agentic-qe 3.15.8 → 3.15.10

package/dist/coordination/handlers/handler-types.d.ts

@@ -43,6 +43,8 @@ export interface TaskHandlerContext {
      */
     getCodeIntelligenceCoordinator?(): Promise<ProjectMetricsCollector | undefined>;
     getQualityAnalyzer(): QualityAnalyzerService;
+    /** The domain execution owner also records run evidence and lifecycle events. */
+    getTestExecutionAPI?(): Promise<import('../../domains/test-execution/interfaces').ITestExecutionAPI | undefined>;
     /** Executor configuration */
     readonly config: {
         defaultLanguage: string;

package/dist/coordination/handlers/requirements-handlers.js

@@ -8,12 +8,20 @@ import * as fs from 'fs/promises';
 import { ok, err } from '../../shared/types/index.js';
 import { toError, toErrorMessage } from '../../shared/error-utils.js';
 import { discoverSourceFiles } from './handler-utils.js';
+import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 export function registerRequirementsHandlers(ctx) {
     // Register requirements validation handler
     ctx.registerHandler('validate-requirements', async (task) => {
         const payload = task.payload;
         try {
-            const targetPath = payload.requirementsPath || process.cwd();
+            // #1126: list requirement files only inside the project.
+            let targetPath = process.cwd();
+            if (payload.requirementsPath) {
+                const confined = await requirePayloadPath('validate-requirements', 'requirementsPath', payload.requirementsPath, { allowDirectory: true, allowMissing: true });
+                if (!confined.success)
+                    return confined;
+                targetPath = confined.value;
+            }
             // Look for requirements files (markdown, feature files, etc.)
             const reqFiles = await discoverSourceFiles(targetPath, {
                 includeTests: false,
@@ -58,9 +66,15 @@ export function registerRequirementsHandlers(ctx) {
                     error: 'contractPath is required. Provide a path to an OpenAPI spec, JSON Schema, or Protocol Buffer file.',
                 });
             }
+            // #1126: read only a regular file inside the project, within the size
+            // limit; the result reports its line count and whether it parses. A
+            // missing file keeps its valid:false result below.
+            const confined = await requirePayloadPath('validate-contracts', 'contractPath', payload.contractPath, { allowMissing: true, maxBytes: MAX_PAYLOAD_FILE_BYTES });
+            if (!confined.success)
+                return confined;
             // Check if the contract file exists
             try {
-                const content = await fs.readFile(payload.contractPath, 'utf-8');
+                const content = await fs.readFile(confined.value, 'utf-8');
                 const isJson = payload.contractPath.endsWith('.json');
                 const isYaml = payload.contractPath.endsWith('.yaml') || payload.contractPath.endsWith('.yml');
                 // Basic structural validation

package/dist/coordination/handlers/security-handlers.js

@@ -13,12 +13,22 @@ import { FilePath } from '../../shared/value-objects/index.js';
 import { generateSecurityRecommendations } from './handler-utils.js';
 import { discoverSecurityFiles, isSecuritySourceFile } from '../../domains/security-compliance/scan-discovery.js';
 import { runDependencyAdvisoryScan } from '../../domains/security-compliance/dependency-advisory-engine.js';
+import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 export function registerSecurityHandlers(ctx) {
     // Register security scan handler - REAL IMPLEMENTATION
     ctx.registerHandler('scan-security', async (task) => {
         const payload = task.payload;
         try {
-            const targetPath = path.resolve(payload.target || process.cwd());
+            // #1126: read (SAST, manifests, dependencies) only a file or directory
+            // inside the project. A DAST-only scan reads no target path.
+            let targetPath = path.resolve(payload.target || process.cwd());
+            const readsTarget = payload.sast !== false || payload.dependencies === true;
+            if (payload.target && payload.target !== '.' && readsTarget) {
+                const confined = await requirePayloadPath('scan-security', 'target', payload.target, { allowDirectory: true, allowMissing: true, maxBytes: MAX_PAYLOAD_FILE_BYTES });
+                if (!confined.success)
+                    return confined;
+                targetPath = confined.value;
+            }
             const sastRequested = payload.sast !== false;
             const discoveryResult = sastRequested ? await discoverSecurityFiles(targetPath) : undefined;
             const filesToScan = discoveryResult?.files ?? [];

package/dist/coordination/handlers/test-execution-handlers.js

@@ -8,9 +8,12 @@ import { v4 as uuidv4 } from 'uuid';
 import * as fs from 'fs/promises';
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
-import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
+import { capDiagnostics, getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../shared/vitest-json-report.js';
 import { jestExactPathPattern, runnerFilePath } from '../../shared/test-runner-args.js';
+import { testCasesFromRunnerReport } from '../../domains/test-execution/services/runner-test-cases.js';
+import { runTestRunnerProcess } from '../../shared/test-runner-process.js';
+import { MAX_PAYLOAD_FILE_BYTES, requirePayloadFiles } from '../../shared/io/payload-path-guard.js';
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -67,9 +70,19 @@ export function registerTestExecutionHandlers(ctx) {
             if (payload.sourceFiles && payload.sourceFiles.length > 0) {
                 sourceFiles = payload.sourceFiles;
             }
-            else if (payload.filePath) {
+            else if (payload.filePath && !payload.sourceCode) {
+                // With sourceCode, filePath is only the import target written into the
+                // generated tests (tool contract); it is neither read nor required.
                 sourceFiles = [payload.filePath];
             }
+            if (sourceFiles.length > 0) {
+                // #1126: the generator reads each file whole, so only project files.
+                const field = payload.sourceFiles?.length ? 'sourceFiles' : 'filePath';
+                const confined = await requirePayloadFiles('generate-tests', field, sourceFiles, { maxBytes: MAX_PAYLOAD_FILE_BYTES });
+                if (!confined.success)
+                    return confined;
+                sourceFiles = confined.value;
+            }
             else if (payload.sourceCode) {
                 // Write temporary file for analysis if only source code provided
                 // Use correct file extension based on language parameter
@@ -173,17 +186,44 @@ export function registerTestExecutionHandlers(ctx) {
     ctx.registerHandler('execute-tests', async (task) => {
         const payload = task.payload;
         try {
-            const testFiles = payload.testFiles || [];
-            if (testFiles.length === 0) {
+            const requestedFiles = payload.testFiles || [];
+            if (requestedFiles.length === 0) {
                 return err(new TestRunnerExecutionError('No test files specified. Provide testFiles array with paths to test files.'));
             }
             // Validate test file paths before invoking a runner.
             const safePathPattern = /^[a-zA-Z0-9_./@-]+$/;
-            if (testFiles.some(file => !safePathPattern.test(file))) {
+            if (requestedFiles.some(file => !safePathPattern.test(file))) {
                 return err(new TestRunnerExecutionError('Some test file paths contain invalid characters and were rejected. Provide concrete paths; expand glob patterns before calling.'));
             }
-            const { spawnSync } = await import('child_process');
-            const options = { cwd: process.cwd(), timeout: 120000, encoding: 'utf-8' };
+            // #1126: a runner executes what it is given, so only files and
+            // directories (#909 Jest targets) inside the project, run as the real
+            // paths that were checked. A missing file is still reported by the runner.
+            const confined = await requirePayloadFiles('execute-tests', 'testFiles', requestedFiles, { allowMissing: true, allowDirectory: true });
+            if (!confined.success)
+                return confined;
+            const testFiles = confined.value;
+            // A caller-owned MCP task skips the Queen's plugin dispatch. Run through
+            // that same domain API here: it owns persistence, measured quality evidence
+            // and TestRunStarted/Completed events as well as the runner itself.
+            if (task.executionOwner === 'caller') {
+                const api = await ctx.getTestExecutionAPI?.();
+                if (!api)
+                    return err(new TestRunnerExecutionError('Test-execution domain is unavailable.'));
+                const result = await api.runTests({
+                    testFiles,
+                    parallel: payload.parallel,
+                    timeout: payload.timeout,
+                    workers: payload.parallelism,
+                    // The domain owns requested retries; Queen dispatch must not replay it.
+                    retryCount: payload.retryCount ?? 0,
+                });
+                if (!result.success)
+                    return result;
+                return ok({ ...result.value, coverage: result.value.coverage?.line ?? null });
+            }
+            // #1074: run the runner asynchronously so the MCP server keeps serving
+            // other requests (task_status, task_cancel, ...) during the test run.
+            const options = { cwd: process.cwd(), timeout: 120000 };
             let runner = 'vitest';
             // Vitest 5 writes the JSON report to a file rather than stdout; an explicit
             // --outputFile gives Vitest 4 and 5 the same contract.
@@ -192,7 +232,7 @@ export function registerTestExecutionHandlers(ctx) {
             let output;
             try {
                 // #909: absolute paths cannot be read as flags (e.g. a "--watch" entry).
-                execution = spawnSync('npx', ['vitest', 'run', ...testFiles.map(file => runnerFilePath(file, options.cwd)), '--reporter=json', ...report.args], options);
+                execution = await runTestRunnerProcess('npx', ['vitest', 'run', ...testFiles.map(file => runnerFilePath(file, options.cwd)), '--reporter=json', ...report.args], options);
                 output = execution.error || execution.signal
                     ? ''
                     : report.read(execution.stdout || '') ?? '';
@@ -203,12 +243,12 @@ export function registerTestExecutionHandlers(ctx) {
             // Preserve the existing Jest fallback when Vitest cannot produce a report.
             if (!output.includes('{') && execution.status !== 0 && !execution.error && !execution.signal) {
                 runner = 'jest';
-                execution = spawnSync('npx', ['jest', ...testFiles.map(file => jestExactPathPattern(file, options.cwd)), '--json'], options);
+                execution = await runTestRunnerProcess('npx', ['jest', ...testFiles.map(file => jestExactPathPattern(file, options.cwd)), '--json'], options);
                 output = execution.stdout || '';
             }
             const diagnostics = [execution.error?.message, execution.signal && `Terminated by ${execution.signal}`, execution.stderr, output].filter(Boolean).join('\n');
             if (execution.error) {
-                return err(new TestRunnerExecutionError(`${runner} could not complete: ${diagnostics.slice(0, 4000)}`));
+                return err(new TestRunnerExecutionError(`${runner} could not complete: ${capDiagnostics(diagnostics)}`));
             }
             try {
                 const jsonStart = output.indexOf('{');
@@ -225,14 +265,19 @@ export function registerTestExecutionHandlers(ctx) {
                         // #1027 N5/NB5: this handler runs the tests without --coverage, so it has no
                         // coverage figure to return (null, never 0%). For test_execute_parallel the
                         // measured coverage + testsPassing are recorded by TestExecutorService.
-                        return ok({ total, passed, failed, skipped, duration: 0, coverage: null, failedTests: [] });
+                        // #1110: per-test entries come from the runner report itself, or are left out.
+                        const testCases = testCasesFromRunnerReport(json, testFiles.join(', '));
+                        return ok({
+                            total, passed, failed, skipped, duration: 0, coverage: null, failedTests: [],
+                            ...(testCases && testCases.length === total ? { testCases } : {}),
+                        });
                     }
                 }
             }
             catch {
                 // A malformed report cannot establish that the requested tests completed.
             }
-            return err(new TestRunnerExecutionError(`Could not parse ${runner} results (exit code ${execution.status ?? 'unknown'}):\n${diagnostics.slice(0, 4000)}`));
+            return err(new TestRunnerExecutionError(`Could not parse ${runner} results (exit code ${execution.status ?? 'unknown'}):\n${capDiagnostics(diagnostics)}`));
         }
         catch (error) {
             return err(toError(error));

package/dist/coordination/index.d.ts

@@ -22,8 +22,8 @@ export { DomainTeamManager, createDomainTeamManager, DEFAULT_DOMAIN_TEAM_MANAGER
 export type { DomainTeamManagerConfig, DomainTeam, DomainTeamHealth, ScaleResult, RebalanceResult, } from './agent-teams/domain-team-manager';
 export { TierSelector, createTierSelector, ALL_USER_FACING_DOMAINS, CORE_PRIORITY_DOMAINS, DEFAULT_DOMAIN_AGENT_MAP, DEFAULT_TIER_CONFIGS, getDefaultTierConfig, validateTierConfig, FLEET_TIER_ORDER, } from './fleet-tiers';
 export type { FleetTier, TierConfig, TierSelectionContext, AgentAllocation, TierSelectionResult, TierSelectionRecord, TierSelectionStats, } from './fleet-tiers';
-export { TaskDAG, DAGScheduler, createTaskDAG, createDAGScheduler, } from './task-dag';
-export type { DAGTaskStatus, DAGTask, AddTaskInput, DAGStats, DAGEventType, DAGEvent, DAGSchedulerConfig, DAGEventHandler, } from './task-dag';
+export { TaskDAG, DAGScheduler, createTaskDAG, createDAGScheduler, PREREQUISITE_RECEIPT_SCHEMA, GraphRevisionConflictError, PrerequisiteWaiverError, } from './task-dag';
+export type { DAGTaskStatus, DAGTask, AddTaskInput, DAGStats, DAGEventType, DAGEvent, DAGSchedulerConfig, DAGEventHandler, PrerequisiteDisposition, PrerequisiteReceiptV1, PrerequisiteEdgeState, WaivePrerequisiteInput, WaiverPolicy, TaskDAGOptions, ObligationSummary, DAGProgress, } from './task-dag';
 export { DomainCircuitBreaker, DomainCircuitOpenError, DEFAULT_DOMAIN_BREAKER_CONFIG, DomainBreakerRegistry, DOMAIN_CRITICALITY_CONFIGS, DOMAIN_CRITICALITY, createDomainCircuitBreaker, createDomainBreakerRegistry, } from './circuit-breaker';
 export type { DomainBreakerState, DomainCircuitBreakerConfig, DomainBreakerStats, DomainBreakerEvent, DomainBreakerStateChangeHandler, DomainCriticalityConfig, DomainCriticalityLevel, DomainBreakerHealthSummary, } from './circuit-breaker';
 export { HypothesisManager, createHypothesisManager, DEFAULT_COMPETING_HYPOTHESES_CONFIG, } from './competing-hypotheses';

package/dist/coordination/index.js

@@ -72,7 +72,7 @@ export { TierSelector, createTierSelector, ALL_USER_FACING_DOMAINS, CORE_PRIORIT
 // ============================================================================
 // Task Dependency DAG (ADR-064: DAG-Based Task Scheduling)
 // ============================================================================
-export { TaskDAG, DAGScheduler, createTaskDAG, createDAGScheduler, } from './task-dag/index.js';
+export { TaskDAG, DAGScheduler, createTaskDAG, createDAGScheduler, PREREQUISITE_RECEIPT_SCHEMA, GraphRevisionConflictError, PrerequisiteWaiverError, } from './task-dag/index.js';
 // ============================================================================
 // Domain Circuit Breakers (ADR-064: Domain-Level Fault Isolation)
 // ============================================================================

package/dist/coordination/mincut/queen-integration.d.ts

@@ -20,6 +20,19 @@ import { SwarmGraph } from './swarm-graph';
 import { MinCutHealthMonitor } from './mincut-health-monitor';
 import { MinCutPersistence } from './mincut-persistence';
 import { SwarmVertex, SwarmEdge, MinCutHealth, MinCutHealthConfig, WeakVertex } from './interfaces';
+/**
+ * #1130: Queen health reads the MinCut of the fleet's own topology (domains
+ * and long-lived agents). An agent spawned for one task is a leaf with a
+ * single edge, so counting it would put every running task below threshold.
+ */
+export interface FleetMinCutHealth extends MinCutHealth {
+    /** Status of the topology without task-scoped agents; this one degrades Queen health. */
+    readonly fleetStatus: MinCutHealth['status'];
+    /** MinCut of the topology without task-scoped agents. `minCutValue` stays the raw value. */
+    readonly fleetMinCutValue: number;
+    /** Running task-scoped agents left out of `fleetStatus`. */
+    readonly taskAgents: number;
+}
 /**
  * Configuration for Queen-MinCut integration
  */
@@ -56,6 +69,13 @@ export declare class QueenMinCutBridge {
     private readonly monitor;
     private readonly persistence;
     private eventSubscriptions;
+    /**
+     * Agents with a vertex in the graph, from QueenAgentSpawned or from the
+     * coordinator when the graph was built. Pruned once they complete (#1130).
+     */
+    private readonly spawnedAgentIds;
+    /** The subset spawned for a single task (#1130). */
+    private readonly taskAgentIds;
     private snapshotTimer;
     private initialized;
     constructor(eventBus: EventBus, agentCoordinator: AgentCoordinator, config?: Partial<QueenMinCutConfig>);
@@ -100,11 +120,29 @@ export declare class QueenMinCutBridge {
      * Convert MinCut alerts to Queen health issues
      */
     getHealthIssuesFromMinCut(): HealthIssue[];
+    /**
+     * #1130: nothing publishes QueenAgentTerminated, so a finished task agent
+     * stayed in the topology and kept the fleet degraded after its run. Drop the
+     * vertex of every tracked agent that completed normally or that the
+     * coordinator no longer lists. A failed agent keeps its vertex (see
+     * failedAgentIssues), so a crash never makes the fleet look healthier.
+     * Returns the tracked agents that failed.
+     */
+    private pruneCompletedAgents;
+    /** #1130: one issue per failed agent, task-scoped or long-lived. */
+    private failedAgentIssues;
+    private isTaskAgentVertex;
+    /**
+     * #1130: MinCut health with the fleet reading next to the raw one. The fleet
+     * reading drops task-scoped agents from a copy of the graph; the raw graph,
+     * its value and its alerts are unchanged.
+     */
+    getFleetMinCutHealth(): FleetMinCutHealth;
     /**
      * Extend Queen health with MinCut metrics
      */
     extendQueenHealth(baseHealth: QueenHealth): QueenHealth & {
-        minCut?: MinCutHealth;
+        minCut?: FleetMinCutHealth;
     };
     /**
      * Extend Queen metrics with MinCut data

package/dist/coordination/mincut/queen-integration.js

@@ -44,6 +44,13 @@ export class QueenMinCutBridge {
     monitor;
     persistence;
     eventSubscriptions = [];
+    /**
+     * Agents with a vertex in the graph, from QueenAgentSpawned or from the
+     * coordinator when the graph was built. Pruned once they complete (#1130).
+     */
+    spawnedAgentIds = new Set();
+    /** The subset spawned for a single task (#1130). */
+    taskAgentIds = new Set();
     snapshotTimer = null;
     initialized = false;
     constructor(eventBus, agentCoordinator, config = {}) {
@@ -137,6 +144,8 @@ export class QueenMinCutBridge {
         // Add agent vertices
         for (const agent of agents) {
             this.addAgentVertex(agent);
+            // #1130: tracked so a completed agent is pruned like a spawned one
+            this.spawnedAgentIds.add(agent.id);
         }
         // Add edges based on coordination patterns
         this.buildCoordinationEdges(agents);
@@ -239,7 +248,10 @@ export class QueenMinCutBridge {
     subscribeToEvents() {
         // Agent spawned
         const onAgentSpawned = async (event) => {
-            const { agentId, domain, type, capabilities } = event.payload;
+            const { agentId, domain, type, capabilities, taskId } = event.payload;
+            this.spawnedAgentIds.add(agentId);
+            if (taskId)
+                this.taskAgentIds.add(agentId);
             // Cast to extended AgentInfo with optional properties
             this.addAgentVertex({
                 id: agentId,
@@ -381,7 +393,9 @@ export class QueenMinCutBridge {
         }
         // Add issues for weak vertices
         const weakVertices = this.monitor.getWeakVertices();
-        for (const weak of weakVertices.slice(0, 3)) { // Top 3 weak vertices
+        // #1130: a task-scoped agent is a leaf by design, not a weak point of the fleet
+        const fleetWeakVertices = weakVertices.filter(weak => !this.isTaskAgentVertex(weak.vertex.id));
+        for (const weak of fleetWeakVertices.slice(0, 3)) { // Top 3 weak vertices
             if (weak.riskScore > 0.7) {
                 issues.push({
                     severity: 'high',
@@ -393,6 +407,66 @@ export class QueenMinCutBridge {
         }
         return issues;
     }
+    /**
+     * #1130: nothing publishes QueenAgentTerminated, so a finished task agent
+     * stayed in the topology and kept the fleet degraded after its run. Drop the
+     * vertex of every tracked agent that completed normally or that the
+     * coordinator no longer lists. A failed agent keeps its vertex (see
+     * failedAgentIssues), so a crash never makes the fleet look healthier.
+     * Returns the tracked agents that failed.
+     */
+    pruneCompletedAgents() {
+        if (this.spawnedAgentIds.size === 0)
+            return [];
+        const byId = new Map(this.agentCoordinator.listAgents().map(agent => [agent.id, agent]));
+        const failed = [];
+        for (const agentId of this.spawnedAgentIds) {
+            const agent = byId.get(agentId);
+            if (agent?.status === 'failed') {
+                failed.push(agent);
+                continue;
+            }
+            if (agent && agent.status !== 'completed')
+                continue;
+            this.graph.removeVertex(`agent:${agentId}`);
+            this.spawnedAgentIds.delete(agentId);
+            this.taskAgentIds.delete(agentId);
+        }
+        return failed;
+    }
+    /** #1130: one issue per failed agent, task-scoped or long-lived. */
+    failedAgentIssues(failed) {
+        return failed.map(agent => ({
+            severity: 'high',
+            message: `Agent ${agent.id} (${agent.type}) failed`,
+            timestamp: new Date(),
+            domain: agent.domain,
+        }));
+    }
+    isTaskAgentVertex(vertexId) {
+        return vertexId.startsWith('agent:') && this.taskAgentIds.has(vertexId.slice('agent:'.length));
+    }
+    /**
+     * #1130: MinCut health with the fleet reading next to the raw one. The fleet
+     * reading drops task-scoped agents from a copy of the graph; the raw graph,
+     * its value and its alerts are unchanged.
+     */
+    getFleetMinCutHealth() {
+        const raw = this.getMinCutHealth();
+        if (this.taskAgentIds.size === 0) {
+            return { ...raw, fleetStatus: raw.status, fleetMinCutValue: raw.minCutValue, taskAgents: 0 };
+        }
+        const fleetGraph = this.graph.clone();
+        for (const agentId of this.taskAgentIds)
+            fleetGraph.removeVertex(`agent:${agentId}`);
+        const fleet = createMinCutHealthMonitor(fleetGraph, this.config).getHealth();
+        return {
+            ...raw,
+            fleetStatus: fleet.status,
+            fleetMinCutValue: fleet.minCutValue,
+            taskAgents: this.taskAgentIds.size,
+        };
+    }
     /**
      * Extend Queen health with MinCut metrics
      */
@@ -400,19 +474,22 @@ export class QueenMinCutBridge {
         if (!this.config.includeInQueenHealth) {
             return baseHealth;
         }
-        const minCutHealth = this.getMinCutHealth();
-        const minCutIssues = this.getHealthIssuesFromMinCut();
+        const failedAgents = this.pruneCompletedAgents();
+        const minCutHealth = this.getFleetMinCutHealth();
+        // #1130: with only task-scoped agents the fleet topology is idle, and the
+        // raw alerts describe those agents, not the fleet.
+        const minCutIssues = minCutHealth.fleetStatus === 'idle' ? [] : this.getHealthIssuesFromMinCut();
         // Issue #205 fix: Only degrade status for actual critical issues
         // 'idle' status is normal for fresh installs - don't degrade health
         let status = baseHealth.status;
-        if (minCutHealth.status === 'critical' && status === 'healthy') {
+        if ((minCutHealth.fleetStatus === 'critical' || failedAgents.length > 0) && status === 'healthy') {
             status = 'degraded';
         }
         // Note: 'idle' status does NOT trigger degradation - it's expected for fresh systems
         return {
             ...baseHealth,
             status,
-            issues: [...baseHealth.issues, ...minCutIssues],
+            issues: [...baseHealth.issues, ...this.failedAgentIssues(failedAgents), ...minCutIssues],
             minCut: minCutHealth,
         };
     }

package/dist/coordination/protocols/learning-consolidation-archive.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Agentic QE v3 - Learning consolidation: pattern archiving (#1071)
+ *
+ * The consolidation protocol archives patterns it selected for removal.
+ * Archiving is a move inside the `learning-optimization` namespace, where
+ * `LearningCoordinatorService` writes every learned pattern:
+ *
+ *   learning:pattern:<id>  ->  learning:pattern:archived:<id>
+ *
+ * Safety rules:
+ * - Only the active key of a pattern the protocol selected is deleted.
+ * - The active record must still be the selected pattern (same id, and the
+ *   same scores and last use) when the archive runs, or nothing is written or
+ *   deleted. A pattern used or re-scored since it was selected is left active.
+ * - The archive copy is read back before the active key is deleted, so a
+ *   failed write never loses the pattern.
+ * The move is implemented in domains/learning-optimization/pattern-archive.ts.
+ */
+import type { LearnedPattern } from '../../domains/learning-optimization/interfaces.js';
+export { archiveSelectedPattern, type ArchiveOutcome } from '../../domains/learning-optimization/pattern-archive.js';
+/** Counts of one consolidation run's archive step, for logs and results. */
+export interface ArchiveCounts {
+    /** Patterns the retention and trim rules selected for removal. */
+    selected: number;
+    /** Selected patterns moved to `:archived:` and removed from the active set. */
+    archived: number;
+    /** Selected patterns whose active record was gone or changed; left alone. */
+    missing: number;
+    /** Selected patterns whose archive copy could not be verified; left active. */
+    failed: number;
+}
+export declare function emptyArchiveCounts(): ArchiveCounts;
+/** True when the pattern was created less than `graceDays` days ago. */
+export declare function isWithinRetentionGrace(pattern: LearnedPattern, graceDays: number, now?: number): boolean;
+//# sourceMappingURL=learning-consolidation-archive.d.ts.map

package/dist/coordination/protocols/learning-consolidation-archive.js

@@ -0,0 +1,34 @@
+/**
+ * Agentic QE v3 - Learning consolidation: pattern archiving (#1071)
+ *
+ * The consolidation protocol archives patterns it selected for removal.
+ * Archiving is a move inside the `learning-optimization` namespace, where
+ * `LearningCoordinatorService` writes every learned pattern:
+ *
+ *   learning:pattern:<id>  ->  learning:pattern:archived:<id>
+ *
+ * Safety rules:
+ * - Only the active key of a pattern the protocol selected is deleted.
+ * - The active record must still be the selected pattern (same id, and the
+ *   same scores and last use) when the archive runs, or nothing is written or
+ *   deleted. A pattern used or re-scored since it was selected is left active.
+ * - The archive copy is read back before the active key is deleted, so a
+ *   failed write never loses the pattern.
+ * The move is implemented in domains/learning-optimization/pattern-archive.ts.
+ */
+// The move itself lives with the patterns, so the merge path in
+// LearningCoordinatorService uses the same read-back rule (#1106).
+export { archiveSelectedPattern } from '../../domains/learning-optimization/pattern-archive.js';
+export function emptyArchiveCounts() {
+    return { selected: 0, archived: 0, missing: 0, failed: 0 };
+}
+/** True when the pattern was created less than `graceDays` days ago. */
+export function isWithinRetentionGrace(pattern, graceDays, now = Date.now()) {
+    if (graceDays <= 0)
+        return false;
+    const created = new Date(pattern.createdAt).getTime();
+    if (!Number.isFinite(created))
+        return false;
+    return now - created < graceDays * 24 * 60 * 60 * 1000;
+}
+//# sourceMappingURL=learning-consolidation-archive.js.map

package/dist/coordination/protocols/learning-consolidation.d.ts

@@ -7,7 +7,13 @@
  */
 import { Result, DomainName, DomainEvent } from '../../shared/types/index.js';
 import { EventBus, MemoryBackend } from '../../kernel/interfaces.js';
+import { type ArchiveCounts } from './learning-consolidation-archive.js';
 import type { LearnedPattern, PatternType, IPatternLearningService, IKnowledgeSynthesisService } from '../../domains/learning-optimization/interfaces.js';
+/**
+ * Id of a merged pattern a dry run predicts but never stores (#1106). It only
+ * appears in `removedPatterns` when the predicted merge would itself be trimmed.
+ */
+export declare const DRY_RUN_MERGE_ID_PREFIX = "dry-run-merge:";
 export interface LearningConsolidationConfig {
     /** Minimum patterns per domain to trigger consolidation */
     minPatternsForConsolidation: number;
@@ -21,6 +27,18 @@ export interface LearningConsolidationConfig {
     analysisWindowWeeks: number;
     /** Enable cross-project transfer */
     enableCrossProjectTransfer: boolean;
+    /**
+     * Report what would be merged and archived without writing anything
+     * (#1071). On by default: the protocol reads the real learned patterns in
+     * `learning-optimization`, so archiving them is opt-in (`dryRun: false`).
+     */
+    dryRun: boolean;
+    /**
+     * Patterns created less than this many days ago are never archived by the
+     * retention or trim rules, so a new pattern gets time to build confidence
+     * and usage before it is judged (#1071).
+     */
+    retentionGraceDays: number;
 }
 export interface LearningConsolidationStartedEvent extends DomainEvent {
     readonly type: 'LearningConsolidationStarted';
@@ -39,6 +57,7 @@ export interface PatternConsolidatedEvent extends DomainEvent {
         patternsAfterCount: number;
         mergedPatternIds: string[];
         removedPatternIds: string[];
+        dryRun: boolean;
     };
 }
 export interface LearningConsolidationCompletedEvent extends DomainEvent {
@@ -48,6 +67,7 @@ export interface LearningConsolidationCompletedEvent extends DomainEvent {
         stats: ConsolidationStats;
         insights: WeeklyInsight[];
         duration: number;
+        dryRun: boolean;
     };
 }
 export interface TransferReadyEvent extends DomainEvent {
@@ -75,7 +95,10 @@ export interface ConsolidationStats {
     domainsProcessed: number;
     totalPatternsAnalyzed: number;
     patternsMerged: number;
+    /** Patterns selected for removal (in a dry run, the ones that would be). */
     patternsRemoved: number;
+    /** Selected patterns actually archived (always 0 in a dry run). */
+    patternsArchived: number;
     patternsRetained: number;
     knowledgeItemsUpdated: number;
     improvementOpportunities: number;
@@ -97,8 +120,24 @@ export interface TransferablePattern {
     transferConfidence: number;
     reason: string;
 }
+/** One step of a run that did not complete (#1106). */
+export interface ConsolidationError {
+    /** Domain the step ran for; absent for run-wide steps. */
+    domain?: DomainName;
+    step: 'consolidate' | 'merge' | 'archive' | 'knowledge-update' | 'transfer';
+    error: string;
+}
 export interface ConsolidationResult {
     consolidationId: string;
+    /** True when nothing was merged, archived or written (#1071). */
+    dryRun: boolean;
+    /**
+     * #1106: `completed` only when every step of every domain succeeded;
+     * `partial` when some failed (see `errors`). When every domain fails,
+     * `execute()` returns an error instead of a result.
+     */
+    status: 'completed' | 'partial';
+    errors: ConsolidationError[];
     startedAt: Date;
     completedAt: Date;
     stats: ConsolidationStats;
@@ -112,10 +151,18 @@ export interface DomainConsolidationReport {
     patternsAfterCount: number;
     mergedPatterns: MergedPatternInfo[];
     removedPatterns: RemovedPatternInfo[];
+    /** Outcome of archiving `removedPatterns` (all zero but `selected` in a dry run). */
+    archiveCounts: ArchiveCounts;
+    /** #1106: merges that failed; their source patterns were left active and kept. */
+    mergeFailures: Array<{
+        sourcePatternIds: string[];
+        error: string;
+    }>;
     topPerformingPatterns: LearnedPattern[];
     improvementAreas: string[];
 }
 export interface MergedPatternInfo {
+    /** Id of the merged pattern; empty in a dry run, where nothing is merged. */
     resultPatternId: string;
     sourcePatternIds: string[];
     mergeReason: string;
@@ -148,7 +195,15 @@ export declare class LearningConsolidationProtocol {
      */
     gatherPatterns(): Promise<Result<DomainPatternGroup[]>>;
     /**
-     * Get patterns for a specific domain
+     * Every active learned pattern, read once per run.
+     *
+     * #1055: active patterns only, excluding `:creation:` provenance and
+     * `:archived:` records. #1071: read from `learning-optimization`, where
+     * LearningCoordinatorService writes them, not the backend default.
+     */
+    private readActivePatterns;
+    /**
+     * Patterns of one domain created or used within the analysis window
      */
     private getPatternsForDomain;
     /**
@@ -183,10 +238,14 @@ export declare class LearningConsolidationProtocol {
      * Get reason for pattern removal
      */
     private getRemovalReason;
+    /** True while a pattern is too new for the retention and trim rules. */
+    private isInGracePeriod;
     /**
-     * Archive a pattern (soft delete)
+     * Archive the selected patterns (soft delete in `learning-optimization`,
+     * #1071). Only the selected patterns are touched, and a dry run touches
+     * none. Counts are logged per domain.
      */
-    private archivePattern;
+    private archivePatterns;
     /**
      * Trim patterns to max allowed per domain
      */