agentic-qe 3.8.14 → 3.9.1

package/dist/domains/quality-assessment/coordinator.js

@@ -26,6 +26,9 @@ import * as ReportHelpers from './coordinator-reports.js';
 import * as RLIntegration from './coordinator-rl-integration.js';
 import * as ClaimVerifierHelpers from './coordinator-claim-verifier.js';
 import * as GateEvalHelpers from './coordinator-gate-evaluation.js';
+// ADR-062: Gate ratcheting
+import { checkRatchet, } from './coherence/gate-controller.js';
+import { DEFAULT_RATCHET_CONFIG, } from './coherence/types.js';
 // ADR-070: Witness Chain audit trail
 import { getWitnessChain } from '../../audit/witness-chain.js';
 // Three-loop feature flag for instantAdapt protocol
@@ -85,6 +88,13 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
     domain = 'quality-assessment';
     // Cache of recent dream insights for quality assessment enhancement
     recentDreamInsights = [];
+    // ADR-062: Monotonic gate threshold ratcheting state
+    ratchetState = {
+        currentThreshold: 70,
+        consecutivePasses: 0,
+        lastRatchetTime: 0,
+        history: [],
+    };
     constructor(eventBus, memory, agentCoordinator, config = {}) {
         const fullConfig = { ...DEFAULT_CONFIG, ...config };
         super(eventBus, 'quality-assessment', fullConfig, {
@@ -116,6 +126,9 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
             this.subscribeToEvents();
             // Load any persisted workflow state
             await this.loadWorkflowState();
+            // ADR-062: Restore persisted ratchet state so the monotonic invariant
+            // survives coordinator restarts.
+            await this.loadRatchetState();
             // Initialize Actor-Critic RL for threshold tuning
             if (this.config.enableRLThresholdTuning) {
                 await this.initializeActorCritic();
@@ -242,6 +255,17 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
                     m.duplications / 100,
                     finalResult.overallScore / 100,
                 ]);
+                // EWC++ outcome recording: reward scaled by gate score
+                try {
+                    this.qesona.recordOutcome(finalResult.overallScore / 100);
+                    if (this.qesona.shouldConsolidate()) {
+                        try {
+                            this.qesona.backgroundConsolidate();
+                        }
+                        catch { /* best-effort */ }
+                    }
+                }
+                catch { /* must not break main flow */ }
             }
             // Store quality pattern in SONA if enabled
             if (this.config.enableSONAPatternLearning && this.qesona) {
@@ -257,6 +281,26 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
                 wc.append(finalResult.passed ? 'QUALITY_GATE_PASS' : 'QUALITY_GATE_FAIL', { gateName: request.gateName, passed: finalResult.passed, score: finalResult.overallScore, failedChecks: finalResult.failedChecks }, 'quality-gate');
             }
             catch (_wcErr) { /* non-critical */ }
+            // ADR-062: Monotonic gate threshold ratcheting
+            // After gate decision is final, check if threshold should ratchet upward
+            if (process.env.AQE_GATE_RATCHETING_ENABLED === 'true') {
+                try {
+                    const prevThreshold = this.ratchetState.currentThreshold;
+                    this.ratchetState = checkRatchet(finalResult.passed, DEFAULT_RATCHET_CONFIG, this.ratchetState);
+                    if (this.ratchetState.currentThreshold > prevThreshold) {
+                        logger.info(`Gate threshold ratcheted: ${prevThreshold} -> ${this.ratchetState.currentThreshold}`);
+                        // ADR-062: Persist updated ratchet state so the monotonic invariant
+                        // survives coordinator restarts.
+                        await this.saveRatchetState();
+                    }
+                }
+                catch (ratchetErr) {
+                    // Ratcheting failure must never break gate evaluation
+                    logger.warn('Gate ratcheting failed (non-critical)', {
+                        error: ratchetErr instanceof Error ? ratchetErr.message : String(ratchetErr),
+                    });
+                }
+            }
             // Publish event
             if (this.config.publishEvents) {
                 await this.publishQualityGateEvaluated(finalResult);
@@ -347,6 +391,17 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
                     result.value.trends.length / 10,
                     result.value.recommendations.length / 10,
                 ]);
+                // EWC++ outcome recording: reward scaled by analysis score
+                try {
+                    this.qesona.recordOutcome(score.overall / 100);
+                    if (this.qesona.shouldConsolidate()) {
+                        try {
+                            this.qesona.backgroundConsolidate();
+                        }
+                        catch { /* best-effort */ }
+                    }
+                }
+                catch { /* must not break main flow */ }
             }
             // Store quality pattern in SONA
             if (this.config.enableSONAPatternLearning && this.qesona) {
@@ -798,6 +853,43 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
         const workflows = Array.from(this.workflows.values());
         await this.memory.set('quality-assessment:coordinator:workflows', workflows, { namespace: 'quality-assessment', persist: true });
     }
+    /**
+     * ADR-062: Load persisted ratchet state from MemoryBackend.
+     * If no saved state exists the in-memory default (threshold 70) is kept.
+     * Persistence failures are logged but never propagated — the coordinator
+     * must remain functional even when the memory backend is degraded.
+     */
+    async loadRatchetState() {
+        try {
+            const saved = await this.memory.get('quality-assessment:ratchet-state');
+            if (saved) {
+                this.ratchetState = saved;
+                logger.info(`Restored ratchet state (threshold=${saved.currentThreshold}, passes=${saved.consecutivePasses})`);
+            }
+        }
+        catch (loadErr) {
+            // Non-critical: default ratchet state is safe
+            logger.warn('Failed to load ratchet state (using default)', {
+                error: loadErr instanceof Error ? loadErr.message : String(loadErr),
+            });
+        }
+    }
+    /**
+     * ADR-062: Persist current ratchet state to MemoryBackend.
+     * Called after checkRatchet() when the threshold actually ratcheted upward.
+     * Persistence failures are logged but never propagated.
+     */
+    async saveRatchetState() {
+        try {
+            await this.memory.set('quality-assessment:ratchet-state', this.ratchetState, { namespace: 'quality-assessment', persist: true });
+        }
+        catch (saveErr) {
+            // Non-critical: next restart will use the previous persisted value
+            logger.warn('Failed to persist ratchet state', {
+                error: saveErr instanceof Error ? saveErr.message : String(saveErr),
+            });
+        }
+    }
     // ============================================================================
     // Ruvector Integration Methods (ADR-040)
     // ============================================================================

package/dist/domains/test-execution/coordinator.d.ts

@@ -98,6 +98,7 @@ export interface ITestExecutionCoordinator extends TestExecutionAPI {
     isConsensusAvailable(): boolean;
 }
 export declare class TestExecutionCoordinator extends BaseDomainCoordinator<TestExecutionCoordinatorConfig> implements ITestExecutionCoordinator {
+    private readonly memory;
     private readonly executor;
     private readonly flakyDetector;
     private readonly retryHandler;
@@ -186,6 +187,24 @@ export declare class TestExecutionCoordinator extends BaseDomainCoordinator<Test
      * Extract test name from file path
      */
     private extractTestName;
+    /**
+     * ADR-062: Partition test files into normal and holdout sets.
+     *
+     * When AQE_HOLDOUT_TESTING_ENABLED is 'true', holdout test file paths are
+     * looked up from memory (stored by the test-generation domain when a test
+     * is created with `holdout: true`).
+     *
+     * - Normal runs execute only non-holdout tests.
+     * - Holdout runs (AQE_RUN_HOLDOUT_TESTS === 'true' or runHoldout flag)
+     *   execute only holdout tests.
+     *
+     * If the feature flag is disabled, all tests are returned as normal tests.
+     * Failures in holdout lookup are logged and treated as "no holdout tests"
+     * so that normal execution is never blocked.
+     *
+     * @returns Object with testsToRun and holdoutCount.
+     */
+    private partitionHoldoutTests;
     /**
      * Execute E2E test case
      */

package/dist/domains/test-execution/coordinator.js

@@ -37,6 +37,7 @@ const DEFAULT_COORDINATOR_CONFIG = {
 // ============================================================================
 const logger = LoggerFactory.create('test-execution');
 export class TestExecutionCoordinator extends BaseDomainCoordinator {
+    memory;
     executor;
     flakyDetector;
     retryHandler;
@@ -52,6 +53,7 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
             verifyFindingTypes: ['flaky-test-detection', 'test-failure-analysis', 'retry-strategy'],
             ...fullConfig.consensusConfig,
         });
+        this.memory = memory;
         // Create services with appropriate configuration
         this.executor = new TestExecutorService({ memory }, {
             simulateForTesting: fullConfig.simulateForTesting,
@@ -116,13 +118,21 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
      * Auto-detects framework and uses sensible defaults
      */
     async runTests(request) {
-        const framework = this.detectFramework(request.testFiles);
-        const workers = request.workers ?? Math.min(4, Math.max(1, request.testFiles.length));
+        // ADR-062: Filter holdout tests before execution
+        const { testsToRun } = await this.partitionHoldoutTests(request.testFiles);
+        if (testsToRun.length === 0) {
+            return ok({
+                runId: uuidv4(), status: 'passed', total: 0, passed: 0,
+                failed: 0, skipped: 0, duration: 0, failedTests: [],
+            });
+        }
+        const framework = this.detectFramework(testsToRun);
+        const workers = request.workers ?? Math.min(4, Math.max(1, testsToRun.length));
         const timeout = request.timeout ?? 60000;
         // Use parallel execution by default (unless explicitly disabled)
-        if (request.parallel !== false && request.testFiles.length > 1) {
+        if (request.parallel !== false && testsToRun.length > 1) {
             const result = await this.executeParallel({
-                testFiles: request.testFiles,
+                testFiles: testsToRun,
                 framework,
                 workers,
                 timeout,
@@ -141,7 +151,7 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
         }
         // Sequential execution
         const result = await this.execute({
-            testFiles: request.testFiles,
+            testFiles: testsToRun,
             framework,
             timeout,
         });
@@ -181,6 +191,17 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
         // ADR-057: Reset recovery attempt counter for each top-level execution
         this.infraRecoveryAttempts = 0;
         try {
+            // ADR-062: Filter holdout tests before execution
+            const { testsToRun } = await this.partitionHoldoutTests(request.testFiles);
+            if (testsToRun.length === 0) {
+                this.activeRuns.delete(runId);
+                return ok({
+                    runId, status: 'passed', total: 0, passed: 0,
+                    failed: 0, skipped: 0, duration: 0, failedTests: [],
+                });
+            }
+            // Replace testFiles with filtered set for the remainder of execution
+            request = { ...request, testFiles: testsToRun };
             // Prioritize tests if enabled
             let orderedTestFiles = request.testFiles;
             let prioritizationResult = null;
@@ -273,6 +294,16 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
         // ADR-057: Reset recovery attempt counter for each top-level execution
         this.infraRecoveryAttempts = 0;
         try {
+            // ADR-062: Filter holdout tests before execution
+            const { testsToRun } = await this.partitionHoldoutTests(request.testFiles);
+            if (testsToRun.length === 0) {
+                this.activeRuns.delete(runId);
+                return ok({
+                    runId, status: 'passed', total: 0, passed: 0,
+                    failed: 0, skipped: 0, duration: 0, failedTests: [],
+                });
+            }
+            request = { ...request, testFiles: testsToRun };
             // ADR-047: Check topology health before expensive parallel operations
             if (this.config.enableMinCutAwareness && !this.isTopologyHealthy()) {
                 logger.warn(`Topology degraded, reducing parallel workers`);
@@ -677,6 +708,72 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
         return parts[parts.length - 1] || filePath;
     }
     // ============================================================================
+    // ADR-062: Holdout Test Filtering
+    // ============================================================================
+    /**
+     * ADR-062: Partition test files into normal and holdout sets.
+     *
+     * When AQE_HOLDOUT_TESTING_ENABLED is 'true', holdout test file paths are
+     * looked up from memory (stored by the test-generation domain when a test
+     * is created with `holdout: true`).
+     *
+     * - Normal runs execute only non-holdout tests.
+     * - Holdout runs (AQE_RUN_HOLDOUT_TESTS === 'true' or runHoldout flag)
+     *   execute only holdout tests.
+     *
+     * If the feature flag is disabled, all tests are returned as normal tests.
+     * Failures in holdout lookup are logged and treated as "no holdout tests"
+     * so that normal execution is never blocked.
+     *
+     * @returns Object with testsToRun and holdoutCount.
+     */
+    async partitionHoldoutTests(testFiles, runHoldout) {
+        const holdoutEnabled = process.env.AQE_HOLDOUT_TESTING_ENABLED === 'true';
+        if (!holdoutEnabled) {
+            return { testsToRun: testFiles, holdoutCount: 0 };
+        }
+        try {
+            // Retrieve the set of holdout test file paths stored by test-generation
+            const holdoutSet = await this.memory.get('test-generation:holdout-test-files');
+            if (!holdoutSet || holdoutSet.length === 0) {
+                return { testsToRun: testFiles, holdoutCount: 0 };
+            }
+            const holdoutPaths = new Set(holdoutSet);
+            const normalTests = [];
+            const holdoutTests = [];
+            for (const file of testFiles) {
+                if (holdoutPaths.has(file)) {
+                    holdoutTests.push(file);
+                }
+                else {
+                    normalTests.push(file);
+                }
+            }
+            // Determine if this is a holdout-only run
+            const isHoldoutRun = runHoldout === true ||
+                process.env.AQE_RUN_HOLDOUT_TESTS === 'true';
+            if (isHoldoutRun) {
+                logger.info(`Holdout run: executing ${holdoutTests.length} holdout tests, skipping ${normalTests.length} normal tests`);
+                // Store metadata about the holdout run
+                await this.memory.set(`test-execution:holdout-run:${Date.now()}`, { holdoutCount: holdoutTests.length, holdoutFiles: holdoutTests }, { namespace: 'test-execution', ttl: 86400 });
+                return { testsToRun: holdoutTests, holdoutCount: holdoutTests.length };
+            }
+            if (holdoutTests.length > 0) {
+                logger.info(`Normal run: filtered out ${holdoutTests.length} holdout test(s), running ${normalTests.length} normal tests`);
+                // Store metadata for visibility
+                await this.memory.set(`test-execution:holdout-filtered:${Date.now()}`, { holdoutCount: holdoutTests.length, holdoutFiles: holdoutTests }, { namespace: 'test-execution', ttl: 86400 });
+            }
+            return { testsToRun: normalTests, holdoutCount: holdoutTests.length };
+        }
+        catch (partitionErr) {
+            // Non-critical: if holdout lookup fails, run all tests
+            logger.warn('Holdout test partitioning failed (running all tests)', {
+                error: partitionErr instanceof Error ? partitionErr.message : String(partitionErr),
+            });
+            return { testsToRun: testFiles, holdoutCount: 0 };
+        }
+    }
+    // ============================================================================
     // E2E Test Execution Methods
     // ============================================================================
     /**

package/dist/domains/test-generation/coordinator.js

@@ -320,6 +320,17 @@ export class TestGenerationCoordinator extends BaseDomainCoordinator {
                         (request.coverageTarget ?? 80) / 100,
                         tests.tests.filter(t => t.type === 'unit').length / 20,
                     ]);
+                    // EWC++ outcome recording: close the feedback loop
+                    try {
+                        this.qesona.recordOutcome(1.0);
+                        if (this.qesona.shouldConsolidate()) {
+                            try {
+                                this.qesona.backgroundConsolidate();
+                            }
+                            catch { /* best-effort */ }
+                        }
+                    }
+                    catch { /* must not break main flow */ }
                 }
                 // Learn from successful generation using QESONA
                 if (this.config.enableQESONA && this.qesona) {

package/dist/domains/test-generation/interfaces.d.ts

@@ -48,6 +48,8 @@ export interface IGeneratedTest {
     llmEnhanced?: boolean;
     /** Test quality gate validation result (loki-mode Gates 8 & 9) */
     qualityGateResult?: TestQualityGateResult;
+    /** ADR-062: Whether this test is a holdout test (not shown to developer, runs in CI only) */
+    holdout?: boolean;
 }
 export interface ITDDRequest {
     feature: string;

package/dist/domains/test-generation/services/test-generator.d.ts

@@ -15,6 +15,15 @@ import { type ITDDGeneratorService } from './tdd-generator';
 import { type IPropertyTestGeneratorService } from './property-test-generator';
 import { type ITestDataGeneratorService } from './test-data-generator';
 import type { HybridRouter } from '../../../shared/llm';
+/**
+ * Deterministically decide whether a test ID should be a holdout test.
+ * Uses FNV-1a hash of the testId to select ~10% of tests as holdout.
+ *
+ * @param testId - Unique identifier for the test
+ * @param seed - Optional seed for the hash (default: 0)
+ * @returns true if this test should be flagged as holdout
+ */
+export declare function isHoldoutTest(testId: string, seed?: number): boolean;
 /**
  * Interface for the test generation service
  */

package/dist/domains/test-generation/services/test-generator.js

@@ -27,6 +27,35 @@ import { resolveRequest } from '../../../shared/language-detector.js';
 import { compilationValidator } from './compilation-validator.js';
 import { resolveTestFilePath } from './test-file-resolver.js';
 import { getPromptConfig } from '../prompts/language-prompts.js';
+// ============================================================================
+// ADR-062 Tier 2: Holdout Test Selection
+// ============================================================================
+/**
+ * FNV-1a hash of a string, returning a 32-bit unsigned integer.
+ * Deterministic: same input always produces the same output.
+ */
+function fnv1aHashU32(input, seed = 0) {
+    let hash = (0x811c9dc5 ^ seed) >>> 0; // FNV offset basis, XOR with seed
+    for (let i = 0; i < input.length; i++) {
+        hash ^= input.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193); // FNV prime
+        hash = hash >>> 0; // Force unsigned 32-bit
+    }
+    return hash;
+}
+/**
+ * Deterministically decide whether a test ID should be a holdout test.
+ * Uses FNV-1a hash of the testId to select ~10% of tests as holdout.
+ *
+ * @param testId - Unique identifier for the test
+ * @param seed - Optional seed for the hash (default: 0)
+ * @returns true if this test should be flagged as holdout
+ */
+export function isHoldoutTest(testId, seed = 0) {
+    const hash = fnv1aHashU32(testId, seed);
+    // Select bottom 10% of the hash space (0 to 0xFFFFFFFF)
+    return (hash % 100) < 10;
+}
 const DEFAULT_CONFIG = {
     defaultFramework: 'vitest',
     maxTestsPerFile: 50,
@@ -280,6 +309,14 @@ Return a JSON array of test suggestions, each with: { "name": "test name", "desc
                     patternsUsed.push(...fileTests.value.patternsUsed);
                 }
             }
+            // ADR-062 Tier 2: Mark holdout tests when feature flag is enabled
+            if (process.env.AQE_HOLDOUT_TESTING_ENABLED === 'true') {
+                for (const test of tests) {
+                    if (isHoldoutTest(test.id)) {
+                        test.holdout = true;
+                    }
+                }
+            }
             const coverageEstimate = this.estimateCoverage(tests, coverageTarget);
             await this.storeGenerationMetadata(tests, patternsUsed);
             return ok({

package/dist/hooks/cross-phase-hooks.d.ts

@@ -26,6 +26,17 @@ export declare class CrossPhaseHookExecutor {
     private querySignalsForInjection;
     formatSignalsForInjection(signals: CrossPhaseSignal[]): string;
     private getRecommendations;
+    /**
+     * IMP-07: When AQE_HOOKS_MANAGED_ONLY is set, only hooks whose names start
+     * with "managed:" are allowed to execute.  All other hooks are filtered out.
+     */
+    private filterManagedHooks;
+    /**
+     * IMP-07: SSRF guard — if a target string looks like a URL (has a scheme),
+     * validate it against the SSRF blocklist.  Returns true when the URL is
+     * blocked and the caller should abort the action.
+     */
+    private isBlockedUrl;
     private checkConditions;
     private evaluateCondition;
     private getValueFromPath;

package/dist/hooks/cross-phase-hooks.js

@@ -11,6 +11,7 @@ import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
 import { parse as parseYaml } from 'yaml';
 import { getCrossPhaseMemory, } from '../memory/cross-phase-memory.js';
+import { captureHooksConfigSnapshot, validateHookUrl, classifyHookExit, } from './security/index.js';
 // =============================================================================
 // Hook Executor
 // =============================================================================
@@ -27,17 +28,24 @@ export class CrossPhaseHookExecutor {
     // Initialization
     // ---------------------------------------------------------------------------
     async initialize() {
+        // IMP-07: Policy flag — globally disable all hook execution
+        if (process.env.AQE_HOOKS_DISABLED === 'true') {
+            console.log('[CrossPhaseHooks] All hooks disabled via AQE_HOOKS_DISABLED');
+            return false;
+        }
         if (!existsSync(this.configPath)) {
             console.warn(`[CrossPhaseHooks] Config not found: ${this.configPath}`);
             return false;
         }
         try {
             const content = readFileSync(this.configPath, 'utf-8');
-            this.config = parseYaml(content);
-            if (!this.config.enabled) {
+            const parsed = parseYaml(content);
+            if (!parsed.enabled) {
                 console.log('[CrossPhaseHooks] Hooks disabled in config');
                 return false;
             }
+            // IMP-07: Deep-freeze config so it cannot be mutated at runtime
+            this.config = captureHooksConfigSnapshot(parsed);
             await this.memory.initialize();
             console.log(`[CrossPhaseHooks] Initialized with ${Object.keys(this.config.hooks).length} hooks`);
             return true;
@@ -53,8 +61,11 @@ export class CrossPhaseHookExecutor {
     async onAgentComplete(agentName, result) {
         if (!this.config)
             return;
-        const matchingHooks = Object.entries(this.config.hooks).filter(([_, hook]) => hook.trigger.event === 'agent-complete' &&
-            hook.trigger.agent === agentName);
+        // IMP-07: Runtime kill-switch check
+        if (process.env.AQE_HOOKS_DISABLED === 'true')
+            return;
+        const matchingHooks = this.filterManagedHooks(Object.entries(this.config.hooks).filter(([_, hook]) => hook.trigger.event === 'agent-complete' &&
+            hook.trigger.agent === agentName));
         for (const [hookName, hook] of matchingHooks) {
             if (this.checkConditions(hook.trigger.conditions, result)) {
                 console.log(`[CrossPhaseHooks] Executing hook: ${hookName}`);
@@ -65,9 +76,12 @@ export class CrossPhaseHookExecutor {
     async onPhaseStart(phaseName, context = {}) {
         if (!this.config)
             return {};
+        // IMP-07: Runtime kill-switch check
+        if (process.env.AQE_HOOKS_DISABLED === 'true')
+            return {};
         const injectedSignals = {};
-        const matchingHooks = Object.entries(this.config.hooks).filter(([_, hook]) => hook.trigger.event === 'phase-start' &&
-            hook.trigger.phase === phaseName);
+        const matchingHooks = this.filterManagedHooks(Object.entries(this.config.hooks).filter(([_, hook]) => hook.trigger.event === 'phase-start' &&
+            hook.trigger.phase === phaseName));
         for (const [hookName, hook] of matchingHooks) {
             console.log(`[CrossPhaseHooks] Executing phase-start hook: ${hookName}`);
             for (const action of hook.actions) {
@@ -87,8 +101,11 @@ export class CrossPhaseHookExecutor {
     async onPhaseEnd(phaseName, result) {
         if (!this.config)
             return;
-        const matchingHooks = Object.entries(this.config.hooks).filter(([_, hook]) => hook.trigger.event === 'phase-end' &&
-            hook.trigger.phase === phaseName);
+        // IMP-07: Runtime kill-switch check
+        if (process.env.AQE_HOOKS_DISABLED === 'true')
+            return;
+        const matchingHooks = this.filterManagedHooks(Object.entries(this.config.hooks).filter(([_, hook]) => hook.trigger.event === 'phase-end' &&
+            hook.trigger.phase === phaseName));
         for (const [hookName, hook] of matchingHooks) {
             console.log(`[CrossPhaseHooks] Executing phase-end hook: ${hookName}`);
             await this.executeActions(hook.actions, result);
@@ -103,7 +120,19 @@ export class CrossPhaseHookExecutor {
                 await this.executeAction(action, context);
             }
             catch (err) {
-                console.error(`[CrossPhaseHooks] Action failed:`, err);
+                // IMP-07: Classify exit codes when error carries one
+                const exitCode = err?.exitCode;
+                if (typeof exitCode === 'number') {
+                    const classification = classifyHookExit(exitCode);
+                    if (classification === 'model_blocking') {
+                        console.error(`[CrossPhaseHooks] Model-blocking hook failure (exit ${exitCode}):`, err);
+                        throw err; // Propagate blocking failures
+                    }
+                    console.warn(`[CrossPhaseHooks] Hook ${classification} (exit ${exitCode}):`, err);
+                }
+                else {
+                    console.error(`[CrossPhaseHooks] Action failed:`, err);
+                }
             }
         }
     }
@@ -158,6 +187,9 @@ export class CrossPhaseHookExecutor {
     async executeNotifyAgent(action, context) {
         if (!action.target || !action.message)
             return;
+        // IMP-07: SSRF guard — block if target looks like a URL pointing to private IP
+        if (await this.isBlockedUrl(action.target))
+            return;
         console.log(`[CrossPhaseHooks] Notify ${action.target}: ${action.message}`);
         this.emit('agent-notification', {
             target: action.target,
@@ -169,6 +201,9 @@ export class CrossPhaseHookExecutor {
     async executeInvokeAgent(action, context) {
         if (!action.target)
             return;
+        // IMP-07: SSRF guard — block if target looks like a URL pointing to private IP
+        if (await this.isBlockedUrl(action.target))
+            return;
         console.log(`[CrossPhaseHooks] Invoke agent: ${action.target}`);
         this.emit('agent-invocation', {
             agent: action.target,
@@ -235,6 +270,35 @@ export class CrossPhaseHookExecutor {
     // ---------------------------------------------------------------------------
     // Helpers
     // ---------------------------------------------------------------------------
+    /**
+     * IMP-07: When AQE_HOOKS_MANAGED_ONLY is set, only hooks whose names start
+     * with "managed:" are allowed to execute.  All other hooks are filtered out.
+     */
+    filterManagedHooks(hooks) {
+        if (process.env.AQE_HOOKS_MANAGED_ONLY !== 'true')
+            return hooks;
+        const filtered = hooks.filter(([name]) => name.startsWith('managed:'));
+        if (filtered.length < hooks.length) {
+            console.log(`[CrossPhaseHooks] AQE_HOOKS_MANAGED_ONLY: filtered ${hooks.length - filtered.length} non-managed hooks`);
+        }
+        return filtered;
+    }
+    /**
+     * IMP-07: SSRF guard — if a target string looks like a URL (has a scheme),
+     * validate it against the SSRF blocklist.  Returns true when the URL is
+     * blocked and the caller should abort the action.
+     */
+    async isBlockedUrl(target) {
+        // Only validate strings that look like URLs (contain "://")
+        if (!target.includes('://'))
+            return false;
+        const result = await validateHookUrl(target);
+        if (!result.safe) {
+            console.warn(`[CrossPhaseHooks] SSRF blocked: ${result.reason}`);
+            return true;
+        }
+        return false;
+    }
     checkConditions(conditions, context) {
         if (!conditions || conditions.length === 0)
             return true;

package/dist/hooks/security/config-snapshot.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Hook Configuration Snapshot
+ *
+ * Deep-freezes hook configuration at startup so it cannot be mutated
+ * at runtime. Uses structuredClone to detach from the original, then
+ * recursively freezes every nested object and array.
+ *
+ * @module hooks/security/config-snapshot
+ * @see IMP-07 Hook Security Hardening
+ */
+/**
+ * Deep-freeze an object and all nested objects.
+ * Returns a Readonly<T> that throws on mutation attempts.
+ */
+export declare function deepFreeze<T extends object>(obj: T): Readonly<T>;
+/**
+ * Capture an immutable snapshot of hook configuration.
+ * Uses structuredClone to detach from original, then deep-freezes.
+ */
+export declare function captureHooksConfigSnapshot<T extends object>(config: T): Readonly<T>;
+//# sourceMappingURL=config-snapshot.d.ts.map

package/dist/hooks/security/config-snapshot.js

@@ -0,0 +1,33 @@
+/**
+ * Hook Configuration Snapshot
+ *
+ * Deep-freezes hook configuration at startup so it cannot be mutated
+ * at runtime. Uses structuredClone to detach from the original, then
+ * recursively freezes every nested object and array.
+ *
+ * @module hooks/security/config-snapshot
+ * @see IMP-07 Hook Security Hardening
+ */
+/**
+ * Deep-freeze an object and all nested objects.
+ * Returns a Readonly<T> that throws on mutation attempts.
+ */
+export function deepFreeze(obj) {
+    const props = Object.getOwnPropertyNames(obj);
+    for (const prop of props) {
+        const val = obj[prop];
+        if (val && typeof val === 'object' && !Object.isFrozen(val)) {
+            deepFreeze(val);
+        }
+    }
+    return Object.freeze(obj);
+}
+/**
+ * Capture an immutable snapshot of hook configuration.
+ * Uses structuredClone to detach from original, then deep-freezes.
+ */
+export function captureHooksConfigSnapshot(config) {
+    const snapshot = structuredClone(config);
+    return deepFreeze(snapshot);
+}
+//# sourceMappingURL=config-snapshot.js.map