agentic-qe 3.15.10 → 3.15.12

package/dist/mcp/handlers/task-handlers.d.ts

@@ -8,7 +8,9 @@
 import { ToolResult, TaskSubmitParams, TaskSubmitResult, TaskListParams, TaskStatusParams, TaskStatusResult, TaskCancelParams } from '../types';
 import { TaskType } from '../../coordination/queen-coordinator';
 import { type RoutingLogEntry, type RoutingStats } from '../services/task-router';
+import type { ExperienceGuidanceStatus } from '../../integrations/agentic-flow/reasoning-bank/index.js';
 import type { ModelTier } from '../../integrations/agentic-flow';
+import { type Priority } from '../../shared/types/index.js';
 export declare function handleTaskSubmit(params: TaskSubmitParams): Promise<ToolResult<TaskSubmitResult>>;
 export declare function handleTaskList(params: TaskListParams): Promise<ToolResult<TaskStatusResult[]>>;
 export declare function handleTaskStatus(params: TaskStatusParams): Promise<ToolResult<TaskStatusResult>>;
@@ -20,7 +22,8 @@ export declare function handleTaskCancel(params: TaskCancelParams): Promise<Tool
 export interface TaskOrchestrateParams {
     task: string;
     strategy?: 'parallel' | 'sequential' | 'adaptive';
-    priority?: 'low' | 'medium' | 'high' | 'critical';
+    /** Named levels, or a canonical p0-p3 priority (p0 stays p0). */
+    priority?: 'low' | 'medium' | 'high' | 'critical' | Priority;
     maxAgents?: number;
     /** Manual tier override (0-4) */
     manualTier?: ModelTier;
@@ -35,6 +38,23 @@ export interface TaskOrchestrateParams {
         requirements?: string[];
     };
 }
+/**
+ * #1022: how learned patterns informed task_orchestrate.
+ * - 'vector': embedding similarity plus text matching
+ * - 'lexical-only': no working embedder (absent, or failed at runtime, #1187);
+ *   text matching only, no similarity
+ *   scores, and experience guidance unavailable
+ * - 'unavailable': the ReasoningBank could not start; no learned guidance
+ *
+ * #1204: `experienceGuidance` says the same for similar-experience guidance:
+ * 'unavailable' (with the reason) when its embedder failed or is absent.
+ * Omitted when experience replay is disabled or the ReasoningBank is down.
+ */
+export interface OrchestrateLearningStatus {
+    patternSearch: 'vector' | 'lexical-only' | 'unavailable';
+    reason?: string;
+    experienceGuidance?: ExperienceGuidanceStatus;
+}
 export interface TaskOrchestrateResult {
     taskId: string;
     /** The task type submitted to the domain. */
@@ -57,6 +77,8 @@ export interface TaskOrchestrateResult {
         rationale: string;
         decisionTimeMs: number;
     };
+    /** #1022: how learned patterns informed this orchestration */
+    learning: OrchestrateLearningStatus;
 }
 export declare function handleTaskOrchestrate(params: TaskOrchestrateParams): Promise<ToolResult<TaskOrchestrateResult>>;
 export interface ModelRouteParams {

package/dist/mcp/handlers/task-handlers.js

@@ -13,6 +13,7 @@ import { toErrorMessage } from '../../shared/error-utils.js';
 import { ALL_DOMAINS, invalidPriorityMessage, isDomainName, isPriority } from '../../shared/types/index.js';
 import { validateIndexPaths, validateIndexTaskPayload } from '../../domains/code-intelligence/index-path-guard.js';
 import { routeInferredTask } from './orchestrate-routes.js';
+import { getTaskExecutor } from './handler-factory.js';
 // ============================================================================
 // Task Type to Workflow Mapping (Issue #206)
 // Maps TaskTypes to their associated workflow IDs for auto-execution
@@ -111,6 +112,11 @@ export async function handleTaskList(params) {
             error: 'Fleet not initialized. Call fleet_init first.',
         };
     }
+    // A priority outside the allowed set is an error, not an empty list.
+    // Parity with `aqe task list --priority`.
+    if (params.priority !== undefined && !isPriority(params.priority)) {
+        return { success: false, error: invalidPriorityMessage(params.priority) };
+    }
     const { queen } = getFleetState();
     try {
         const tasks = queen.listTasks({
@@ -232,6 +238,56 @@ export async function handleTaskCancel(params) {
         };
     }
 }
+/**
+ * #1022: gather experience guidance and pattern hints for task_orchestrate.
+ * Learned guidance is optional: a missing embedder, or a ReasoningBank that
+ * cannot start, must not fail the orchestration. The returned status says
+ * which kind of matching produced the hints.
+ */
+async function getOrchestrateLearningContext(task, guidanceDomain, patternDomain) {
+    let service;
+    try {
+        service = await getReasoningBankService();
+    }
+    catch (error) {
+        return {
+            experienceGuidance: null,
+            patternHintMatches: [],
+            learning: { patternSearch: 'unavailable', reason: toErrorMessage(error) },
+        };
+    }
+    // #1204: a background embedder retry can finish while this call runs.
+    // Report vector matching only if the embedder was usable for the whole
+    // call, so hints found by text alone are never labelled vector.
+    const patternStatusBefore = service.getPatternSearchStatus();
+    const experienceStatusBefore = service.getExperienceGuidanceStatus();
+    const experienceGuidance = await service.getExperienceGuidance(task, guidanceDomain);
+    // Bring HNSW A (qe_patterns) into the routing decision alongside HNSW C
+    // (experienceGuidance). Without this, only past trajectories influenced
+    // routing — the catalog of consolidated long-term patterns was never
+    // consulted for new tasks. Fail-soft: empty array on error.
+    const patternHintMatches = await service
+        .searchPatternMatches(task, { limit: 5, domain: patternDomain })
+        .catch(() => []);
+    const status = notVectorIfEither(patternStatusBefore, service.getPatternSearchStatus());
+    const experienceStatusAfter = service.getExperienceGuidanceStatus();
+    const experienceStatus = experienceStatusBefore && experienceStatusAfter
+        ? notVectorIfEither(experienceStatusBefore, experienceStatusAfter)
+        : experienceStatusAfter;
+    return {
+        experienceGuidance,
+        patternHintMatches,
+        learning: {
+            patternSearch: status.mode,
+            ...(status.reason ? { reason: status.reason } : {}),
+            ...(experienceStatus ? { experienceGuidance: experienceStatus } : {}),
+        },
+    };
+}
+/** #1204: the status before the call unless it was vector; otherwise the one after. */
+function notVectorIfEither(before, after) {
+    return before.mode === 'vector' ? after : before;
+}
 export async function handleTaskOrchestrate(params) {
     if (!isFleetInitialized()) {
         return {
@@ -247,6 +303,11 @@ export async function handleTaskOrchestrate(params) {
             return { success: false, error: filePaths.error.message };
         }
     }
+    // #1117: an unrecognised priority used to fall through to p1 (and a
+    // requested p0 was downgraded). Reject it up front, as task_submit does.
+    if (params.priority !== undefined && mapPriority(params.priority) === undefined) {
+        return { success: false, error: invalidOrchestratePriorityMessage(params.priority) };
+    }
     const { queen, workflowOrchestrator } = getFleetState();
     try {
         // ADR-051: Route task to optimal model tier BEFORE execution
@@ -270,21 +331,10 @@ export async function handleTaskOrchestrate(params) {
             },
         });
         // INTEGRATION FIX: Get ReasoningBank guidance for the task
-        const reasoningBankService = await getReasoningBankService();
-        const experienceGuidance = await reasoningBankService.getExperienceGuidance(params.task, params.context?.project);
-        // Bring HNSW A (qe_patterns) into the routing decision alongside HNSW C
-        // (experienceGuidance). Without this, only past trajectories influenced
-        // routing — the catalog of consolidated long-term patterns was never
-        // consulted for new tasks. Fail-soft: empty array on error.
-        const patternHintMatches = await reasoningBankService
-            .searchPatternMatches(params.task, {
-            limit: 5,
-            domain: params.context?.project ?? inferredDomain,
-        })
-            .catch(() => []);
+        const { experienceGuidance, patternHintMatches, learning } = await getOrchestrateLearningContext(params.task, params.context?.project, params.context?.project ?? inferredDomain);
         // Parse task description to determine task type
         const taskType = inferTaskType(params.task);
-        const priority = mapPriority(params.priority || 'medium');
+        const priority = mapPriority(params.priority ?? 'medium') ?? 'p2';
         // Issue #206: Check if this task type has an associated workflow
         const workflowId = TASK_WORKFLOW_MAP[taskType];
         if (workflowId && workflowOrchestrator) {
@@ -355,6 +405,7 @@ export async function handleTaskOrchestrate(params) {
                         rationale: routingResult.decision.rationale,
                         decisionTimeMs: routingResult.decision.metadata.decisionTimeMs,
                     },
+                    learning,
                 },
             };
         }
@@ -368,6 +419,9 @@ export async function handleTaskOrchestrate(params) {
         }
         const submitType = route.kind === 'route' ? route.type : taskType;
         const targetDomains = route.kind === 'route' ? [route.domain] : [];
+        // #1200: a caller-owned task runs through the MCP task executor, as the
+        // domain's own tool does; the Queen does not dispatch it.
+        const callerExecutor = route.kind === 'route' && route.executionOwner === 'caller' ? getTaskExecutor() : null;
         // #1081: the type must have a domain handler. Otherwise the Queen can
         // only fail the task at dispatch, so reject it here with the reason.
         const executable = queen.validateTaskExecutable(submitType, targetDomains);
@@ -401,6 +455,7 @@ export async function handleTaskOrchestrate(params) {
             Object.assign(taskPayload, route.payload);
         const result = await queen.submitTask({
             type: submitType,
+            ...(callerExecutor ? { executionOwner: 'caller' } : {}),
             priority,
             targetDomains,
             payload: {
@@ -446,13 +501,23 @@ export async function handleTaskOrchestrate(params) {
         }
         // INTEGRATION FIX: Start trajectory tracking for learning
         const taskId = result.value;
-        await startTaskTrajectory(taskId, params.task, {
-            agent: 'queen-coordinator',
-            domain: params.context?.project,
-        });
+        if (learning.patternSearch !== 'unavailable') {
+            await startTaskTrajectory(taskId, params.task, {
+                agent: 'queen-coordinator',
+                domain: params.context?.project,
+            });
+        }
         // Issue N1: Trajectory auto-close is handled by subscribeTrajectoryEvents(),
         // which listens for TaskCompleted/TaskFailed on the event router.
         // No per-task polling needed.
+        // #1200: run a caller-owned task after its trajectory started, without
+        // waiting: the executor's TaskCompleted / TaskFailed settle it for task_status.
+        const execution = callerExecutor ? queen.getTaskStatus(taskId) : undefined;
+        if (callerExecutor && execution) {
+            void callerExecutor.execute(execution.task).catch(error => {
+                console.error(`[TaskOrchestrate] Task ${taskId} failed to execute: ${toErrorMessage(error)}`);
+            });
+        }
         // Trajectory judge: opt-in LLM scoring of recent unscored trajectories.
         // Hook-created rows in qe_trajectories never receive feedback unless
         // something goes back and judges them. This catches up by scoring ≤5
@@ -485,6 +550,7 @@ export async function handleTaskOrchestrate(params) {
                     rationale: routingResult.decision.rationale,
                     decisionTimeMs: routingResult.decision.metadata.decisionTimeMs,
                 },
+                learning,
             },
         };
     }
@@ -742,7 +808,9 @@ function inferTaskType(description) {
     return 'generate-tests';
 }
 /**
- * Map priority string to Priority type
+ * Map a task_orchestrate priority to the canonical Priority type.
+ * Accepts the named levels and the canonical p0-p3 values; returns
+ * undefined for anything else so the caller can reject it (#1117).
  */
 function mapPriority(priority) {
     switch (priority) {
@@ -755,9 +823,12 @@ function mapPriority(priority) {
         case 'low':
             return 'p3';
         default:
-            return 'p1';
+            return isPriority(priority) ? priority : undefined;
     }
 }
+function invalidOrchestratePriorityMessage(value) {
+    return `${invalidPriorityMessage(value)} (or critical, high, medium, low)`;
+}
 /**
  * Record a task outcome for ReasoningBank learning
  * ADR-051: Enables cross-session learning from task execution

package/dist/mcp/handlers/validation-pipeline-handler.js

@@ -4,11 +4,11 @@
  * Exposes the structured 13-step requirements validation pipeline
  * as an MCP tool that users can invoke directly.
  */
-import { readFileSync, existsSync } from 'fs';
 import { runPipeline, formatPipelineReport } from '../../validation/pipeline.js';
 import { createRequirementsPipeline, REQUIREMENTS_VALIDATION_STEPS } from '../../validation/steps/requirements.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
 import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../shared/io/payload-path-guard.js';
+import { ConfinedReadError, readConfinedText } from '../../shared/io/confined-read.js';
 /**
  * Run the structured validation pipeline on a document.
  */
@@ -23,17 +23,17 @@ export async function handleValidationPipeline(params) {
         const confined = await requirePayloadPath('validation_pipeline', 'filePath', params.filePath, { allowMissing: true, maxBytes: MAX_PAYLOAD_FILE_BYTES });
         if (!confined.success)
             return { success: false, error: confined.error.message };
-        const absPath = confined.value;
-        if (!existsSync(absPath)) {
-            return {
-                success: false,
-                error: `File not found: ${params.filePath}`,
-            };
-        }
+        // #1161: read from the validated descriptor, not the name checked above.
         try {
-            content = readFileSync(absPath, 'utf-8');
+            content = await readConfinedText(confined.value, { maxBytes: MAX_PAYLOAD_FILE_BYTES });
         }
         catch (readErr) {
+            if (readErr instanceof ConfinedReadError && readErr.reason === 'not-found') {
+                return {
+                    success: false,
+                    error: `File not found: ${params.filePath}`,
+                };
+            }
             return {
                 success: false,
                 error: `Failed to read file: ${toErrorMessage(readErr)}`,

package/dist/mcp/protocol-server.js

@@ -627,7 +627,7 @@ export class MCPProtocolServer {
                 parameters: [
                     { name: 'topology', type: 'string', description: 'Swarm topology type', enum: ['hierarchical', 'mesh', 'ring', 'adaptive'] },
                     { name: 'maxAgents', type: 'number', description: 'Maximum number of agents', default: 15 },
-                    { name: 'enabledDomains', type: 'array', description: 'Domains to enable' },
+                    { name: 'enabledDomains', type: 'array', description: 'Domains to enable', items: { type: 'string' } },
                     { name: 'lazyLoading', type: 'boolean', description: 'Enable lazy loading', default: true },
                 ],
             },
@@ -669,7 +669,7 @@ export class MCPProtocolServer {
                 parameters: [
                     { name: 'type', type: 'string', description: 'Task type', required: true },
                     { name: 'priority', type: 'string', description: 'Task priority', enum: ['p0', 'p1', 'p2', 'p3'], default: 'p1' },
-                    { name: 'targetDomains', type: 'array', description: 'Target domains (e.g. ["coverage-analysis"]); unknown domains are rejected' },
+                    { name: 'targetDomains', type: 'array', description: 'Target domains (e.g. ["coverage-analysis"]); unknown domains are rejected', items: { type: 'string' } },
                     { name: 'payload', type: 'object', description: 'Task payload data' },
                 ],
             },
@@ -684,6 +684,8 @@ export class MCPProtocolServer {
                 isCacheable: false,
                 parameters: [
                     { name: 'status', type: 'string', description: 'Filter by status' },
+                    { name: 'priority', type: 'string', description: 'Filter by priority', enum: ['p0', 'p1', 'p2', 'p3'] },
+                    { name: 'domain', type: 'string', description: 'Filter by assigned domain' },
                     { name: 'limit', type: 'number', description: 'Maximum results', default: 50 },
                 ],
             },
@@ -722,6 +724,7 @@ export class MCPProtocolServer {
                     { name: 'task', type: 'string', description: 'Task description', required: true },
                     { name: 'strategy', type: 'string', description: 'Execution strategy', enum: ['parallel', 'sequential', 'adaptive'] },
                     { name: 'filePaths', type: 'array', description: 'Project files the task works on. A security scan or quality assessment runs on these files and is refused without them.', items: { type: 'string' } },
+                    { name: 'priority', type: 'string', description: 'Task priority (default: medium/p2)', enum: ['p0', 'p1', 'p2', 'p3', 'critical', 'high', 'medium', 'low'] },
                 ],
             },
             handler: (params) => handleTaskOrchestrate(params),
@@ -882,7 +885,7 @@ export class MCPProtocolServer {
                 description: `Execute test files in parallel with automatic retry on flaky failures. ${SAVE_RESULTS_HINT} Example: test_execute_parallel({ testFiles: ["tests/auth.test.ts"], parallel: true })`,
                 category: 'domain',
                 parameters: [
-                    { name: 'testFiles', type: 'array', description: 'Nonempty list of concrete test file paths (relative to the project working directory or absolute). Expand glob patterns before calling; glob patterns are rejected.' },
+                    { name: 'testFiles', type: 'array', description: 'Nonempty list of concrete test file paths (relative to the project working directory or absolute). Expand glob patterns before calling; glob patterns are rejected.', items: { type: 'string' } },
                     { name: 'parallel', type: 'boolean', description: 'Enable parallel execution', default: true },
                     saveResultsParameter('test_execute_parallel'),
                 ],
@@ -1110,7 +1113,7 @@ export class MCPProtocolServer {
                 category: 'memory',
                 parameters: [
                     { name: 'sourceAgentId', type: 'string', description: 'Source agent ID', required: true },
-                    { name: 'targetAgentIds', type: 'array', description: 'Target agent IDs', required: true },
+                    { name: 'targetAgentIds', type: 'array', description: 'Target agent IDs', required: true, items: { type: 'string' } },
                     { name: 'knowledgeDomain', type: 'string', description: 'Knowledge domain', required: true },
                 ],
             },
@@ -1127,7 +1130,7 @@ export class MCPProtocolServer {
                 parameters: [
                     { name: 'task', type: 'string', description: 'Task description to analyze', required: true },
                     { name: 'codeContext', type: 'string', description: 'Optional code context for complexity analysis' },
-                    { name: 'filePaths', type: 'array', description: 'Optional file paths involved' },
+                    { name: 'filePaths', type: 'array', description: 'Optional file paths involved', items: { type: 'string' } },
                     { name: 'manualTier', type: 'number', description: 'Manual tier override (0-4)' },
                     { name: 'isCritical', type: 'boolean', description: 'Mark as critical task (allows budget overrides)' },
                     { name: 'agentType', type: 'string', description: 'Agent type making the request' },
@@ -1194,7 +1197,7 @@ export class MCPProtocolServer {
                 description: 'Trigger infrastructure recovery for detected failures and optionally re-run affected tests. Example: infra_healing_recover({ services: ["postgres"], rerunTests: true })',
                 category: 'infra-healing',
                 parameters: [
-                    { name: 'services', type: 'array', description: 'Specific services to recover (empty = all failing)' },
+                    { name: 'services', type: 'array', description: 'Specific services to recover (empty = all failing)', items: { type: 'string' } },
                     { name: 'rerunTests', type: 'boolean', description: 'Re-run affected tests after recovery', default: true },
                 ],
             },
@@ -1283,7 +1286,7 @@ export class MCPProtocolServer {
                 category: 'cross-phase',
                 isConcurrencySafe: true,
                 parameters: [
-                    { name: 'signals', type: 'array', description: 'Signals to format', required: true },
+                    { name: 'signals', type: 'array', description: 'Signals to format', required: true, items: { type: 'object' } },
                 ],
             },
             handler: (params) => handleFormatSignals(params),
@@ -1309,7 +1312,7 @@ export class MCPProtocolServer {
                     { name: 'filePath', type: 'string', description: 'Path to the document to validate' },
                     { name: 'content', type: 'string', description: 'Inline content to validate (alternative to filePath)' },
                     { name: 'pipeline', type: 'string', description: 'Pipeline type (default: requirements)', default: 'requirements' },
-                    { name: 'steps', type: 'array', description: 'Specific step IDs to run (default: all 13)' },
+                    { name: 'steps', type: 'array', description: 'Specific step IDs to run (default: all 13)', items: { type: 'string' } },
                     { name: 'continueOnFailure', type: 'boolean', description: 'Continue past blocking failures', default: false },
                     { name: 'format', type: 'string', description: 'Output format: markdown or json', default: 'json' },
                 ],

package/dist/mcp/qe-tool-bridge.js

@@ -46,6 +46,9 @@ function schemaToParameters(tool) {
             required: requiredSet.has(name) || undefined,
             default: prop.default,
             enum: prop.enum,
+            // #1185: keep the element schema; clients such as VS Code Copilot
+            // reject a tool whose array parameter has no items.
+            items: prop.items,
         });
     }
     return params;

package/dist/mcp/services/reasoning-bank-service.d.ts

@@ -11,8 +11,8 @@
  * - Pattern evolution and consolidation
  * - Synchronous learning (no fire-and-forget)
  */
-import { type Trajectory, type TrajectoryStep as TrackerTrajectoryStep, type TrajectoryOptions, type ExperienceGuidance, type EnhancedReasoningBankAdapterStats } from '../../integrations/agentic-flow/reasoning-bank/index.js';
-import { type RealQERoutingRequest, type RealQERoutingResult, type RealQEReasoningBankStats, type RealQEPatternSearchResult } from '../../learning/real-qe-reasoning-bank.js';
+import { type Trajectory, type TrajectoryStep as TrackerTrajectoryStep, type TrajectoryOptions, type ExperienceGuidance, type ExperienceGuidanceStatus, type EnhancedReasoningBankAdapterStats } from '../../integrations/agentic-flow/reasoning-bank/index.js';
+import { type RealQERoutingRequest, type RealQERoutingResult, type RealQEReasoningBankStats, type PatternSearchStatus, type RealQEPatternSearchResult } from '../../learning/real-qe-reasoning-bank.js';
 import type { QEPattern, QEDomain } from '../../learning/qe-patterns.js';
 /**
  * Task outcome record for learning
@@ -208,6 +208,13 @@ export declare class ReasoningBankService {
         limit?: number;
         domain?: QEDomain;
     }): Promise<RealQEPatternSearchResult[]>;
+    /** #1022: whether pattern search uses vectors or text matching only. */
+    getPatternSearchStatus(): PatternSearchStatus;
+    /**
+     * #1204: whether similar-experience guidance can use vectors; null when
+     * experience replay is disabled or the service is disposed.
+     */
+    getExperienceGuidanceStatus(): ExperienceGuidanceStatus | null;
     /**
      * Get service statistics
      */

package/dist/mcp/services/reasoning-bank-service.js

@@ -515,6 +515,19 @@ export class ReasoningBankService {
             return [];
         }
     }
+    /** #1022: whether pattern search uses vectors or text matching only. */
+    getPatternSearchStatus() {
+        return this.enhancedAdapter.getPatternSearchStatus();
+    }
+    /**
+     * #1204: whether similar-experience guidance can use vectors; null when
+     * experience replay is disabled or the service is disposed.
+     */
+    getExperienceGuidanceStatus() {
+        if (!this.config.enableExperienceReplay || this.disposed)
+            return null;
+        return this.enhancedAdapter.getExperienceGuidanceStatus();
+    }
     /**
      * Get service statistics
      */

package/dist/mcp/tool-annotations.js

@@ -58,7 +58,10 @@ function conservativeDisposition() {
 export const BUILT_IN_TOOL_SAFETY_INVENTORY = Object.freeze(Object.fromEntries(BUILT_IN_TOOL_NAMES.map((name) => [name, conservativeDisposition()])));
 /** Resolve explicit metadata over inventory metadata over conservative defaults. */
 export function resolveToolAnnotations(name, annotations) {
-    const reviewedDisposition = BUILT_IN_TOOL_SAFETY_INVENTORY[name];
+    // #1157: own entries only; a tool named `constructor` is not in the inventory.
+    const reviewedDisposition = Object.hasOwn(BUILT_IN_TOOL_SAFETY_INVENTORY, name)
+        ? BUILT_IN_TOOL_SAFETY_INVENTORY[name]
+        : undefined;
     return Object.freeze({
         ...(reviewedDisposition?.annotations ?? CONSERVATIVE_TOOL_ANNOTATIONS),
         // Dynamic and plugin-supplied names cannot self-assert optimistic hints.

package/dist/mcp/tools/coherence/check.js

@@ -19,6 +19,7 @@ const COHERENCE_CHECK_SCHEMA = {
         nodes: {
             type: 'array',
             description: 'Array of nodes to check for coherence. Each node must have an id and embedding vector.',
+            items: { type: 'object', description: 'Node with id, embedding vector, optional weight and metadata' },
         },
         energyThreshold: {
             type: 'number',

package/dist/mcp/tools/coherence/consensus.js

@@ -54,11 +54,13 @@ const COHERENCE_CONSENSUS_SCHEMA = {
                     agentId: { type: 'string', description: 'Agent identifier', minLength: 1 },
                     agentType: { type: 'string', description: 'Agent type (default: worker)' },
                     // `verdict` may be a string, number, or boolean, which this schema
-                    // type cannot express; it is required below and checked in execute().
+                    // type cannot express. It is required, but checked in execute():
+                    // listing it in `required` without a property is invalid in strict
+                    // JSON Schema (#1185).
                     confidence: { type: 'number', description: 'Confidence in the verdict', minimum: 0, maximum: 1 },
                     reasoning: { type: 'string', description: 'Optional reasoning text' },
                 },
-                required: ['agentId', 'verdict', 'confidence'],
+                required: ['agentId', 'confidence'],
             },
         },
         confidenceThreshold: {

package/dist/mcp/tools/learning-optimization/optimize.js

@@ -318,6 +318,7 @@ export class LearningOptimizeTool extends MCPToolBase {
             // Not enough data - recommend default strategy
             const contextForRecommendation = {
                 tags: [targetDomain, objective.metric],
+                objective: { metric: objective.metric, direction: objective.direction },
             };
             const recommendResult = await metricsOptimizer.recommendStrategy(contextForRecommendation);
             if (!recommendResult.success)
@@ -362,7 +363,6 @@ export class LearningOptimizeTool extends MCPToolBase {
         let sourcePatterns = 0;
         let transferredPatterns = 0;
         let adaptedPatterns = 0;
-        let totalRelevance = 0;
         if (queryResult.success) {
             sourcePatterns = queryResult.value.length;
             // Transfer each piece of knowledge to target domain
@@ -370,7 +370,6 @@ export class LearningOptimizeTool extends MCPToolBase {
                 const transferResult = await transferSpecialist.transferKnowledge(knowledge, targetDomain);
                 if (transferResult.success) {
                     transferredPatterns++;
-                    totalRelevance += transferResult.value.relevanceScore;
                     // Count as adapted if relevance changed significantly
                     if (Math.abs(transferResult.value.relevanceScore - knowledge.relevanceScore) > 0.1) {
                         adaptedPatterns++;

package/dist/mcp/tools/mincut/index.js

@@ -39,10 +39,12 @@ export class MinCutHealthTool extends MCPToolBase {
                 agents: {
                     type: 'array',
                     description: 'Agent vertices to add to the graph before analysis',
+                    items: { type: 'object', description: 'Agent vertex { id, domain, weight? }' },
                 },
                 edges: {
                     type: 'array',
                     description: 'Edges to add between agents',
+                    items: { type: 'object', description: 'Edge { source, target, weight? }' },
                 },
                 includeWeakVertices: {
                     type: 'boolean',
@@ -210,6 +212,7 @@ export class MinCutStrengthenTool extends MCPToolBase {
                 targetVertices: {
                     type: 'array',
                     description: 'Specific vertices to strengthen',
+                    items: { type: 'string', description: 'Vertex ID' },
                 },
                 apply: {
                     type: 'boolean',

package/dist/mcp/tools/quality-assessment/gate.js

@@ -13,6 +13,8 @@ import { MCPToolBase } from '../base.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../../shared/io/payload-path-guard.js';
 import { findProjectRoot } from '../../../kernel/project-root.js';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
+import { parseAnchorSet } from '../../../validation/anchor-set.js';
 import { getLLMRouter } from '../base.js';
 import { runQualityGate, } from '../../../validation/quality-gate-runner.js';
 import { createRouterFrontierJudge, createUnavailableJudge, } from '../../../validation/frontier-judge.js';
@@ -37,11 +39,15 @@ export class QualityGateTool extends MCPToolBase {
             // #1126: a caller-named anchor must be a regular file inside the project
             // (relative paths resolve against the project root, as the runner does).
             let anchorPath;
+            let anchor;
             if (params.anchorPath !== undefined) {
                 const confined = await requirePayloadPath('qe/quality/gate', 'anchorPath', params.anchorPath, { basePath: findProjectRoot(), maxBytes: MAX_PAYLOAD_FILE_BYTES });
                 if (!confined.success)
                     return { success: false, error: confined.error.message };
                 anchorPath = confined.value;
+                // #1161: the runner gets the anchor read from the validated descriptor,
+                // so a file swapped after the check is never read by name.
+                anchor = parseAnchorSet(await readConfinedText(anchorPath, { maxBytes: MAX_PAYLOAD_FILE_BYTES }), params.anchorPath);
             }
             const router = await getLLMRouter(context);
             const judge = router
@@ -59,6 +65,7 @@ export class QualityGateTool extends MCPToolBase {
                 checklistId: params.checklistId,
                 judge,
                 anchorPath,
+                anchor,
                 verificationManifest: params.verificationManifest,
             });
             return { success: true, data: result };

package/dist/mcp/tools/qx-analysis/analyze.js

@@ -37,6 +37,7 @@ const QX_ANALYZE_SCHEMA = {
         heuristics: {
             type: 'array',
             description: 'Specific heuristics to apply (default: all)',
+            items: { type: 'string', description: 'Heuristic name' },
         },
         minOracleSeverity: {
             type: 'string',

package/dist/mcp/tools/requirements-validation/quality-criteria.js

@@ -13,9 +13,9 @@
  */
 import { MCPToolBase } from '../base.js';
 import { createQualityCriteriaService, HTSM_CATEGORIES, NEVER_OMIT_CATEGORIES, } from '../../../domains/requirements-validation/index.js';
-import { existsSync, readFileSync } from 'fs';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../../shared/io/payload-path-guard.js';
+import { ConfinedReadError, readConfinedText } from '../../../shared/io/confined-read.js';
 // ============================================================================
 // Tool Implementation
 // ============================================================================
@@ -128,8 +128,15 @@ export class QualityCriteriaTool extends MCPToolBase {
                 const confined = await requirePayloadPath('quality-criteria', 'epicPath', epicPath, { allowMissing: true, maxBytes: MAX_PAYLOAD_FILE_BYTES });
                 if (!confined.success)
                     return { success: false, error: confined.error.message };
-                if (existsSync(confined.value))
-                    content = readFileSync(confined.value, 'utf-8');
+                // #1161: read from the validated descriptor; a missing file stays empty.
+                try {
+                    content = await readConfinedText(confined.value, { maxBytes: MAX_PAYLOAD_FILE_BYTES });
+                }
+                catch (readErr) {
+                    if (!(readErr instanceof ConfinedReadError) || readErr.reason !== 'not-found') {
+                        return { success: false, error: toErrorMessage(readErr) };
+                    }
+                }
             }
             if (!content && !epicPath) {
                 return {

package/dist/mcp/tools/security-compliance/scan.js

@@ -10,6 +10,7 @@
 import { MCPToolBase, getMemoryBackend } from '../base.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
+import { getOwn } from '../../../shared/utils/safe-record.js';
 import { ALL_SECURITY_PATTERNS, SECRET_PATTERNS, } from '../../../domains/security-compliance/services/scanners/security-patterns.js';
 import { writeQualityEvidence } from '../../../domains/quality-assessment/quality-evidence.js';
 // ============================================================================
@@ -460,7 +461,8 @@ const KNOWN_VULNERABLE_NPM = {
 function checkKnownVulnerableDeps(deps, manifest) {
     const vulns = [];
     for (const [name, version] of Object.entries(deps)) {
-        const known = KNOWN_VULNERABLE_NPM[name];
+        // #1157: a dependency named `constructor` is a package, not a table entry.
+        const known = getOwn(KNOWN_VULNERABLE_NPM, name);
         if (known) {
             const cleanVersion = version.replace(/^[\^~>=<]+/, '');
             if (compareVersions(cleanVersion, known.maxSafe) < 0) {
@@ -512,7 +514,7 @@ function extractRequirementsTxtDeps(content) {
 function checkKnownVulnerablePythonDeps(deps, manifest) {
     const vulns = [];
     for (const dep of deps) {
-        const known = KNOWN_VULNERABLE_PYTHON[dep];
+        const known = getOwn(KNOWN_VULNERABLE_PYTHON, dep);
         if (known) {
             vulns.push({
                 id: `DEP-py-${dep}-${known.cve}`,

package/dist/mcp/tools/test-execution/e2e-execute.js

@@ -130,7 +130,7 @@ const E2E_EXECUTE_SCHEMA = {
                 name: { type: 'string', description: 'Test case name' },
                 description: { type: 'string', description: 'Test case description' },
                 baseUrl: { type: 'string', description: 'Base URL for the test' },
-                steps: { type: 'array', description: 'Test steps to execute' },
+                steps: { type: 'array', description: 'Test steps to execute', items: { type: 'object', description: 'Test step' } },
                 viewport: {
                     type: 'object',
                     description: 'Browser viewport configuration',
@@ -149,7 +149,7 @@ const E2E_EXECUTE_SCHEMA = {
                 id: { type: 'string', description: 'Test suite ID' },
                 name: { type: 'string', description: 'Test suite name' },
                 description: { type: 'string', description: 'Test suite description' },
-                testCases: { type: 'array', description: 'Test cases in the suite' },
+                testCases: { type: 'array', description: 'Test cases in the suite', items: { type: 'object', description: 'Test case' } },
                 parallel: { type: 'boolean', description: 'Run tests in parallel' },
                 maxWorkers: { type: 'number', description: 'Maximum parallel workers' },
             },