agentic-qe 3.8.1 → 3.8.3

package/.opencode/tools/qe-test-and-verify.ts

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+
+export default {
+  name: 'qe-test-and-verify',
+  description: 'Generate tests for source code, execute them, and analyze coverage gaps in one pipeline',
+  parameters: z.object({
+    sourceCode: z.string().describe('Source code or file path to generate tests for'),
+    language: z.string().default('typescript').describe('Programming language of the source'),
+    testType: z
+      .enum(['unit', 'integration', 'e2e'])
+      .default('unit')
+      .describe('Type of tests to generate'),
+    coverageTarget: z.number().default(80).describe('Target coverage percentage'),
+    parallel: z.boolean().default(true).describe('Execute tests in parallel'),
+  }),
+  execute: async (
+    params: {
+      sourceCode: string;
+      language: string;
+      testType: 'unit' | 'integration' | 'e2e';
+      coverageTarget: number;
+      parallel: boolean;
+    },
+    ctx: any,
+  ) => {
+    const startTime = Date.now();
+    const results: Record<string, any> = {};
+
+    // Step 1: Generate tests
+    try {
+      results.generated = await ctx.callTool('mcp:agentic-qe:test_generate_enhanced', {
+        sourceCode: params.sourceCode,
+        language: params.language,
+        testType: params.testType,
+      });
+    } catch (err: any) {
+      return {
+        error: `Test generation failed: ${err.message}`,
+        phase: 'generate',
+      };
+    }
+
+    // Step 2: Execute generated tests
+    const testFiles = results.generated?.testFiles ?? [];
+    if (testFiles.length > 0) {
+      try {
+        results.execution = await ctx.callTool('mcp:agentic-qe:test_execute_parallel', {
+          testFiles,
+          parallel: params.parallel,
+        });
+      } catch (err: any) {
+        results.execution = { error: `Test execution failed: ${err.message}` };
+      }
+    }
+
+    // Step 3: Analyze coverage gaps
+    try {
+      results.coverage = await ctx.callTool('mcp:agentic-qe:coverage_analyze_sublinear', {
+        target: params.sourceCode,
+        detectGaps: true,
+      });
+    } catch (err: any) {
+      results.coverage = { error: `Coverage analysis failed: ${err.message}` };
+    }
+
+    const elapsed = Date.now() - startTime;
+    const coverageMet =
+      results.coverage?.summary?.statements?.percentage >= params.coverageTarget;
+
+    // Store results for learning
+    try {
+      await ctx.callTool('mcp:agentic-qe:memory_store', {
+        key: `test-verify/${Date.now()}`,
+        namespace: 'qe-test-results',
+        value: {
+          source: params.sourceCode,
+          testType: params.testType,
+          testsGenerated: testFiles.length,
+          coverageMet,
+          timestamp: new Date().toISOString(),
+        },
+      });
+    } catch {
+      // Non-critical
+    }
+
+    return {
+      generated: results.generated,
+      execution: results.execution,
+      coverage: results.coverage,
+      coverageTarget: params.coverageTarget,
+      coverageMet,
+      elapsedMs: elapsed,
+      summary: `Generated ${testFiles.length} test files. Coverage target ${params.coverageTarget}%: ${coverageMet ? 'MET' : 'NOT MET'}.`,
+    };
+  },
+};

package/CHANGELOG.md

@@ -5,6 +5,56 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.8.3] - 2026-03-18
+
+### Fixed
+
+- **Portable hook commands** — `aqe init` no longer embeds the host machine's absolute path into `.claude/settings.json` hook commands. Commands now use simple relative paths (`node .claude/helpers/brain-checkpoint.cjs`), making settings fully portable across machines. ([#369](https://github.com/proffesor-for-testing/agentic-qe/issues/369))
+- **SONA persistence initialization** — Fixed circular `ensureInitialized()` call during `PersistentSONAEngine._doInitialize()` that caused all 31 sona-persistence tests to fail when `useSONAThreeLoop` flag was enabled by default.
+- **RuVector feature flag test compatibility** — Updated compressed-hnsw and temporal-compression tests to explicitly set flag state instead of assuming defaults, fixing 9 test failures introduced when v3.8.0 enabled all flags by default.
+- **CI timeout and contract test path** — Resolved CI workflow timeouts and broken contract test path. ([#350](https://github.com/proffesor-for-testing/agentic-qe/issues/350))
+- **OpenCode config schema** — `aqe init --with-opencode` now generates valid `opencode.json` matching OpenCode's `McpLocal.strict()` zod schema (`command` as string array, `environment` instead of `env`, no extra `args` field). ([#370](https://github.com/proffesor-for-testing/agentic-qe/issues/370))
+- **Infra-healing fallback playbook** — Fixed field name mismatches (`check` → `healthCheck`, added `verify`) in the hardcoded fallback playbook that caused a TypeError on every MCP startup. ([#371](https://github.com/proffesor-for-testing/agentic-qe/issues/371))
+- **Fleet init crash** — `LearningOptimizationCoordinator` now gracefully degrades when SONA init fails, matching the other 6 coordinators. Combined with the circular init fix, fleet initialization succeeds on MCP startup. ([#372](https://github.com/proffesor-for-testing/agentic-qe/issues/372))
+
+### Added
+
+- **ADR-086 skill design standards** — Major overhaul of all 84 QE skills based on Anthropic's "Lessons from Building Claude Code" skill design guidance. Skills are now folder-based systems with progressive disclosure, gotchas, composition, config, and run history.
+- **5 new skills** — `test-failure-investigator`, `coverage-drop-investigator`, `e2e-flow-verifier`, `test-metrics-dashboard`, and `skill-stats` fill previously missing categories.
+- **5 on-demand hook skills** — `strict-tdd`, `no-skip`, `coverage-guard`, `freeze-tests`, and `security-watch` with executable scripts that activate via slash commands.
+- **Gotchas sections** — 30 skills now include battle-tested failure data from production learning records.
+- **Reference and template files** — 10 reference/template files across 7 skills (OWASP top 10, k6 configs, mutation operators, security report templates, etc.).
+- **Skill composition** — Cross-references added to 10 key skills showing how to chain skills together for complex workflows.
+- **Config and run-history** — `config.json` with `_setupPrompt` added to 7 skills; `run-history.json` with write instructions added to 5 metric-producing skills.
+
+### Changed
+
+- **Skill descriptions rewritten** — All 84 skill descriptions now use "Use when..." trigger conditions for better auto-detection.
+- **Textbook knowledge stripped** — 892 lines of generic content removed from 15 skills (26% size reduction) to focus on actionable guidance.
+- **3 redundant skills removed** — `qe-contract-testing` (→ `contract-testing`), `qe-security-compliance` (→ `security-testing`), `aqe-v2-v3-migration` (obsolete). `aqe init --upgrade` auto-cleans these.
+- **Removed tracked generated file** — `aqe.rvf.manifest.json` is now gitignored as it changes every session.
+
+## [3.8.2] - 2026-03-17
+
+### Fixed
+
+- **YAML frontmatter validation** — Removed blank lines inside frontmatter delimiters across 114 SKILL.md files that caused parsers to fail. ([#360](https://github.com/proffesor-for-testing/agentic-qe/issues/360))
+- **OpenCode installer path resolution** — `aqe init --with-opencode` now resolves source paths relative to the package installation directory instead of CWD, fixing 0-agent installs for global npm users. ([#361](https://github.com/proffesor-for-testing/agentic-qe/issues/361))
+- **Settings permissions overwrite** — `aqe init --upgrade` now union-merges AQE permissions into existing `settings.json` instead of replacing the entire permissions array, preserving user-added entries. ([#362](https://github.com/proffesor-for-testing/agentic-qe/issues/362))
+- **Hook path fallback** — Brain-checkpoint and statusline hook commands now use a hardcoded absolute path fallback (resolved at install time) instead of `pwd`, which could resolve incorrectly outside the project root. ([#363](https://github.com/proffesor-for-testing/agentic-qe/issues/363))
+- **Agent updated date** — `aqe init --upgrade` now bumps the `updated:` field in agent frontmatter when overlays modify content. ([#365](https://github.com/proffesor-for-testing/agentic-qe/issues/365))
+- **Validation pipeline docs** — Fixed `--steps` parameter documentation to consistently describe comma-separated format. ([#367](https://github.com/proffesor-for-testing/agentic-qe/issues/367))
+
+### Added
+
+- **Validation pipeline helper** — New `.claude/helpers/validation-pipeline.cjs` implements the 13-step requirements validation pipeline with sequential execution, gate enforcement, per-step scoring, and weighted category rollup. ([#364](https://github.com/proffesor-for-testing/agentic-qe/issues/364))
+
+### Changed
+
+- **Security scanner dependency** — `qe-security-scanner` dependency on `qe-dependency-mapper` changed from `hard` to `soft`, allowing security scans to start immediately without waiting for the full dependency graph. ([#366](https://github.com/proffesor-for-testing/agentic-qe/issues/366))
+- **Ruflo rebrand** — Completed `claude-flow` to `ruflo` rename across all remaining skills, helpers, and TypeScript bridge modules with `resolveCliPackage()` for consistent CLI resolution.
+- **CI stability** — Resolved CI timeouts, cancellations, and test failures from PR #350.
+
 ## [3.8.1] - 2026-03-17
 
 ### Fixed

package/README.md

@@ -177,12 +177,16 @@ Agents automatically apply relevant skills from the skill library. Skills are ra
 
 **Specialized Testing (13):** accessibility-testing, mobile-testing, database-testing, contract-testing, chaos-engineering-resilience, visual-testing-advanced, security-visual-testing, compliance-testing, compatibility-testing, localization-testing, mutation-testing, performance-testing, security-testing
 
-**Domain Skills (14):** qe-test-generation, qe-test-execution, qe-coverage-analysis, qe-quality-assessment, qe-defect-intelligence, qe-requirements-validation, qe-code-intelligence, qe-security-compliance, qe-contract-testing, qe-visual-accessibility, qe-chaos-resilience, qe-learning-optimization, qe-iterative-loop, aqe-v2-v3-migration
+**Domain Skills (11):** qe-test-generation, qe-test-execution, qe-coverage-analysis, qe-quality-assessment, qe-defect-intelligence, qe-requirements-validation, qe-code-intelligence, qe-visual-accessibility, qe-chaos-resilience, qe-learning-optimization, qe-iterative-loop
 
 **Strategic (8):** six-thinking-hats, brutal-honesty-review, sherlock-review, cicd-pipeline-qe-orchestrator, bug-reporting-excellence, consultancy-practices, quality-metrics, pair-programming
 
 **Testing Techniques (9):** exploratory-testing-advanced, test-design-techniques, test-data-management, test-environment-management, test-reporting-analytics, testability-scoring, technical-writing, code-review-quality, api-testing-patterns
 
+**On-Demand Hooks (5):** strict-tdd, no-skip, coverage-guard, freeze-tests, security-watch
+
+**Runbooks & Analysis (5):** test-failure-investigator, coverage-drop-investigator, e2e-flow-verifier, test-metrics-dashboard, skill-stats
+
 **n8n Workflow Testing (5):** n8n-workflow-testing-fundamentals, n8n-expression-testing, n8n-security-testing, n8n-trigger-testing-strategies, n8n-integration-testing-patterns
 
 **QCSD Swarms (5):** qcsd-ideation-swarm, qcsd-refinement-swarm, qcsd-development-swarm, qcsd-cicd-swarm, qcsd-production-swarm

package/assets/agents/v3/qe-security-scanner.md

@@ -8,8 +8,8 @@ domain: security-compliance
 dependencies:
   agents:
     - name: qe-dependency-mapper
-      type: hard
-      reason: "Provides dependency data for vulnerability correlation"
+      type: soft
+      reason: "Enhances vulnerability correlation with dependency data when available"
   mcp_servers:
     - name: agentic-qe
       required: true

package/assets/helpers/statusline-v3.cjs

@@ -391,7 +391,7 @@ function getCveStatus(projectDir) {
 
   // Fetch fresh CVE data (with timeout)
   try {
-    const output = execQuiet('timeout 2 npx @claude-flow/cli@latest security cve --list 2>/dev/null');
+    const output = execQuiet('timeout 2 npx --no-install ruflo security cve --list 2>/dev/null');
     if (output) {
       total = (output.match(/CVE-/g) || []).length;
       fixed = (output.match(/Fixed/g) || []).length;