bmad-method-test-architecture-enterprise 2.0.3-next.0 → 2.0.3

package/.claude-plugin/marketplace.json

@@ -31,7 +31,7 @@
       "name": "bmad-method-test-architecture-enterprise",
       "source": "./",
       "description": "Master Test Architect module for quality strategy, test generation in red and expand modes with automatic run-and-heal, combined framework and CI setup, CI/CD quality gates, and structured testing education. The CI and ATDD commands remain available with existing customizations. Part of the BMad Method ecosystem.",
-      "version": "2.0.3-next.0",
+      "version": "2.0.3",
       "author": {
         "name": "Murat K Ozcan (TEA Creator) & Brian (BMad) Madison"
       },

package/cli/lib/evaluate/confinement-audit.js

@@ -6,8 +6,8 @@
  * runtime reads. `confinement.js` holds the boundary and decides what each
  * sandbox grants; this module only observes.
  *
- *   Seatbelt     the target's profile reports every `file-read-data` it allows
- *                outside the grants (`with report`) and tags each file rule it
+ *   Seatbelt     the target's profile refuses ungranted `file-read-data` and
+ *                reports those refusals, tagging each file rule it
  *                holds with a random token of the sandbox (`with message`).
  *                The kernel logs a report as `Sandbox: <name>(<pid>) allow|
  *                deny(1) <operation> <real path>` with the token on the next

package/cli/lib/evaluate/confinement.js

@@ -147,7 +147,7 @@
  *                as the isolation manifest's `observedMounts`, which
  *                eval-quality holds against the allowed mounts and records as
  *                an isolation violation (Story 1.60). Seatbelt reports each
- *                read its profile allows outside the grants (`with report`) and
+ *                ungranted read its profile refuses and
  *                tags every file rule with a token of the sandbox (`with
  *                message`), and a `/usr/bin/log stream` child the runtime owns
  *                writes the kernel's reports of that token to a file beneath
@@ -463,15 +463,17 @@ function seatbeltLayerProfile(evaluationFolder, gitDirectory = null, hooksDirect
  * A `connect()` to a path-based unix socket is refused anywhere but the workspace, the private directories, the home and the two system services in `SEATBELT_SYSTEM_SOCKETS` (Story 1.87).
  * The rule names a path, so it holds for a socket bound after the call started.
  *
- * With `audit` (`{ token, exempt }`), the kernel reports what the profile allows or refuses.
+ * Read grants restrict file data to the workspace, system roots and explicitly declared dependencies.
+ * With `audit` (`{ token }`), the kernel reports refusals with the sandbox token.
  * Every file rule that denies carries the sandbox's token (`with message`).
- * One rule reports each `file-read-data` the profile allows outside `exempt` (the paths the sandbox may read, and the root directory itself) with the same token (`with report`).
+ * Every ungranted `file-read-data` is denied even when its diagnostic is lost by the unified log.
  * That rule is placed before every rule that follows it, so a later grant (the home, a call directory, the git directory's own entry) overrides it.
- * Without `audit` the profile is the one every earlier story generated, byte for byte.
+ * The same read boundary applies when a qualification port carries no observer.
  */
 function seatbeltTargetProfile({
   workspace,
   writable,
+  readable = [],
   evaluationFolder,
   git = null,
   privateRoot = null,
@@ -485,11 +487,8 @@ function seatbeltTargetProfile({
   const socketRules = seatbeltSocketRules(allowed);
   const socketRoutes = (candidates) => candidates.map((entry) => `(remote unix-socket ${entry})`).join('\n  ');
   const tagged = audit === null ? '' : ` (with message "${audit.token}")`;
-  // Seatbelt decides an operation by the rules that name it before the rules that name its wildcard, so the report rule
-  // (which names `file-read-data`) would override every later `file-read*` rule, whatever their order; an audited profile
-  // therefore names `file-read-data` in each rule that governs reads, which keeps the textual order (the last matching rule
-  // wins) the unaudited profile relies on.
-  const reads = audit === null ? 'file-read*' : 'file-read-data file-read*';
+  // Specific data-read grants outrank wildcard rules in Seatbelt. Every protected denial and re-grant must name the data operation.
+  const reads = 'file-read-data file-read*';
   const subpaths = (candidate) => spellings(candidate).map((entry) => `(subpath "${assertProfileSafePath(entry, refuseUnsafePath)}")`);
   // A denial of reads and writes of `paths`; an audited profile names `file-read-data` and tags it (see `reads`).
   const denials = (paths) => [`(deny ${reads} file-write*\n  ${paths.join('\n  ')}${tagged})`];
@@ -542,18 +541,12 @@ function seatbeltTargetProfile({
           `(allow file-read-metadata\n  ${reachableAncestors.flatMap(literals).join('\n  ')})`,
           `(allow network-outbound\n  ${socketRoutes(reachable.flatMap(subpaths))})`,
         ];
-  // What the sandbox may read is not reported; every other read the profile allows is (macOS reports by real path, so both spellings are named).
-  const reportRule =
-    audit === null
-      ? []
-      : [
-          `(allow file-read-data\n  (require-all\n    ${[
-            ...EXACT_GRANTS.map((entry) => `(require-not (literal "${entry}"))`),
-            ...audit.exempt
-              .flatMap(spellings)
-              .map((entry) => `(require-not (subpath "${assertProfileSafePath(entry, refuseUnsafePath)}"))`),
-          ].join('\n    ')})\n  (with report)${tagged})`,
-        ];
+  // Kernel enforcement is independent of the lossy log: ungranted data reads are refused even if their diagnostic is dropped.
+  // Keep the specific operation in later denials/re-grants so Seatbelt's wildcard precedence cannot reopen protected paths.
+  const reportRule = [
+    `(deny file-read-data${tagged})`,
+    `(allow file-read-data\n  ${[...EXACT_GRANTS.map((entry) => `(literal "${entry}")`), ...readable.flatMap(subpaths)].join('\n  ')})`,
+  ];
   // A target's git tries to write the worktree's own entry and the private repository (the index lock of a `git status`), which
   // the profile refuses and the target's git expects to fail; the refusal carries no token, so it is not an observed mount.
   const quiet =
@@ -1457,15 +1450,13 @@ function targetSandbox({
         const profile = seatbeltTargetProfile({
           workspace,
           writable: grants,
+          readable: readRoots([...grants, ...readable]),
           evaluationFolder,
           git,
           privateRoot,
           rootHome,
           rootGrants: callDirectories,
-          audit:
-            observer === null
-              ? null
-              : { token: observer.token, exempt: readRoots([...grants, ...readable]), quiet: [...ownGitEntries(), ...linked] },
+          audit: observer === null ? null : { token: observer.token, quiet: [...ownGitEntries(), ...linked] },
         });
         // `env` runs outside the sandbox and after the watchdog hop that starts every target, which is where Node adds the host's `NODE_V8_COVERAGE` to the environment; the sandbox then starts the target without it, as Bubblewrap's `--unsetenv` does.
         return {

package/cli/lib/evaluate/isolation-allowlist.js

@@ -115,7 +115,7 @@ function chanceMountNotes(legs, folder) {
  * @param {object} options
  * @param {string[]} options.mounts the offending paths, as the audit reported them
  * @param {string} options.folder the evaluation folder, for the neutral form of each path
- * @param {'legs'|'trials'} options.who
+ * @param {'legs'|'denied-legs'|'trials'} options.who
  * @returns {string|null}
  */
 function mountRefusal({ mounts, folder, who }) {
@@ -124,9 +124,11 @@ function mountRefusal({ mounts, folder, who }) {
   const named = mounts.slice(0, NAMED_PATHS).map((mount) => `mount outside allowlist: ${neutral(mount)}`);
   const list = `${named.join('; ')}${mounts.length > named.length ? `; and ${mounts.length - named.length} more` : ''}`;
   const finding =
-    who === 'legs'
-      ? `isolation manifest violation: every preflight leg opened ${mounts.length} path(s) outside the allowlist (${list}), so every trial will too, and \`score\` refuses a trial that does (exit 3).`
-      : `isolation manifest violation: the trials opened ${mounts.length} path(s) outside the allowlist, so \`score\` would exit 3 (${list}).`;
+    who === 'denied-legs'
+      ? `isolation manifest violation: every preflight leg attempted access to ${mounts.length} path(s) outside the allowlist (${list}); the kernel refused those accesses (exit 3).`
+      : who === 'legs'
+        ? `isolation manifest violation: every preflight leg opened ${mounts.length} path(s) outside the allowlist (${list}), so every trial will too, and \`score\` refuses a trial that does (exit 3).`
+        : `isolation manifest violation: the trials opened ${mounts.length} path(s) outside the allowlist, so \`score\` would exit 3 (${list}).`;
   return [
     finding,
     'If they are the files of a target that launches from outside its workspace, use one of two setups: make the registry `target` a path inside `launch.root` (for example `node_modules/.bin/tea-skill-runner` over a copy workspace, or a git workspace with `workspace.provision`), or keep the bare name and list the directories it runs from in `systemPaths`, with the bin directory that holds its link on `PATH`.',

package/cli/lib/evaluate/preflight.js

@@ -1361,11 +1361,12 @@ async function runInWorkspaces({
   // A passed `preflight` is refused when every leg of the pristine workspace opened a path outside the allowlist: a target that lives
   // outside its workspace loads its own files on every launch, so every trial opens them too, and `score` refuses a trial that does
   // (exit 3). `run` judges the trials' own manifests, the set `score` judges, so it does not refuse on the legs.
-  if (afterVerdict === null && verdict.exitCode === 0) {
+  // Seatbelt can refuse an undeclared runner before it produces a passing leg. Preserve the captured denial's path and setup guidance.
+  if (afterVerdict === null && (verdict.exitCode === 0 || confinement.mode === 'seatbelt')) {
     const refusal = mountRefusal({
       mounts: mountsOfEveryLeg(legMounts, [`${pristine.kind} pristine`]),
       folder,
-      who: 'legs',
+      who: confinement.mode === 'seatbelt' ? 'denied-legs' : 'legs',
     });
     if (refusal !== null) return outcome({ stage: 'leg', exitCode: 3, message: refusal });
   }

package/cli/lib/evaluate/run.js

@@ -1468,7 +1468,9 @@ async function runTrialSets(given) {
   for (const arm of arms) {
     arm.trials = [];
     for (let trialIndex = 1; trialIndex <= trialCount; trialIndex += 1) {
-      log(`${arm.conditionArm}: trial ${trialIndex} of ${trialCount}`);
+      const trialDetail = `${arm.conditionArm}: trial ${trialIndex} of ${trialCount}`;
+      log(trialDetail);
+      progress('trials', { detail: trialDetail, completedTrials });
       const trial = await runTrial({ ...context, arm, trialIndex });
       const versionReadBegan = Date.now();
       const agentMoved = await agentVersionChange(context);
@@ -1480,7 +1482,7 @@ async function runTrialSets(given) {
       missingReports += trial.unreportedSteps.length;
       completedTrials += 1;
       progress('trials', {
-        detail: `${arm.conditionArm}: trial ${trialIndex} of ${trialCount}`,
+        detail: `${trialDetail} completed`,
         completedTrials,
         usage: {
           trialCostUsd: missingReports === 0 && completedTrials === totalTrials ? reportedUse.costUsd : null,

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-method-test-architecture-enterprise",
-  "version": "2.0.3-next.0",
+  "version": "2.0.3",
   "description": "Master Test Architect for quality strategy, test automation, and release gates",
   "keywords": [
     "bmad",

package/skills/bmad-testarch-evaluate/references/authoring-routing.md

@@ -16,13 +16,15 @@ When the adopter asks for the latest target model or model tier, resolve it from
 
 Use at most two read-only workers at once. Give each a disjoint source scope, the confirmed requirements statement, a concrete question, a time bound, and this output shape: `candidate`, `source path and line`, `uncertainty`, and `files inspected`. Good tasks are entry-point inventory, failure-history search, candidate boundary cases, candidate mutation locations, and summaries of public evaluator documentation. Workers may draft a probe or oracle fragment as text, but the parent decides whether it enters the corpus or contract.
 
+When the host supports an isolated worker context, start each task without inheriting the parent conversation. Supply a short task packet with the confirmed requirement, exact source paths, the question, and the output shape above. For a later task, start a fresh bounded worker with a new packet; a long worker history can cost more than the research itself. If the host requires inherited context, keep the worker task narrow and record that constraint. Verify source claims and run the same authoring gates regardless of the context mode.
+
 Keep one writer: the parent. Instruct workers to avoid editing the repository, evaluation folder, policy, or run artifacts; launching targets; running `tea-evaluate` or `eval-quality`; or contacting other workers. Some hosts give subagents writable tools even for a read-only request. Pause parent writes during a worker group. Compare the scoped source and evaluation-file inventory and digests before dispatch and after every worker returns. If files changed, reject the affected drafts, identify the writer, and repair worker-attributed edits before continuing. Never send workers secrets, credentials, private user data, `corpus/held-out/`, a held-out plan, held-out results, or a complete held-out request. When a task cannot be split cleanly, keep it in the parent session.
 
 The parent checks every file and line claim before adopting it. Draft probes still pass `tea-evaluate check`, `eval-quality compile` and `seal`, preflight, scored `run`, and `score` at their normal stages. A cheap worker's confidence or self-reported pass does not replace any gate. If a draft fails a gate, record the failure and repair time in the authoring log.
 
 ## Show authoring progress and cost
 
-Start an authoring log in `{test_artifacts}/evaluate/` before Stage 1 inspection, then carry it to `<evaluation-folder>/authoring-log.md` when that folder exists. Record each stage's start and completion time, its artifact paths, and its next gate. For each worker task, record dispatch and completion time, scope, requested tier, resolved model, outcome, retries, parent verification and repair time, and reported input/output tokens or cost when available. Write `unknown` for missing usage. Count parent work separately from worker work. On resume, read the existing log, mark any unfinished worker task interrupted, and continue with new entries rather than replacing prior timings. Keep this log outside `corpus/`, `probes/`, `mutations/`, and `runs/` so it does not alter a corpus digest or sealed run.
+Start an authoring log in `{test_artifacts}/evaluate/` before Stage 1 inspection, then carry it to `<evaluation-folder>/authoring-log.md` when that folder exists. Record each stage's start and completion time, its artifact paths, and its next gate. For each worker task, record dispatch and completion time, scope, context mode (isolated or inherited), requested tier, resolved model, outcome, retries, parent verification and repair time, and reported input/output tokens or cost when available. Write `unknown` for missing usage. Count parent work separately from worker work. On resume, read the existing log, mark any unfinished worker task interrupted, and continue with new entries rather than replacing prior timings. Keep this log outside `corpus/`, `probes/`, `mutations/`, and `runs/` so it does not alter a corpus digest or sealed run.
 
 For a long target run, use the runtime's progress command when available and report its current phase, completed/planned trials, whole-run elapsed time, and last heartbeat. Report scored trial usage separately from authoring usage; a subtotal is not full-run cost. Continue through `score` before reporting a verdict.
 

package/skills/bmod-tea/bmod.toml

@@ -2,7 +2,7 @@
 
 [bmod]
 code = "tea"
-version = "2.0.3-next.0"
+version = "2.0.3"
 update_source = "github:bmad-code-org/bmad-method-test-architecture-enterprise/skills"
 skills = [
   "bmad-tea",