw new Error('WitnessChain not initialized');
-        const live = this.db.prepare('SELECT * FROM witness_chain ORDER BY id ASC').all();
-        if (live.length === 0)
-            return { valid: true, entriesChecked: 0 };
-        let signatureFailures = 0;
-        const checkSigs = options?.checkSignatures === true && this.keyManager !== null;
-        const checkSignature = (current) => {
-            if (checkSigs && current.signature && current.signer_key_id) {
-                const sigData = Buffer.from(current.prev_hash + current.action_hash + current.action_type + current.timestamp + current.actor, 'utf-8');
-                if (!this.keyManager.verify(Buffer.from(sigData), Buffer.from(current.signature, 'hex'), current.signer_key_id)) {
-                    signatureFailures++;
-                }
-            }
-        };
-        // Live table: always its own valid chain, since append() always chains
-        // to whatever the live tail is at write time — array-adjacency is right
-        // by construction *except* at a boundary where the true predecessor has
-        // since been archived, which checkEntryLink()'s fallback covers.
-        for (let i = 0; i < live.length; i++) {
-            const current = live[i];
-            if (!this.checkEntryLink(current, i > 0 ? live[i - 1] : undefined)) {
-                return { valid: false, brokenAt: current.id, entriesChecked: i + 1, signatureFailures };
-            }
-            checkSignature(current);
-        }
-        let entriesChecked = live.length;
-        if (options?.includeArchive) {
-            // The archived segment is its own contiguous slice of history (by id)
-            // and is checked the same way — NOT by merging archive+live into one
-            // id-sorted array, which would wrongly treat an archived row as the
-            // predecessor of a live row that was actually appended (and correctly
-            // chained to the live tail) well after that row was archived.
-            const archived = this.db.prepare('SELECT * FROM witness_chain_archive ORDER BY id ASC').all();
-            for (let i = 0; i < archived.length; i++) {
-                const current = archived[i];
-                if (!this.checkEntryLink(current, i > 0 ? archived[i - 1] : undefined)) {
-                    return { valid: false, brokenAt: current.id, entriesChecked: entriesChecked + i + 1, signatureFailures };
-                }
-                checkSignature(current);
-            }
-            entriesChecked += archived.length;
-        }
-        const valid = signatureFailures === 0;
-        return {
-            valid, entriesChecked, signatureFailures,
-            ...(signatureFailures > 0 ? { brokenAt: live[0].id } : {}),
-        };
+        return verifyWitnessChain(this.db, this.keyManager, options);
     }
     /** Query entries with optional filters. */
     getEntries(filter) {
@@ -330,5 +240,5 @@ export function createWitnessChain(db, keyManager) {
 export function _resetWitnessChainForTests() {
     _instance = null;
 }
-export { GENESIS_PREV_HASH, sha256, shake256, hashWith, serializeEntry };
+export { GENESIS_PREV_HASH, sha256, shake256, hashWith, serializeEntry, signaturePayload };
 //# sourceMappingURL=witness-chain.js.map

package/dist/audit/witness-findings.js

@@ -31,7 +31,10 @@ export function recordGateResult(chain, result, actor = DEFAULT_ACTOR) {
 export function verifyDeliveryChain(chain, opts) {
     const r = chain.verify({ checkSignatures: opts?.checkSignatures === true });
     if (!r.valid) {
-        throw new Error(`Witness delivery chain INVALID — tampering detected at entry ${r.brokenAt ?? '?'} (checked ${r.entriesChecked}). Delivered findings cannot be trusted.`);
+        const what = r.tampered
+            ? `tampering detected at entry ${r.tamperedAt ?? r.brokenAt ?? '?'}`
+            : `${r.forks.length - r.acknowledgedForks.length} unacknowledged fork(s), first at entry ${r.brokenAt ?? '?'}`;
+        throw new Error(`Witness delivery chain INVALID — ${what} (checked ${r.entriesChecked}). Delivered findings cannot be trusted.`);
     }
     if (opts?.checkSignatures && (r.signatureFailures ?? 0) > 0) {
         throw new Error(`Witness delivery chain has ${r.signatureFailures} signature failure(s) — provenance unverifiable.`);

package/dist/cli/bundle.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.5");process.exit(0)}
-import{b as v}from"./chunks/chunk-SQF6HRXR.js";import{b as w,c as C,e as k}from"./chunks/chunk-IUHB5GVS.js";import{a as h}from"./chunks/chunk-XEZIIQYJ.js";import{a as z}from"./chunks/chunk-J27F4NSB.js";import"./chunks/chunk-7CD7PBHY.js";import{a as f,c as q}from"./chunks/chunk-J5UNP6W3.js";import{Q as y,S as Q}from"./chunks/chunk-WJHWH5D2.js";import"./chunks/chunk-JSZ663MU.js";q();Q();import{createRequire as R}from"node:module";import{Command as O}from"commander";import l from"chalk";z();function E(e,a,c,i){let m=e.command(a).description(c);if(i)for(let u of i)m.alias(u);return m.helpOption(!1),m.allowUnknownOption(!0),m.allowExcessArguments(!0),m}function A(e,a){let c=e.commands,i=c.indexOf(a);i>=0&&c.splice(i,1)}function n(e,a){let c=E(e,a.name,a.description,a.aliases);c.action(async()=>{try{let i=await a.factory();A(e,c),e.addCommand(i),await e.parseAsync(process.argv)}catch(i){console.error(`Failed to load command '${a.name}':`,i instanceof Error?i.message:i),process.exit(1)}})}function d(e,a,c,i,m,u){let g=E(e,a,c,u);g.action(async()=>{try{let p=await i();A(e,g),p.register(e,m),await e.parseAsync(process.argv)}catch(p){console.error(`Failed to load command '${a}':`,p instanceof Error?p.message:p),process.exit(1)}})}k();var t={kernel:null,queen:null,router:null,workflowOrchestrator:null,scheduledWorkflows:new Map,persistentScheduler:null,initialized:!1};function L(e,a){let c=e.getDomainAPI("visual-accessibility");if(c?.registerWorkflowActions)try{c.registerWorkflowActions(a)}catch(m){console.error(l.yellow(`  Warning: Could not register visual-accessibility workflow actions: ${f(m)}`))}let i=e.getDomainAPI("requirements-validation");if(i?.registerWorkflowActions)try{i.registerWorkflowActions(a)}catch(m){console.error(l.yellow(`  Warning: Could not register requirements-validation workflow actions: ${f(m)}`))}}async function V(){let{QEKernelImpl:e}=await import("./chunks/kernel-DV5MTNZD.js"),{CrossDomainEventRouter:a}=await import("./chunks/cross-domain-router-ODU5IZD6.js"),{DefaultProtocolExecutor:c}=await import("./chunks/protocol-executor-GEVH5KD6.js"),{WorkflowOrchestrator:i}=await import("./chunks/workflow-orchestrator-UKSIDM7Q.js"),{createQueenCoordinator:m}=await import("./chunks/queen-coordinator-F7E3AS26.js"),{createPersistentScheduler:u}=await import("./chunks/scheduler-SQS2CZFZ.js"),{loadCLIDomainPlugins:g}=await import("./chunks/domain-plugins-H6IZ5USZ.js");t.kernel=new e({maxConcurrentAgents:15,memoryBackend:"sqlite",hnswEnabled:!0,lazyLoading:!0,enabledDomains:[...h],enableExperienceBridge:!1}),await t.kernel.initialize();let p=await g(t.kernel.plugins);t.router=new a(t.kernel.eventBus),await t.router.initialize();let S=D=>t.kernel.getDomainAPI(D),b=new c(t.kernel.eventBus,t.kernel.memory,S);t.workflowOrchestrator=new i(t.kernel.eventBus,t.kernel.memory,t.kernel.coordinator),await t.workflowOrchestrator.initialize(),L(t.kernel,t.workflowOrchestrator),t.persistentScheduler=u(),t.queen=m(t.kernel,t.router,b,void 0,p),await t.queen.initialize();let{adoptExternalFleet:x}=await import("./chunks/core-handlers-UEXO3VAA.js");x({kernel:t.kernel,queen:t.queen,router:t.router,workflowOrchestrator:t.workflowOrchestrator}),t.initialized=!0}async function P(){if(t.initialized&&t.kernel&&t.queen)return!0;let e=await import("fs"),a=await import("path"),{findProjectRoot:c}=await import("./chunks/project-root-LNOYVTYY.js"),i=a.join(c(),".agentic-qe");return e.existsSync(i)?s():(console.error(l.red(`
-Error: AQE system not initialized in this directory.`)),console.log(l.yellow("Run `aqe init` first to set up this project.\n")),process.exitCode=1,!1)}async function s(){if(t.initialized&&t.kernel&&t.queen)return!0;let e=C(1);e&&process.stderr.write(l.gray("Auto-initializing v3 system...")+`
-`);let a=3e4,c=new Promise((i,m)=>{setTimeout(()=>m(new Error("Initialization timeout after 30 seconds")),a)});try{return await Promise.race([V(),c]),e&&process.stderr.write(l.green("System ready")+`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.7");process.exit(0)}
+import{b as A}from"./chunks/chunk-NHUGHAY6.js";import{b as k,c as E,e as v}from"./chunks/chunk-OAZX6WFU.js";import{a as w}from"./chunks/chunk-Y6AKKQIQ.js";import{b as y,c as M}from"./chunks/chunk-PELENDDQ.js";import{a as V}from"./chunks/chunk-TW3SR4TS.js";import{b as C,c as O}from"./chunks/chunk-5GFKTJ65.js";import"./chunks/chunk-5D7ZFWDS.js";import{a as g,e as R}from"./chunks/chunk-ZUOVNFXK.js";import{Q as h,S as z}from"./chunks/chunk-AEUEMVJK.js";import"./chunks/chunk-YO4ESCB4.js";R();z();import{createRequire as _}from"node:module";import{Command as T}from"commander";import l from"chalk";V();O();function L(e,a,c,i){let m=e.command(a).description(c);if(i)for(let u of i)m.alias(u);return m.helpOption(!1),m.allowUnknownOption(!0),m.allowExcessArguments(!0),m}function I(e,a){let c=e.commands,i=c.indexOf(a);i>=0&&c.splice(i,1)}function n(e,a){let c=L(e,a.name,a.description,a.aliases);c.action(async()=>{try{let i=await a.factory();I(e,c),e.addCommand(i),await e.parseAsync(process.argv)}catch(i){console.error(`Failed to load command '${a.name}':`,i instanceof Error?i.message:i),process.exit(1)}})}function d(e,a,c,i,m,u){let f=L(e,a,c,u);f.action(async()=>{try{let p=await i();I(e,f),p.register(e,m),await e.parseAsync(process.argv)}catch(p){console.error(`Failed to load command '${a}':`,p instanceof Error?p.message:p),process.exit(1)}})}M();v();var t={kernel:null,queen:null,router:null,workflowOrchestrator:null,scheduledWorkflows:new Map,persistentScheduler:null,initialized:!1};function P(e,a){let c=e.getDomainAPI("visual-accessibility");if(c?.registerWorkflowActions)try{c.registerWorkflowActions(a)}catch(m){console.error(l.yellow(`  Warning: Could not register visual-accessibility workflow actions: ${g(m)}`))}let i=e.getDomainAPI("requirements-validation");if(i?.registerWorkflowActions)try{i.registerWorkflowActions(a)}catch(m){console.error(l.yellow(`  Warning: Could not register requirements-validation workflow actions: ${g(m)}`))}}async function H(){let{QEKernelImpl:e}=await import("./chunks/kernel-MISPSPPA.js"),{CrossDomainEventRouter:a}=await import("./chunks/cross-domain-router-JCQ7SWDP.js"),{DefaultProtocolExecutor:c}=await import("./chunks/protocol-executor-AD5A4DAI.js"),{WorkflowOrchestrator:i}=await import("./chunks/workflow-orchestrator-H6G65YKU.js"),{createQueenCoordinator:m}=await import("./chunks/queen-coordinator-HQRHLIJX.js"),{createPersistentScheduler:u}=await import("./chunks/scheduler-5ZTEPNDD.js"),{loadCLIDomainPlugins:f}=await import("./chunks/domain-plugins-GQ3V5X6L.js");t.kernel=new e({maxConcurrentAgents:15,memoryBackend:"sqlite",hnswEnabled:!0,lazyLoading:!0,enabledDomains:[...w],enableExperienceBridge:!1}),await t.kernel.initialize();let p=await f(t.kernel.plugins);t.router=new a(t.kernel.eventBus),await t.router.initialize();let x=Q=>t.kernel.getDomainAPI(Q),D=new c(t.kernel.eventBus,t.kernel.memory,x);t.workflowOrchestrator=new i(t.kernel.eventBus,t.kernel.memory,t.kernel.coordinator),await t.workflowOrchestrator.initialize(),P(t.kernel,t.workflowOrchestrator),t.persistentScheduler=u(),t.queen=m(t.kernel,t.router,D,void 0,p),await t.queen.initialize();let{adoptExternalFleet:q}=await import("./chunks/core-handlers-C3H2ZCS2.js");q({kernel:t.kernel,queen:t.queen,router:t.router,workflowOrchestrator:t.workflowOrchestrator}),t.initialized=!0}async function S(){if(t.initialized&&t.kernel&&t.queen)return!0;let e=await import("fs"),a=await import("path"),{findProjectRoot:c}=await import("./chunks/project-root-BSNZC243.js"),i=a.join(c(),".agentic-qe");return e.existsSync(i)?s():(console.error(l.red(`
+Error: AQE system not initialized in this directory.`)),console.log(l.yellow("Run `aqe init` first to set up this project.\n")),process.exitCode=1,!1)}async function s(){if(t.initialized&&t.kernel&&t.queen)return!0;let e=E(1);e&&process.stderr.write(l.gray("Auto-initializing v3 system...")+`
+`);let a=3e4,c=new Promise((i,m)=>{setTimeout(()=>m(new Error("Initialization timeout after 30 seconds")),a)});try{return await Promise.race([H(),c]),e&&process.stderr.write(l.green("System ready")+`
 
-`),!0}catch(i){return i.message.includes("timeout")?(console.error(l.red("Initialization timed out after 30 seconds.")),console.log(l.yellow("Try running `aqe init` manually."))):(console.error(l.red("Failed to auto-initialize:"),i),console.log(l.yellow("Try running `aqe init` manually."))),process.exitCode=1,!1}}async function o(e=0){try{t.workflowOrchestrator&&t.workflowOrchestrator.dispose().catch(()=>{}),t.queen&&t.queen.dispose().catch(()=>{}),t.router&&t.router.dispose().catch(()=>{}),t.kernel&&t.kernel.dispose().catch(()=>{})}catch{}process.exit(e)}var r=new O,_=R(import.meta.url),Y=_("../../package.json").version,I="3.14.5";r.name("aqe").description("Agentic QE - Domain-Driven Quality Engineering").version(I).addHelpText("after",`
+`),!0}catch(i){return i.message.includes("timeout")?(console.error(l.red("Initialization timed out after 30 seconds.")),console.log(l.yellow("Try running `aqe init` manually."))):(console.error(l.red("Failed to auto-initialize:"),i),console.log(l.yellow("Try running `aqe init` manually."))),process.exitCode=1,!1}}async function o(e=0){try{t.workflowOrchestrator&&t.workflowOrchestrator.dispose().catch(()=>{}),t.queen&&t.queen.dispose().catch(()=>{}),t.router&&t.router.dispose().catch(()=>{}),t.kernel&&t.kernel.dispose().catch(()=>{})}catch{}process.exit(e)}var r=new T,F=_(import.meta.url),te=F("../../package.json").version,b="3.14.7";r.name("aqe").description("Agentic QE - Domain-Driven Quality Engineering").version(b).addHelpText("after",`
 Environment:
   AQE_LOG_LEVEL   Internal log level: debug | info | warn | error | silent (default: warn)
   LOG_LEVEL       Same as AQE_LOG_LEVEL; AQE_LOG_LEVEL takes precedence
   AQE_VERBOSE=1   Shorthand for info-level logging (full system-init output)
-Diagnostics are written to stderr; stdout carries command output only.`);r.hook("preAction",(e,a)=>{w(a.opts())});d(r,"init","Initialize the AQE v3 system",()=>import("./chunks/init-handler-5UIVOM7K.js").then(e=>e.createInitHandler(o)),t);d(r,"status","Show system status",()=>import("./chunks/status-handler-CPFTN4XL.js").then(e=>e.createStatusHandler(o,P)),t);d(r,"health","Check system health",()=>import("./chunks/status-handler-CPFTN4XL.js").then(e=>e.createHealthHandler(o,P)),t);d(r,"task","Manage QE tasks",()=>import("./chunks/task-handler-7H5OYJG4.js").then(e=>e.createTaskHandler(o,s)),t);d(r,"agent","Manage QE agents",()=>import("./chunks/agent-handler-V6CZ7Q6S.js").then(e=>e.createAgentHandler(o,s)),t);d(r,"domain","Domain operations",()=>import("./chunks/domain-handler-LBC3GJ7Z.js").then(e=>e.createDomainHandler(o,s)),t);d(r,"protocol","Execute coordination protocols",()=>import("./chunks/protocol-handler-CE3Q6LY4.js").then(e=>e.createProtocolHandler(o,s)),t);d(r,"brain","Export, import, and inspect QE brain state",()=>import("./chunks/brain-handler-GBY4EZ4P.js").then(e=>e.createBrainHandler(o,s)),t);d(r,"hypergraph","Query the code knowledge hypergraph",()=>import("./chunks/hypergraph-handler-QHF7NOU5.js").then(e=>e.createHypergraphHandler(o,s)),t,["hg"]);d(r,"heartbeat","Manage the token-free heartbeat scheduler",()=>import("./chunks/heartbeat-handler-6HVM6ZMR.js").then(e=>e.createHeartbeatHandler(o)),t);d(r,"routing","View routing performance, economics, and accuracy",()=>import("./chunks/routing-handler-6AENUIRG.js").then(e=>e.createRoutingHandler(o)),t);n(r,{name:"workflow",description:"Manage QE workflows and pipelines (ADR-041)",factory:()=>import("./chunks/workflow-TWOIA6LZ.js").then(e=>e.createWorkflowCommand(t,o,s))});n(r,{name:"test",description:"Test generation, execution, scheduling, and load testing",factory:()=>import("./chunks/test-MPHGT4T6.js").then(e=>e.createTestCommand(t,o,s))});n(r,{name:"coverage",description:"Coverage analysis shortcut",factory:()=>import("./chunks/coverage-NNWM7TX3.js").then(e=>e.createCoverageCommand(t,o,s))});n(r,{name:"quality",description:"Quality assessment shortcut",factory:()=>import("./chunks/quality-TT23JRFX.js").then(e=>e.createQualityCommand(t,o,s))});n(r,{name:"quality-gate",description:"Two-gate, three-valued quality verdict against a pinned checklist (ADR-119)",factory:()=>import("./chunks/quality-gate-PPPRP255.js").then(e=>e.createQualityGateCommand(t,o,s))});n(r,{name:"security",description:"Security scanning and URL validation",factory:()=>import("./chunks/security-325A7FMB.js").then(e=>e.createSecurityCommand(t,o,s))});n(r,{name:"arena",description:"Competitive test-strategy tournaments (ADR-104)",factory:()=>import("./chunks/arena-4UPAEHFT.js").then(e=>e.createArenaCommand(t,o,s))});n(r,{name:"code",description:"Code intelligence analysis",factory:()=>import("./chunks/code-JWXJMYXB.js").then(e=>e.createCodeCommand(t,o,s))});n(r,{name:"completions",description:"Generate shell completions for aqe",factory:()=>import("./chunks/completions-A55NCTAO.js").then(e=>e.createCompletionsCommand(o))});n(r,{name:"upgrade",description:"Detect optional native bindings and recommend install / flag changes",factory:()=>import("./chunks/upgrade-UJBJ5AYM.js").then(e=>e.createUpgradeCommand(o))});n(r,{name:"fleet",description:"Fleet operations with multi-agent progress tracking",factory:()=>import("./chunks/fleet-ZIQCAZ2Y.js").then(e=>e.createFleetCommand(t,o,s,L))});n(r,{name:"validate",description:"Validation commands for skills and agents",factory:()=>import("./chunks/validate-swarm-IVEVMGVM.js").then(e=>e.createValidateSwarmCommand(t,o,s))});n(r,{name:"skill",description:"Skill validation and reporting (ADR-056)",factory:()=>import("./chunks/validate-RUV6YMWS.js").then(e=>e.createValidateCommand(t,o,s))});n(r,{name:"eval",description:"Run skill evaluation suites in parallel",factory:()=>import("./chunks/eval-DZU2KISM.js").then(e=>e.createEvalCommand())});n(r,{name:"ci",description:"CI/CD pipeline orchestration",factory:()=>import("./chunks/ci-RACDAJMR.js").then(e=>e.createCICommand(t,o,s))});n(r,{name:"token-usage",description:"View and analyze token consumption metrics (ADR-042)",factory:()=>import("./chunks/token-usage-EBXUJNRB.js").then(e=>e.createTokenUsageCommand())});n(r,{name:"llm",description:"LLM Router management (ADR-043)",factory:()=>import("./chunks/llm-router-NKF7J3RI.js").then(e=>e.createLLMRouterCommand())});n(r,{name:"sync",description:"Sync local learning data to cloud PostgreSQL",factory:()=>import("./chunks/sync-EE4VVKOW.js").then(e=>e.createSyncCommands())});n(r,{name:"hooks",description:"Self-learning QE hooks for pattern recognition and guidance",factory:()=>import("./chunks/hooks-QHH6FVO4.js").then(e=>e.createHooksCommand())});n(r,{name:"learning",description:"AQE self-learning system management (standalone, no claude-flow required)",factory:()=>import("./chunks/learning-STE5W6BS.js").then(e=>e.createLearningCommand())});n(r,{name:"memory",description:"Memory store, retrieve, search, and delete operations",factory:()=>Promise.all([import("./chunks/memory-WRFZKG56.js"),import("./chunks/standalone-memory-UD4MJ6GZ.js")]).then(([e,a])=>e.createMemoryCommand(t,o,a.createEnsureMemoryBackend(t)))});n(r,{name:"mcp",description:"Start the MCP protocol server for Claude Code integration",factory:()=>import("./chunks/mcp-JGSFCEMH.js").then(e=>e.createMcpCommand())});n(r,{name:"platform",description:"Manage coding agent platform configurations",factory:()=>import("./chunks/platform-ANGBFWBV.js").then(e=>e.createPlatformCommand())});n(r,{name:"prove",description:"Generate a verifiable Proof-of-Quality attestation",factory:()=>import("./chunks/prove-7XPN53PY.js").then(e=>e.createProveCommand(t,o,s))});n(r,{name:"ruvector",description:"RuVector integration management",factory:()=>import("./chunks/ruvector-commands-5AWMEV34.js").then(e=>e.createRuVectorCommand())});n(r,{name:"audit",description:"Witness chain audit trail management",factory:()=>import("./chunks/audit-CVZQMF55.js").then(e=>e.createAuditCommand(t,o,s))});n(r,{name:"pipeline",description:"Manage YAML deterministic pipelines (Imp-9)",factory:()=>import("./chunks/pipeline-OWAHDUAQ.js").then(e=>e.createPipelineCommand(t,o,s))});n(r,{name:"plugin",description:"Manage external QE domain plugins",factory:()=>import("./chunks/plugin-OO7ON2YW.js").then(e=>e.createPluginCommand())});n(r,{name:"daemon",description:"Manage the QE Quality Daemon",factory:()=>import("./chunks/daemon-T4JO4IXP.js").then(e=>e.createDaemonCommand())});process.on("SIGINT",async()=>{console.log(l.yellow(`
+Diagnostics are written to stderr; stdout carries command output only.`);r.hook("preAction",(e,a)=>{k(a.opts())});d(r,"init","Initialize the AQE v3 system",()=>import("./chunks/init-handler-ENJ5ONJX.js").then(e=>e.createInitHandler(o)),t);d(r,"status","Show system status",()=>import("./chunks/status-handler-EXRKETV7.js").then(e=>e.createStatusHandler(o,S)),t);d(r,"health","Check system health",()=>import("./chunks/status-handler-EXRKETV7.js").then(e=>e.createHealthHandler(o,S)),t);d(r,"task","Manage QE tasks",()=>import("./chunks/task-handler-LYQ6WYUY.js").then(e=>e.createTaskHandler(o,s)),t);d(r,"agent","Manage QE agents",()=>import("./chunks/agent-handler-MGZCWHIY.js").then(e=>e.createAgentHandler(o,s)),t);d(r,"domain","Domain operations",()=>import("./chunks/domain-handler-L3CLNL7U.js").then(e=>e.createDomainHandler(o,s)),t);d(r,"protocol","Execute coordination protocols",()=>import("./chunks/protocol-handler-JDSSC2SF.js").then(e=>e.createProtocolHandler(o,s)),t);d(r,"brain","Export, import, and inspect QE brain state",()=>import("./chunks/brain-handler-SD63KOQ6.js").then(e=>e.createBrainHandler(o,s)),t);d(r,"hypergraph","Query the code knowledge hypergraph",()=>import("./chunks/hypergraph-handler-VOWO5ZTW.js").then(e=>e.createHypergraphHandler(o,s)),t,["hg"]);d(r,"heartbeat","Manage the token-free heartbeat scheduler",()=>import("./chunks/heartbeat-handler-U7XENHRR.js").then(e=>e.createHeartbeatHandler(o)),t);d(r,"routing","View routing performance, economics, and accuracy",()=>import("./chunks/routing-handler-UYDC5MMD.js").then(e=>e.createRoutingHandler(o)),t);n(r,{name:"workflow",description:"Manage QE workflows and pipelines (ADR-041)",factory:()=>import("./chunks/workflow-2RBDOM7V.js").then(e=>e.createWorkflowCommand(t,o,s))});n(r,{name:"test",description:"Test generation, execution, scheduling, and load testing",factory:()=>import("./chunks/test-WRHZMUCW.js").then(e=>e.createTestCommand(t,o,s))});n(r,{name:"coverage",description:"Coverage analysis shortcut",factory:()=>import("./chunks/coverage-NUPP6KZZ.js").then(e=>e.createCoverageCommand(t,o,s))});n(r,{name:"quality",description:"Quality assessment shortcut",factory:()=>import("./chunks/quality-SXWGYRQR.js").then(e=>e.createQualityCommand(t,o,s))});n(r,{name:"quality-gate",description:"Two-gate, three-valued quality verdict against a pinned checklist (ADR-119)",factory:()=>import("./chunks/quality-gate-GYNCA4ZY.js").then(e=>e.createQualityGateCommand(t,o,s))});n(r,{name:"security",description:"Security scanning and URL validation",factory:()=>import("./chunks/security-YKB622PK.js").then(e=>e.createSecurityCommand(t,o,s))});n(r,{name:"arena",description:"Competitive test-strategy tournaments (ADR-104)",factory:()=>import("./chunks/arena-YSWTKBCL.js").then(e=>e.createArenaCommand(t,o,s))});n(r,{name:"code",description:"Code intelligence analysis",factory:()=>import("./chunks/code-XMBLI7OF.js").then(e=>e.createCodeCommand(t,o,s))});n(r,{name:"completions",description:"Generate shell completions for aqe",factory:()=>import("./chunks/completions-2A3WRXY2.js").then(e=>e.createCompletionsCommand(o))});n(r,{name:"upgrade",description:"Detect optional native bindings and recommend install / flag changes",factory:()=>import("./chunks/upgrade-4BGOU5RM.js").then(e=>e.createUpgradeCommand(o))});n(r,{name:"fleet",description:"Fleet operations with multi-agent progress tracking",factory:()=>import("./chunks/fleet-E6WTXWFL.js").then(e=>e.createFleetCommand(t,o,s,P))});n(r,{name:"validate",description:"Validation commands for skills and agents",factory:()=>import("./chunks/validate-swarm-VI72CPR7.js").then(e=>e.createValidateSwarmCommand(t,o,s))});n(r,{name:"skill",description:"Skill validation and reporting (ADR-056)",factory:()=>import("./chunks/validate-EDWAR63H.js").then(e=>e.createValidateCommand(t,o,s))});n(r,{name:"eval",description:"Run skill evaluation suites in parallel",factory:()=>import("./chunks/eval-3B7UIYGY.js").then(e=>e.createEvalCommand())});n(r,{name:"ci",description:"CI/CD pipeline orchestration",factory:()=>import("./chunks/ci-J3TDK5RA.js").then(e=>e.createCICommand(t,o,s))});n(r,{name:"token-usage",description:"View and analyze token consumption metrics (ADR-042)",factory:()=>import("./chunks/token-usage-M7RRDPXO.js").then(e=>e.createTokenUsageCommand())});n(r,{name:"llm",description:"LLM Router management (ADR-043)",factory:()=>import("./chunks/llm-router-YWTARCCT.js").then(e=>e.createLLMRouterCommand())});n(r,{name:"sync",description:"Sync local learning data to cloud PostgreSQL",factory:()=>import("./chunks/sync-UW7SX7GO.js").then(e=>e.createSyncCommands())});n(r,{name:"hooks",description:"Self-learning QE hooks for pattern recognition and guidance",factory:()=>import("./chunks/hooks-F3O2SB6H.js").then(e=>e.createHooksCommand())});n(r,{name:"learning",description:"AQE self-learning system management (standalone, no claude-flow required)",factory:()=>import("./chunks/learning-YMLCVFUT.js").then(e=>e.createLearningCommand())});n(r,{name:"memory",description:"Memory store, retrieve, search, and delete operations",factory:()=>Promise.all([import("./chunks/memory-3L3O6JMM.js"),import("./chunks/standalone-memory-2DOABVLC.js")]).then(([e,a])=>e.createMemoryCommand(t,o,a.createEnsureMemoryBackend(t)))});n(r,{name:"mcp",description:"Start the MCP protocol server for Claude Code integration",factory:()=>import("./chunks/mcp-5PSGIUCW.js").then(e=>e.createMcpCommand())});n(r,{name:"platform",description:"Manage coding agent platform configurations",factory:()=>import("./chunks/platform-GK7ZVDJI.js").then(e=>e.createPlatformCommand())});n(r,{name:"prove",description:"Generate a verifiable Proof-of-Quality attestation",factory:()=>import("./chunks/prove-ANPTOZJE.js").then(e=>e.createProveCommand(t,o,s))});n(r,{name:"ruvector",description:"RuVector integration management",factory:()=>import("./chunks/ruvector-commands-QXADPVEY.js").then(e=>e.createRuVectorCommand())});n(r,{name:"audit",description:"Witness chain audit trail management",factory:()=>import("./chunks/audit-LVU76QGA.js").then(e=>e.createAuditCommand(t,o,s))});n(r,{name:"pipeline",description:"Manage YAML deterministic pipelines (Imp-9)",factory:()=>import("./chunks/pipeline-BGFEHXIN.js").then(e=>e.createPipelineCommand(t,o,s))});n(r,{name:"plugin",description:"Manage external QE domain plugins",factory:()=>import("./chunks/plugin-CAH2CKI6.js").then(e=>e.createPluginCommand())});n(r,{name:"daemon",description:"Manage the QE Quality Daemon",factory:()=>import("./chunks/daemon-D662EX5N.js").then(e=>e.createDaemonCommand())});process.on("SIGINT",async()=>{y("SIGINT")||(console.log(l.yellow(`
 
 Shutting down...`)),console.log(l.green(`Shutdown complete
-`)),await o(0)});process.on("SIGTERM",async()=>{console.log(l.yellow(`
-Received SIGTERM, shutting down gracefully...`)),await o(0)});async function M(){let{isVersionFastPath:e}=await import("./chunks/fast-paths-2KLDUWCY.js");e(process.argv)&&(console.log(I),process.exit(0)),y();let a=process.argv.slice(2).filter(i=>i!=="--");if(!(a[0]==="learning"&&(a[1]==="backup"||a[1]==="restore"))){let{bootstrapTokenTracking:i}=await import("./chunks/token-bootstrap-SSDCYEKK.js");await i({enableOptimization:!0,enablePersistence:!0,verbose:process.env.AQE_VERBOSE==="true"})}await r.parseAsync(),!v()&&await o(process.exitCode??0)}M().catch(async e=>{console.error(l.red("Fatal error:"),e),await o(1)});
+`)),await o(0))});process.on("SIGTERM",async()=>{y("SIGTERM")||(console.log(l.yellow(`
+Received SIGTERM, shutting down gracefully...`)),await o(0))});async function G(){let{isVersionFastPath:e}=await import("./chunks/fast-paths-QOSAEPYD.js");e(process.argv)&&(console.log(b),process.exit(0)),h();let a=process.argv.slice(2).filter(i=>i!=="--");if(!(a[0]==="learning"&&(a[1]==="backup"||a[1]==="restore"))){let{bootstrapTokenTracking:i}=await import("./chunks/token-bootstrap-23SA6SWZ.js");await i({enableOptimization:!0,enablePersistence:!0,verbose:process.env.AQE_VERBOSE==="true"})}await r.parseAsync(),!A()&&await o(process.exitCode??0)}G().catch(async e=>{console.error(l.red("Fatal error:"),C(e)),await o(1)});

package/dist/cli/chunks/adapter-TVQKH65T.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.7");process.exit(0)}
+import{a,b,c}from"./chunk-ROVZSZCS.js";import"./chunk-RC2A4JZ5.js";import"./chunk-JOZ47MV6.js";import"./chunk-OIDWDGLG.js";import"./chunk-ZUOVNFXK.js";import"./chunk-YO4ESCB4.js";export{a as AgentBoosterAdapter,b as createAgentBoosterAdapter,c as createAgentBoosterAdapterSync};