gemstack-ai 1.3.0 → 2.0.0

package/scripts/ci/check-secrets.js

@@ -0,0 +1,84 @@
+const fs = require('fs');
+const path = require('path');
+const { detectSecrets } = require('../../src/commands/hooks');
+
+const rootDir = path.resolve(__dirname, '../../');
+
+const IGNORED_DIRS = new Set([
+    '.git',
+    'node_modules',
+    '.gemstack',
+    'tests'
+]);
+
+const IGNORED_FILES = new Set([
+    'package-lock.json',
+    'check-secrets.js',
+    'security-p0-hardening.test.js' // Contains test patterns
+]);
+
+const BINARY_EXTENSIONS = new Set([
+    '.png', '.jpg', '.jpeg', '.gif', '.ico', '.pdf', '.zip', '.tar', '.gz', '.tgz', '.sqlite', '.db'
+]);
+
+function walkDirectory(dir, fileList = []) {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        const relPath = path.relative(rootDir, fullPath).replace(/\\/g, '/');
+
+        if (entry.isDirectory()) {
+            if (!IGNORED_DIRS.has(entry.name)) {
+                walkDirectory(fullPath, fileList);
+            }
+        } else if (entry.isFile()) {
+            if (!IGNORED_FILES.has(entry.name) && !BINARY_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) {
+                fileList.push(fullPath);
+            }
+        }
+    }
+    return fileList;
+}
+
+function runSecretsCheck() {
+    const files = walkDirectory(rootDir);
+    let violations = [];
+
+    for (const filePath of files) {
+        const relPath = path.relative(rootDir, filePath).replace(/\\/g, '/');
+        // Skip demo-app test fixtures or node_modules
+        if (relPath.includes('node_modules/') || relPath.includes('fixtures/')) {
+            continue;
+        }
+
+        try {
+            const content = fs.readFileSync(filePath, 'utf8');
+            const detected = detectSecrets(content);
+            if (detected.length > 0) {
+                for (const d of detected) {
+                    violations.push({
+                        file: relPath,
+                        line: d.lineNumber,
+                        type: d.type,
+                        description: d.description,
+                        snippet: d.lineSnippet
+                    });
+                }
+            }
+        } catch (e) {
+            // Non-text file or read error, skip
+        }
+    }
+
+    if (violations.length > 0) {
+        console.error(`\n❌ [FAIL] ${violations.length} secret(s) detected in repository files:`);
+        for (const v of violations) {
+            console.error(`  - ${v.file}:${v.line} [${v.type}] ${v.description}`);
+        }
+        process.exit(1);
+    } else {
+        console.log('[OK] Zero secrets detected in repository.');
+    }
+}
+
+runSecretsCheck();

package/specs/009-context-capsule/context-capsule.json

@@ -316,7 +316,7 @@
       "value": true
     }
   ],
-  "generated_at": "2026-09-11T18:39:24.919Z",
+  "generated_at": "2026-09-11T19:51:55.434Z",
   "generator": {
     "name": "gemstack",
     "version": "1.2.0"
@@ -352,16 +352,16 @@
   ],
   "project": {
     "active_feature": "specs/009-context-capsule",
-    "current_phase": "shipped",
+    "current_phase": "closure",
     "lifecycle_status": "SHIPPED",
     "name": "gemstack-ai",
     "next_permitted_phase": "PLAN"
   },
   "provenance": {
-    "source_set_hash": "c4f41904cf21ad6f8621e310650de48b7012c40a4a73010a62b37ea633d576b5",
+    "source_set_hash": "cb553121ecd975b8c39e1378e0ff07c9adb2d12ef323f2088c34c6780ca33077",
     "sources": [
       {
-        "hash": "a38e279e94ee6bcfb8bae4e9bf407277cdc1c16491539ae6a66bc179befb0ab6",
+        "hash": "e7b3f8427fd31ef9d591b6752716ebbf1831d669c5000297a8816eeeaf5e6936",
         "path": ".gemstack/state.json",
         "role": "LIFECYCLE_STATE"
       },

package/specs/010-agent-swarm-visual-qa/.gemstack.json

@@ -0,0 +1,5 @@
+{
+  "phase_hashes": {},
+  "historical_findings": [],
+  "accepted_exceptions": []
+}

package/specs/010-agent-swarm-visual-qa/closure.json

@@ -0,0 +1,59 @@
+{
+  "schema": "gemstack-closure",
+  "version": 1,
+  "feature": "specs/010-agent-swarm-visual-qa",
+  "generated_at": "2026-09-11T19:52:14.736Z",
+  "status": "VERIFIED",
+  "closure_context": {
+    "closure_context_hash": "8be65c934d6f21da5ea49237613ef80705121c7006061a55f6db2fa24216ef41",
+    "repository_type": "git",
+    "git_commit": "832550278fa95d3ed571c8ec2f7db9830ddd9ebc",
+    "working_tree_clean": false,
+    "relevant_files_digest": "d02611dc5c123f386294bb6807b2c424fbc1c4666586a3284686cfd99452a905"
+  },
+  "acceptance_signature": "4c62312b07e949480087e1bced495abfe44f137bf5a04ac5d87c8ef4ccd3fbeb",
+  "canonical_summary": {
+    "required_total": 20,
+    "required_passed": 20,
+    "supplemental_total": 0,
+    "supplemental_passed": 0
+  },
+  "physical_summary": {
+    "supporting_total": 6,
+    "supporting_passed": 6,
+    "total_executed": 26,
+    "total_passed": 26,
+    "total_failed": 0,
+    "total_skipped": 0
+  },
+  "reconciliation": {
+    "math_valid": true,
+    "phantoms_detected": 0,
+    "orphans_detected": 0,
+    "missing_canonical_ids": []
+  },
+  "task_traceability_summary": {
+    "tasks_total": 29,
+    "tasks_with_validation": 29,
+    "tasks_documentation_only": 0,
+    "unmapped_canonical_tests": []
+  },
+  "required_gates": {
+    "project-tests": "PASS",
+    "gate-ci-frontmatter": "PASS",
+    "gate-ci-mojibake": "PASS"
+  },
+  "supplemental_gates": {},
+  "exceptions": [],
+  "evidence_sources": [
+    {
+      "type": "PACKAGE_SCRIPT",
+      "script": "test",
+      "runner": "node:test",
+      "exit_code": 0,
+      "duration_ms": 351
+    }
+  ],
+  "blockers": [],
+  "warnings": []
+}