agentic-qe 3.15.12 → 3.15.13

package/dist/domains/quality-assessment/coherence/lambda-calculator.js

@@ -6,6 +6,7 @@
  * Based on ruvector-mincut-gated-transformer's coherence calculation patterns.
  */
 import { QualityLambdaFlags, DEFAULT_COHERENCE_GATE_POLICY, } from './types.js';
+import { isMeasuredMetricValue } from '../evidence-sufficiency.js';
 /**
  * Default dimension weights
  */
@@ -62,38 +63,80 @@ export class LambdaCalculator {
             flags,
             calculatedAt: new Date(),
             dimensions,
+            unmeasured: this.findUnmeasuredInputs(metrics),
         };
     }
+    /**
+     * #1020: inputs with no measured value — missing, negative or non-finite.
+     * highVulns, mediumVulns and flakyTestRatio feed the always-scored security
+     * and reliability dimensions, so leaving them out is missing evidence, not
+     * "none". Optional dimensions (technical debt, duplication, branch coverage)
+     * count only when supplied.
+     */
+    findUnmeasuredInputs(metrics) {
+        const unmeasured = [];
+        const required = [
+            'lineCoverage', 'testPassRate', 'criticalVulns', 'highVulns', 'mediumVulns',
+            'maintainabilityIndex', 'flakyTestRatio',
+        ];
+        if (!(metrics.targetLatency <= 0))
+            required.push('p95Latency', 'targetLatency');
+        for (const name of required) {
+            if (!isMeasuredMetricValue(metrics[name]))
+                unmeasured.push(name);
+        }
+        const optional = ['branchCoverage', 'technicalDebtHours', 'duplicationPercent'];
+        for (const name of optional) {
+            if (metrics[name] !== undefined && !isMeasuredMetricValue(metrics[name]))
+                unmeasured.push(name);
+        }
+        return unmeasured;
+    }
     /**
      * Normalize raw metrics to 0-1 scale dimensions
      */
     normalizeMetrics(metrics) {
+        // #1020: a dimension whose inputs are unmeasured (missing, negative,
+        // non-finite) is left out, never filled with a passing value; the inputs
+        // are listed in `unmeasured` and the gate never allows on them.
+        const measured = isMeasuredMetricValue;
         // Coverage: Direct percentage to 0-1
-        const coverage = Math.min(Math.max(metrics.lineCoverage / 100, 0), 1);
+        const coverage = measured(metrics.lineCoverage) ? Math.min(metrics.lineCoverage / 100, 1) : undefined;
         // Pass rate: Direct percentage to 0-1
-        const passRate = Math.min(Math.max(metrics.testPassRate / 100, 0), 1);
+        const passRate = measured(metrics.testPassRate) ? Math.min(metrics.testPassRate / 100, 1) : undefined;
         // Security: Inverse of vulnerability count, capped at 5 critical vulns
-        // 0 vulns = 1.0, 5+ critical vulns = 0.0
-        const criticalImpact = Math.min(metrics.criticalVulns / 5, 1);
-        const highImpact = Math.min((metrics.highVulns || 0) / 10, 0.3);
-        const mediumImpact = Math.min((metrics.mediumVulns || 0) / 20, 0.1);
-        const security = Math.max(1 - criticalImpact - highImpact - mediumImpact, 0);
+        // 0 vulns = 1.0, 5+ critical vulns = 0.0. Unmeasured high/medium counts can
+        // only lower it further, so the score is then an upper bound: a failing
+        // value is conclusive, a passing one is not (they are listed as unmeasured).
+        let security;
+        if (measured(metrics.criticalVulns)) {
+            const criticalImpact = Math.min(metrics.criticalVulns / 5, 1);
+            const highImpact = measured(metrics.highVulns) ? Math.min(metrics.highVulns / 10, 0.3) : 0;
+            const mediumImpact = measured(metrics.mediumVulns) ? Math.min(metrics.mediumVulns / 20, 0.1) : 0;
+            security = Math.max(1 - criticalImpact - highImpact - mediumImpact, 0);
+        }
         // Performance: Ratio of target to actual P95 latency, capped at 1
-        const performance = metrics.targetLatency > 0
-            ? Math.min(metrics.targetLatency / Math.max(metrics.p95Latency, 1), 1)
-            : 1;
+        // (a target of 0 means no latency target is set)
+        let performance = 1;
+        if (!(metrics.targetLatency <= 0)) {
+            performance = measured(metrics.targetLatency) && measured(metrics.p95Latency)
+                ? Math.min(metrics.targetLatency / Math.max(metrics.p95Latency, 1), 1)
+                : undefined;
+        }
         // Maintainability: Direct index to 0-1
-        const maintainability = Math.min(Math.max(metrics.maintainabilityIndex / 100, 0), 1);
+        const maintainability = measured(metrics.maintainabilityIndex)
+            ? Math.min(metrics.maintainabilityIndex / 100, 1)
+            : undefined;
         // Reliability: Inverse of flaky test ratio
-        const reliability = 1 - (metrics.flakyTestRatio || 0);
+        const reliability = measured(metrics.flakyTestRatio) ? Math.max(1 - metrics.flakyTestRatio, 0) : undefined;
         // Technical debt: Inverse ratio of debt to max acceptable
         let technicalDebt;
-        if (metrics.technicalDebtHours !== undefined && metrics.maxAcceptableDebtHours) {
+        if (isMeasuredMetricValue(metrics.technicalDebtHours) && metrics.maxAcceptableDebtHours) {
             technicalDebt = Math.max(1 - metrics.technicalDebtHours / metrics.maxAcceptableDebtHours, 0);
         }
         // Duplication: Inverse of duplication percentage (capped at 20%)
         let duplication;
-        if (metrics.duplicationPercent !== undefined) {
+        if (isMeasuredMetricValue(metrics.duplicationPercent)) {
             duplication = Math.max(1 - metrics.duplicationPercent / 20, 0);
         }
         return {

package/dist/domains/quality-assessment/coherence/types.d.ts

@@ -25,23 +25,28 @@ export interface QualityLambda {
     calculatedAt: Date;
     /** Individual dimension values (normalized 0-1) */
     dimensions: QualityDimensions;
+    /**
+     * #1020: inputs with no measured value (missing, negative or non-finite).
+     * While any is listed the gate never allows.
+     */
+    unmeasured?: string[];
 }
 /**
  * Quality dimensions normalized to 0-1 scale
  */
 export interface QualityDimensions {
     /** Line/statement coverage (0-1) */
-    coverage: number;
+    coverage?: number;
     /** Test pass rate (0-1) */
-    passRate: number;
+    passRate?: number;
     /** Security score (0-1, where 1 = no vulnerabilities) */
-    security: number;
+    security?: number;
     /** Performance score (0-1, based on P95 latency vs target) */
-    performance: number;
+    performance?: number;
     /** Maintainability index (0-1) */
-    maintainability: number;
+    maintainability?: number;
     /** Reliability score (0-1, based on flaky test ratio) */
-    reliability: number;
+    reliability?: number;
     /** Technical debt ratio (0-1, where 1 = no debt) */
     technicalDebt?: number;
     /** Code duplication score (0-1, where 1 = no duplication) */
@@ -116,7 +121,7 @@ export declare enum QualityTier {
 /**
  * Reason for quality gate decision
  */
-export type QualityGateReason = 'none' | 'lambdaBelowMin' | 'lambdaDroppedFast' | 'boundarySpike' | 'boundaryConcentrationSpike' | 'partitionDrift' | 'forcedByFlag' | 'securityCritical' | 'coverageDrop' | 'testFailureSpike';
+export type QualityGateReason = 'none' | 'lambdaBelowMin' | 'lambdaDroppedFast' | 'boundarySpike' | 'boundaryConcentrationSpike' | 'partitionDrift' | 'forcedByFlag' | 'securityCritical' | 'coverageDrop' | 'testFailureSpike' | 'insufficientEvidence';
 /**
  * Quality actions to take based on decision
  */

package/dist/domains/quality-assessment/coordinator-gate-evaluation.js

@@ -7,6 +7,7 @@
 import { LoggerFactory } from '../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import { createDomainFinding, } from '../../coordination/consensus/domain-findings.js';
+import { isMeasuredMetricValue } from './evidence-sufficiency.js';
 /**
  * Check if a gate result is a borderline case.
  * A borderline case is when any metric is within the configured margin of its threshold.
@@ -26,7 +27,8 @@ export function isBorderlineGateResult(metrics, thresholds, _result, borderlineM
     for (const { metricKey, thresholdKey, isMin } of metricsToCheck) {
         const metricValue = metrics[metricKey];
         const thresholdConfig = thresholds[thresholdKey];
-        if (thresholdConfig === undefined)
+        // #1020: an unmeasured value is not near any threshold.
+        if (thresholdConfig === undefined || !isMeasuredMetricValue(metricValue))
             continue;
         const threshold = isMin
             ? thresholdConfig.min

package/dist/domains/quality-assessment/coordinator-reports.d.ts

@@ -7,14 +7,28 @@
 import { Result } from '../../shared/types';
 import type { MemoryBackend } from '../../kernel/interfaces';
 import type { QualityMetrics, GateEvaluationRequest } from './interfaces';
+import { type StaticEvidenceStatus } from './evidence-sufficiency.js';
+import { INSUFFICIENT_EVIDENCE, type QualityMetricName } from './quality-evidence.js';
 /**
- * Default quality metrics used when no stored metrics are available
+ * #1020: the canonical quality metrics as measured. A metric without fresh,
+ * well-formed evidence is `-1` and listed in `unmeasured`; it is never
+ * replaced by a passing default.
  */
-export declare function getDefaultMetrics(): QualityMetrics;
+export interface MeasuredQualityMetrics {
+    metrics: QualityMetrics;
+    unmeasured: QualityMetricName[];
+}
+/** Evidence state of the metrics one result was computed from. */
+export interface MetricEvidence {
+    evidenceStatus: StaticEvidenceStatus;
+    /** Metrics this result needed but has no measured value for. */
+    unmeasured: QualityMetricName[];
+}
 /**
- * Get stored quality metrics or defaults
+ * #1020: read the measured quality evidence (the same records the measured
+ * gate uses). Unmeasured metrics are `-1`, never a default.
  */
-export declare function getStoredOrDefaultMetrics(memory: MemoryBackend): Promise<QualityMetrics>;
+export declare function getMeasuredMetrics(memory: MemoryBackend): Promise<MeasuredQualityMetrics>;
 /**
  * Generate a quality report
  */
@@ -24,15 +38,16 @@ export declare function generateReport(memory: MemoryBackend, options: {
 }): Promise<Result<{
     content: string;
     format: string;
-}, Error>>;
+} & MetricEvidence, Error>>;
 /**
  * Get quality dashboard overview
  */
 export declare function getQualityDashboard(memory: MemoryBackend): Promise<Result<{
+    /** 0-100; -1 when any metric is unmeasured (#1020). */
     overallScore: number;
     metrics: QualityMetrics;
     trends: Record<string, number>;
-}, Error>>;
+} & MetricEvidence, Error>>;
 /**
  * Analyze project risks
  */
@@ -46,8 +61,9 @@ export declare function analyzeRisks(memory: MemoryBackend, options: {
         description: string;
         category: string;
     }>;
-    overallRiskLevel: 'low' | 'medium' | 'high' | 'critical';
-}, Error>>;
+    /** #1020: `insufficient-evidence` unless a measured risk is already critical. */
+    overallRiskLevel: 'low' | 'medium' | 'high' | 'critical' | typeof INSUFFICIENT_EVIDENCE;
+} & MetricEvidence, Error>>;
 /**
  * Evaluate a quality gate (simplified API)
  */
@@ -62,14 +78,16 @@ export declare function assessDeploymentReadiness(memory: MemoryBackend, options
     environment: 'development' | 'staging' | 'production';
     changeSet: string[];
 }): Promise<Result<{
+    /** #1020: never true while an input is unmeasured. */
     ready: boolean;
     risks: Array<{
         id: string;
         severity: string;
         description: string;
     }>;
+    /** 0-100; -1 when a score input is unmeasured (#1020). */
     score: number;
-}, Error>>;
+} & MetricEvidence, Error>>;
 /**
  * Analyze technical debt
  */
@@ -77,6 +95,7 @@ export declare function analyzeTechnicalDebt(memory: MemoryBackend, options: {
     projectPath: string;
     includeCodeSmells?: boolean;
 }): Promise<Result<{
+    /** -1 when technical debt is unmeasured (#1020). */
     totalDebt: number;
     items: Array<{
         file: string;
@@ -84,7 +103,8 @@ export declare function analyzeTechnicalDebt(memory: MemoryBackend, options: {
         effort: number;
         description: string;
     }>;
+    /** -1 when technical debt is unmeasured (#1020). */
     debtRatio: number;
-}, Error>>;
+} & MetricEvidence, Error>>;
 export declare function generateRecommendations(metrics: QualityMetrics): string[];
 //# sourceMappingURL=coordinator-reports.d.ts.map

package/dist/domains/quality-assessment/coordinator-reports.js

@@ -6,38 +6,55 @@
  */
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
+import { isMeasuredMetricValue } from './evidence-sufficiency.js';
+import { INSUFFICIENT_EVIDENCE, QUALITY_METRICS, describeMissingMetrics, inspectQualityEvidence, } from './quality-evidence.js';
+/** #996: the sentinel for a metric with no measured value. */
+const UNMEASURED = -1;
 /**
- * Default quality metrics used when no stored metrics are available
+ * #1020: read the measured quality evidence (the same records the measured
+ * gate uses). Unmeasured metrics are `-1`, never a default.
  */
-export function getDefaultMetrics() {
+export async function getMeasuredMetrics(memory) {
+    const { values } = await inspectQualityEvidence(memory);
+    const metrics = {};
+    const unmeasured = [];
+    for (const metric of QUALITY_METRICS) {
+        const value = values[metric];
+        if (isMeasuredMetricValue(value)) {
+            metrics[metric] = value;
+        }
+        else {
+            metrics[metric] = UNMEASURED;
+            unmeasured.push(metric);
+        }
+    }
+    return { metrics, unmeasured };
+}
+/** Evidence state of `inputs` within `metrics`. */
+function evidenceFor(metrics, inputs) {
+    const unmeasured = inputs.filter((metric) => !isMeasuredMetricValue(metrics[metric]));
     return {
-        coverage: 80,
-        testsPassing: 95,
-        criticalBugs: 0,
-        codeSmells: 5,
-        securityVulnerabilities: 0,
-        technicalDebt: 10,
-        duplications: 3,
+        evidenceStatus: unmeasured.length === 0 ? 'measured' : INSUFFICIENT_EVIDENCE,
+        unmeasured,
     };
 }
-/**
- * Get stored quality metrics or defaults
- */
-export async function getStoredOrDefaultMetrics(memory) {
-    const storedMetrics = await memory.get('quality-assessment:current-metrics');
-    return storedMetrics ?? getDefaultMetrics();
+/** True when `metric` has a measured value. */
+function measured(metrics, metric) {
+    return isMeasuredMetricValue(metrics[metric]);
 }
 /**
  * Generate a quality report
  */
 export async function generateReport(memory, options) {
     try {
-        const metrics = await getStoredOrDefaultMetrics(memory);
+        const { metrics } = await getMeasuredMetrics(memory);
+        const evidence = evidenceFor(metrics, QUALITY_METRICS);
         const reportData = {
             timestamp: new Date().toISOString(),
+            ...evidence,
             metrics,
             recommendations: options.includeRecommendations
-                ? generateRecommendations(metrics)
+                ? [...generateRecommendations(metrics), ...describeMissingMetrics(evidence.unmeasured)]
                 : undefined,
         };
         let content;
@@ -54,7 +71,7 @@ export async function generateReport(memory, options) {
             default:
                 content = JSON.stringify(reportData, null, 2);
         }
-        return ok({ content, format: options.format });
+        return ok({ content, format: options.format, ...evidence });
     }
     catch (error) {
         return err(toError(error));
@@ -65,14 +82,16 @@ export async function generateReport(memory, options) {
  */
 export async function getQualityDashboard(memory) {
     try {
-        const metrics = await getStoredOrDefaultMetrics(memory);
-        const overallScore = Math.round((metrics.coverage * 0.3) +
+        const { metrics } = await getMeasuredMetrics(memory);
+        const evidence = evidenceFor(metrics, QUALITY_METRICS);
+        const overallScore = evidence.unmeasured.length > 0 ? UNMEASURED : Math.round((metrics.coverage * 0.3) +
             (metrics.testsPassing * 0.3) +
             ((100 - Math.min(100, metrics.codeSmells)) * 0.2) +
             ((100 - Math.min(100, metrics.securityVulnerabilities * 10)) * 0.2));
         return ok({
             overallScore,
             metrics,
+            ...evidence,
             trends: {
                 coverage: 0,
                 quality: 0,
@@ -89,9 +108,13 @@ export async function getQualityDashboard(memory) {
  */
 export async function analyzeRisks(memory, options) {
     try {
-        const metrics = await getStoredOrDefaultMetrics(memory);
+        const { metrics } = await getMeasuredMetrics(memory);
+        const inputs = ['coverage', 'technicalDebt'];
+        if (options.includeSecurityRisks)
+            inputs.push('securityVulnerabilities');
+        const evidence = evidenceFor(metrics, inputs);
         const risks = [];
-        if (metrics.coverage < 50) {
+        if (measured(metrics, 'coverage') && metrics.coverage < 50) {
             risks.push({
                 id: 'risk-coverage-critical',
                 severity: 'critical',
@@ -99,7 +122,7 @@ export async function analyzeRisks(memory, options) {
                 category: 'quality',
             });
         }
-        else if (metrics.coverage < 70) {
+        else if (measured(metrics, 'coverage') && metrics.coverage < 70) {
             risks.push({
                 id: 'risk-coverage-high',
                 severity: 'high',
@@ -107,7 +130,7 @@ export async function analyzeRisks(memory, options) {
                 category: 'quality',
             });
         }
-        if (options.includeSecurityRisks && metrics.securityVulnerabilities > 0) {
+        if (options.includeSecurityRisks && measured(metrics, 'securityVulnerabilities') && metrics.securityVulnerabilities > 0) {
             risks.push({
                 id: 'risk-security',
                 severity: metrics.securityVulnerabilities > 5 ? 'critical' : 'high',
@@ -115,7 +138,7 @@ export async function analyzeRisks(memory, options) {
                 category: 'security',
             });
         }
-        if (metrics.technicalDebt > 40) {
+        if (measured(metrics, 'technicalDebt') && metrics.technicalDebt > 40) {
             risks.push({
                 id: 'risk-debt-critical',
                 severity: 'high',
@@ -129,13 +152,17 @@ export async function analyzeRisks(memory, options) {
         if (criticalCount > 0) {
             overallRiskLevel = 'critical';
         }
+        else if (evidence.unmeasured.length > 0) {
+            // An unmeasured input could hide any risk: no level below critical is known.
+            overallRiskLevel = INSUFFICIENT_EVIDENCE;
+        }
         else if (highCount > 1) {
             overallRiskLevel = 'high';
         }
         else if (highCount > 0 || risks.length > 2) {
             overallRiskLevel = 'medium';
         }
-        return ok({ risks, overallRiskLevel });
+        return ok({ risks, overallRiskLevel, ...evidence });
     }
     catch (error) {
         return err(toError(error));
@@ -145,15 +172,12 @@ export async function analyzeRisks(memory, options) {
  * Evaluate a quality gate (simplified API)
  */
 export function buildFullGateRequest(options) {
-    const fullMetrics = {
-        coverage: options.metrics.coverage ?? 80,
-        testsPassing: options.metrics.testsPassing ?? 95,
-        criticalBugs: options.metrics.criticalBugs ?? 0,
-        codeSmells: options.metrics.codeSmells ?? 5,
-        securityVulnerabilities: options.metrics.securityVulnerabilities ?? 0,
-        technicalDebt: options.metrics.technicalDebt ?? 10,
-        duplications: options.metrics.duplications ?? 3,
-    };
+    // #1020: a metric the caller did not supply is unmeasured (-1), never a
+    // passing default; the gate reports it as insufficient evidence.
+    const fullMetrics = {};
+    for (const metric of QUALITY_METRICS) {
+        fullMetrics[metric] = options.metrics[metric] ?? UNMEASURED;
+    }
     return {
         gateName: options.gateId,
         metrics: fullMetrics,
@@ -171,24 +195,26 @@ export function buildFullGateRequest(options) {
  */
 export async function assessDeploymentReadiness(memory, options) {
     try {
-        const metrics = await getStoredOrDefaultMetrics(memory);
+        const { metrics } = await getMeasuredMetrics(memory);
+        const scoreInputs = ['coverage', 'testsPassing', 'securityVulnerabilities'];
+        const evidence = evidenceFor(metrics, options.environment === 'production' ? [...scoreInputs, 'criticalBugs'] : scoreInputs);
         const risks = [];
         if (options.environment === 'production') {
-            if (metrics.coverage < 70) {
+            if (measured(metrics, 'coverage') && metrics.coverage < 70) {
                 risks.push({
                     id: 'risk-coverage',
                     severity: 'high',
                     description: 'Coverage below recommended threshold for production',
                 });
             }
-            if (metrics.securityVulnerabilities > 0) {
+            if (measured(metrics, 'securityVulnerabilities') && metrics.securityVulnerabilities > 0) {
                 risks.push({
                     id: 'risk-security',
                     severity: 'critical',
                     description: 'Security vulnerabilities must be resolved before production deployment',
                 });
             }
-            if (metrics.criticalBugs > 0) {
+            if (measured(metrics, 'criticalBugs') && metrics.criticalBugs > 0) {
                 risks.push({
                     id: 'risk-bugs',
                     severity: 'critical',
@@ -196,11 +222,14 @@ export async function assessDeploymentReadiness(memory, options) {
                 });
             }
         }
-        const score = Math.round((metrics.coverage * 0.4) +
-            (metrics.testsPassing * 0.3) +
-            ((100 - Math.min(100, metrics.securityVulnerabilities * 20)) * 0.3));
-        const ready = risks.filter((r) => r.severity === 'critical').length === 0 && score >= 70;
-        return ok({ ready, risks, score });
+        const score = scoreInputs.every((metric) => measured(metrics, metric))
+            ? Math.round((metrics.coverage * 0.4) +
+                (metrics.testsPassing * 0.3) +
+                ((100 - Math.min(100, metrics.securityVulnerabilities * 20)) * 0.3))
+            : UNMEASURED;
+        const ready = evidence.unmeasured.length === 0
+            && risks.filter((r) => r.severity === 'critical').length === 0 && score >= 70;
+        return ok({ ready, risks, score, ...evidence });
     }
     catch (error) {
         return err(toError(error));
@@ -211,27 +240,33 @@ export async function assessDeploymentReadiness(memory, options) {
  */
 export async function analyzeTechnicalDebt(memory, options) {
     try {
-        const metrics = await getStoredOrDefaultMetrics(memory);
+        const { metrics } = await getMeasuredMetrics(memory);
+        const inputs = ['technicalDebt', 'duplications'];
+        if (options.includeCodeSmells)
+            inputs.push('codeSmells');
+        const evidence = evidenceFor(metrics, inputs);
+        // #1020: the metrics are project-wide counts, so the items name the
+        // project, not invented file paths.
         const items = [];
-        if (metrics.duplications > 0) {
+        if (measured(metrics, 'duplications') && metrics.duplications > 0) {
             items.push({
-                file: `${options.projectPath}/src/utils/helpers.ts`,
+                file: options.projectPath,
                 type: 'duplication',
                 effort: metrics.duplications * 30,
-                description: 'Duplicated code blocks that should be refactored',
+                description: `Measured duplication of ${metrics.duplications}% across the project should be refactored`,
             });
         }
-        if (options.includeCodeSmells && metrics.codeSmells > 0) {
+        if (options.includeCodeSmells && measured(metrics, 'codeSmells') && metrics.codeSmells > 0) {
             items.push({
-                file: `${options.projectPath}/src/services/legacy.ts`,
+                file: options.projectPath,
                 type: 'code-smell',
                 effort: metrics.codeSmells * 15,
-                description: 'Code smells that impact maintainability',
+                description: `${metrics.codeSmells} measured code smells impact maintainability`,
             });
         }
         const totalDebt = metrics.technicalDebt;
-        const debtRatio = totalDebt / 100;
-        return ok({ totalDebt, items, debtRatio });
+        const debtRatio = measured(metrics, 'technicalDebt') ? totalDebt / 100 : UNMEASURED;
+        return ok({ totalDebt, items, debtRatio, ...evidence });
     }
     catch (error) {
         return err(toError(error));
@@ -242,16 +277,17 @@ export async function analyzeTechnicalDebt(memory, options) {
 // ============================================================================
 export function generateRecommendations(metrics) {
     const recommendations = [];
-    if (metrics.coverage < 80) {
+    // #1020: only measured values support a recommendation; -1 is not "low".
+    if (measured(metrics, 'coverage') && metrics.coverage < 80) {
         recommendations.push('Increase test coverage to at least 80%');
     }
-    if (metrics.codeSmells > 10) {
+    if (measured(metrics, 'codeSmells') && metrics.codeSmells > 10) {
         recommendations.push('Refactor complex code to improve maintainability');
     }
-    if (metrics.technicalDebt > 20) {
+    if (measured(metrics, 'technicalDebt') && metrics.technicalDebt > 20) {
         recommendations.push('Allocate time to reduce technical debt');
     }
-    if (metrics.securityVulnerabilities > 0) {
+    if (measured(metrics, 'securityVulnerabilities') && metrics.securityVulnerabilities > 0) {
         recommendations.push('Address security vulnerabilities urgently');
     }
     return recommendations;