agentic-qe 3.15.17 → 3.15.18

package/.claude/skills/holistic-testing-pact/SKILL.md

@@ -4,7 +4,7 @@ description: "Apply the Holistic Testing Model evolved with PACTS (Proactive, Au
 category: testing-methodologies
 priority: critical
 tokenEstimate: 1100
-agents: [qe-fleet-commander, qe-test-generator, qe-quality-analyzer, qe-requirements-validator]
+agents: [qe-fleet-commander, qe-test-architect, qe-quality-gate, qe-requirements-validator]
 implementation_status: optimized
 optimization_version: 1.0
 last_optimized: 2025-12-02
@@ -27,7 +27,7 @@ When designing test strategies or building quality into teams:
 
 **Quick PACTS Application:**
 - Proactive → Design testability into architecture, risk analysis during refinement
-- Autonomous → Devs run tests locally, CI pipeline with no manual gates
+- Autonomous → Devs run tests locally, CI gates automated wherever risk and regulation allow
 - Collaborative → Three Amigos, QE pairs with dev, shared test ownership
 - Targeted → Risk-based planning, focus on critical flows, kill valueless tests
 - Structured → Governance, observability, and explainability of agent behavior; measure confidence, not trust
@@ -66,10 +66,10 @@ When designing test strategies or building quality into teams:
 ### Agent Selection by PACTS + Quadrant
 | PACTS Dimension | Agents |
 |----------------|--------|
-| Proactive + Tech | qe-test-generator, qe-requirements-validator |
-| Autonomous + Tech | qe-test-executor, qe-coverage-analyzer |
+| Proactive + Tech | qe-test-architect, qe-requirements-validator |
+| Autonomous + Tech | qe-parallel-executor, qe-coverage-specialist |
 | Collaborative | qe-fleet-commander (orchestration) |
-| Targeted | qe-regression-risk-analyzer, qe-quality-gate |
+| Targeted | qe-regression-analyzer, qe-quality-gate |
 | Structured | qe-fleet-commander, qe-quality-gate (governance, observability, explainability) |
 
 ---
@@ -89,7 +89,7 @@ await Task("Risk Analysis", {
 ### Autonomous: Teams Own Quality
 - Developers run full test suite locally
 - CI fails fast with clear diagnostics
-- No manual deployment approvals
+- Deployment approvals automated where the risk allows; where regulation or risk requires a human sign-off, make it fast and evidence-based rather than a queue
 - Self-service test environments
 
 ### Collaborative: Whole-Team Thinking
@@ -105,7 +105,7 @@ await Task("Risk Analysis", {
 await Task("Risk-Based Planning", {
   critical: ['checkout', 'payment'],
   light: ['admin-panel', 'settings']
-}, "qe-regression-risk-analyzer");
+}, "qe-regression-analyzer");
 ```
 
 ### Structured: Governance, Observability, Explainability
@@ -136,7 +136,7 @@ PACT originated with Reuven Cohen (Agentics Foundation) and was adapted to quali
 engineering by Dragan Spiridonov. PACTS adds a fifth principle — **Structured** —
 inspired by DORA's research on AI-assisted delivery and platform-engineering
 quality measurement. The addition reflects that autonomous, agentic quality work
-needs governance, observability, and explainability to be trustworthy at scale.
+needs governance, observability, and explainability to earn confidence at scale.
 
 ---
 
@@ -153,7 +153,7 @@ needs governance, observability, and explainability to be trustworthy at scale.
 
 ## Success Signals
 
-- Features deploy multiple times per day
+- Deployments happen as often as the business and its risk profile need, without fear (a medical device and a consumer web app have different right answers)
 - Bug escape rate trending down
 - Team discusses quality naturally
 - Developers write tests without being told
@@ -179,9 +179,9 @@ const holisticFleet = await FleetManager.coordinate({
   pacts: { proactive: true, autonomous: true, collaborative: true, targeted: true, structured: true },
   agents: [
     'qe-fleet-commander',       // Orchestration
-    'qe-test-generator',        // Tech quadrant
+    'qe-test-architect',        // Tech quadrant
     'qe-requirements-validator', // Business quadrant
-    'qe-quality-analyzer'       // Metrics
+    'qe-quality-gate'           // Quality decisions
   ],
   topology: 'mesh'
 });

package/.claude/skills/sherlock-review/SKILL.md

@@ -15,6 +15,7 @@ trust_tier: 2
 validation:
   schema_path: schemas/output.json
   validator_path: scripts/validate-config.json
+  eval_path: evals/sherlock-review.yaml
 ---
 
 # Sherlock Review
@@ -68,6 +69,7 @@ npm test -- --coverage
 | ⚠ **PARTIALLY TRUE** | Claim accurate but incomplete |
 | ✗ **FALSE** | Evidence contradicts claim |
 | ? **NONSENSICAL** | Claim doesn't apply to context |
+| … **UNVERIFIED** | Not enough evidence either way; state what would settle it |
 
 ---
 
@@ -100,8 +102,8 @@ npm test -- --coverage
 1. [Action based on findings]
 ```
 
-## Minimum Findings Enforcement
-Every investigation MUST surface at least 3 weighted observations (CRITICAL=3, HIGH=2, MEDIUM=1, LOW=0.5). Elementary observations count at INFORMATIONAL=0.25 weight. A Sherlock investigation that finds nothing is a failed investigation -- Holmes always finds clues.
+## Evidence Over Volume (No Findings Quota)
+Every finding and every verdict must chain to observable evidence: code, command output, test results, history. There is no minimum number of observations. When the evidence supports the claim, the correct verdict is TRUE (the output schema's `case-closed-clean`), with a list of what was examined. Manufacturing clues to make an investigation look productive is the same failure Sherlock exists to catch. If the evidence is insufficient either way, say so, state what would settle it, and do not guess.
 
 ---
 

package/.claude/skills/sherlock-review/evals/sherlock-review.yaml

@@ -0,0 +1,124 @@
+# =============================================================================
+# AQE Skill Evaluation Test Suite: Sherlock Review v1.0.0
+# =============================================================================
+#
+# Guards evidence-over-volume investigations:
+# - A claim the evidence supports is closed clean, without manufactured clues
+# - A claim the evidence contradicts is called FALSE with the evidence
+# - A claim with no evidence either way is UNVERIFIED, not guessed
+#
+# Schema: .claude/skills/.validation/schemas/skill-eval.schema.json
+# Output schema: .claude/skills/sherlock-review/schemas/output.json
+#
+# =============================================================================
+
+skill: sherlock-review
+version: 1.0.0
+description: >
+  Evaluation suite for sherlock-review. Verifies verdicts follow the evidence:
+  TRUE when supported, FALSE when contradicted, UNVERIFIED when the evidence
+  is missing, and no invented observations to make an investigation look busy.
+
+models_to_test:
+  - claude-sonnet-5      # Primary
+  - claude-haiku-4-5     # Minimum quality floor
+
+test_cases:
+
+  - id: tc001_supported_claim_closes_clean
+    description: "A PR whose code and test match its description is closed clean"
+    category: verdicts
+    priority: critical
+    input:
+      prompt: "Investigate this PR claim: 'Adds retry with exponential backoff (max 3 attempts) to fetchProfile'."
+      code: |
+        export async function fetchProfile(id: string, get = httpGet, sleep = delay) {
+          for (let attempt = 0; attempt < 3; attempt++) {
+            try { return await get(`/profiles/${id}`); }
+            catch (err) {
+              if (attempt === 2) throw err;
+              await sleep(100 * 2 ** attempt);
+            }
+          }
+        }
+
+        test('retries with backoff then succeeds', async () => {
+          const get = jest.fn().mockRejectedValueOnce(new Error('x')).mockResolvedValue({ id: 'p1' });
+          const sleep = jest.fn().mockResolvedValue(undefined);
+          await expect(fetchProfile('p1', get, sleep)).resolves.toEqual({ id: 'p1' });
+          expect(sleep).toHaveBeenCalledWith(100);
+        });
+        test('gives up after 3 attempts', async () => {
+          const get = jest.fn().mockRejectedValue(new Error('down'));
+          await expect(fetchProfile('p1', get, jest.fn())).rejects.toThrow('down');
+          expect(get).toHaveBeenCalledTimes(3);
+        });
+      context:
+        language: typescript
+    expected_output:
+      must_match_regex:
+        - "\\b(true|case-closed-clean|supported)\\b"
+      # Documented intent (not yet enforced by parallel-eval-runner):
+      finding_count:
+        min: 0
+        max: 2
+      custom_assertions:
+        - type: semantic
+          expression: "The verdict is that the claim holds; any recommendation is minor, and no defects are invented."
+          expected: true
+    validation:
+      schema_check: true
+
+  - id: tc002_contradicted_claim_is_false
+    description: "A claim the code contradicts is called FALSE with the evidence"
+    category: verdicts
+    priority: critical
+    input:
+      prompt: "Investigate this PR claim: 'Eliminates the race condition by adding mutex locking'."
+      code: |
+        // before: callbacks fired saveA and saveB concurrently
+        export async function saveBoth(a: Doc, b: Doc) {
+          await saveA(a);
+          await saveB(b);
+        }
+      context:
+        language: typescript
+    expected_output:
+      must_contain:
+        - "FALSE"
+        - "mutex"
+      custom_assertions:
+        - type: semantic
+          expression: "The investigation notes there is no mutex or lock in the code and that the race is avoided by sequencing the awaits, citing the code."
+          expected: true
+    validation:
+      schema_check: true
+      keyword_match_threshold: 0.8
+
+  - id: tc003_missing_evidence_is_unverified
+    description: "A performance claim with no benchmark is UNVERIFIED, with what would settle it"
+    category: verdicts
+    priority: high
+    input:
+      prompt: "Investigate this PR claim: 'Improves search performance by 50%'. The PR changes a loop to use a Map lookup and includes no benchmark."
+    expected_output:
+      must_match_regex:
+        - "(unverified|insufficient evidence|not enough evidence)"
+      custom_assertions:
+        - type: semantic
+          expression: "The response does not confirm or deny the 50% figure, and names the benchmark that would settle it."
+          expected: true
+    validation:
+      schema_check: false
+
+success_criteria:
+  pass_rate: 0.9
+  critical_pass_rate: 1.0
+  max_execution_time_ms: 300000
+
+metadata:
+  author: "agentic-qe"
+  created: "2026-10-29"
+  coverage_target: >
+    Verdicts that follow the evidence: clean close, FALSE on contradiction,
+    UNVERIFIED on missing evidence.

package/.claude/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.17",
+    "fleetVersion": "3.15.18",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/.claude/skills/technical-writing/SKILL.md

@@ -14,6 +14,7 @@ tags: [writing, documentation, communication, blogs, tutorials]
 trust_tier: 1
 validation:
   schema_path: schemas/output.json
+  eval_path: evals/technical-writing.yaml
 ---
 
 # Technical Writing
@@ -21,10 +22,11 @@ validation:
 <default_to_action>
 When writing technical content:
 1. LEAD with value (what will reader learn/gain?)
-2. SHOW, don't tell (specific examples, code, numbers)
+2. SHOW, don't tell (specific examples, code, and numbers you measured or can source)
 3. STRUCTURE for scanning (headers, bold, short paragraphs)
 4. CUT ruthlessly (every sentence must earn its place)
 5. BE honest about trade-offs
+6. NEVER invent figures: every number, duration, and date traces to a source (tracker, benchmark, PR, release note). Missing a number? Write `[number?]` and ask, or describe what changed without one.
 
 **Blog Post Structure:**
 ```markdown
@@ -55,10 +57,13 @@ When writing technical content:
 
 | Principle | Bad | Good |
 |-----------|-----|------|
-| **Lead with value** | "In today's landscape..." | "Here's how we cut bugs 60%" |
-| **Show, don't tell** | "We improved testing" | "Bug detection: 12→47 per sprint" |
-| **Be specific** | "Performance improved" | "Response time: 2.3s→180ms" |
-| **Honest trade-offs** | "This approach is best" | "TDD slowed velocity 20%, reduced bugs 75%" |
+| **Lead with value** | "In today's landscape..." | "Here's what changed when we moved testing into refinement" |
+| **Show, don't tell** | "We improved testing" | "Bugs found per sprint, before and after, from our tracker: [before]→[after]" |
+| **Be specific** | "Performance improved" | "p95 response time before and after, with how and where it was measured" |
+| **Honest trade-offs** | "This approach is best" | "TDD slowed our first features; here is what we got back, with the numbers we measured" |
+| **Source every figure** | "Coverage jumped 40%" (from memory) | The figure plus where it came from, or no figure at all |
+
+Bracketed values are placeholders for your own measured data. Never fill them with plausible-sounding numbers.
 
 ### Words to Cut
 
@@ -99,6 +104,7 @@ Before publishing:
 - [ ] Title promises something specific
 - [ ] Opening hooks in 30 seconds
 - [ ] Claims backed by examples
+- [ ] Every number, duration, and date traced to a source (or removed)
 - [ ] All unnecessary words cut
 - [ ] Code examples tested and correct
 - [ ] Takeaway crystal clear
@@ -120,7 +126,7 @@ Before publishing:
 "The benefits of this approach are numerous and include improved quality, faster feedback loops, and better team collaboration."
 
 **After:**
-"Three outcomes: bugs found 2 days earlier on average, 30% fewer regression issues, and devs now ask QE for input during design."
+"Three outcomes: bugs now surface during refinement instead of after merge, the regression suite stopped growing with every release, and developers ask QE for input during design." (Add figures only if you measured them, and say where they came from.)
 
 ---
 

package/.claude/skills/technical-writing/evals/technical-writing.yaml

@@ -0,0 +1,96 @@
+# =============================================================================
+# AQE Skill Evaluation Test Suite: Technical Writing v1.0.0
+# =============================================================================
+#
+# Guards the "never invent figures" rule:
+# - No numbers appear that the input did not provide
+# - Provided numbers are used accurately, with their source
+# - Missing data is marked or asked for, not filled in
+#
+# Schema: .claude/skills/.validation/schemas/skill-eval.schema.json
+#
+# =============================================================================
+
+skill: technical-writing
+version: 1.0.0
+description: >
+  Evaluation suite for technical-writing. Verifies that writing stays factual:
+  no invented statistics, accurate use of provided figures, and explicit
+  placeholders or questions when data is missing.
+
+models_to_test:
+  - claude-sonnet-5      # Primary
+  - claude-haiku-4-5     # Minimum quality floor
+
+test_cases:
+
+  - id: tc001_no_invented_numbers
+    description: "With no metrics in the input, the draft contains no percentages or numeric outcomes"
+    category: factual_accuracy
+    priority: critical
+    input:
+      prompt: >
+        Write a three-paragraph blog introduction about our team moving
+        exploratory testing into story refinement. We have not measured
+        the impact yet.
+    expected_output:
+      must_not_contain:
+        - "%"
+      custom_assertions:
+        - type: semantic
+          expression: "The draft states no quantitative outcomes (counts, percentages, durations) that were not in the input."
+          expected: true
+    validation:
+      schema_check: false
+
+  - id: tc002_uses_provided_numbers_with_source
+    description: "Provided figures are reproduced exactly and attributed to their source"
+    category: factual_accuracy
+    priority: critical
+    input:
+      prompt: >
+        Write a short paragraph for a release blog post. From our defect
+        tracker: escaped defects went from 14 in Q1 to 6 in Q2 after we added
+        contract tests. Do not add other numbers.
+    expected_output:
+      must_contain:
+        - "\\b14\\b"
+        - "\\b6\\b"
+        - "tracker"
+      custom_assertions:
+        - type: semantic
+          expression: "The paragraph uses only the figures 14 and 6 (and Q1/Q2), attributes them to the defect tracker, and adds no other statistics."
+          expected: true
+    validation:
+      schema_check: false
+      keyword_match_threshold: 1.0
+
+  - id: tc003_marks_missing_data
+    description: "When asked to include a figure that was not provided, the draft marks it or asks for it"
+    category: factual_accuracy
+    priority: high
+    input:
+      prompt: >
+        Write a LinkedIn-length summary of our migration from Selenium to
+        Playwright, including how much faster the suite got.
+    expected_output:
+      must_match_regex:
+        - "(\\[(number|date|duration)\\?\\]|how much faster|could you share|what was the|do you have)"
+      custom_assertions:
+        - type: semantic
+          expression: "The response does not state a specific speed-up; it uses a placeholder or asks for the measured figure."
+          expected: true
+    validation:
+      schema_check: false
+
+success_criteria:
+  pass_rate: 0.9
+  critical_pass_rate: 1.0
+  max_execution_time_ms: 300000
+
+metadata:
+  author: "agentic-qe"
+  created: "2026-10-29"
+  coverage_target: >
+    Factual accuracy in technical writing: no invented figures, accurate
+    sourced figures, and explicit handling of missing data.

package/.opencode/skills/qe-agentic-quality-engineering.yaml

@@ -19,10 +19,10 @@ steps:
     prompt: |
       Coordination Patterns
   - name: success-criteria
-    description: "✅ 10x deployment frequency with same/better quality ✅ Coverage gaps detected in real-time ✅ Bugs caught pre-production ❌ Agents acting without human oversight on critical decisions ❌ Deploying all 19 agents at once (start with 1-2)"
+    description: "✅ Deployment frequency rises without escaped defects rising (measured against your own baseline) ✅ Coverage gaps detected in real-time ✅ Bugs caught pre-production ❌ Agents acting without human oversight on critical decisions ❌ Deploying all 19 agents at once (start with 1-2)"
     tools: ["bash", "read"]
     prompt: |
-      ✅ 10x deployment frequency with same/better quality ✅ Coverage gaps detected in real-time ✅ Bugs caught pre-production ❌ Agents acting without human oversight on critical decisions ❌ Deploying all 19 agents at once (start with 1-2)
+      ✅ Deployment frequency rises without escaped defects rising (measured against your own baseline) ✅ Coverage gaps detected in real-time ✅ Bugs caught pre-production ❌ Agents acting without human oversight on critical decisions ❌ Deploying all 19 agents at once (start with 1-2)
   - name: core-concepts
     description: "Core Concepts"
     tools: ["bash", "read"]

package/.opencode/skills/qe-holistic-testing-pact.yaml

@@ -29,10 +29,10 @@ steps:
     prompt: |
       Proactive: Test Before Bugs
   - name: autonomous-teams-own-quality
-    description: "- Developers run full test suite locally - CI fails fast with clear diagnostics - No manual deployment approvals - Self-service test environments"
+    description: "- Developers run full test suite locally - CI fails fast with clear diagnostics - Deployment approvals automated where the risk allows; where regulation or risk requires a human sign-off, make it fast and evidence-based rather than a queue - Self-service test environments"
     tools: ["bash", "read"]
     prompt: |
-      - Developers run full test suite locally - CI fails fast with clear diagnostics - No manual deployment approvals - Self-service test environments
+      - Developers run full test suite locally - CI fails fast with clear diagnostics - Deployment approvals automated where the risk allows; where regulation or risk requires a human sign-off, make it fast and evidence-based rather than a queue - Self-service test environments
   - name: collaborative-whole-team-thinking
     description: "- QE attends planning and refinement - Three Amigos for every user story - Shared ownership of test code - Ensemble testing for complex scenarios"
     tools: ["bash", "read"]

package/CHANGELOG.md

@@ -5,6 +5,129 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.15.18] - 2026-11-01
+
+AQE no longer fails with "database is locked" when several processes open a
+new database at once, and cloud sync reads a `memory.db` that is not in WAL
+mode without changing it. Git timeouts and failures are no longer reported
+as "no changes", and predictions built on them report lower confidence.
+`aqe coverage` says why it refused a coverage report instead of reading a
+file outside the project or hanging on a FIFO. Learned patterns are moved
+and merged safely, re-seeding no longer duplicates them, and a recreated
+`memory.db` can no longer overwrite a richer brain checkpoint.
+
+### Fixed
+
+- **Concurrent first open of a database** ([#1164], [#1319]): when the MCP
+  server, hooks and the CLI opened a database that was not yet in WAL mode
+  at the same moment, about 1 in 20 opens failed with "database is locked".
+  The switch to WAL is now retried within the busy timeout. With
+  `AQE_DISABLE_WAL` set, AQE no longer switches the database back to WAL.
+- **Cloud sync reads a non-WAL `memory.db`** ([#1320], [#1324]): `aqe sync`
+  and `aqe sync status` opened the database read-only and then tried to
+  switch it to WAL, so every SQLite source was skipped with "attempt to
+  write a readonly database". The reader now leaves the file's journal mode
+  unchanged and reads DELETE-mode and WAL-mode databases alike.
+- **Git timeouts are not "no changes"** ([#1165], [#1327]): a git timeout,
+  output overflow or failed git call no longer reads as an empty history or
+  an empty change set, and nothing is cached from it. The quality daemon's
+  git watcher retries a timed-out diff instead of skipping the commit.
+  Overlapping defect predictions on the same file each keep their own
+  deadline and warning.
+- **`aqe coverage` says why a report was refused** ([#1186], [#1335]): a
+  coverage report symlinked out of the project, a FIFO or device, or a file
+  over the size limit is named with the reason in `aqe coverage`,
+  `aqe fleet run analyze` and MCP `coverage_analyze_sublinear`. Before,
+  `aqe coverage` read a `coverage-final.json` symlinked out of the project
+  and reported it as measured coverage, and hung on a FIFO. Hardlink
+  refusal is tracked in [#1329] and the remaining unconfined reader in
+  [#1337].
+- **Cross-domain pattern seeding is idempotent** ([#1325], [#1334]): if
+  the "already seeded" flag was lost while the patterns remained, each
+  session copied patterns again, including copies of copies, and the
+  pattern table kept growing. A re-run now adds nothing. Cleanup of
+  duplicates left by earlier versions is tracked in [#1332].
+- **Pattern archive moves and merges** ([#1149], [#1314]): a pattern is
+  deleted only after its archive copy is read back in full and matches.
+  A usage update made during a move is kept, and a merge that fails part
+  way is rolled back or reports exactly which sources were removed.
+- **A recreated `memory.db` no longer overwrites a richer brain
+  checkpoint** ([#1251], [#1316]): the end-of-turn hook keeps the existing
+  `.agentic-qe/aqe.rvf` if a table collapsed, logs why once and backs off.
+  Routine retention, `aqe learning prune --apply` and dream retention are
+  still checkpointed. A global `aqe` too old for the new export options
+  keeps the checkpoint and says to upgrade.
+- **Defect prediction history** ([#1137], [#1315]): pruning no longer
+  deletes runs it cannot parse, the latest run for every target is kept,
+  and a stored run is not reported as failed when only cleanup failed. The
+  background worker reports health as unmeasured, not 100, when it
+  measured nothing.
+- **First start after upgrading with float noise** ([#1302], [#1317]): a
+  project's embedding space created before 3.15.17 is kept, after checking
+  that the current embedder reproduces stored vectors, instead of being
+  split into a new space.
+- **Learning outcomes** ([#1147], [#1321]): failed runs no longer create
+  learned patterns, a domain whose runs all failed is no longer listed as
+  top performing, and `learn` says why it learned nothing. A test file
+  that does not exist is reported as a caller error, not a failed test.
+
+### Changed
+
+- **`aqe coverage` exit code for a refused report** ([#1335]): when the
+  coverage report is refused, `aqe coverage` exits **3** and labels the
+  figures UNMEASURED (a static estimate, no threshold verdict). Before, it
+  exited 0. Scripts that treated exit 0 as "coverage measured" now see the
+  failure.
+- **Defect prediction confidence after a git timeout** ([#1327]): a
+  prediction for a file whose git history timed out reports half its
+  confidence share (0.375 instead of 0.75 for a single file), together
+  with the timeout warning.
+- **Domain-filtered pattern search with an empty query** ([#1334]): the RVF
+  pattern store now filters by domain in SQL, so it returns the domain's
+  patterns up to the limit. Before, it filtered the top rows of the whole
+  table and could miss most of a domain.
+- **Review and writing skills** ([#1312]): `brutal-honesty-review`,
+  `sherlock-review` and `code-review-quality` no longer require a minimum
+  number of findings. A clean change can get a clean verdict, and the
+  `brutal-honesty-review` output schema now requires an `evidence` field
+  for each finding. `sherlock-review` adds an `UNVERIFIED` verdict.
+  `technical-writing` and `agentic-quality-engineering` no longer contain
+  invented statistics, and agent names in those skills use the current v3
+  names (for example `qe-test-architect` instead of `qe-test-generator`).
+  These skills are installed by `aqe init`.
+- **Dev dependencies** ([#1308], [#1311]): lockfile updates for `qs`,
+  `body-parser`, `ip-address` and `protobufjs` resolve `npm audit`
+  advisories. All are dev-only; the published package was not affected.
+  The remaining dev-only findings are tracked in [#1310].
+
+[#1137]: https://github.com/proffesor-for-testing/agentic-qe/issues/1137
+[#1147]: https://github.com/proffesor-for-testing/agentic-qe/issues/1147
+[#1149]: https://github.com/proffesor-for-testing/agentic-qe/issues/1149
+[#1164]: https://github.com/proffesor-for-testing/agentic-qe/issues/1164
+[#1165]: https://github.com/proffesor-for-testing/agentic-qe/issues/1165
+[#1186]: https://github.com/proffesor-for-testing/agentic-qe/issues/1186
+[#1251]: https://github.com/proffesor-for-testing/agentic-qe/issues/1251
+[#1302]: https://github.com/proffesor-for-testing/agentic-qe/issues/1302
+[#1308]: https://github.com/proffesor-for-testing/agentic-qe/pull/1308
+[#1310]: https://github.com/proffesor-for-testing/agentic-qe/issues/1310
+[#1311]: https://github.com/proffesor-for-testing/agentic-qe/pull/1311
+[#1312]: https://github.com/proffesor-for-testing/agentic-qe/pull/1312
+[#1314]: https://github.com/proffesor-for-testing/agentic-qe/pull/1314
+[#1315]: https://github.com/proffesor-for-testing/agentic-qe/pull/1315
+[#1316]: https://github.com/proffesor-for-testing/agentic-qe/pull/1316
+[#1317]: https://github.com/proffesor-for-testing/agentic-qe/pull/1317
+[#1319]: https://github.com/proffesor-for-testing/agentic-qe/pull/1319
+[#1320]: https://github.com/proffesor-for-testing/agentic-qe/issues/1320
+[#1321]: https://github.com/proffesor-for-testing/agentic-qe/pull/1321
+[#1324]: https://github.com/proffesor-for-testing/agentic-qe/pull/1324
+[#1325]: https://github.com/proffesor-for-testing/agentic-qe/issues/1325
+[#1327]: https://github.com/proffesor-for-testing/agentic-qe/pull/1327
+[#1329]: https://github.com/proffesor-for-testing/agentic-qe/issues/1329
+[#1332]: https://github.com/proffesor-for-testing/agentic-qe/issues/1332
+[#1334]: https://github.com/proffesor-for-testing/agentic-qe/pull/1334
+[#1335]: https://github.com/proffesor-for-testing/agentic-qe/pull/1335
+[#1337]: https://github.com/proffesor-for-testing/agentic-qe/issues/1337
+
 ## [3.15.17] - 2026-10-28
 
 Python projects can run their pytest suites through AQE, and those runs now