agentic-qe 3.15.6 → 3.15.8

package/dist/coordination/protocols/security-audit.js

@@ -137,6 +137,12 @@ export class SecurityAuditProtocol {
             if (depResult.success) {
                 this.currentAudit = { ...this.currentAudit, dependencyResult: depResult.value };
                 await this.publishDependencyVulnerabilities(depResult.value.vulnerabilities);
+                // #1049: a failed or partial advisory lookup (or a result without a
+                // status, which cannot show it was complete) is not a clean dependency scan.
+                if (depResult.value.status !== 'complete') {
+                    this.recordIncompleteCheck(depResult.value.error
+                        ?? `Dependency advisories could not be checked for ${depResult.value.uncheckedPackages?.length ?? 'unknown number of'} package(s)`);
+                }
             }
             else {
                 this.recordIncompleteCheck('Dependency scan did not complete');
@@ -280,6 +286,11 @@ export class SecurityAuditProtocol {
                             vulnerabilities: scanResult.value.vulnerabilities,
                             outdatedPackages: [],
                             summary: scanResult.value.summary,
+                            status: scanResult.value.status,
+                            measured: scanResult.value.measured,
+                            packagesChecked: scanResult.value.packagesChecked,
+                            uncheckedPackages: scanResult.value.uncheckedPackages,
+                            ...(scanResult.value.error ? { error: scanResult.value.error } : {}),
                         });
                     }
                 }

package/dist/coordination/result-saver.d.ts

@@ -88,6 +88,15 @@ export declare class ResultSaver {
      * `name-1.ext`, `name-2.ext`, … instead of replacing the earlier file (#1007).
      */
     private writeNewFile;
+    /**
+     * File name for a generated test source: the sanitized name capped at
+     * MAX_GENERATED_STEM_LENGTH characters (a long source file name would
+     * otherwise exceed the filesystem's 255-byte limit once the temp-file suffix
+     * is added) plus a short hash of the source path and full name. The hash keeps
+     * `src/one/math.ts` and `src/two/math.ts` (or a truncated long name) from
+     * overwriting each other, while the same test still maps to the same file.
+     */
+    private generatedTestFilename;
     private sanitizeFilename;
     private getTestExtension;
     private createFileEntry;

package/dist/coordination/result-saver.js

@@ -7,6 +7,8 @@ import * as path from 'path';
 import { createHash, randomBytes } from 'crypto';
 import { safeJsonParse } from '../shared/safe-json.js';
 import { getProjectStorePath } from '../kernel/project-root.js';
+/** Cap on the sanitized stem of a generated test file name (see generatedTestFilename). */
+const MAX_GENERATED_STEM_LENGTH = 100;
 function securityReportExecution(data) {
     return data.evidence?.completeness === 'complete' ? 'completed'
         : data.evidence?.completeness === 'partial' ? 'partial'
@@ -174,14 +176,26 @@ export class ResultSaver {
         // Save individual test files if code is provided
         if (data.tests) {
             for (const test of data.tests) {
-                if (test.code) {
+                // The test-generation domain returns `testCode`; retain `code` for
+                // older callers of ResultSaver that already use that field.
+                const code = test.testCode ?? test.code;
+                if (code) {
                     const ext = this.getTestExtension(options.language || 'typescript', options.framework || 'vitest');
-                    const testFilename = this.sanitizeFilename(test.name) + ext;
+                    const testFilename = this.generatedTestFilename(test, ext);
                     const testPath = path.join(testDir, testFilename);
                     // Review of #1026 N7: a generated test keeps one file per test name
                     // (replaced atomically), unlike reports, so numbered copies never
                     // pile up for a test runner to collect.
-                    files.push(await this.replaceFile(testPath, test.code, 'source'));
+                    //
+                    // One unwritable source file (e.g. a name the filesystem rejects)
+                    // must not discard the manifest and report, so a per-file failure is
+                    // skipped; `files` then lists only what is actually on disk.
+                    try {
+                        files.push(await this.replaceFile(testPath, code, 'source'));
+                    }
+                    catch (error) {
+                        console.warn(`ResultSaver: could not write generated test ${testFilename}: ${error.message}`);
+                    }
                 }
             }
         }
@@ -504,7 +518,7 @@ ${data.recommendations.length === 0 ? noRecommendations : data.recommendations.m
     // ==========================================================================
     // Utilities
     // ==========================================================================
-    async ensureDirectories(taskType) {
+    async ensureDirectories(_taskType) {
         const dirs = [
             this.resultsDir,
             path.join(this.resultsDir, 'security'),
@@ -563,6 +577,22 @@ ${data.recommendations.length === 0 ? noRecommendations : data.recommendations.m
         }
         throw new Error(`ResultSaver: no free file name for ${filePath}`);
     }
+    /**
+     * File name for a generated test source: the sanitized name capped at
+     * MAX_GENERATED_STEM_LENGTH characters (a long source file name would
+     * otherwise exceed the filesystem's 255-byte limit once the temp-file suffix
+     * is added) plus a short hash of the source path and full name. The hash keeps
+     * `src/one/math.ts` and `src/two/math.ts` (or a truncated long name) from
+     * overwriting each other, while the same test still maps to the same file.
+     */
+    generatedTestFilename(test, ext) {
+        const stem = this.sanitizeFilename(test.name).slice(0, MAX_GENERATED_STEM_LENGTH) || 'test';
+        const hash = createHash('sha256')
+            .update(`${test.file ?? ''}\0${test.name}`)
+            .digest('hex')
+            .slice(0, 8);
+        return `${stem}-${hash}${ext}`;
+    }
     sanitizeFilename(name) {
         return name.replace(/[^a-zA-Z0-9_-]/g, '_').toLowerCase();
     }

package/dist/domains/coverage-analysis/collected-metrics.d.ts

@@ -14,6 +14,8 @@ import type { CoverageSummary, FileCoverage } from './interfaces';
  * (or the cwd when none is known), so one file never has two records.
  */
 export declare function fileCoverageKey(filePath: string, projectRoot?: string): string;
+/** Read the canonical key first, then a measured legacy relative key if present. */
+export declare function fileCoverageLookupKeys(filePath: string, projectRoot?: string): string[];
 export interface CollectedMetrics {
     branch: boolean;
     function: boolean;

package/dist/domains/coverage-analysis/collected-metrics.js

@@ -7,6 +7,7 @@
  * null — never as 0% (a fake low figure) nor as istanbul's 0/0 = 100%.
  */
 import * as path from 'path';
+import { findProjectRoot } from '../../kernel/project-root.js';
 /**
  * The ONE key form for per-file coverage records (#1027 N7): the absolute
  * path. Reports write absolute (istanbul) or project-relative (lcov
@@ -14,7 +15,13 @@ import * as path from 'path';
  * (or the cwd when none is known), so one file never has two records.
  */
 export function fileCoverageKey(filePath, projectRoot) {
-    return path.isAbsolute(filePath) ? path.normalize(filePath) : path.resolve(projectRoot ?? process.cwd(), filePath);
+    return path.isAbsolute(filePath) ? path.normalize(filePath) : path.resolve(projectRoot ?? findProjectRoot(), filePath);
+}
+/** Read the canonical key first, then a measured legacy relative key if present. */
+export function fileCoverageLookupKeys(filePath, projectRoot) {
+    const canonical = `coverage:file:${fileCoverageKey(filePath, projectRoot)}`;
+    const legacy = `coverage:file:${filePath}`;
+    return canonical === legacy ? [canonical] : [canonical, legacy];
 }
 /** Which optional metrics the files carry. Line coverage is always collected. */
 export function collectedMetrics(files) {

package/dist/domains/defect-intelligence/services/defect-predictor.js

@@ -15,6 +15,7 @@ import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
 import { measuredCoverageSummary, measuredFileCoverage } from '../../quality-assessment/coverage-report-event.js';
+import { fileCoverageLookupKeys } from '../../coverage-analysis/collected-metrics.js';
 // LLMDefectAnalysis is imported from ../interfaces
 const DEFAULT_CONFIG = {
     defaultThreshold: 0.5,
@@ -161,7 +162,7 @@ Be specific and actionable. Focus on concrete issues, not generic advice.`,
             }
             return null;
         }
-        catch (error) {
+        catch {
             logger.warn('LLM analysis failed, using heuristics only');
             return null;
         }
@@ -498,7 +499,7 @@ Be specific and actionable. Focus on concrete issues, not generic advice.`,
                     // Count complexity indicators in code
                     const content = fileResult.value;
                     const ifCount = (content.match(/\bif\s*\(/g) || []).length;
-                    const loopCount = (content.match(/\b(for|while|do)\s*[\(\{]/g) || []).length;
+                    const loopCount = (content.match(/\b(for|while|do)\s*[{(]/g) || []).length;
                     const switchCount = (content.match(/\bswitch\s*\(/g) || []).length;
                     const catchCount = (content.match(/\bcatch\s*\(/g) || []).length;
                     const ternaryCount = (content.match(/\?[^?:]+:/g) || []).length;
@@ -592,10 +593,12 @@ Be specific and actionable. Focus on concrete issues, not generic advice.`,
         try {
             // Try per-file coverage (written by coverage-analyzer and test-executor)
             // #1014: only measured records; legacy unstamped estimates are ignored.
-            const fileCoverage = measuredFileCoverage(await this.memory.get(`coverage:file:${file}`));
-            if (fileCoverage) {
-                // Invert: low coverage = high defect risk
-                return 1 - fileCoverage.line / 100;
+            for (const key of fileCoverageLookupKeys(file)) {
+                const fileCoverage = measuredFileCoverage(await this.memory.get(key));
+                if (fileCoverage) {
+                    // Invert: low coverage = high defect risk
+                    return 1 - fileCoverage.line / 100;
+                }
             }
             // Fall back to project-wide coverage
             const summary = measuredCoverageSummary(await this.memory.get('coverage:latest'));

package/dist/domains/learning-optimization/active-patterns.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Agentic QE v3 - Active learned-pattern reads (#1055)
+ *
+ * Active learned patterns live at `learning:pattern:<id>`. The same prefix
+ * also holds records that are NOT active patterns:
+ *
+ * - `learning:pattern:creation:<id>`: creation provenance written by
+ *   `LearningCoordinatorService.recordPatternCreation()` (no `context`)
+ * - `learning:pattern:archived:<id>`: archived patterns written by
+ *   `LearningCoordinatorService.archivePattern()` and the
+ *   learning-consolidation protocol (full pattern shape)
+ *
+ * Every reader of active patterns must go through this module so that
+ * provenance and archives are excluded before `get()`, and so that those rows
+ * cannot use up the search cap and push active patterns out. Records stay
+ * untouched; this is read-side classification only.
+ */
+import type { MemoryBackend, RetrieveOptions } from '../../kernel/interfaces.js';
+import type { LearnedPattern } from './interfaces.js';
+export declare const LEARNING_PATTERN_KEY_PREFIX = "learning:pattern:";
+/** Sub-key families under the pattern prefix that are not active patterns. */
+export declare const NON_ACTIVE_PATTERN_SEGMENTS: readonly string[];
+/**
+ * Key-scan cap for active pattern reads. Keys are cheap to list, and only
+ * active keys are fetched, so the cap is set well above realistic store
+ * sizes. When it is reached, `onTruncated` is called.
+ */
+export declare const ACTIVE_PATTERN_KEY_SCAN_LIMIT = 10000;
+/**
+ * True when the key is in the active pattern key family
+ * (`learning:pattern:<id>`), false for provenance, archives and any other
+ * non-active sub-key.
+ */
+export declare function isActivePatternKey(key: string): boolean;
+/**
+ * Shape guard for a record read from an active key: it must be an object
+ * whose own id maps back to that key, and it must carry a `context` object.
+ */
+export declare function isActivePatternRecord(key: string, value: unknown): value is LearnedPattern;
+export interface ReadActivePatternsOptions {
+    /** Namespace passed to `search()` and `get()`. Omit for the backend default. */
+    retrieve?: RetrieveOptions;
+    /** Override the key-scan cap (tests). */
+    scanLimit?: number;
+    /** Called when the key scan hit the cap, so results may be incomplete. */
+    onTruncated?: (scanned: number) => void;
+}
+/**
+ * Read every active learned pattern: list keys, drop non-active key families
+ * before `get()`, then drop records that fail the shape guard. Date fields
+ * come back from kv as ISO strings and are rehydrated (#491 Bug 3), so
+ * `TimeRange.contains(pattern.createdAt)` works for every reader.
+ */
+export declare function readActivePatterns(memory: MemoryBackend, options?: ReadActivePatternsOptions): Promise<LearnedPattern[]>;
+//# sourceMappingURL=active-patterns.d.ts.map

package/dist/domains/learning-optimization/active-patterns.js

@@ -0,0 +1,77 @@
+/**
+ * Agentic QE v3 - Active learned-pattern reads (#1055)
+ *
+ * Active learned patterns live at `learning:pattern:<id>`. The same prefix
+ * also holds records that are NOT active patterns:
+ *
+ * - `learning:pattern:creation:<id>`: creation provenance written by
+ *   `LearningCoordinatorService.recordPatternCreation()` (no `context`)
+ * - `learning:pattern:archived:<id>`: archived patterns written by
+ *   `LearningCoordinatorService.archivePattern()` and the
+ *   learning-consolidation protocol (full pattern shape)
+ *
+ * Every reader of active patterns must go through this module so that
+ * provenance and archives are excluded before `get()`, and so that those rows
+ * cannot use up the search cap and push active patterns out. Records stay
+ * untouched; this is read-side classification only.
+ */
+import { rehydrateDates } from '../../shared/utils/kv-date-rehydrate.js';
+export const LEARNING_PATTERN_KEY_PREFIX = 'learning:pattern:';
+/** Sub-key families under the pattern prefix that are not active patterns. */
+export const NON_ACTIVE_PATTERN_SEGMENTS = ['creation', 'archived'];
+/**
+ * Key-scan cap for active pattern reads. Keys are cheap to list, and only
+ * active keys are fetched, so the cap is set well above realistic store
+ * sizes. When it is reached, `onTruncated` is called.
+ */
+export const ACTIVE_PATTERN_KEY_SCAN_LIMIT = 10_000;
+/**
+ * True when the key is in the active pattern key family
+ * (`learning:pattern:<id>`), false for provenance, archives and any other
+ * non-active sub-key.
+ */
+export function isActivePatternKey(key) {
+    if (!key.startsWith(LEARNING_PATTERN_KEY_PREFIX))
+        return false;
+    const rest = key.slice(LEARNING_PATTERN_KEY_PREFIX.length);
+    if (rest.length === 0)
+        return false;
+    const firstSegment = rest.split(':', 1)[0];
+    return !NON_ACTIVE_PATTERN_SEGMENTS.includes(firstSegment);
+}
+/**
+ * Shape guard for a record read from an active key: it must be an object
+ * whose own id maps back to that key, and it must carry a `context` object.
+ */
+export function isActivePatternRecord(key, value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const record = value;
+    if (typeof record.id !== 'string' || key !== `${LEARNING_PATTERN_KEY_PREFIX}${record.id}`) {
+        return false;
+    }
+    return !!record.context && typeof record.context === 'object';
+}
+/**
+ * Read every active learned pattern: list keys, drop non-active key families
+ * before `get()`, then drop records that fail the shape guard. Date fields
+ * come back from kv as ISO strings and are rehydrated (#491 Bug 3), so
+ * `TimeRange.contains(pattern.createdAt)` works for every reader.
+ */
+export async function readActivePatterns(memory, options = {}) {
+    const limit = options.scanLimit ?? ACTIVE_PATTERN_KEY_SCAN_LIMIT;
+    const keys = await memory.search(`${LEARNING_PATTERN_KEY_PREFIX}*`, limit, options.retrieve);
+    if (keys.length >= limit)
+        options.onTruncated?.(keys.length);
+    const patterns = [];
+    for (const key of keys) {
+        if (!isActivePatternKey(key))
+            continue;
+        const value = await memory.get(key, options.retrieve);
+        if (isActivePatternRecord(key, value)) {
+            patterns.push(rehydrateDates(value, ['createdAt', 'lastUsedAt']));
+        }
+    }
+    return patterns;
+}
+//# sourceMappingURL=active-patterns.js.map

package/dist/domains/learning-optimization/coordinator.js

@@ -3,6 +3,7 @@
  * Orchestrates learning workflows across all QE domains
  */
 import { LoggerFactory } from '../../logging/index.js';
+import { readActivePatterns } from './active-patterns.js';
 import { v4 as uuidv4 } from 'uuid';
 import { toError } from '../../shared/error-utils.js';
 import { rehydrateDates } from '../../shared/utils/kv-date-rehydrate.js';
@@ -739,17 +740,19 @@ export class LearningOptimizationCoordinator extends BaseDomainCoordinator {
             const patterns = [];
             const knowledge = [];
             const strategies = [];
-            // Export patterns
-            for (const _domain of targetDomains) {
-                const patternKeys = await this.memory.search(`learning:pattern:*`, 500);
-                for (const key of patternKeys) {
-                    const pattern = await this.memory.get(key);
-                    if (pattern && targetDomains.includes(pattern.domain)) {
-                        patterns.push(pattern);
-                    }
+            // Export patterns (#1055: active patterns only — creation provenance
+            // and archives share the `learning:pattern:` prefix). One read covers
+            // every target domain; the previous per-domain loop exported each
+            // pattern once per target domain.
+            const activePatterns = await readActivePatterns(this.memory, {
+                onTruncated: (scanned) => logger.warn('Pattern export key scan hit its cap; export may be incomplete', { scanned }),
+            });
+            for (const pattern of activePatterns) {
+                if (targetDomains.includes(pattern.domain)) {
+                    patterns.push(pattern);
                 }
-                this.updateWorkflowProgress(workflowId, Math.round((patterns.length / 100) * 30));
             }
+            this.updateWorkflowProgress(workflowId, 30);
             // Export knowledge
             const knowledgeResult = await this.transferService.queryKnowledge({
                 limit: 1000,

package/dist/domains/learning-optimization/services/learning-coordinator.js

@@ -7,6 +7,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../shared/types/index.js';
 import { rehydrateDates } from '../../../shared/utils/kv-date-rehydrate.js';
 import { toError } from '../../../shared/error-utils.js';
+import { readActivePatterns } from '../active-patterns.js';
 import { createQEFlashAttention, } from '../../../integrations/ruvector/wrappers.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
 import { createSafeRecord } from '../../../shared/utils/safe-record.js';
@@ -33,6 +34,16 @@ const logger = LoggerFactory.create('learning-optimization/learning-coordinator'
  * domain even on installs with hundreds of indexed experiences.
  */
 const LEARNING_NS = { namespace: 'learning-optimization' };
+/**
+ * #1055: active patterns only. `learning:pattern:*` also holds creation
+ * provenance and archived patterns written by this service.
+ */
+function readActiveLearnedPatterns(memory) {
+    return readActivePatterns(memory, {
+        retrieve: LEARNING_NS,
+        onTruncated: (scanned) => logger.warn('Active pattern key scan hit its cap; results may be incomplete', { scanned }),
+    });
+}
 export class LearningCoordinatorService {
     config;
     memory;
@@ -251,14 +262,7 @@ Provide:
      */
     async findMatchingPatterns(context, limit = 10) {
         try {
-            const patterns = [];
-            const keys = await this.memory.search('learning:pattern:*', 100, LEARNING_NS);
-            for (const key of keys) {
-                const pattern = await this.memory.get(key, LEARNING_NS);
-                if (pattern && this.matchesContext(pattern, context)) {
-                    patterns.push(pattern);
-                }
-            }
+            const patterns = (await readActiveLearnedPatterns(this.memory)).filter((pattern) => this.matchesContext(pattern, context));
             // Sort by confidence and usage
             patterns.sort((a, b) => {
                 const scoreA = a.confidence * 0.6 + (a.successRate * 0.4);
@@ -384,14 +388,7 @@ Provide:
      */
     async getPatternStats(domain) {
         try {
-            const keys = await this.memory.search('learning:pattern:*', 500, LEARNING_NS);
-            const patterns = [];
-            for (const key of keys) {
-                const pattern = await this.memory.get(key, LEARNING_NS);
-                if (pattern && (!domain || pattern.domain === domain)) {
-                    patterns.push(pattern);
-                }
-            }
+            const patterns = (await readActiveLearnedPatterns(this.memory)).filter((pattern) => !domain || pattern.domain === domain);
             const byType = {
                 'test-pattern': 0,
                 'fix-pattern': 0,
@@ -761,7 +758,8 @@ Provide:
             return false;
         }
         if (context.tags.length > 0) {
-            const hasMatchingTag = context.tags.some((tag) => pattern.context.tags.includes(tag));
+            const patternTags = Array.isArray(pattern.context.tags) ? pattern.context.tags : [];
+            const hasMatchingTag = context.tags.some((tag) => patternTags.includes(tag));
             if (!hasMatchingTag) {
                 return false;
             }

package/dist/domains/quality-assessment/interfaces.d.ts

@@ -56,6 +56,10 @@ export interface GateResult {
     checks: GateCheck[];
     overallScore: number;
     failedChecks: string[];
+    /** Gate service evidence state; absent for other gate implementations. */
+    evidenceStatus?: 'measured' | 'insufficient-evidence';
+    /** Configured checks whose input was missing, negative, or non-finite. */
+    unmeasured?: string[];
 }
 export interface GateCheck {
     name: string;

package/dist/domains/quality-assessment/quality-evidence.d.ts

@@ -98,7 +98,7 @@ export declare class InsufficientQualityEvidenceError extends Error {
  * Inspect every canonical metric with the same validation, collecting each
  * absent, stale, future-dated or malformed record instead of stopping at the first.
  */
-export declare function inspectQualityEvidence(memory: MemoryBackend, options?: {
+export declare function inspectQualityEvidence(memory: Pick<MemoryBackend, 'get'>, options?: {
     now?: number;
     maxAgeMs?: number;
 }): Promise<{

package/dist/domains/quality-assessment/services/quality-analyzer.js

@@ -10,6 +10,7 @@ import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
 import { measuredCoverageSummary, measuredFileCoverage } from '../coverage-report-event.js';
+import { fileCoverageLookupKeys } from '../../coverage-analysis/collected-metrics.js';
 /** Metrics the static analyzer produces when the caller asks for all of them. */
 const ANALYZER_METRICS = ['coverage', 'complexity', 'maintainability', 'duplication', 'testability'];
 /** Metrics computed from parsing each source file. */
@@ -157,7 +158,7 @@ Focus on:
             }
             return null;
         }
-        catch (error) {
+        catch {
             logger.warn('LLM insights generation failed:');
             return null;
         }
@@ -226,7 +227,7 @@ Focus on:
             }
             return null;
         }
-        catch (error) {
+        catch {
             logger.warn('Failed to parse LLM insights response:');
             return null;
         }
@@ -508,9 +509,10 @@ Focus on:
             // 1. Try per-file coverage stored by test executor
             // #1014: only measured records count. Legacy unstamped estimate
             // records (written by <= 3.15.4, never expiring) are ignored.
-            const fileCoverage = measuredFileCoverage(await this.memory.get(`coverage:file:${file}`));
-            if (fileCoverage) {
-                return fileCoverage.line;
+            for (const key of fileCoverageLookupKeys(file)) {
+                const fileCoverage = measuredFileCoverage(await this.memory.get(key));
+                if (fileCoverage)
+                    return fileCoverage.line;
             }
             // 2. Fall back to project-wide summary from coverage-analyzer
             const summary = measuredCoverageSummary(await this.memory.get('coverage:latest'));

package/dist/domains/quality-assessment/services/quality-gate.js

@@ -5,6 +5,7 @@
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
+import { isMeasuredMetricValue } from '../evidence-sufficiency.js';
 const DEFAULT_CONFIG = {
     strictMode: false,
     enableWarnings: true,
@@ -80,6 +81,12 @@ export class QualityGateService {
             // Evaluate each threshold
             checks.push(...this.evaluateMinThresholds(metrics, thresholds));
             checks.push(...this.evaluateMaxThresholds(metrics, thresholds));
+            if (checks.length === 0) {
+                return err(new Error('No thresholds configured for gate evaluation'));
+            }
+            const unmeasured = checks
+                .filter((check) => !isMeasuredMetricValue(check.value))
+                .map((check) => check.name);
             // Collect failed checks
             for (const check of checks) {
                 if (!check.passed) {
@@ -89,13 +96,15 @@ export class QualityGateService {
             // Calculate overall score (0-100)
             const overallScore = this.calculateOverallScore(checks);
             // Determine pass/fail based on critical checks
-            const passed = this.determineGateStatus(checks);
+            const passed = unmeasured.length === 0 && this.determineGateStatus(checks);
             const result = {
                 gateName,
                 passed,
                 checks,
                 overallScore,
                 failedChecks,
+                evidenceStatus: unmeasured.length === 0 ? 'measured' : 'insufficient-evidence',
+                unmeasured,
             };
             // Store evaluation result in memory
             await this.storeEvaluationResult(result);
@@ -188,9 +197,9 @@ export class QualityGateService {
         return checks;
     }
     createCheck(name, value, threshold, type, severity) {
-        const passed = type === 'min'
+        const passed = isMeasuredMetricValue(value) && (type === 'min'
             ? value >= threshold
-            : value <= threshold;
+            : value <= threshold);
         return {
             name,
             passed,

package/dist/domains/security-compliance/dependency-advisory-engine.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Dependency advisory (OSV) engine for the scan-security task (#1049).
+ *
+ * Runs the security-compliance DependencyScanner on the project's package.json
+ * and turns its outcome into an execution receipt. A failed or partial OSV
+ * lookup is a failed/partial engine with the unchecked packages listed, never
+ * a completed engine with zero findings.
+ */
+import type { SecurityEngineEvidence } from './scan-evidence.js';
+import type { Vulnerability, UncheckedDependency, LocalDependency } from './interfaces.js';
+import type { DependencyScanResult } from './services/scanners/scanner-types.js';
+import type { Result } from '../../shared/types/index.js';
+export declare const DEPENDENCY_ADVISORY_ENGINE_ID = "osv-dependency-advisories";
+/** The dependency scan as reported to MCP and CLI consumers. */
+export interface DependencyScanReport {
+    status: 'complete' | 'incomplete' | 'failed' | 'not-run';
+    measured: boolean;
+    manifest?: string;
+    /** Lockfile the checked versions were resolved from, or null (exact specs only). */
+    lockfile?: string | null;
+    packagesRequested: number;
+    packagesChecked: number;
+    uncheckedPackages: UncheckedDependency[];
+    /** Local workspace / linked packages: not OSV subjects, excluded from the counts. */
+    localPackages: LocalDependency[];
+    /** Why the scan is not complete beyond individual packages (malformed lockfile, workspace root #1057). */
+    resolutionErrors: string[];
+    /** Only direct dependencies are checked; transitive dependencies are not. */
+    scope: 'direct';
+    vulnerabilities: number;
+    scanId?: string;
+    error?: string;
+    /** One plain sentence for humans; says when advisories could not be checked. */
+    message: string;
+}
+export interface DependencyAdvisoryOutcome {
+    engine: SecurityEngineEvidence;
+    vulnerabilities: Vulnerability[];
+    report: DependencyScanReport;
+}
+interface PackageJsonScanner {
+    scanPackageJson(packageJsonPath: string): Promise<Result<DependencyScanResult>>;
+}
+/** The package.json for a scan target: the target directory's, else the project root's. */
+export declare function findPackageJson(targetPath: string, env?: NodeJS.ProcessEnv): Promise<string | null>;
+/** Human message for a dependency scan outcome. */
+export declare const DEPENDENCY_SCOPE_NOTE = "direct dependencies of this package.json only; workspace members and transitive dependencies are not checked";
+export declare function dependencyScanMessage(report: Omit<DependencyScanReport, 'message'>): string;
+/** Run the OSV dependency scan for a target and describe it as an engine receipt. */
+export declare function runDependencyAdvisoryScan(scanner: PackageJsonScanner, targetPath: string): Promise<DependencyAdvisoryOutcome>;
+export {};
+//# sourceMappingURL=dependency-advisory-engine.d.ts.map