agentic-qe 3.7.16 → 3.7.17

package/assets/skills/qcsd-refinement-swarm/steps/01-flag-detection.md

@@ -0,0 +1,91 @@
+# Step 1: Analyze Story Content (Flag Detection)
+
+## Prerequisites
+- Refinement swarm skill invoked
+- User story / acceptance criteria provided
+- OUTPUT_FOLDER determined
+
+## Instructions
+
+### MANDATORY: Complete this analysis before Step 2.
+
+### Step 0: Retrieve Ideation Phase Signals (Cross-Phase Consumption)
+
+Before analyzing story content, retrieve the most recent Ideation phase signals from memory.
+
+**MCP Method (preferred):**
+
+```javascript
+mcp__agentic-qe__memory_query({
+  pattern: "qcsd-ideation-*",
+  namespace: "qcsd-ideation",
+  limit: 1
+})
+```
+
+**CLI Fallback:**
+
+```bash
+npx @claude-flow/cli@latest memory search --query "qcsd-ideation" --namespace qcsd-ideation --limit 1
+```
+
+### Step 1: Scan Story Content and Detect Flags
+
+Scan the user story, acceptance criteria, and any referenced specifications to SET these flags. Do not skip any flag.
+
+### Flag Detection (Check ALL SEVEN)
+
+```
+HAS_API = FALSE
+  Set TRUE if story mentions ANY of: API, endpoint, REST, GraphQL, gRPC,
+  webhook, contract, consumer, provider, OpenAPI, Swagger, request/response,
+  HTTP method, payload, schema, backward compatibility
+
+HAS_REFACTORING = FALSE
+  Set TRUE if story mentions ANY of: refactor, restructure, rewrite,
+  migrate, replace, consolidate, extract, decompose, simplify, optimize,
+  technical debt, legacy, modernize, upgrade
+
+HAS_DEPENDENCIES = FALSE
+  Set TRUE if story mentions ANY of: dependency, library, package, version,
+  upgrade, third-party, external service, integration, SDK, plugin,
+  framework update, breaking change, compatibility
+
+HAS_SECURITY = FALSE
+  Set TRUE if story mentions ANY of: authentication, authorization, encryption,
+  token, OAuth, JWT, RBAC, security, vulnerability, OWASP, input validation,
+  sanitization, XSS, CSRF, injection, secrets, credentials
+
+HAS_MIDDLEWARE = FALSE
+  Set TRUE if story mentions ANY of: middleware, ESB, message broker, MQ,
+  Kafka, RabbitMQ, integration bus, API gateway, message queue, pub/sub,
+  event bus, service bus, ActiveMQ, NATS, Redis Streams
+
+HAS_SAP_INTEGRATION = FALSE
+  Set TRUE if story mentions ANY of: SAP, OData, RFC, BAPI, IDoc,
+  S/4HANA, EWM, ECC, ABAP, CDS view, Fiori, SAP Cloud Integration,
+  SAP PI/PO, SAP Gateway, SAP connector
+
+HAS_AUTHORIZATION = FALSE
+  Set TRUE if story mentions ANY of: SoD, segregation of duties,
+  role conflict, authorization object, T-code, user role,
+  access control matrix, GRC, RBAC policy, permission matrix,
+  privilege escalation, role assignment
+```
+
+### MANDATORY: Output Flag Detection Results
+
+You MUST output flag detection results in a structured format showing each flag value with evidence before proceeding.
+
+## Success Criteria
+- [ ] Ideation phase signals retrieved (or documented as unavailable)
+- [ ] All SEVEN flags evaluated with evidence
+- [ ] Flag detection results output
+- [ ] Expected agent count calculated (3 core + conditional count + 1 transformation)
+
+## Output
+Provide: All flag values with evidence, expected agent count, Ideation baseline data.
+
+## Navigation
+- On success: proceed to Step 2 by reading `steps/02-core-agents.md`
+- On failure: halt and report which flags could not be evaluated

package/assets/skills/qcsd-refinement-swarm/steps/02-core-agents.md

@@ -0,0 +1,40 @@
+# Step 2: Spawn Core Agents (Parallel Batch 1)
+
+## Prerequisites
+- Step 1 (Flag Detection) completed
+- User story content available
+- OUTPUT_FOLDER determined
+
+## Instructions
+
+### CRITICAL: Spawn ALL THREE core agents in ONE message
+
+| Agent | Domain | Role |
+|-------|--------|------|
+| qe-product-factors-assessor | requirements-validation | SFDIPOT (7 factors, 37 subcategories) analysis |
+| qe-bdd-generator | requirements-validation | BDD Gherkin scenario generation |
+| qe-requirements-validator | requirements-validation | INVEST validation and testability scoring |
+
+### Agent 1: Product Factors Assessor
+Analyze the story using SFDIPOT product factors (Structure, Function, Data, Interface, Platform, Operations, Time). Must read the SFDIPOT reference material first. Save to: `${OUTPUT_FOLDER}/02-product-factors.md`
+
+### Agent 2: BDD Generator
+Generate comprehensive BDD Gherkin scenarios from the story acceptance criteria. Must produce Given/When/Then scenarios covering happy paths, edge cases, and negative cases. Save to: `${OUTPUT_FOLDER}/03-bdd-scenarios.md`
+
+### Agent 3: Requirements Validator
+Validate the story against INVEST criteria (Independent, Negotiable, Valuable, Estimable, Small, Testable). Assess testability scoring and acceptance criteria completeness. Save to: `${OUTPUT_FOLDER}/04-requirements-validation.md`
+
+### Post-Spawn Confirmation
+Tell the user all 3 core agents are running and WAIT.
+
+## Success Criteria
+- [ ] All THREE agents spawned in ONE message
+- [ ] Each agent has complete story content
+- [ ] Post-spawn confirmation sent
+
+## Output
+Confirmation that 3 agents are running in background.
+
+## Navigation
+- On success: proceed to Step 3 by reading `steps/03-batch1-results.md`
+- On failure: respawn missing agents

package/assets/skills/qcsd-refinement-swarm/steps/03-batch1-results.md

@@ -0,0 +1,40 @@
+# Step 3: Wait for Batch 1 & Extract Results
+
+## Prerequisites
+- Step 2: All 3 core agents spawned
+
+## Instructions
+
+### WAIT for all three agents to complete. Do NOT proceed early.
+
+### Extract from each agent:
+
+**From qe-product-factors-assessor:**
+- SFDIPOT factor scores and priorities
+- Key quality risks identified
+- Product factor coverage assessment
+
+**From qe-bdd-generator:**
+- Number of BDD scenarios generated
+- Coverage of acceptance criteria
+- Edge cases and negative scenarios
+
+**From qe-requirements-validator:**
+- INVEST validation score
+- Testability score
+- Acceptance criteria completeness percentage
+- Missing requirements identified
+
+### Output Metrics Summary Box with all extracted values.
+
+## Success Criteria
+- [ ] All three agents returned results
+- [ ] All metrics extracted
+- [ ] Summary box output with actual values
+
+## Output
+Complete Batch 1 metrics for use in subsequent steps.
+
+## Navigation
+- On success: proceed to Step 4 by reading `steps/04-conditional-agents.md`
+- On failure: retry failed agents

package/assets/skills/qcsd-refinement-swarm/steps/04-conditional-agents.md

@@ -0,0 +1,35 @@
+# Step 4: Spawn Conditional Agents (Parallel Batch 2)
+
+## Prerequisites
+- Step 3 completed with core metrics
+- Flag values from Step 1
+
+## Instructions
+
+### IF A FLAG IS TRUE, YOU MUST SPAWN THAT AGENT
+
+| Flag | Agent | Domain | Output File |
+|------|-------|--------|-------------|
+| HAS_API | qe-contract-validator | contract-testing | `05-contract-validation.md` |
+| HAS_REFACTORING | qe-impact-analyzer | code-intelligence | `06-impact-analysis.md` |
+| HAS_DEPENDENCIES | qe-dependency-mapper | code-intelligence | `07-dependency-analysis.md` |
+| HAS_SECURITY | (handled by core) | - | - |
+| HAS_MIDDLEWARE | qe-middleware-validator | enterprise-integration | `08-middleware-validation.md` |
+| HAS_SAP_INTEGRATION | qe-odata-contract-tester | enterprise-integration | `09-odata-contracts.md` |
+| HAS_AUTHORIZATION | qe-sod-analyzer | enterprise-integration | `10-sod-analysis.md` |
+
+If ALL flags are FALSE, skip to Step 5.
+
+Otherwise, spawn all applicable agents in ONE message and WAIT for completion.
+
+## Success Criteria
+- [ ] All flagged agents spawned (or skipped if no flags)
+- [ ] Agent count validation passed
+- [ ] All conditional agents completed
+
+## Output
+Conditional agent scores for decision logic.
+
+## Navigation
+- On success: proceed to Step 5 by reading `steps/05-decision-synthesis.md`
+- On failure: spawn missing agents

package/assets/skills/qcsd-refinement-swarm/steps/05-decision-synthesis.md

@@ -0,0 +1,43 @@
+# Step 5: Synthesize Results & Determine Recommendation
+
+## Prerequisites
+- Core and conditional agent results available
+
+## Instructions
+
+### Apply READY/CONDITIONAL/NOT-READY decision logic EXACTLY
+
+Derive metrics from agent outputs and apply the decision tree:
+
+**NOT-READY conditions (ANY triggers NOT-READY):**
+- Testability score < 40%
+- INVEST validation fails on 3+ criteria
+- Critical SFDIPOT gaps in Structure or Function
+- Missing acceptance criteria for core functionality
+- Contract validation failures on existing APIs (if applicable)
+
+**READY conditions (ALL required for READY):**
+- Testability score >= 70%
+- INVEST validation passes on 5+ criteria
+- All SFDIPOT factors assessed with no critical gaps
+- BDD scenarios cover all acceptance criteria
+- No unresolved blocking issues from conditional agents
+
+**Default: CONDITIONAL**
+
+### Record decision with full metrics and rationale.
+
+If CONDITIONAL, list specific conditions that must be met.
+If NOT-READY, list specific blockers with remediation steps.
+
+## Success Criteria
+- [ ] All metrics derived from actual agent outputs
+- [ ] Decision logic applied exactly
+- [ ] FINAL RECOMMENDATION: READY / CONDITIONAL / NOT-READY
+
+## Output
+Recommendation, metrics, rationale, and improvement actions.
+
+## Navigation
+- On success: proceed to Step 6 by reading `steps/06-report-generation.md`
+- On failure: resolve missing metrics

package/assets/skills/qcsd-refinement-swarm/steps/06-report-generation.md

@@ -0,0 +1,42 @@
+# Step 6: Generate Refinement Report
+
+## Prerequisites
+- Step 5 completed with FINAL RECOMMENDATION
+- All agent reports available
+
+## Instructions
+
+Generate the complete Refinement Report and save to `${OUTPUT_FOLDER}/01-executive-summary.md`.
+
+The report MUST include:
+1. Executive Summary with recommendation and key metrics
+2. SFDIPOT Product Factors Analysis (from qe-product-factors-assessor)
+3. BDD Scenarios (from qe-bdd-generator)
+4. Requirements Validation (from qe-requirements-validator)
+5. Conditional Analysis sections (for each conditional agent that ran)
+6. Recommended Actions (P0/P1/P2 prioritized)
+7. Test Strategy Summary
+
+### Report Validation Checklist
+
+```
++-- Executive Summary is complete with all metrics
++-- Recommendation matches decision logic
++-- SFDIPOT section covers all 7 factors
++-- BDD section includes all generated scenarios
++-- Requirements section includes INVEST scores
++-- Conditional sections present for all spawned agents
++-- Actions are specific and actionable
++-- Report saved to output folder
+```
+
+## Success Criteria
+- [ ] Complete report with all sections
+- [ ] Report saved to correct path
+
+## Output
+Confirmation that report is saved.
+
+## Navigation
+- On success: proceed to Step 7 by reading `steps/07-learning-persistence.md`
+- On failure: complete missing sections

package/assets/skills/qcsd-refinement-swarm/steps/07-learning-persistence.md

@@ -0,0 +1,53 @@
+# Step 7: Store Learnings & Persist State
+
+## Prerequisites
+- Step 6 completed
+- All metrics and flags available
+
+## Instructions
+
+### ENFORCEMENT: ALWAYS RUN. NOT OPTIONAL.
+
+Store refinement findings to memory for cross-phase feedback:
+
+**Step 1: Store to memory**
+
+```javascript
+mcp__agentic-qe__memory_store({
+  key: `qcsd-refinement-${storyId}-${Date.now()}`,
+  namespace: "qcsd-refinement",
+  value: {
+    storyId, recommendation, testabilityScore,
+    investScore, sfdipotPriorities, bddScenarioCount,
+    flags, agentsInvoked, timestamp
+  }
+})
+```
+
+**Step 2: Share learnings**
+
+```javascript
+mcp__agentic-qe__memory_share({
+  sourceAgentId: "qcsd-refinement-swarm",
+  targetAgentIds: ["qe-test-idea-rewriter"],
+  knowledgeDomain: "refinement-test-patterns"
+})
+```
+
+**Step 3: Save persistence record**
+
+Save to `${OUTPUT_FOLDER}/11-learning-persistence.json` with complete metrics, flags, and cross-phase signals.
+
+### Fallback: CLI commands if MCP unavailable.
+
+## Success Criteria
+- [ ] Memory store executed with actual values
+- [ ] Learning persistence JSON saved
+- [ ] Cross-phase signals documented
+
+## Output
+Confirmation of persistence.
+
+## Navigation
+- On success: proceed to Step 8 by reading `steps/08-transformation.md`
+- On failure: retry persistence

package/assets/skills/qcsd-refinement-swarm/steps/08-transformation.md

@@ -0,0 +1,36 @@
+# Step 8: Apply Test Idea Rewriter (Transformation)
+
+## Prerequisites
+- Step 7 completed
+- BDD scenarios from Step 2 available
+- All test ideas collected from all agents
+
+## Instructions
+
+### ENFORCEMENT: ALWAYS RUN qe-test-idea-rewriter
+
+Spawn qe-test-idea-rewriter to transform ALL test ideas from passive descriptions
+into active, exploratory test charters.
+
+This agent must:
+1. Read all BDD scenarios from qe-bdd-generator output
+2. Read all test suggestions from other agents
+3. Transform each passive test idea ("Verify X works") into an active charter
+4. Apply the Session-Based Test Management (SBTM) charter format
+5. Prioritize test ideas by risk and SFDIPOT factor weights
+
+Save output to: `${OUTPUT_FOLDER}/12-rewritten-test-ideas.md`
+
+WAIT for the agent to complete.
+
+## Success Criteria
+- [ ] qe-test-idea-rewriter spawned and completed
+- [ ] All test ideas transformed
+- [ ] Output saved to correct path
+
+## Output
+Transformed test ideas for final report.
+
+## Navigation
+- On success: proceed to Step 9 by reading `steps/09-final-output.md`
+- On failure: retry the transformation agent

package/assets/skills/qcsd-refinement-swarm/steps/09-final-output.md

@@ -0,0 +1,46 @@
+# Step 9: Final Output & Completion Summary
+
+## Prerequisites
+- All steps (1-8) completed
+
+## Instructions
+
+Display the completion summary:
+
+```
++---------------------------------------------------------------------+
+|                  QCSD REFINEMENT SWARM COMPLETE                       |
++---------------------------------------------------------------------+
+|                                                                      |
+|  Story Assessed: [Story ID/Title]                                     |
+|  Reports Generated: [count]                                           |
+|  Output Folder: ${OUTPUT_FOLDER}                                     |
+|                                                                      |
+|  REFINEMENT SCORES:                                                   |
+|  +-- Testability Score:       __%                                     |
+|  +-- INVEST Score:            __/6                                    |
+|  +-- SFDIPOT Coverage:        __%                                     |
+|  +-- BDD Scenarios:           __ generated                           |
+|  +-- Test Ideas Rewritten:    __                                      |
+|                                                                      |
+|  RECOMMENDATION: [READY / CONDITIONAL / NOT-READY]                    |
+|  REASON: [1-2 sentence rationale]                                     |
+|                                                                      |
+|  DELIVERABLES:                                                        |
+|  +-- 01-executive-summary.md                                          |
+|  +-- 02-product-factors.md                                            |
+|  +-- 03-bdd-scenarios.md                                              |
+|  +-- 04-requirements-validation.md                                    |
+|  [conditional reports as applicable]                                  |
+|  +-- 11-learning-persistence.json                                     |
+|  +-- 12-rewritten-test-ideas.md                                       |
+|                                                                      |
++---------------------------------------------------------------------+
+```
+
+## Success Criteria
+- [ ] Completion summary displayed
+- [ ] All deliverables listed
+
+## Navigation
+- This is the terminal step.

package/assets/skills/sherlock-review/SKILL.md

@@ -101,6 +101,9 @@ npm test -- --coverage
 1. [Action based on findings]
 ```
 
+## Minimum Findings Enforcement
+Every investigation MUST surface at least 3 weighted observations (CRITICAL=3, HIGH=2, MEDIUM=1, LOW=0.5). Elementary observations count at INFORMATIONAL=0.25 weight. A Sherlock investigation that finds nothing is a failed investigation -- Holmes always finds clues.
+
 ---
 
 ## Investigation Scenarios

package/assets/templates/agent-override-example.yaml

@@ -0,0 +1,39 @@
+# Agent Customization Overlay Example
+#
+# Copy this file and rename it to match your agent:
+#   .claude/agent-overrides/qe-test-architect.override.yaml
+#
+# Fields in "replace" OVERWRITE the base agent value.
+# Fields in "append" are ADDED to the base agent value.
+# Fields in "config" provide runtime configuration overrides.
+
+# Which agent this overlay applies to
+agent: qe-test-architect
+
+# Replace base agent fields (overwrites)
+# replace:
+#   description: "Custom test architect with focus on integration tests"
+#   domains:
+#     - test-generation
+#     - integration-testing
+#   complexity: complex
+
+# Append to base agent (additions)
+# append:
+#   instructions: |
+#     Additional custom instructions for this agent.
+#     These are appended to the end of the agent's instructions.
+#   capabilities:
+#     - custom-framework-support
+#   tags:
+#     - custom
+#     - team-specific
+
+# Runtime configuration overrides
+# config:
+#   minimumFindings: 5
+#   maxParallelAgents: 4
+#   preferredFrameworks:
+#     - vitest
+#     - playwright
+#   needsContext: true

package/dist/agents/devils-advocate/agent.d.ts

@@ -8,7 +8,7 @@
  *
  * @module agents/devils-advocate
  */
-import type { ChallengeTarget, ChallengeTargetType, ChallengeResult, ChallengeStrategy, DevilsAdvocateConfig, DevilsAdvocateStats } from './types.js';
+import type { ChallengeTarget, ChallengeTargetType, ChallengeResult, ChallengeStrategy, DevilsAdvocateConfig, DevilsAdvocateStats, ReviewOutcome } from './types.js';
 /**
  * The Devil's Advocate agent reviews other agents' outputs and produces
  * structured challenges identifying gaps, weaknesses, and questionable results.
@@ -80,6 +80,30 @@ export declare class DevilsAdvocate {
      * Reset all accumulated statistics.
      */
     resetStats(): void;
+    /**
+     * Record the outcome of a review for learning feedback.
+     * Captures which challenges were accepted or dismissed.
+     *
+     * @param result - The challenge result from a review
+     * @param accepted - Array of booleans indicating acceptance per challenge
+     * @returns A ReviewOutcome for storage in the learning system
+     */
+    recordOutcome(result: ChallengeResult, accepted: boolean[]): ReviewOutcome;
+    /**
+     * Calculate the weighted finding score based on severity weights.
+     *
+     * @param challenges - The challenges to score
+     * @returns The weighted score sum
+     */
+    private calculateWeightedScore;
+    /**
+     * Run a second pass with all strategies and halved minConfidence
+     * to surface additional findings when the first pass falls below minimum.
+     *
+     * @param target - The challenge target to re-analyze
+     * @returns Additional challenges found in the second pass
+     */
+    private runSecondPass;
     /**
      * Compute the overall score based on challenges found.
      * Score is 1.0 minus the weighted impact of all challenges.

package/dist/agents/devils-advocate/agent.js

@@ -8,7 +8,7 @@
  *
  * @module agents/devils-advocate
  */
-import { DEFAULT_DEVILS_ADVOCATE_CONFIG, SEVERITY_ORDER, SEVERITY_WEIGHTS, } from './types.js';
+import { DEFAULT_DEVILS_ADVOCATE_CONFIG, MINIMUM_FINDING_WEIGHTS, SEVERITY_ORDER, SEVERITY_WEIGHTS, } from './types.js';
 import { createAllStrategies, getApplicableStrategies } from './strategies.js';
 // ============================================================================
 // DevilsAdvocate Agent
@@ -99,12 +99,40 @@ export class DevilsAdvocate {
         }
         // 4-5: Filter by confidence and severity
         const minSeverityIndex = SEVERITY_ORDER.indexOf(this.config.minSeverity);
-        const filtered = allChallenges.filter(c => {
+        let filtered = allChallenges.filter(c => {
             if (c.confidence < this.config.minConfidence)
                 return false;
             const severityIndex = SEVERITY_ORDER.indexOf(c.severity);
             return severityIndex <= minSeverityIndex;
         });
+        // 5a: Calculate weighted finding score
+        let weightedScore = this.calculateWeightedScore(filtered);
+        // 5b: If below minimum, run second pass with all strategies and lower confidence
+        if (weightedScore < this.config.minimumFindings) {
+            const secondPassChallenges = this.runSecondPass(target);
+            // Merge new challenges, deduplicating by title
+            const existingTitles = new Set(filtered.map(c => c.title));
+            for (const challenge of secondPassChallenges) {
+                if (!existingTitles.has(challenge.title)) {
+                    filtered.push(challenge);
+                    existingTitles.add(challenge.title);
+                }
+            }
+            // Recalculate weighted score
+            weightedScore = this.calculateWeightedScore(filtered);
+        }
+        // 5c: Determine if minimum was met and build clean justification if needed
+        const minimumMet = weightedScore >= this.config.minimumFindings;
+        let cleanJustification;
+        if (!minimumMet) {
+            cleanJustification = {
+                isClean: true,
+                filesExamined: [],
+                patternsChecked: [],
+                toolsRun: applicable.map(s => s.type),
+                reasoning: 'Review completed under minimum threshold after first and second pass analysis.',
+            };
+        }
         // 6: Sort by severity (critical first), then by confidence descending
         const sorted = filtered.sort((a, b) => {
             const sevDiff = SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity);
@@ -114,8 +142,12 @@ export class DevilsAdvocate {
         });
         // 7: Limit to max challenges
         const limited = sorted.slice(0, this.config.maxChallengesPerReview);
-        // 8: Compute overall score
-        const overallScore = this.computeScore(limited);
+        // 8: Compute overall score (factor in minimum met status)
+        let overallScore = this.computeScore(limited);
+        if (!minimumMet && !cleanJustification) {
+            // Reduce score when minimum not met and no justification provided
+            overallScore = Math.max(0, overallScore * 0.8);
+        }
         // 9: Generate summary
         const summary = this.generateSummary(target, limited, overallScore);
         const reviewDuration = Date.now() - startTime;
@@ -129,6 +161,9 @@ export class DevilsAdvocate {
             summary,
             timestamp: Date.now(),
             reviewDuration,
+            cleanJustification,
+            weightedFindingScore: weightedScore,
+            minimumMet,
         };
     }
     /**
@@ -171,6 +206,75 @@ export class DevilsAdvocate {
             delete this.categoryCounts[key];
         }
     }
+    /**
+     * Record the outcome of a review for learning feedback.
+     * Captures which challenges were accepted or dismissed.
+     *
+     * @param result - The challenge result from a review
+     * @param accepted - Array of booleans indicating acceptance per challenge
+     * @returns A ReviewOutcome for storage in the learning system
+     */
+    recordOutcome(result, accepted) {
+        return {
+            targetType: result.targetType,
+            targetAgentId: result.targetAgentId,
+            challengeCount: result.challenges.length,
+            acceptedCount: accepted.filter(Boolean).length,
+            dismissedCount: accepted.filter(a => !a).length,
+            severityBreakdown: result.challenges.reduce((acc, c) => {
+                acc[c.severity] = (acc[c.severity] || 0) + 1;
+                return acc;
+            }, {}),
+            minimumMet: result.minimumMet ?? true,
+            timestamp: new Date().toISOString(),
+        };
+    }
+    /**
+     * Calculate the weighted finding score based on severity weights.
+     *
+     * @param challenges - The challenges to score
+     * @returns The weighted score sum
+     */
+    calculateWeightedScore(challenges) {
+        if (this.config.minimumFindingsMode === 'count') {
+            return challenges.length;
+        }
+        let score = 0;
+        for (const challenge of challenges) {
+            score += MINIMUM_FINDING_WEIGHTS[challenge.severity] ?? 0.25;
+        }
+        return score;
+    }
+    /**
+     * Run a second pass with all strategies and halved minConfidence
+     * to surface additional findings when the first pass falls below minimum.
+     *
+     * @param target - The challenge target to re-analyze
+     * @returns Additional challenges found in the second pass
+     */
+    runSecondPass(target) {
+        const allStrategies = getApplicableStrategies(this.strategies, target.type);
+        const halvedConfidence = this.config.minConfidence / 2;
+        const minSeverityIndex = SEVERITY_ORDER.indexOf(this.config.minSeverity);
+        const secondPassChallenges = [];
+        for (const strategy of allStrategies) {
+            try {
+                const found = strategy.challenge(target);
+                for (const c of found) {
+                    if (c.confidence < halvedConfidence)
+                        continue;
+                    const severityIndex = SEVERITY_ORDER.indexOf(c.severity);
+                    if (severityIndex <= minSeverityIndex) {
+                        secondPassChallenges.push(c);
+                    }
+                }
+            }
+            catch {
+                // Strategy failure should not abort the second pass.
+            }
+        }
+        return secondPassChallenges;
+    }
     /**
      * Compute the overall score based on challenges found.
      * Score is 1.0 minus the weighted impact of all challenges.