agentic-qe 3.15.6 → 3.15.7

package/dist/workers/workers/quality-gate.js

@@ -2,13 +2,18 @@
  * Agentic QE v3 - Quality Gate Worker
  * ADR-014: Background Workers for QE Monitoring
  *
- * Continuous quality gate evaluation including:
- * - Multi-criteria quality assessment
- * - Release readiness scoring
- * - Blocking issue detection
- * - Quality trend tracking
+ * Continuously evaluates the measured quality gate and tracks its verdict.
+ *
+ * #1043: the gate is the canonical measured gate — the same evidence
+ * validation (`inspectQualityEvidence`) and thresholds
+ * (`evaluateQualityEvidence` / `resolveQualityThresholds`) the quality_assess
+ * tool uses. When any metric lacks usable evidence (absent, stale, malformed)
+ * the gate is not evaluated: nothing is stored and an info finding names the
+ * unmeasured metrics. A status without the measured stamp (the invented one
+ * written by <= 3.15.6) is ignored and replaced by the next measured verdict.
  */
 import { BaseWorker } from '../base-worker.js';
+import { INSUFFICIENT_EVIDENCE, QUALITY_METRICS, describeMissingMetrics, evaluateQualityEvidence, inspectQualityEvidence, } from '../../domains/quality-assessment/quality-evidence.js';
 const CONFIG = {
     id: 'quality-gate',
     name: 'Quality Gate Evaluator',
@@ -21,6 +26,21 @@ const CONFIG = {
     retryCount: 2,
     retryDelayMs: 5000,
 };
+const CURRENT_KEY = 'quality-gate:current';
+const HISTORY_KEY = 'quality-gate:history';
+const SCHEMA_VERSION = 1;
+const MAX_HISTORY = 100;
+/** The stored status when it is a measured verdict, else `null`. */
+function measuredStatus(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const r = raw;
+    if (r.measured !== true || r.schemaVersion !== SCHEMA_VERSION || typeof r.passed !== 'boolean'
+        || !Array.isArray(r.checks))
+        return null;
+    return r;
+}
+const comparator = (check) => (check.direction === 'min' ? '>=' : '<=');
 export class QualityGateWorker extends BaseWorker {
     constructor() {
         super(CONFIG);
@@ -30,318 +50,156 @@ export class QualityGateWorker extends BaseWorker {
         context.logger.info('Starting quality gate evaluation');
         const findings = [];
         const recommendations = [];
-        // Evaluate all quality gates
-        const gateStatus = await this.evaluateQualityGates(context);
-        // Analyze gate status
-        this.analyzeGateResults(gateStatus, findings, recommendations);
-        // Check for blockers
-        this.checkBlockers(gateStatus, findings, recommendations);
-        // Compare to previous
-        await this.compareToHistory(context, gateStatus, findings);
-        // Store current status
-        await context.memory.set('quality-gate:current', gateStatus);
-        await context.memory.set('quality-gate:lastCheck', new Date().toISOString());
-        // Add to history
-        const history = await context.memory.get('quality-gate:history') || [];
-        history.push(gateStatus);
-        if (history.length > 100)
+        const { values, problems } = await inspectQualityEvidence(context.memory);
+        const measuredValues = Object.fromEntries(QUALITY_METRICS.map((m) => [m, values[m] ?? 'unmeasured']));
+        if (problems.length > 0) {
+            const unmeasured = problems.map((p) => p.metric);
+            findings.push({
+                type: 'quality-gate-insufficient-evidence',
+                severity: 'info',
+                domain: 'quality-assessment',
+                title: 'Quality Gate Not Evaluated: Insufficient Evidence',
+                description: `${unmeasured.length} of ${QUALITY_METRICS.length} gate metrics have no usable measured evidence ` +
+                    `(${unmeasured.join(', ')}), so no verdict was reached and nothing was stored.`,
+                context: { status: INSUFFICIENT_EVIDENCE, unmeasured, problems },
+            });
+            for (const advice of describeMissingMetrics(unmeasured)) {
+                recommendations.push({
+                    priority: 'p3',
+                    domain: 'quality-assessment',
+                    action: 'Record Measured Quality Evidence',
+                    description: advice,
+                    estimatedImpact: 'medium',
+                    effort: 'low',
+                    autoFixable: false,
+                });
+            }
+            context.logger.info('Quality gate evaluation complete', { status: INSUFFICIENT_EVIDENCE, unmeasured });
+            return this.createResult(Date.now() - startTime, {
+                itemsAnalyzed: 0,
+                issuesFound: 0,
+                healthScore: 100,
+                trend: 'stable',
+                domainMetrics: {
+                    gateStatus: INSUFFICIENT_EVIDENCE,
+                    gatePassed: 'unmeasured',
+                    releaseReady: 'unmeasured',
+                    unmeasuredMetrics: unmeasured.length,
+                    ...measuredValues,
+                },
+            }, findings, recommendations);
+        }
+        const evaluation = evaluateQualityEvidence(values);
+        const failed = evaluation.checks.filter((c) => !c.passed);
+        const status = {
+            measured: true,
+            schemaVersion: SCHEMA_VERSION,
+            evaluatedAt: new Date().toISOString(),
+            passed: evaluation.passed,
+            passedChecks: evaluation.checks.length - failed.length,
+            failedChecks: failed.length,
+            checks: evaluation.checks,
+        };
+        this.analyzeGateResults(status, findings, recommendations);
+        await this.compareToPrevious(context, status, findings);
+        await context.memory.set(CURRENT_KEY, status);
+        await context.memory.set('quality-gate:lastCheck', status.evaluatedAt);
+        const stored = await context.memory.get(HISTORY_KEY);
+        const history = Array.isArray(stored) ? stored : [];
+        history.push(status);
+        while (history.length > MAX_HISTORY)
             history.shift();
-        await context.memory.set('quality-gate:history', history);
-        const healthScore = this.calculateHealthScore(gateStatus);
+        await context.memory.set(HISTORY_KEY, history);
+        const healthScore = this.calculateHealthScore(status);
         context.logger.info('Quality gate evaluation complete', {
             healthScore,
-            passed: gateStatus.passed,
-            releaseReady: gateStatus.releaseReady,
-            blockers: gateStatus.blockers,
+            passed: status.passed,
+            failedChecks: status.failedChecks,
         });
         return this.createResult(Date.now() - startTime, {
-            itemsAnalyzed: gateStatus.rules.length,
-            issuesFound: gateStatus.failedRules,
+            itemsAnalyzed: status.checks.length,
+            issuesFound: status.failedChecks,
             healthScore,
             trend: 'stable',
             domainMetrics: {
-                gatePassed: gateStatus.passed ? 'YES' : 'NO',
-                releaseReady: gateStatus.releaseReady ? 'YES' : 'NO',
-                passedRules: gateStatus.passedRules,
-                failedRules: gateStatus.failedRules,
-                blockers: gateStatus.blockers,
-                warnings: gateStatus.warnings,
+                gateStatus: 'evaluated',
+                gatePassed: status.passed ? 'YES' : 'NO',
+                releaseReady: status.passed ? 'YES' : 'NO',
+                passedChecks: status.passedChecks,
+                failedChecks: status.failedChecks,
+                ...measuredValues,
             },
         }, findings, recommendations);
     }
-    async evaluateQualityGates(_context) {
-        // Define quality gate rules
-        const rules = [
-            // Coverage rules
-            {
-                id: 'coverage-line',
-                name: 'Line Coverage',
-                category: 'coverage',
-                threshold: 80,
-                operator: 'gte',
-                currentValue: 78.5,
-                unit: '%',
-                blocking: true,
-            },
-            {
-                id: 'coverage-branch',
-                name: 'Branch Coverage',
-                category: 'coverage',
-                threshold: 70,
-                operator: 'gte',
-                currentValue: 65.2,
-                unit: '%',
-                blocking: false,
-            },
-            // Reliability rules
-            {
-                id: 'reliability-test-pass-rate',
-                name: 'Test Pass Rate',
-                category: 'reliability',
-                threshold: 95,
-                operator: 'gte',
-                currentValue: 98.2,
-                unit: '%',
-                blocking: true,
-            },
-            {
-                id: 'reliability-flaky-tests',
-                name: 'Flaky Test Count',
-                category: 'reliability',
-                threshold: 5,
-                operator: 'lte',
-                currentValue: 3,
-                unit: 'tests',
-                blocking: false,
-            },
-            // Security rules
-            {
-                id: 'security-critical-vulns',
-                name: 'Critical Vulnerabilities',
-                category: 'security',
-                threshold: 0,
-                operator: 'eq',
-                currentValue: 1,
-                unit: 'issues',
-                blocking: true,
-            },
-            {
-                id: 'security-high-vulns',
-                name: 'High Vulnerabilities',
-                category: 'security',
-                threshold: 3,
-                operator: 'lte',
-                currentValue: 2,
-                unit: 'issues',
-                blocking: false,
-            },
-            // Maintainability rules
-            {
-                id: 'maintainability-complexity',
-                name: 'Average Complexity',
-                category: 'maintainability',
-                threshold: 15,
-                operator: 'lte',
-                currentValue: 12,
-                unit: 'score',
-                blocking: false,
-            },
-            {
-                id: 'maintainability-duplication',
-                name: 'Code Duplication',
-                category: 'maintainability',
-                threshold: 5,
-                operator: 'lte',
-                currentValue: 3.2,
-                unit: '%',
-                blocking: false,
-            },
-            // Performance rules
-            {
-                id: 'performance-test-duration',
-                name: 'Avg Test Duration',
-                category: 'performance',
-                threshold: 500,
-                operator: 'lte',
-                currentValue: 245,
-                unit: 'ms',
-                blocking: false,
-            },
-        ];
-        // Evaluate each rule
-        let passedRules = 0;
-        let failedRules = 0;
-        let blockers = 0;
-        let warnings = 0;
-        for (const rule of rules) {
-            const passed = this.evaluateRule(rule);
-            if (passed) {
-                passedRules++;
-            }
-            else {
-                failedRules++;
-                if (rule.blocking) {
-                    blockers++;
-                }
-                else {
-                    warnings++;
-                }
-            }
-        }
-        return {
-            passed: blockers === 0,
-            passedRules,
-            failedRules,
-            blockers,
-            warnings,
-            releaseReady: blockers === 0 && warnings <= 2,
-            rules,
-        };
-    }
-    evaluateRule(rule) {
-        switch (rule.operator) {
-            case 'gte':
-                return rule.currentValue >= rule.threshold;
-            case 'lte':
-                return rule.currentValue <= rule.threshold;
-            case 'eq':
-                return rule.currentValue === rule.threshold;
-            default:
-                return false;
-        }
-    }
     analyzeGateResults(status, findings, recommendations) {
-        // Report failed rules
-        for (const rule of status.rules) {
-            if (!this.evaluateRule(rule)) {
-                const severity = rule.blocking ? 'critical' : 'medium';
-                findings.push({
-                    type: 'quality-gate-failure',
-                    severity,
-                    domain: 'quality-assessment',
-                    title: `Quality Gate Failed: ${rule.name}`,
-                    description: `${rule.name} is ${rule.currentValue}${rule.unit}, threshold is ${rule.operator === 'gte' ? '>=' : rule.operator === 'lte' ? '<=' : '='} ${rule.threshold}${rule.unit}`,
-                    context: {
-                        ruleId: rule.id,
-                        category: rule.category,
-                        currentValue: rule.currentValue,
-                        threshold: rule.threshold,
-                        blocking: rule.blocking,
-                    },
-                });
-            }
-        }
-        // Category-specific recommendations
-        const coverageFailures = status.rules
-            .filter(r => r.category === 'coverage' && !this.evaluateRule(r));
-        if (coverageFailures.length > 0) {
-            recommendations.push({
-                priority: coverageFailures.some(r => r.blocking) ? 'p0' : 'p2',
-                domain: 'quality-assessment',
-                action: 'Improve Test Coverage',
-                description: `${coverageFailures.length} coverage gates are failing. Add tests to increase coverage.`,
-                estimatedImpact: 'high',
-                effort: 'medium',
-                autoFixable: true,
-            });
-        }
-        const securityFailures = status.rules
-            .filter(r => r.category === 'security' && !this.evaluateRule(r));
-        if (securityFailures.length > 0) {
-            recommendations.push({
-                priority: 'p0',
+        const failed = status.checks.filter((c) => !c.passed);
+        for (const check of failed) {
+            findings.push({
+                type: 'quality-gate-failure',
+                severity: check.severity,
                 domain: 'quality-assessment',
-                action: 'Address Security Issues',
-                description: 'Security gates are failing. Resolve vulnerabilities before release.',
-                estimatedImpact: 'high',
-                effort: 'medium',
-                autoFixable: false,
+                title: `Quality Gate Failed: ${check.name}`,
+                description: `Measured ${check.name} is ${check.value}, threshold is ${comparator(check)} ${check.threshold}`,
+                context: {
+                    metric: check.name,
+                    value: check.value,
+                    threshold: check.threshold,
+                    direction: check.direction,
+                },
             });
         }
-    }
-    checkBlockers(status, findings, recommendations) {
-        if (status.blockers > 0) {
+        if (failed.length > 0) {
             findings.push({
                 type: 'release-blocked',
-                severity: 'critical',
+                severity: failed.some((c) => c.severity === 'critical') ? 'critical' : 'high',
                 domain: 'quality-assessment',
                 title: 'Release Blocked',
-                description: `${status.blockers} blocking issues prevent release`,
-                context: {
-                    blockers: status.blockers,
-                    blockingRules: status.rules
-                        .filter(r => r.blocking && !this.evaluateRule(r))
-                        .map(r => r.name),
-                },
+                description: `${failed.length} measured quality checks fail the gate`,
+                context: { failingMetrics: failed.map((c) => c.name) },
             });
             recommendations.push({
                 priority: 'p0',
                 domain: 'quality-assessment',
-                action: 'Resolve Release Blockers',
-                description: 'Address all blocking quality gate failures before proceeding with release.',
+                action: 'Resolve Failing Quality Checks',
+                description: `Fix ${failed.map((c) => c.name).join(', ')} before proceeding with release.`,
                 estimatedImpact: 'high',
                 effort: 'medium',
                 autoFixable: false,
             });
         }
-        else if (!status.releaseReady) {
-            findings.push({
-                type: 'release-warning',
-                severity: 'medium',
-                domain: 'quality-assessment',
-                title: 'Release Not Recommended',
-                description: `No blockers, but ${status.warnings} warnings suggest caution`,
-                context: { warnings: status.warnings },
-            });
-        }
     }
-    async compareToHistory(context, current, findings) {
-        const previous = await context.memory.get('quality-gate:current');
+    /** Compare with the previous verdict — only a measured one (#1043). */
+    async compareToPrevious(context, current, findings) {
+        const previous = measuredStatus(await context.memory.get(CURRENT_KEY));
         if (!previous)
             return;
-        // Check for regression
         if (previous.passed && !current.passed) {
             findings.push({
                 type: 'quality-gate-regression',
                 severity: 'high',
                 domain: 'quality-assessment',
                 title: 'Quality Gate Regression',
-                description: 'Quality gates were passing previously but are now failing',
-                context: {
-                    previousBlockers: previous.blockers,
-                    currentBlockers: current.blockers,
-                },
+                description: 'The measured quality gate was passing previously but is now failing',
+                context: { previousEvaluatedAt: previous.evaluatedAt, currentFailedChecks: current.failedChecks },
             });
         }
-        // Check for improvement
         if (!previous.passed && current.passed) {
             findings.push({
                 type: 'quality-gate-improvement',
                 severity: 'info',
                 domain: 'quality-assessment',
-                title: 'Quality Gates Now Passing',
-                description: 'All quality gates are now passing after previous failures',
-                context: {
-                    previousFailures: previous.failedRules,
-                    currentFailures: current.failedRules,
-                },
+                title: 'Quality Gate Now Passing',
+                description: 'The measured quality gate is now passing after previous failures',
+                context: { previousEvaluatedAt: previous.evaluatedAt },
             });
         }
     }
     calculateHealthScore(status) {
-        if (status.rules.length === 0)
+        if (status.checks.length === 0)
             return 100;
-        // Base score from pass rate
-        const passRate = status.passedRules / status.rules.length;
-        let score = passRate * 70;
-        // Penalty for blockers
-        score -= status.blockers * 15;
-        // Penalty for warnings
-        score -= status.warnings * 5;
-        // Bonus for release readiness
-        if (status.releaseReady) {
+        let score = (status.passedChecks / status.checks.length) * 90;
+        if (status.passed)
             score += 10;
-        }
         return Math.max(0, Math.min(100, Math.round(score)));
     }
 }

package/dist/workers/workers/security-scan-records.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Agentic QE v3 - security-scan worker: recorded scan parsing (#1043, #1049)
+ *
+ * Parses the `security:scan:<id>` records the security-compliance domain writes
+ * (OSV dependency scans and SAST scans) into what the security-scan worker
+ * reports. Nothing is filled in: a field a record does not carry stays absent.
+ */
+export declare const SCHEMA_VERSION = 1;
+/** The dependency scanner keeps its records for 7 days; nothing older is current. */
+export declare const MAX_SCAN_AGE_MS: number;
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'informational';
+export declare const SEVERITIES: readonly Severity[];
+export declare const CVE_ID: RegExp;
+export interface ScanCounts {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    informational: number;
+}
+/** A vulnerability as a recorded scan reported it; nothing is filled in. */
+export interface ReportedVulnerability {
+    severity: Severity;
+    title: string;
+    description: string;
+    category: string;
+    /** Dependency name (dependency scan) — only when the record names it. */
+    package?: string;
+    /** `file:line` (SAST) — only when the record locates it. */
+    location?: string;
+    /** CVE id exactly as the advisory carried it; absent when it carried none. */
+    cve?: string;
+    fixedIn?: string;
+    references: string[];
+}
+export interface RecordedScan {
+    scanId: string;
+    scannedAt: string;
+    summary: ScanCounts;
+    /** Vulnerabilities the record lists (SAST keeps only critical/high). */
+    vulnerabilities: ReportedVulnerability[];
+    /** Total the scan found, including ones the record does not list. */
+    total: number;
+}
+/** A package the OSV lookup could not check (#1049 record contract). */
+export interface UncheckedPackage {
+    name: string;
+    version: string;
+    reason: string;
+}
+/**
+ * A dependency scan whose OSV lookup was not complete (#1049): `incomplete`,
+ * `failed`, or a pre-#1049 record without `status` — which cannot be told
+ * apart from a failed lookup recorded as clean. Never "0 vulnerabilities".
+ */
+export interface IncompleteDependencyScan {
+    scan: RecordedScan;
+    status: 'incomplete' | 'failed' | 'unknown';
+    error?: string;
+    uncheckedPackages: UncheckedPackage[];
+    /** Packages the lookup did check, when the record states it. */
+    packagesChecked?: number;
+}
+/** The `security:lastScan` record: only scans that actually ran (#1043). */
+export interface MeasuredSecurityScan {
+    measured: true;
+    schemaVersion: typeof SCHEMA_VERSION;
+    evaluatedAt: string;
+    dependency: (RecordedScan & {
+        source: 'osv';
+    }) | null;
+    code: (RecordedScan & {
+        source: 'sast';
+    }) | null;
+}
+export declare const isCount: (v: unknown) => v is number;
+export declare const isRecord: (v: unknown) => v is Record<string, unknown>;
+export declare function parseCounts(raw: unknown): ScanCounts | null;
+/** `scannedAt` when the record's timestamp is valid, not in the future and within the scanner's retention. */
+export declare function parseScannedAt(raw: unknown, now: number): string | null;
+export declare function parseVulnerability(raw: unknown, kind: 'dependency' | 'sast'): ReportedVulnerability | null;
+export declare function parseUnchecked(raw: unknown): UncheckedPackage[];
+/**
+ * #1049: a dependency scan is a measurement only when its OSV lookup checked
+ * every requested package (`measured: true` and `status: 'complete'`).
+ */
+export declare function dependencyCompleteness(raw: Record<string, unknown>): {
+    complete: true;
+} | {
+    complete: false;
+    status: IncompleteDependencyScan['status'];
+    error?: string;
+    uncheckedPackages: UncheckedPackage[];
+    packagesChecked?: number;
+};
+export declare const SEVERITY_LABEL: Record<Severity, string>;
+/** Health penalty for the real critical/high advisories of a partial dependency scan (#1049). */
+export declare function partialDependencyPenalty(incomplete: IncompleteDependencyScan | null): number;
+/** What a partial dependency scan did check; the dependency totals stay 'unmeasured' (#1049). */
+export declare function partialDependencyMetrics(incomplete: IncompleteDependencyScan | null): Record<string, number>;
+export type ParsedScan = {
+    kind: 'sast';
+    scan: RecordedScan;
+} | {
+    kind: 'dependency';
+    scan: RecordedScan;
+    completeness: ReturnType<typeof dependencyCompleteness>;
+};
+/** A recorded dependency (OSV) or SAST scan, or `null` when the record is not one. */
+export declare function parseRecordedScan(raw: unknown, now: number): ParsedScan | null;
+//# sourceMappingURL=security-scan-records.d.ts.map