agentic-qe 3.15.9 → 3.15.10

package/dist/coordination/handlers/code-intelligence-handlers.js

@@ -5,6 +5,8 @@
  * Covers: index-code, predict-defects
  */
 import * as fs from 'fs/promises';
+import { randomUUID } from 'node:crypto';
+import { prunePredictionHistory } from '../../domains/defect-intelligence/prediction-history.js';
 import * as path from 'path';
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
@@ -12,6 +14,7 @@ import { discoverSourceFiles } from './handler-utils.js';
 import { resolveProjectRootFromPaths } from '../../domains/code-intelligence/project-root-resolver.js';
 import { nothingIndexedError } from '../../domains/code-intelligence/index-path-guard.js';
 import { createLogger } from '../../logging/logger-factory.js';
+import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 const logger = createLogger('CodeIntelligenceHandlers');
 async function collectProjectMetricsForTarget(ctx, targetPath, indexedFiles) {
     if (!ctx.getCodeIntelligenceCoordinator)
@@ -43,13 +46,24 @@ async function collectProjectMetricsForTarget(ctx, targetPath, indexedFiles) {
         return undefined;
     }
 }
+/** #1126: a caller-named target must be a file or directory inside the project. */
+async function confineTarget(taskType, target) {
+    if (!target || target === '.')
+        return ok(undefined);
+    return requirePayloadPath(taskType, 'target', target, { allowDirectory: true, allowMissing: true });
+}
 export function registerCodeIntelligenceHandlers(ctx) {
     // Register code indexing handler - REAL IMPLEMENTATION
     ctx.registerHandler('index-code', async (task) => {
         const payload = task.payload;
         try {
+            // #1126: refuse an outside target before listing it, so the error
+            // cannot name the files in an outside directory.
+            const confined = await confineTarget('index-code', payload.target);
+            if (!confined.success)
+                return confined;
             const kg = ctx.getKnowledgeGraph();
-            const targetPath = payload.target || process.cwd();
+            const targetPath = confined.value ?? (payload.target || process.cwd());
             const startTime = Date.now();
             // Discover files to index
             const filesToIndex = await discoverSourceFiles(targetPath, {
@@ -139,7 +153,10 @@ export function registerCodeIntelligenceHandlers(ctx) {
     ctx.registerHandler('predict-defects', async (task) => {
         const payload = task.payload;
         try {
-            const targetPath = payload.target || process.cwd();
+            const confined = await confineTarget('predict-defects', payload.target);
+            if (!confined.success)
+                return confined;
+            const targetPath = confined.value ?? path.resolve(payload.target || process.cwd());
             const minConfidence = payload.minConfidence || 0.5;
             // Discover actual source files in the target directory
             const sourceFiles = await discoverSourceFiles(targetPath, { includeTests: false });
@@ -156,6 +173,8 @@ export function registerCodeIntelligenceHandlers(ctx) {
             }
             // Analyze each file for defect indicators based on real metrics
             const predictedDefects = [];
+            const predictions = [];
+            let filesSkipped = 0;
             for (const filePath of sourceFiles) {
                 try {
                     const content = await fs.readFile(filePath, 'utf-8');
@@ -206,6 +225,18 @@ export function registerCodeIntelligenceHandlers(ctx) {
                         reasons.push('Potentially long functions');
                     }
                     probability = Math.min(probability, 0.95);
+                    // Keep every analyzed file, including a clean reanalysis below the
+                    // display threshold. Absolute paths retain the project-relative
+                    // identity when the caller targeted a nested directory (#1050).
+                    const roundedProbability = Math.round(probability * 100) / 100;
+                    predictions.push({
+                        file: path.resolve(filePath),
+                        probability: roundedProbability,
+                        riskLevel: probability >= 0.8 ? 'critical' : probability >= 0.6 ? 'high'
+                            : probability >= 0.4 ? 'medium' : probability >= 0.2 ? 'low' : 'info',
+                        factors: [{ name: 'staticCodeIndicators', contribution: roundedProbability }],
+                        recommendations: reasons,
+                    });
                     if (probability >= minConfidence) {
                         // Use relative path for readability
                         const relativePath = filePath.startsWith(targetPath)
@@ -219,9 +250,27 @@ export function registerCodeIntelligenceHandlers(ctx) {
                     }
                 }
                 catch {
+                    filesSkipped++;
                     // Skip files that can't be read
                 }
             }
+            if (predictions.length === 0) {
+                return err(new Error(`Defect prediction could not read any of ${sourceFiles.length} source files`));
+            }
+            // Record the run in the schema consumed by the background worker.
+            // These are static risk estimates from files actually read, not an
+            // empirically calibrated likelihood of future production defects.
+            const id = randomUUID();
+            await ctx.memory.set(`defect-intelligence:predictor:prediction:${id}`, {
+                id,
+                timestamp: new Date().toISOString(),
+                predictions,
+                predictionMethod: 'static-code-indicators',
+                estimated: true,
+                filesSkipped,
+                scanStatus: filesSkipped > 0 ? 'partial' : 'complete',
+            }, { namespace: 'defect-intelligence', ttl: 86400 * 7 });
+            await prunePredictionHistory(ctx.memory);
             // Sort by probability descending
             predictedDefects.sort((a, b) => b.probability - a.probability);
             // Calculate overall risk score
@@ -232,7 +281,7 @@ export function registerCodeIntelligenceHandlers(ctx) {
             // Generate recommendations from actual findings
             const recommendations = [];
             if (predictedDefects.length > 0) {
-                recommendations.push(`${predictedDefects.length} files flagged for potential defects out of ${sourceFiles.length} analyzed`);
+                recommendations.push(`${predictedDefects.length} files flagged for potential defects out of ${predictions.length} analyzed`);
                 const topFile = predictedDefects[0];
                 recommendations.push(`Highest risk: ${topFile.file} (${Math.round(topFile.probability * 100)}%) — ${topFile.reason}`);
             }
@@ -243,13 +292,19 @@ export function registerCodeIntelligenceHandlers(ctx) {
                 recommendations.push('Address TODO/FIXME comments to reduce technical debt');
             }
             if (predictedDefects.length === 0) {
-                recommendations.push('No files exceeded the defect probability threshold — code looks healthy');
+                recommendations.push(filesSkipped > 0
+                    ? `No analyzed files exceeded the threshold; ${filesSkipped} unreadable source files remain unassessed`
+                    : 'No files exceeded the defect probability threshold — code looks healthy');
             }
             return ok({
                 predictedDefects: predictedDefects.slice(0, 20), // Top 20
                 riskScore,
                 recommendations,
-                filesAnalyzed: sourceFiles.length,
+                filesAnalyzed: predictions.length,
+                filesSkipped,
+                scanStatus: filesSkipped > 0 ? 'partial' : 'complete',
+                predictionMethod: 'static-code-indicators',
+                estimated: true,
             });
         }
         catch (error) {

package/dist/coordination/handlers/coverage-handlers.js

@@ -6,6 +6,7 @@
  */
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
+import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 import { buildEstimatedCoverage, collectRustCoverage, findCargoRoot, isCoverageExecDisabled, isRustProject, } from './coverage-collection.js';
 import { describeNoData, evaluateCoverageForTarget, isUnmeasured, packageFilterForTarget, resolveExistingCoverage, scopeCoverageToTarget, reconcileRecommendations, thresholdVerdict, } from './coverage-target.js';
 import { randomUUID } from 'crypto';
@@ -200,8 +201,16 @@ export function registerCoverageHandlers(ctx) {
     ctx.registerHandler('analyze-coverage', async (task) => {
         const payload = task.payload;
         try {
+            // #1126: collect coverage (which may run the tests) only inside the
+            // project. A missing target keeps its own message below.
+            let targetPath = payload.target || process.cwd();
+            if (payload.target && payload.target !== '.') {
+                const confined = await requirePayloadPath('analyze-coverage', 'target', payload.target, { allowDirectory: true, allowMissing: true });
+                if (!confined.success)
+                    return confined;
+                targetPath = confined.value;
+            }
             const analyzer = ctx.getCoverageAnalyzer();
-            const targetPath = payload.target || process.cwd();
             const threshold = payload.threshold || 80;
             const { collected, ranTests, noData, projectRoot, notes, runStatus, testRun } = await collectCoverage(targetPath);
             // #995 review N5: say so plainly instead of "no coverage data found".

package/dist/coordination/handlers/requirements-handlers.js

@@ -8,12 +8,20 @@ import * as fs from 'fs/promises';
 import { ok, err } from '../../shared/types/index.js';
 import { toError, toErrorMessage } from '../../shared/error-utils.js';
 import { discoverSourceFiles } from './handler-utils.js';
+import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 export function registerRequirementsHandlers(ctx) {
     // Register requirements validation handler
     ctx.registerHandler('validate-requirements', async (task) => {
         const payload = task.payload;
         try {
-            const targetPath = payload.requirementsPath || process.cwd();
+            // #1126: list requirement files only inside the project.
+            let targetPath = process.cwd();
+            if (payload.requirementsPath) {
+                const confined = await requirePayloadPath('validate-requirements', 'requirementsPath', payload.requirementsPath, { allowDirectory: true, allowMissing: true });
+                if (!confined.success)
+                    return confined;
+                targetPath = confined.value;
+            }
             // Look for requirements files (markdown, feature files, etc.)
             const reqFiles = await discoverSourceFiles(targetPath, {
                 includeTests: false,
@@ -58,9 +66,15 @@ export function registerRequirementsHandlers(ctx) {
                     error: 'contractPath is required. Provide a path to an OpenAPI spec, JSON Schema, or Protocol Buffer file.',
                 });
             }
+            // #1126: read only a regular file inside the project, within the size
+            // limit; the result reports its line count and whether it parses. A
+            // missing file keeps its valid:false result below.
+            const confined = await requirePayloadPath('validate-contracts', 'contractPath', payload.contractPath, { allowMissing: true, maxBytes: MAX_PAYLOAD_FILE_BYTES });
+            if (!confined.success)
+                return confined;
             // Check if the contract file exists
             try {
-                const content = await fs.readFile(payload.contractPath, 'utf-8');
+                const content = await fs.readFile(confined.value, 'utf-8');
                 const isJson = payload.contractPath.endsWith('.json');
                 const isYaml = payload.contractPath.endsWith('.yaml') || payload.contractPath.endsWith('.yml');
                 // Basic structural validation

package/dist/coordination/handlers/security-handlers.js

@@ -13,12 +13,22 @@ import { FilePath } from '../../shared/value-objects/index.js';
 import { generateSecurityRecommendations } from './handler-utils.js';
 import { discoverSecurityFiles, isSecuritySourceFile } from '../../domains/security-compliance/scan-discovery.js';
 import { runDependencyAdvisoryScan } from '../../domains/security-compliance/dependency-advisory-engine.js';
+import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 export function registerSecurityHandlers(ctx) {
     // Register security scan handler - REAL IMPLEMENTATION
     ctx.registerHandler('scan-security', async (task) => {
         const payload = task.payload;
         try {
-            const targetPath = path.resolve(payload.target || process.cwd());
+            // #1126: read (SAST, manifests, dependencies) only a file or directory
+            // inside the project. A DAST-only scan reads no target path.
+            let targetPath = path.resolve(payload.target || process.cwd());
+            const readsTarget = payload.sast !== false || payload.dependencies === true;
+            if (payload.target && payload.target !== '.' && readsTarget) {
+                const confined = await requirePayloadPath('scan-security', 'target', payload.target, { allowDirectory: true, allowMissing: true, maxBytes: MAX_PAYLOAD_FILE_BYTES });
+                if (!confined.success)
+                    return confined;
+                targetPath = confined.value;
+            }
             const sastRequested = payload.sast !== false;
             const discoveryResult = sastRequested ? await discoverSecurityFiles(targetPath) : undefined;
             const filesToScan = discoveryResult?.files ?? [];

package/dist/coordination/handlers/test-execution-handlers.js

@@ -8,11 +8,12 @@ import { v4 as uuidv4 } from 'uuid';
 import * as fs from 'fs/promises';
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
-import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
+import { capDiagnostics, getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../shared/vitest-json-report.js';
 import { jestExactPathPattern, runnerFilePath } from '../../shared/test-runner-args.js';
 import { testCasesFromRunnerReport } from '../../domains/test-execution/services/runner-test-cases.js';
 import { runTestRunnerProcess } from '../../shared/test-runner-process.js';
+import { MAX_PAYLOAD_FILE_BYTES, requirePayloadFiles } from '../../shared/io/payload-path-guard.js';
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -69,9 +70,19 @@ export function registerTestExecutionHandlers(ctx) {
             if (payload.sourceFiles && payload.sourceFiles.length > 0) {
                 sourceFiles = payload.sourceFiles;
             }
-            else if (payload.filePath) {
+            else if (payload.filePath && !payload.sourceCode) {
+                // With sourceCode, filePath is only the import target written into the
+                // generated tests (tool contract); it is neither read nor required.
                 sourceFiles = [payload.filePath];
             }
+            if (sourceFiles.length > 0) {
+                // #1126: the generator reads each file whole, so only project files.
+                const field = payload.sourceFiles?.length ? 'sourceFiles' : 'filePath';
+                const confined = await requirePayloadFiles('generate-tests', field, sourceFiles, { maxBytes: MAX_PAYLOAD_FILE_BYTES });
+                if (!confined.success)
+                    return confined;
+                sourceFiles = confined.value;
+            }
             else if (payload.sourceCode) {
                 // Write temporary file for analysis if only source code provided
                 // Use correct file extension based on language parameter
@@ -175,15 +186,22 @@ export function registerTestExecutionHandlers(ctx) {
     ctx.registerHandler('execute-tests', async (task) => {
         const payload = task.payload;
         try {
-            const testFiles = payload.testFiles || [];
-            if (testFiles.length === 0) {
+            const requestedFiles = payload.testFiles || [];
+            if (requestedFiles.length === 0) {
                 return err(new TestRunnerExecutionError('No test files specified. Provide testFiles array with paths to test files.'));
             }
             // Validate test file paths before invoking a runner.
             const safePathPattern = /^[a-zA-Z0-9_./@-]+$/;
-            if (testFiles.some(file => !safePathPattern.test(file))) {
+            if (requestedFiles.some(file => !safePathPattern.test(file))) {
                 return err(new TestRunnerExecutionError('Some test file paths contain invalid characters and were rejected. Provide concrete paths; expand glob patterns before calling.'));
             }
+            // #1126: a runner executes what it is given, so only files and
+            // directories (#909 Jest targets) inside the project, run as the real
+            // paths that were checked. A missing file is still reported by the runner.
+            const confined = await requirePayloadFiles('execute-tests', 'testFiles', requestedFiles, { allowMissing: true, allowDirectory: true });
+            if (!confined.success)
+                return confined;
+            const testFiles = confined.value;
             // A caller-owned MCP task skips the Queen's plugin dispatch. Run through
             // that same domain API here: it owns persistence, measured quality evidence
             // and TestRunStarted/Completed events as well as the runner itself.
@@ -230,7 +248,7 @@ export function registerTestExecutionHandlers(ctx) {
             }
             const diagnostics = [execution.error?.message, execution.signal && `Terminated by ${execution.signal}`, execution.stderr, output].filter(Boolean).join('\n');
             if (execution.error) {
-                return err(new TestRunnerExecutionError(`${runner} could not complete: ${diagnostics.slice(0, 4000)}`));
+                return err(new TestRunnerExecutionError(`${runner} could not complete: ${capDiagnostics(diagnostics)}`));
             }
             try {
                 const jsonStart = output.indexOf('{');
@@ -259,7 +277,7 @@ export function registerTestExecutionHandlers(ctx) {
             catch {
                 // A malformed report cannot establish that the requested tests completed.
             }
-            return err(new TestRunnerExecutionError(`Could not parse ${runner} results (exit code ${execution.status ?? 'unknown'}):\n${diagnostics.slice(0, 4000)}`));
+            return err(new TestRunnerExecutionError(`Could not parse ${runner} results (exit code ${execution.status ?? 'unknown'}):\n${capDiagnostics(diagnostics)}`));
         }
         catch (error) {
             return err(toError(error));

package/dist/coordination/mincut/queen-integration.d.ts

@@ -20,6 +20,19 @@ import { SwarmGraph } from './swarm-graph';
 import { MinCutHealthMonitor } from './mincut-health-monitor';
 import { MinCutPersistence } from './mincut-persistence';
 import { SwarmVertex, SwarmEdge, MinCutHealth, MinCutHealthConfig, WeakVertex } from './interfaces';
+/**
+ * #1130: Queen health reads the MinCut of the fleet's own topology (domains
+ * and long-lived agents). An agent spawned for one task is a leaf with a
+ * single edge, so counting it would put every running task below threshold.
+ */
+export interface FleetMinCutHealth extends MinCutHealth {
+    /** Status of the topology without task-scoped agents; this one degrades Queen health. */
+    readonly fleetStatus: MinCutHealth['status'];
+    /** MinCut of the topology without task-scoped agents. `minCutValue` stays the raw value. */
+    readonly fleetMinCutValue: number;
+    /** Running task-scoped agents left out of `fleetStatus`. */
+    readonly taskAgents: number;
+}
 /**
  * Configuration for Queen-MinCut integration
  */
@@ -56,6 +69,13 @@ export declare class QueenMinCutBridge {
     private readonly monitor;
     private readonly persistence;
     private eventSubscriptions;
+    /**
+     * Agents with a vertex in the graph, from QueenAgentSpawned or from the
+     * coordinator when the graph was built. Pruned once they complete (#1130).
+     */
+    private readonly spawnedAgentIds;
+    /** The subset spawned for a single task (#1130). */
+    private readonly taskAgentIds;
     private snapshotTimer;
     private initialized;
     constructor(eventBus: EventBus, agentCoordinator: AgentCoordinator, config?: Partial<QueenMinCutConfig>);
@@ -100,11 +120,29 @@ export declare class QueenMinCutBridge {
      * Convert MinCut alerts to Queen health issues
      */
     getHealthIssuesFromMinCut(): HealthIssue[];
+    /**
+     * #1130: nothing publishes QueenAgentTerminated, so a finished task agent
+     * stayed in the topology and kept the fleet degraded after its run. Drop the
+     * vertex of every tracked agent that completed normally or that the
+     * coordinator no longer lists. A failed agent keeps its vertex (see
+     * failedAgentIssues), so a crash never makes the fleet look healthier.
+     * Returns the tracked agents that failed.
+     */
+    private pruneCompletedAgents;
+    /** #1130: one issue per failed agent, task-scoped or long-lived. */
+    private failedAgentIssues;
+    private isTaskAgentVertex;
+    /**
+     * #1130: MinCut health with the fleet reading next to the raw one. The fleet
+     * reading drops task-scoped agents from a copy of the graph; the raw graph,
+     * its value and its alerts are unchanged.
+     */
+    getFleetMinCutHealth(): FleetMinCutHealth;
     /**
      * Extend Queen health with MinCut metrics
      */
     extendQueenHealth(baseHealth: QueenHealth): QueenHealth & {
-        minCut?: MinCutHealth;
+        minCut?: FleetMinCutHealth;
     };
     /**
      * Extend Queen metrics with MinCut data

package/dist/coordination/mincut/queen-integration.js

@@ -44,6 +44,13 @@ export class QueenMinCutBridge {
     monitor;
     persistence;
     eventSubscriptions = [];
+    /**
+     * Agents with a vertex in the graph, from QueenAgentSpawned or from the
+     * coordinator when the graph was built. Pruned once they complete (#1130).
+     */
+    spawnedAgentIds = new Set();
+    /** The subset spawned for a single task (#1130). */
+    taskAgentIds = new Set();
     snapshotTimer = null;
     initialized = false;
     constructor(eventBus, agentCoordinator, config = {}) {
@@ -137,6 +144,8 @@ export class QueenMinCutBridge {
         // Add agent vertices
         for (const agent of agents) {
             this.addAgentVertex(agent);
+            // #1130: tracked so a completed agent is pruned like a spawned one
+            this.spawnedAgentIds.add(agent.id);
         }
         // Add edges based on coordination patterns
         this.buildCoordinationEdges(agents);
@@ -239,7 +248,10 @@ export class QueenMinCutBridge {
     subscribeToEvents() {
         // Agent spawned
         const onAgentSpawned = async (event) => {
-            const { agentId, domain, type, capabilities } = event.payload;
+            const { agentId, domain, type, capabilities, taskId } = event.payload;
+            this.spawnedAgentIds.add(agentId);
+            if (taskId)
+                this.taskAgentIds.add(agentId);
             // Cast to extended AgentInfo with optional properties
             this.addAgentVertex({
                 id: agentId,
@@ -381,7 +393,9 @@ export class QueenMinCutBridge {
         }
         // Add issues for weak vertices
         const weakVertices = this.monitor.getWeakVertices();
-        for (const weak of weakVertices.slice(0, 3)) { // Top 3 weak vertices
+        // #1130: a task-scoped agent is a leaf by design, not a weak point of the fleet
+        const fleetWeakVertices = weakVertices.filter(weak => !this.isTaskAgentVertex(weak.vertex.id));
+        for (const weak of fleetWeakVertices.slice(0, 3)) { // Top 3 weak vertices
             if (weak.riskScore > 0.7) {
                 issues.push({
                     severity: 'high',
@@ -393,6 +407,66 @@ export class QueenMinCutBridge {
         }
         return issues;
     }
+    /**
+     * #1130: nothing publishes QueenAgentTerminated, so a finished task agent
+     * stayed in the topology and kept the fleet degraded after its run. Drop the
+     * vertex of every tracked agent that completed normally or that the
+     * coordinator no longer lists. A failed agent keeps its vertex (see
+     * failedAgentIssues), so a crash never makes the fleet look healthier.
+     * Returns the tracked agents that failed.
+     */
+    pruneCompletedAgents() {
+        if (this.spawnedAgentIds.size === 0)
+            return [];
+        const byId = new Map(this.agentCoordinator.listAgents().map(agent => [agent.id, agent]));
+        const failed = [];
+        for (const agentId of this.spawnedAgentIds) {
+            const agent = byId.get(agentId);
+            if (agent?.status === 'failed') {
+                failed.push(agent);
+                continue;
+            }
+            if (agent && agent.status !== 'completed')
+                continue;
+            this.graph.removeVertex(`agent:${agentId}`);
+            this.spawnedAgentIds.delete(agentId);
+            this.taskAgentIds.delete(agentId);
+        }
+        return failed;
+    }
+    /** #1130: one issue per failed agent, task-scoped or long-lived. */
+    failedAgentIssues(failed) {
+        return failed.map(agent => ({
+            severity: 'high',
+            message: `Agent ${agent.id} (${agent.type}) failed`,
+            timestamp: new Date(),
+            domain: agent.domain,
+        }));
+    }
+    isTaskAgentVertex(vertexId) {
+        return vertexId.startsWith('agent:') && this.taskAgentIds.has(vertexId.slice('agent:'.length));
+    }
+    /**
+     * #1130: MinCut health with the fleet reading next to the raw one. The fleet
+     * reading drops task-scoped agents from a copy of the graph; the raw graph,
+     * its value and its alerts are unchanged.
+     */
+    getFleetMinCutHealth() {
+        const raw = this.getMinCutHealth();
+        if (this.taskAgentIds.size === 0) {
+            return { ...raw, fleetStatus: raw.status, fleetMinCutValue: raw.minCutValue, taskAgents: 0 };
+        }
+        const fleetGraph = this.graph.clone();
+        for (const agentId of this.taskAgentIds)
+            fleetGraph.removeVertex(`agent:${agentId}`);
+        const fleet = createMinCutHealthMonitor(fleetGraph, this.config).getHealth();
+        return {
+            ...raw,
+            fleetStatus: fleet.status,
+            fleetMinCutValue: fleet.minCutValue,
+            taskAgents: this.taskAgentIds.size,
+        };
+    }
     /**
      * Extend Queen health with MinCut metrics
      */
@@ -400,19 +474,22 @@ export class QueenMinCutBridge {
         if (!this.config.includeInQueenHealth) {
             return baseHealth;
         }
-        const minCutHealth = this.getMinCutHealth();
-        const minCutIssues = this.getHealthIssuesFromMinCut();
+        const failedAgents = this.pruneCompletedAgents();
+        const minCutHealth = this.getFleetMinCutHealth();
+        // #1130: with only task-scoped agents the fleet topology is idle, and the
+        // raw alerts describe those agents, not the fleet.
+        const minCutIssues = minCutHealth.fleetStatus === 'idle' ? [] : this.getHealthIssuesFromMinCut();
         // Issue #205 fix: Only degrade status for actual critical issues
         // 'idle' status is normal for fresh installs - don't degrade health
         let status = baseHealth.status;
-        if (minCutHealth.status === 'critical' && status === 'healthy') {
+        if ((minCutHealth.fleetStatus === 'critical' || failedAgents.length > 0) && status === 'healthy') {
             status = 'degraded';
         }
         // Note: 'idle' status does NOT trigger degradation - it's expected for fresh systems
         return {
             ...baseHealth,
             status,
-            issues: [...baseHealth.issues, ...minCutIssues],
+            issues: [...baseHealth.issues, ...this.failedAgentIssues(failedAgents), ...minCutIssues],
             minCut: minCutHealth,
         };
     }

package/dist/coordination/protocols/learning-consolidation-archive.d.ts

@@ -14,10 +14,10 @@
  *   deleted. A pattern used or re-scored since it was selected is left active.
  * - The archive copy is read back before the active key is deleted, so a
  *   failed write never loses the pattern.
+ * The move is implemented in domains/learning-optimization/pattern-archive.ts.
  */
-import type { MemoryBackend } from '../../kernel/interfaces.js';
 import type { LearnedPattern } from '../../domains/learning-optimization/interfaces.js';
-export type ArchiveOutcome = 'archived' | 'missing' | 'failed';
+export { archiveSelectedPattern, type ArchiveOutcome } from '../../domains/learning-optimization/pattern-archive.js';
 /** Counts of one consolidation run's archive step, for logs and results. */
 export interface ArchiveCounts {
     /** Patterns the retention and trim rules selected for removal. */
@@ -30,10 +30,6 @@ export interface ArchiveCounts {
     failed: number;
 }
 export declare function emptyArchiveCounts(): ArchiveCounts;
-/**
- * Move one selected pattern to its archive key in the learning namespace.
- */
-export declare function archiveSelectedPattern(memory: MemoryBackend, pattern: LearnedPattern, archivedAt?: Date): Promise<ArchiveOutcome>;
 /** True when the pattern was created less than `graceDays` days ago. */
 export declare function isWithinRetentionGrace(pattern: LearnedPattern, graceDays: number, now?: number): boolean;
 //# sourceMappingURL=learning-consolidation-archive.d.ts.map

package/dist/coordination/protocols/learning-consolidation-archive.js

@@ -14,37 +14,14 @@
  *   deleted. A pattern used or re-scored since it was selected is left active.
  * - The archive copy is read back before the active key is deleted, so a
  *   failed write never loses the pattern.
+ * The move is implemented in domains/learning-optimization/pattern-archive.ts.
  */
-import { LEARNING_NS, LEARNING_PATTERN_KEY_PREFIX, isActivePatternKey, } from '../../domains/learning-optimization/active-patterns.js';
+// The move itself lives with the patterns, so the merge path in
+// LearningCoordinatorService uses the same read-back rule (#1106).
+export { archiveSelectedPattern } from '../../domains/learning-optimization/pattern-archive.js';
 export function emptyArchiveCounts() {
     return { selected: 0, archived: 0, missing: 0, failed: 0 };
 }
-/**
- * Move one selected pattern to its archive key in the learning namespace.
- */
-export async function archiveSelectedPattern(memory, pattern, archivedAt = new Date()) {
-    const activeKey = `${LEARNING_PATTERN_KEY_PREFIX}${pattern.id}`;
-    if (!isActivePatternKey(activeKey))
-        return 'missing';
-    const current = await memory.get(activeKey, LEARNING_NS);
-    if (!current || current.id !== pattern.id || changedSinceSelection(current, pattern))
-        return 'missing';
-    const archiveKey = `${LEARNING_PATTERN_KEY_PREFIX}archived:${pattern.id}`;
-    await memory.set(archiveKey, { ...pattern, archivedAt }, { ...LEARNING_NS, persist: true });
-    const copy = await memory.get(archiveKey, LEARNING_NS);
-    if (!copy || copy.id !== pattern.id)
-        return 'failed';
-    await memory.delete(activeKey, LEARNING_NS);
-    return 'archived';
-}
-/** True when the stored record's scores or last use differ from the selected snapshot. */
-function changedSinceSelection(current, selected) {
-    const time = (value) => new Date(value).getTime();
-    return (!Object.is(current.usageCount, selected.usageCount) ||
-        !Object.is(current.confidence, selected.confidence) ||
-        !Object.is(current.successRate, selected.successRate) ||
-        !Object.is(time(current.lastUsedAt), time(selected.lastUsedAt)));
-}
 /** True when the pattern was created less than `graceDays` days ago. */
 export function isWithinRetentionGrace(pattern, graceDays, now = Date.now()) {
     if (graceDays <= 0)

package/dist/coordination/protocols/learning-consolidation.d.ts

@@ -9,6 +9,11 @@ import { Result, DomainName, DomainEvent } from '../../shared/types/index.js';
 import { EventBus, MemoryBackend } from '../../kernel/interfaces.js';
 import { type ArchiveCounts } from './learning-consolidation-archive.js';
 import type { LearnedPattern, PatternType, IPatternLearningService, IKnowledgeSynthesisService } from '../../domains/learning-optimization/interfaces.js';
+/**
+ * Id of a merged pattern a dry run predicts but never stores (#1106). It only
+ * appears in `removedPatterns` when the predicted merge would itself be trimmed.
+ */
+export declare const DRY_RUN_MERGE_ID_PREFIX = "dry-run-merge:";
 export interface LearningConsolidationConfig {
     /** Minimum patterns per domain to trigger consolidation */
     minPatternsForConsolidation: number;
@@ -115,10 +120,24 @@ export interface TransferablePattern {
     transferConfidence: number;
     reason: string;
 }
+/** One step of a run that did not complete (#1106). */
+export interface ConsolidationError {
+    /** Domain the step ran for; absent for run-wide steps. */
+    domain?: DomainName;
+    step: 'consolidate' | 'merge' | 'archive' | 'knowledge-update' | 'transfer';
+    error: string;
+}
 export interface ConsolidationResult {
     consolidationId: string;
     /** True when nothing was merged, archived or written (#1071). */
     dryRun: boolean;
+    /**
+     * #1106: `completed` only when every step of every domain succeeded;
+     * `partial` when some failed (see `errors`). When every domain fails,
+     * `execute()` returns an error instead of a result.
+     */
+    status: 'completed' | 'partial';
+    errors: ConsolidationError[];
     startedAt: Date;
     completedAt: Date;
     stats: ConsolidationStats;
@@ -134,6 +153,11 @@ export interface DomainConsolidationReport {
     removedPatterns: RemovedPatternInfo[];
     /** Outcome of archiving `removedPatterns` (all zero but `selected` in a dry run). */
     archiveCounts: ArchiveCounts;
+    /** #1106: merges that failed; their source patterns were left active and kept. */
+    mergeFailures: Array<{
+        sourcePatternIds: string[];
+        error: string;
+    }>;
     topPerformingPatterns: LearnedPattern[];
     improvementAreas: string[];
 }