agentic-qe 3.15.12 → 3.15.13

package/dist/domains/security-compliance/services/security-auditor.js

@@ -52,17 +52,11 @@ export class SecurityAuditorService {
             if (!ecosystem) {
                 return err(new Error(`Unknown manifest format: ${manifest}`));
             }
-            const outdatedPackages = [];
             const { dependencies, preUnchecked } = await this.parseDependenciesForScan(manifest, ecosystem);
             const advisories = await this.checkDependencyAdvisories(dependencies, preUnchecked);
-            for (const dep of dependencies) {
-                const outdated = await this.checkOutdated(dep);
-                if (outdated) {
-                    outdatedPackages.push(outdated);
-                }
-            }
+            const outdated = await this.checkOutdatedPackages(dependencies);
             const summary = this.createDependencySummary(advisories.vulnerabilities, dependencies.length);
-            const result = this.toDependencyScanResult(advisories, outdatedPackages, summary);
+            const result = this.toDependencyScanResult(advisories, outdated, summary);
             await this.memory.set(`security:deps:${manifestPath.filename}`, result, { namespace: 'security-compliance', ttl: 86400 });
             return ok(result);
         }
@@ -73,9 +67,20 @@ export class SecurityAuditorService {
     async checkPackage(name, version, ecosystem) {
         try {
             const vulnerabilities = await this.queryVulnerabilityDatabase(name, version, ecosystem);
-            const latestVersion = await this.getLatestVersion(name, ecosystem);
-            const isDeprecated = await this.checkDeprecation(name, ecosystem);
-            return ok({ name, version, vulnerabilities, latestVersion, isDeprecated });
+            // #1052: a failed registry lookup is unchecked, never "not deprecated".
+            const registry = await this.lookupRegistry(name, ecosystem);
+            const unchecked = !registry.ok
+                ? [`latest version and deprecation: ${registry.reason}`]
+                : registry.deprecated === null ? [`deprecation: not reported by the ${ecosystem} registry`] : [];
+            return ok({
+                name,
+                version,
+                vulnerabilities,
+                latestVersion: registry.ok ? registry.version : null,
+                isDeprecated: registry.ok ? registry.deprecated : null,
+                status: unchecked.length > 0 ? 'incomplete' : 'complete',
+                ...(unchecked.length > 0 ? { unchecked } : {}),
+            });
         }
         catch (error) {
             return err(toError(error));
@@ -97,17 +102,27 @@ export class SecurityAuditorService {
             for (const [key, vulns] of byPackage) {
                 const [ecosystem, name] = key.split(':');
                 const currentVersion = vulns[0].location.dependency?.version || 'unknown';
-                const latestVersion = await this.getLatestVersion(name, ecosystem);
+                const registry = await this.lookupRegistry(name, ecosystem);
                 const fixedVersions = vulns
                     .filter((v) => v.id)
                     .map((v) => v.id);
-                recommendations.push({
-                    package: name,
-                    fromVersion: currentVersion,
-                    toVersion: latestVersion,
-                    fixesVulnerabilities: fixedVersions,
-                    breakingChanges: this.hasBreakingChanges(currentVersion, latestVersion),
-                });
+                // #1052: without a target version the package is unchecked, not "upgrade to unknown".
+                recommendations.push(registry.ok
+                    ? {
+                        package: name,
+                        fromVersion: currentVersion,
+                        toVersion: registry.version,
+                        fixesVulnerabilities: fixedVersions,
+                        breakingChanges: this.hasBreakingChanges(currentVersion, registry.version),
+                    }
+                    : {
+                        package: name,
+                        fromVersion: currentVersion,
+                        toVersion: null,
+                        fixesVulnerabilities: fixedVersions,
+                        breakingChanges: null,
+                        unchecked: registry.reason,
+                    });
             }
             recommendations.sort((a, b) => b.fixesVulnerabilities.length - a.fixesVulnerabilities.length);
             return ok(recommendations);
@@ -142,9 +157,26 @@ export class SecurityAuditorService {
             const overallRiskScore = calculateOverallRisk(sastResults, dastResults, dependencyResults, secretScanResults);
             const recommendations = generateRecommendations(sastResults, dastResults, dependencyResults, secretScanResults);
             // #1049: an incomplete advisory lookup leaves dependency risk unmeasured.
+            const incompleteChecks = [];
             if (dependencyResults && dependencyResults.status !== 'complete') {
+                incompleteChecks.push(`Dependency scan ${dependencyResults.status}: ${dependencyResults.error ?? 'advisories could not be checked'}`);
                 recommendations.unshift(`${dependencyResults.error ?? 'Dependency advisories could not be checked'}. Dependency risk is unmeasured; re-run the scan when the OSV API is reachable.`);
             }
+            // #1221: a package whose latest version could not be looked up is not "up to date".
+            if (dependencyResults && dependencyResults.outdatedStatus !== 'complete' && dependencyResults.outdatedStatus !== 'not-run') {
+                const unchecked = dependencyResults.outdatedUnchecked;
+                const reasons = [...new Set(unchecked.map((p) => p.reason))].slice(0, 3).join('; ') || 'no reason was recorded';
+                // A planning entry (the scan itself failed) is not a package.
+                const packages = unchecked.filter((p) => p.name !== PLANNING_ENTRY).length;
+                const what = packages > 0 ? `latest version unknown for ${packages} package(s)` : 'no latest version was looked up';
+                incompleteChecks.push(`Outdated-package check ${dependencyResults.outdatedStatus}: ${what}: ${reasons}`);
+                recommendations.unshift(`${packages > 0 ? `Latest versions could not be looked up for ${packages} package(s)` : 'No latest versions were looked up'} (${reasons}). Whether packages are outdated is unknown.`);
+            }
+            // #1052: a DAST target that could not be (fully) scanned is not a clean target.
+            if (dastResults && dastResults.status !== 'complete') {
+                incompleteChecks.push(`DAST scan ${dastResults.status}: ${dastResults.error ?? 'the target was not fully scanned'}`);
+                recommendations.unshift(`DAST scan ${dastResults.status} (${dastResults.error ?? 'the target was not fully scanned'}). Dynamic risk is unmeasured for what was not scanned.`);
+            }
             const report = {
                 auditId,
                 timestamp,
@@ -154,6 +186,7 @@ export class SecurityAuditorService {
                 secretScanResults,
                 overallRiskScore,
                 recommendations,
+                ...(incompleteChecks.length > 0 ? { incompleteChecks } : {}),
             };
             await this.memory.set(`security:audit:${auditId}`, report, { namespace: 'security-compliance', persist: true });
             return ok(report);
@@ -359,10 +392,12 @@ export class SecurityAuditorService {
             }),
         };
     }
-    toDependencyScanResult(advisories, outdatedPackages, summary) {
+    toDependencyScanResult(advisories, outdated, summary) {
         return {
             vulnerabilities: advisories.vulnerabilities,
-            outdatedPackages,
+            outdatedPackages: outdated.outdatedPackages,
+            outdatedStatus: outdated.outdatedStatus,
+            outdatedUnchecked: outdated.outdatedUnchecked,
             summary,
             status: advisories.status,
             measured: advisories.status === 'complete',
@@ -430,18 +465,30 @@ export class SecurityAuditorService {
             return 'vulnerable-components';
         return 'vulnerable-components';
     }
-    async checkOutdated(dep) {
-        const latestVersion = await this.getLatestVersion(dep.name, dep.ecosystem);
-        // A failed registry lookup ('unknown') is not evidence the package is outdated.
-        if (latestVersion !== 'unknown' && latestVersion !== dep.version) {
-            return {
-                name: dep.name,
-                currentVersion: dep.version,
-                latestVersion,
-                updateType: this.determineUpdateType(dep.version, latestVersion),
-            };
+    /**
+     * Look up the latest version of each dependency (#1221). A failed lookup is
+     * listed in `outdatedUnchecked` with its reason, never counted as up to date.
+     */
+    async checkOutdatedPackages(dependencies) {
+        const outdatedPackages = [];
+        const outdatedUnchecked = [];
+        for (const dep of dependencies) {
+            const registry = await this.lookupRegistry(dep.name, dep.ecosystem);
+            if (!registry.ok) {
+                outdatedUnchecked.push({ name: dep.name, version: dep.version, reason: registry.reason });
+            }
+            else if (registry.version !== dep.version) {
+                outdatedPackages.push({
+                    name: dep.name,
+                    currentVersion: dep.version,
+                    latestVersion: registry.version,
+                    updateType: this.determineUpdateType(dep.version, registry.version),
+                });
+            }
         }
-        return null;
+        const outdatedStatus = outdatedUnchecked.length === 0 ? 'complete'
+            : outdatedUnchecked.length === dependencies.length ? 'failed' : 'incomplete';
+        return { outdatedPackages, outdatedStatus, outdatedUnchecked };
     }
     async queryVulnerabilityDatabase(name, version, ecosystem) {
         const outcome = await this.checkDependencyAdvisories([{ name, version, ecosystem }]);
@@ -450,39 +497,35 @@ export class SecurityAuditorService {
         }
         return outcome.vulnerabilities;
     }
-    async getLatestVersion(name, ecosystem) {
+    /**
+     * Latest version and deprecation from the package registry (#1052). A failed
+     * lookup says why; it never reads as "not deprecated" or a version.
+     * `deprecated` is null when the registry does not report deprecation.
+     */
+    async lookupRegistry(name, ecosystem) {
         try {
             if (ecosystem === 'npm') {
                 const response = await httpGet(`https://registry.npmjs.org/${encodeURIComponent(name)}/latest`);
-                if (response.ok && response.data.version) {
-                    return response.data.version;
-                }
+                if (!response.ok)
+                    return { ok: false, reason: `npm registry returned HTTP ${response.status}` };
+                if (!response.data.version)
+                    return { ok: false, reason: 'npm registry response has no version' };
+                return { ok: true, version: response.data.version, deprecated: Boolean(response.data.deprecated) };
             }
-            else if (ecosystem === 'pip') {
+            if (ecosystem === 'pip') {
                 const response = await httpGet(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`);
-                if (response.ok && response.data.info?.version) {
-                    return response.data.info.version;
-                }
+                if (!response.ok)
+                    return { ok: false, reason: `PyPI returned HTTP ${response.status}` };
+                if (!response.data.info?.version)
+                    return { ok: false, reason: 'PyPI response has no version' };
+                return { ok: true, version: response.data.info.version, deprecated: null };
             }
+            return { ok: false, reason: `no registry lookup for ${ecosystem} packages` };
         }
         catch (error) {
-            logger.error(`Failed to get latest version for ${name}:`, error instanceof Error ? error : undefined);
+            logger.error(`Registry lookup failed for ${name}:`, error instanceof Error ? error : undefined);
+            return { ok: false, reason: `registry lookup failed: ${toError(error).message}` };
         }
-        return 'unknown';
-    }
-    async checkDeprecation(name, ecosystem) {
-        try {
-            if (ecosystem === 'npm') {
-                const response = await httpGet(`https://registry.npmjs.org/${encodeURIComponent(name)}/latest`);
-                if (response.ok && response.data.deprecated) {
-                    return true;
-                }
-            }
-        }
-        catch (error) {
-            logger.error(`Failed to check deprecation for ${name}:`, error instanceof Error ? error : undefined);
-        }
-        return false;
     }
     determineUpdateType(current, latest) {
         const currentParts = current.split('.').map(Number);
@@ -534,26 +577,24 @@ export class SecurityAuditorService {
     }
     async performDependencyScan() {
         const startTime = Date.now();
-        const outdatedPackages = [];
         const manifestPath = path.join(process.cwd(), 'package.json');
         try {
             const { dependencies, preUnchecked } = await this.parseDependenciesForScan(manifestPath, 'npm');
             const advisories = await this.checkDependencyAdvisories(dependencies, preUnchecked);
-            for (const dep of dependencies) {
-                const outdated = await this.checkOutdated(dep);
-                if (outdated) {
-                    outdatedPackages.push(outdated);
-                }
-            }
+            const outdated = await this.checkOutdatedPackages(dependencies);
             const baseSummary = this.createDependencySummary(advisories.vulnerabilities, dependencies.length);
-            return this.toDependencyScanResult(advisories, outdatedPackages, { ...baseSummary, scanDurationMs: Date.now() - startTime });
+            return this.toDependencyScanResult(advisories, outdated, { ...baseSummary, scanDurationMs: Date.now() - startTime });
         }
         catch (error) {
             logger.error('Dependency scan failed:', error instanceof Error ? error : undefined);
             // #1049: a scan that could not run is failed, never an empty clean result.
+            const reason = `Dependency scan of ${manifestPath} failed: ${toError(error).message}`;
             return {
                 vulnerabilities: [],
                 outdatedPackages: [],
+                outdatedStatus: 'failed',
+                // #1221: no package list to look up; the planning entry says why.
+                outdatedUnchecked: [{ name: PLANNING_ENTRY, version: 'unknown', reason }],
                 summary: {
                     critical: 0, high: 0, medium: 0, low: 0, informational: 0,
                     totalFiles: 0, scanDurationMs: Date.now() - startTime,
@@ -562,7 +603,7 @@ export class SecurityAuditorService {
                 measured: false,
                 packagesChecked: 0,
                 uncheckedPackages: [],
-                error: `Dependency scan of ${manifestPath} failed: ${toError(error).message}`,
+                error: reason,
             };
         }
     }

package/dist/domains/test-execution/coordinator.d.ts

@@ -126,7 +126,8 @@ export declare class TestExecutionCoordinator extends BaseDomainCoordinator<Test
     /**
      * Retry a run's failed tests when retries were requested, and attach what
      * the retries did to the run (#1130). A test that passed on a retry counts
-     * as passed and flaky in the run's own counts (#1170).
+     * as passed and flaky in the run's own counts (#1170). When that changes
+     * the outcome, the run is stored again with it (#1176).
      */
     private retryFailures;
     /**

package/dist/domains/test-execution/coordinator.js

@@ -23,6 +23,17 @@ import { createMinCutTestOptimizer, } from './services/mincut-test-optimizer.js'
 export function calculateRetryStrategyConfidence(testCount) {
     return Math.min(1, 0.7 + (testCount / 100));
 }
+/** #1176: TestRunCompleted for a run's final outcome, retries applied. */
+function completedPayload(run) {
+    return {
+        runId: run.runId,
+        passed: run.passed,
+        failed: run.failed,
+        skipped: run.skipped,
+        duration: run.duration,
+        ...(run.flaky ? { flaky: run.flaky } : {}),
+    };
+}
 const DEFAULT_COORDINATOR_CONFIG = {
     simulateForTesting: false,
     enablePrioritization: true,
@@ -141,32 +152,31 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
         const timeout = request.timeout ?? Math.max(60000, testsToRun.length * 2000);
         // Use parallel execution by default (unless explicitly disabled)
         if (request.parallel !== false && testsToRun.length > 1) {
-            const result = await this.executeParallel({
+            // #1176: execute/executeParallel run the retries before they record
+            // the run, so its events and learning records see the final outcome.
+            return this.executeParallel({
                 testFiles: testsToRun,
                 framework,
                 workers,
                 timeout,
+                retryCount: request.retryCount,
             });
-            if (result.success)
-                await this.retryFailures(result.value, request.retryCount);
-            return result;
         }
         // Sequential execution
-        const result = await this.execute({
+        return this.execute({
             testFiles: testsToRun,
             framework,
             timeout,
+            retryCount: request.retryCount,
         });
-        if (result.success)
-            await this.retryFailures(result.value, request.retryCount);
-        return result;
     }
     /**
      * Retry a run's failed tests when retries were requested, and attach what
      * the retries did to the run (#1130). A test that passed on a retry counts
-     * as passed and flaky in the run's own counts (#1170).
+     * as passed and flaky in the run's own counts (#1170). When that changes
+     * the outcome, the run is stored again with it (#1176).
      */
-    async retryFailures(run, retryCount) {
+    async retryFailures(run, retryCount, testFiles) {
         if (!retryCount || retryCount <= 0)
             return;
         if (run.failed === 0) {
@@ -182,6 +192,7 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
         if (!retried.success)
             return;
         applyRetryOutcome(run, retried.value);
+        await this.executor.recordFinalOutcome(run, testFiles);
     }
     /**
      * Detect test framework from file patterns and project configuration
@@ -244,20 +255,18 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
             // Remove from active runs
             this.activeRuns.delete(runId);
             if (result.success) {
+                // #1176: these first-attempt failures did happen; flaky analysis
+                // records them even when a retry then passes.
+                const firstAttemptFailures = [...result.value.failedTests];
+                await this.retryFailures(result.value, request.retryCount, orderedTestFiles);
                 // Record execution results for learning
                 if (this.config.enablePrioritization && prioritizationResult) {
                     await this.recordExecutionResults(runId, orderedTestFiles, result.value, prioritizationResult);
                 }
                 // Publish completion event
-                await this.publishEvent(TestExecutionEvents.TestRunCompleted, {
-                    runId: result.value.runId,
-                    passed: result.value.passed,
-                    failed: result.value.failed,
-                    skipped: result.value.skipped,
-                    duration: result.value.duration,
-                });
+                await this.publishEvent(TestExecutionEvents.TestRunCompleted, completedPayload(result.value));
                 // Record failed tests for flaky analysis
-                for (const failed of result.value.failedTests) {
+                for (const failed of firstAttemptFailures) {
                     await this.flakyDetector.recordExecution(failed.testId, {
                         runId: result.value.runId,
                         passed: false,
@@ -287,7 +296,7 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
                 if (this.config.infraHealing && result.value.failedTests.length > 0) {
                     this.feedInfraHealingFromFailures(result.value.failedTests);
                     // ADR-057: Attempt automatic recovery and re-run affected tests
-                    const rerunResult = await this.attemptAutoRecoveryAndRerun(result.value.failedTests, request.framework, { timeout: request.timeout, env: request.env });
+                    const rerunResult = await this.attemptAutoRecoveryAndRerun(result.value.failedTests, request.framework, { timeout: request.timeout, env: request.env, retryCount: request.retryCount });
                     if (rerunResult)
                         return rerunResult;
                 }
@@ -357,18 +366,14 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
             // Remove from active runs
             this.activeRuns.delete(runId);
             if (result.success) {
+                // #1176: retries finish before the run is recorded or announced.
+                await this.retryFailures(result.value, request.retryCount, orderedTestFiles);
                 // Record execution results for learning
                 if (this.config.enablePrioritization && prioritizationResult) {
                     await this.recordExecutionResults(runId, orderedTestFiles, result.value, prioritizationResult);
                 }
                 // Publish completion event
-                await this.publishEvent(TestExecutionEvents.TestRunCompleted, {
-                    runId: result.value.runId,
-                    passed: result.value.passed,
-                    failed: result.value.failed,
-                    skipped: result.value.skipped,
-                    duration: result.value.duration,
-                });
+                await this.publishEvent(TestExecutionEvents.TestRunCompleted, completedPayload(result.value));
                 // Check for flaky tests based on history
                 for (const failed of result.value.failedTests) {
                     const flakinessScore = await this.flakyDetector.getFlakinessScore(failed.testId);
@@ -402,7 +407,7 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
                 if (this.config.infraHealing && result.value.failedTests.length > 0) {
                     this.feedInfraHealingFromFailures(result.value.failedTests);
                     // ADR-057: Attempt automatic recovery and re-run affected tests
-                    const rerunResult = await this.attemptAutoRecoveryAndRerun(result.value.failedTests, request.framework, { timeout: request.timeout, env: request.env });
+                    const rerunResult = await this.attemptAutoRecoveryAndRerun(result.value.failedTests, request.framework, { timeout: request.timeout, env: request.env, retryCount: request.retryCount });
                     if (rerunResult)
                         return rerunResult;
                 }
@@ -624,6 +629,7 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
             framework,
             timeout: originalRequest.timeout,
             env: originalRequest.env,
+            retryCount: originalRequest.retryCount,
         });
     }
     /**

package/dist/domains/test-execution/interfaces.d.ts

@@ -54,6 +54,11 @@ export interface IExecuteTestsRequest {
     timeout?: number;
     env?: Record<string, string>;
     reporters?: string[];
+    /**
+     * #1176: retries of each failed test. They run before the run is recorded
+     * or TestRunCompleted is published, so both carry the final outcome.
+     */
+    retryCount?: number;
 }
 export interface IParallelExecutionRequest extends IExecuteTestsRequest {
     workers: number;

package/dist/domains/test-execution/services/test-executor.d.ts

@@ -71,6 +71,12 @@ export declare class TestExecutorService implements ITestExecutionService {
      * Execute tests in parallel across multiple workers
      */
     executeParallel(request: ParallelExecutionRequest): Promise<Result<TestRunResult, Error>>;
+    /**
+     * #1176: record a run again after its retries changed the outcome, so the
+     * stored run, its testsPassing evidence and its coverage runStatus are the
+     * final ones rather than the first attempt's.
+     */
+    recordFinalOutcome(run: TestRunResult, testFiles?: readonly string[]): Promise<void>;
     /**
      * Get results for a specific run
      */

package/dist/domains/test-execution/services/test-executor.js

@@ -16,7 +16,7 @@ import { safeJsonParse } from '../../../shared/safe-json.js';
 import { secureRandom, secureRandomInt } from '../../../shared/utils/crypto-random.js';
 import { writeTestRunEvidence } from '../../quality-assessment/quality-evidence.js';
 import { istanbulLineHits } from '../../../coordination/handlers/handler-utils.js';
-import { fileCoverageKey } from '../../coverage-analysis/collected-metrics.js';
+import { fileCoverageKey, projectFileCoverageKeys } from '../../coverage-analysis/collected-metrics.js';
 import { mergeTestCases, redactFailedTests, redactFailureText, testCasesFromRunnerReport } from './runner-test-cases.js';
 import { capDiagnostics, getTestRunnerExecutionError, TestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
@@ -157,6 +157,15 @@ export class TestExecutorService {
             return err(toError(error));
         }
     }
+    /**
+     * #1176: record a run again after its retries changed the outcome, so the
+     * stored run, its testsPassing evidence and its coverage runStatus are the
+     * final ones rather than the first attempt's.
+     */
+    async recordFinalOutcome(run, testFiles) {
+        this.runResults.set(run.runId, run);
+        await this.storeResults(run.runId, run, testFiles);
+    }
     /**
      * Get results for a specific run
      */
@@ -1246,11 +1255,14 @@ Provide:
             }, { persist: true });
             // Store per-file coverage via memory.set() (not storeVector) so that
             // quality-analyzer's getStoredCoverage() can read it with memory.get()
+            // #1027 N7: one key form — the absolute path. #1030: only files inside
+            // the project, each listed once.
+            const keys = projectFileCoverageKeys((result.fileCoverages ?? []).map(fc => fc.path));
             for (const fc of result.fileCoverages ?? []) {
-                if (!Number.isFinite(fc.line))
+                const key = keys.get(fc.path);
+                if (!key || !Number.isFinite(fc.line))
                     continue;
-                // #1027 N7: one key form — the absolute path.
-                await this.memory.set(`coverage:file:${fileCoverageKey(fc.path)}`, {
+                await this.memory.set(`coverage:file:${key}`, {
                     line: fc.line,
                     branch: fc.branch ?? null,
                     function: fc.function ?? null,

package/dist/domains/visual-accessibility/coordinator.js

@@ -298,13 +298,23 @@ export class VisualAccessibilityCoordinator extends BaseDomainCoordinator {
             }
             this.addAgentToWorkflow(workflowId, agentResult.value);
             const reports = [];
+            const notMeasured = [];
             let totalViolations = 0;
             let criticalViolations = 0;
             let passingUrls = 0;
             for (let i = 0; i < urls.length; i++) {
                 const url = urls[i];
                 const auditResult = await this.accessibilityTester.audit(url, { wcagLevel: level });
-                if (auditResult.success) {
+                if (!auditResult.success) {
+                    notMeasured.push({ url, reason: auditResult.error.message });
+                }
+                else if (auditResult.value.measured !== true) {
+                    // #1145: an unmeasured page is reported as such, never as a pass,
+                    // a fail or a finding, and no audit event is published for it.
+                    reports.push(auditResult.value);
+                    notMeasured.push({ url, reason: auditResult.value.notMeasuredReason ?? 'not measured' });
+                }
+                else {
                     const report = auditResult.value;
                     reports.push(report);
                     totalViolations += report.violations.length;
@@ -319,12 +329,14 @@ export class VisualAccessibilityCoordinator extends BaseDomainCoordinator {
                 }
                 this.updateWorkflowProgress(workflowId, ((i + 1) / urls.length) * 100);
             }
-            // Calculate average score
-            const averageScore = reports.length > 0
-                ? Math.round(reports.reduce((sum, r) => sum + r.score, 0) / reports.length)
-                : 0;
-            // Identify top issues
-            const topIssues = this.identifyTopIssues(reports);
+            // Scores and top issues cover measured pages only (#1145)
+            const measuredReports = reports.filter((r) => r.measured === true);
+            const averageScore = measuredReports.length > 0
+                ? Math.round(measuredReports.reduce((sum, r) => sum + r.score, 0) / measuredReports.length)
+                : -1;
+            const topIssues = this.identifyTopIssues(measuredReports);
+            const status = notMeasured.length === 0 ? 'measured'
+                : measuredReports.length === 0 ? 'not-measured' : 'partial';
             const auditReport = {
                 totalUrls: urls.length,
                 passingUrls,
@@ -333,6 +345,14 @@ export class VisualAccessibilityCoordinator extends BaseDomainCoordinator {
                 averageScore,
                 reports,
                 topIssues,
+                status,
+                measuredUrls: measuredReports.length,
+                notMeasured,
+                ...(notMeasured.length > 0 ? {
+                    message: `Accessibility NOT MEASURED for ${notMeasured.length} of ${urls.length} URL(s); ` +
+                        'they count as neither passing nor failing and contribute no findings. ' +
+                        notMeasured.map((n) => `${n.url}: ${n.reason}`).join('; '),
+                } : {}),
             };
             this.completeWorkflow(workflowId);
             await this.agentCoordinator.stop(agentResult.value);
@@ -512,8 +532,9 @@ export class VisualAccessibilityCoordinator extends BaseDomainCoordinator {
             return err(result.error);
         }
         const report = result.value.reports[0];
-        if (!report) {
-            return ok({ violations: [], wcagLevel: options.wcagLevel, score: 100 });
+        if (!report || report.measured !== true) {
+            // #1145: no measured report is not a clean pass
+            return err(new Error(result.value.message ?? `Accessibility NOT MEASURED for ${options.url}`));
         }
         return ok({
             violations: report.violations,
@@ -562,6 +583,10 @@ export class VisualAccessibilityCoordinator extends BaseDomainCoordinator {
             if (!auditResult.success) {
                 return err(auditResult.error);
             }
+            if (auditResult.value.measured !== true) {
+                return err(new Error(`Color contrast NOT MEASURED for ${options.url}: ` +
+                    `${auditResult.value.notMeasuredReason ?? 'not audited'}. No findings were produced.`));
+            }
             // Filter for color contrast violations
             const contrastViolations = auditResult.value.violations.filter((v) => v.id.includes('color-contrast') || v.id.includes('contrast'));
             const issues = contrastViolations.flatMap((violation) => violation.nodes.map((node) => ({

package/dist/domains/visual-accessibility/interfaces.d.ts

@@ -319,8 +319,18 @@ export interface AccessibilityReport {
     readonly violations: AccessibilityViolation[];
     readonly passes: PassedRule[];
     readonly incomplete: IncompleteCheck[];
+    /** 0-100 when measured; -1 when `measured` is false (#1145), never a grade. */
     readonly score: number;
     readonly wcagLevel: 'A' | 'AA' | 'AAA';
+    /**
+     * True only when a browser loaded the page and ran the checks (#1145).
+     * `false` = nothing was measured: violations and passes are empty (or
+     * synthetic, in simulation mode), `score` is -1, and the report must not
+     * count as a finding, a pass or a fail.
+     */
+    readonly measured?: boolean;
+    /** Why the page was not measured, when `measured` is false (#1145). */
+    readonly notMeasuredReason?: string;
 }
 export interface PassedRule {
     readonly id: string;
@@ -339,6 +349,10 @@ export interface WCAGValidationResult {
     readonly failedCriteria: WCAGCriterion[];
     readonly passedCriteria: WCAGCriterion[];
     readonly score: number;
+    /** Always true: an unmeasured page yields an error, never a verdict (#1145). */
+    readonly measured?: boolean;
+    /** What the verdict does not cover (#1145). */
+    readonly limitations?: string[];
 }
 export interface KeyboardNavigationReport {
     readonly url: string;
@@ -495,9 +509,22 @@ export interface AccessibilityAuditReport {
     readonly passingUrls: number;
     readonly totalViolations: number;
     readonly criticalViolations: number;
+    /** Mean over measured URLs only; -1 when no URL was measured (#1145). */
     readonly averageScore: number;
     readonly reports: AccessibilityReport[];
     readonly topIssues: TopAccessibilityIssue[];
+    /**
+     * #1145: `measured` when every URL was audited in a browser, `partial` when
+     * some were, `not-measured` when none were. Counts, scores and top issues
+     * cover measured URLs only; unmeasured URLs are listed in `notMeasured`.
+     */
+    readonly status?: 'measured' | 'partial' | 'not-measured';
+    readonly measuredUrls?: number;
+    readonly notMeasured?: Array<{
+        readonly url: string;
+        readonly reason: string;
+    }>;
+    readonly message?: string;
 }
 export interface TopAccessibilityIssue {
     readonly ruleId: string;

package/dist/domains/visual-accessibility/plugin.js

@@ -480,6 +480,11 @@ export class VisualAccessibilityPlugin extends BaseDomainPlugin {
                             occurrences: issue.occurrences,
                             impact: issue.impact,
                         })),
+                        // #1145: unmeasured URLs are neither passing nor failing
+                        status: result.value.status,
+                        measuredUrls: result.value.measuredUrls,
+                        notMeasured: result.value.notMeasured,
+                        message: result.value.message,
                     });
                 }
                 return err(result.error);