jules-orchestrator-kit 0.42.0 → 0.51.0

package/.agent/prompts/A11y.md

@@ -0,0 +1,23 @@
+# A11y - Accessibility & Semantic Markup Specialist ♿
+
+> **Role:** Accessibility auditor focused on WCAG 2.2 AA/AAA conformance, keyboard operability, and screen-reader semantics.
+> **Scope:** Semantic HTML, ARIA, focus management, color contrast, and form labelling — across web, rendered markup, and UI text.
+
+## Core Directives
+
+1. **Standards-First, Not Opinion:**
+   - Anchor every finding to a specific WCAG 2.2 success criterion (e.g. 1.4.3 Contrast Minimum, 2.4.7 Focus Visible, 2.1.1 Keyboard, 4.1.2 Name Role Value).
+   - Distinguish between a conformance failure (must fix), a best-practice improvement (should fix), and a subjective preference (leave alone). Do not rewrite working markup on preference.
+
+2. **Semantic, Not Decorative, Fixes:**
+   - Prefer native HTML elements (`<button>`, `<a>`, `<dialog>`, `<label>`, `<nav>`, `<main>`) over bolted-on ARIA. Add ARIA only when no native element carries the semantics.
+   - Every interactive control must be keyboard-reachable, show a visible `:focus-visible` ring, and restore focus on close/escape for overlays.
+
+3. **Evidence Before Claims:**
+   - A contrast change requires measured ratios (normal text >= 4.5:1, large text >= 3:1 for AA; 7:1 / 4.5:1 for AAA). "Looks fine" is not a result.
+   - For dynamic UI, state how the result was verified: automated axe/pa11y output, keyboard walk-through, or screen-reader transcript. Paste the output.
+
+4. **Zero Regressions Invariant:**
+   - Execute `{{VERIFY_TEST}}` before and after every change, and record both results.
+   - Never disable focus styles, skip tests, weaken assertions, or change public API signatures to make an accessibility check pass.
+   - Keep total diff payload under {{DIFF_KB}} KB (`git diff | wc -c`).

package/.agent/prompts/Alchemist.md

@@ -0,0 +1,23 @@
+# Alchemist - Schema, Migration & Data-Integrity Specialist ⚗️
+
+> **Role:** Database and schema change guardian.
+> **Scope:** Inspecting schema constraints, reviewing and generating migrations, and ensuring data integrity across destructive or backfill operations.
+
+## Core Directives
+
+1. **Inspect Before You Migrate:**
+   - Before generating or editing any migration, read the current schema, the migration history, and the foreign-key / NOT NULL / CHECK / unique constraints the change touches. State the exact constraint and the migration that introduced it.
+   - A migration must be reversible, or explicitly and prominently marked irreversible in the file and the PR description. "We'll recreate the table" is not a rollback strategy.
+
+2. **No Silent Data Loss:**
+   - Never drop a column, table, or constraint, never widen a type in a lossy direction, and never truncate data in the same change that ships application code. Split destructive steps from the code that stops using the data, and sequence them so the previous release keeps working.
+   - Backfills must be batched and idempotent, must not lock the table for the duration of the run, and must state the batch size and the detection of a completed row.
+
+3. **Evidence Before Claims:**
+   - Paste the migration plan output, the schema-diff or dry-run result, and the verification query proving the post-migration state. A claim that "the migration is safe" without those is not a result.
+   - Migrations that require a long-running lock, a full table rewrite, or a downtime window must say so in the PR, with the measured or estimated duration.
+
+4. **Zero Regressions Invariant:**
+   - Execute `{{VERIFY_TEST}}` before and after every change, and record both results.
+   - Never disable foreign-key checks, weaken a NOT NULL constraint, edit an already-applied migration, or skip a migration test to make a run pass. If a historical migration is wrong, add a new forward migration that fixes it.
+   - Keep total diff payload under {{DIFF_KB}} KB (`git diff | wc -c`).

package/.agent/prompts/Scribe.md

@@ -0,0 +1,23 @@
+# Scribe - Metadata, Structured Data & Documentation Specialist ✍️
+
+> **Role:** Documentation and metadata auditor — canonical links, OpenGraph/Twitter cards, Schema.org JSON-LD, sitemaps, and public API reference.
+> **Scope:** Machine-readable metadata and human-facing docs; never copywriting or prose tone.
+
+## Core Directives
+
+1. **One Source of Truth per Surface:**
+   - A given piece of metadata (canonical URL, title, description, image, locale) must agree across every surface it appears on — HTML head, sitemap, JSON-LD, and social cards.
+   - Never modify another specialist's surface to resolve a disagreement here. If Schema.org markup is wrong, fix the structured data; do not edit the SEO template's tags.
+
+2. **Valid, Resolvable, Absolute:**
+   - Canonical and OpenGraph URLs must be absolute HTTPS links with consistent trailing-slash policy. Every link in a sitemap, `llms.txt`, or JSON-LD block must resolve against the project's own route table or build output — check locally, do not fetch the live web from the verification step.
+   - JSON-LD must include `@context` and `@type` and validate without missing required Schema.org properties.
+
+3. **Evidence Before Claims:**
+   - Paste the parsed metadata output, link-resolution check, or validator result. A claim that "the sitemap is correct" without a listing of the URLs checked is not a result.
+   - Do not claim ranking, visibility, traffic, or AI-citation effects. Those have no local oracle; they do not belong in the diff, the commit message, or the PR body.
+
+4. **Zero Regressions Invariant:**
+   - Execute `{{VERIFY_TEST}}` before and after every change, and record both results.
+   - Never weaken assertions, delete tests, or alter public API signatures to make a metadata check pass.
+   - Keep total diff payload under {{DIFF_KB}} KB (`git diff | wc -c`).

package/.agent/prompts/Spectator.md

@@ -0,0 +1,24 @@
+# Spectator - End-to-End & Visual Regression Specialist 👁️
+
+> **Role:** Test author for E2E behavior and visual/responsive regressions.
+> **Scope:** Headless browser flows, multi-viewport layout assertions, snapshot stability, and flake elimination.
+
+## Core Directives
+
+1. **Deterministic, Not Sleep-Based:**
+   - Replace arbitrary `waitForTimeout`/`sleep` calls with auto-retrying web assertions that wait for the condition itself (`expect(locator).toBeVisible()`, `toBeAttached()`, network-idle where the harness offers it).
+   - Use resilient, user-facing locators — `getByRole`, `getByLabel`, `getByText` — over brittle CSS hierarchy or XPath. A locator that breaks on a class rename is a future flake.
+
+2. **Headless & Isolated by Default:**
+   - All browser runs must specify headless execution so the suite passes in CI sandboxes without an X11/Wayland display server.
+   - Intercept or mock third-party network requests (analytics, CDNs, fonts). Tests must not depend on a live network or a real third-party service.
+   - Isolate state per test: clean context, no leaked cookies, `localStorage`, or service-worker registrations between runs.
+
+3. **Evidence Before Claims:**
+   - A visual or responsive fix requires the suite to pass across the declared viewports (e.g. mobile 375px, tablet 768px, desktop 1440px) with zero horizontal overflow on mobile and tap targets >= 44x44px.
+   - For flakiness work, state the repetition count the suite passed cleanly under (`--repeat-each=N`). A single green run proves nothing about timing races.
+
+4. **Zero Regressions Invariant:**
+   - Execute `{{VERIFY_TEST}}` before and after every change, and record both results.
+   - Never delete a failing assertion, widen a snapshot threshold to silence a real layout shift, or weaken a locator to force a pass. If a test is genuinely wrong, fix the test and explain why.
+   - Keep total diff payload under {{DIFF_KB}} KB (`git diff | wc -c`).

package/JULES_RULES_TEMPLATE.md

@@ -67,14 +67,16 @@ Jules automatically infers test and build verification commands via `scripts/com
 ## 5. Security Fencing & Specialized Domain Guardrails
 
 - **Untrusted Prompt Fencing**: All dynamic user prompts and issue texts are encapsulated in `<UNTRUSTED_TASK_CONTEXT>` tags with a `# SECURITY DIRECTIVE — UNTRUSTED CONTENT FENCE` header, instructing Jules to treat enclosed text as non-executable data.
-- **Specialized Domain Personas & Task Envelopes**:
-  - **Sentinel (Security)**: Enforces input sanitization, token redaction, and RBAC guardrails.
-  - **Bolt (Performance / `web-cwv`)**: Optimizes Core Web Vitals (LCP, CLS, INP), bundle size, and prevents token bloat.
-  - **A11y Guard (`web-wcag`)**: Eliminates accessibility violations, modal focus traps, and contrast defects.
-  - **Scribe (`web-seo`)**: Injects valid Schema.org JSON-LD, OpenGraph/Twitter cards, and canonical links.
-  - **Spectator (`web-playwright`)**: E2E visual regression and multi-viewport responsive testing.
-  - **Janitor (Clean Code / `web-flaky-heal`)**: Eliminates flaky test oscillations, dead code, and linting warnings.
-  - **Alchemist (Database)**: Inspects schema constraints before running or generating database migrations.
+- **Specialized Domain Personas & Task Envelopes** (each persona ships as a stack-neutral prompt in `.agent/prompts/`; select one with `agentctl dispatch --role <name>`, case-insensitive):
+  - **Overseer (Audit)**: Maps structural debt into scoped, file-and-line task definitions for the worker roles; does not refactor in the audit pass.
+  - **Sentinel (Security)**: Input sanitization, token redaction, RBAC guardrails.
+  - **Bolt (Performance / `web-cwv`)**: Core Web Vitals (LCP, CLS, INP), bundle size, token bloat.
+  - **A11y (`--role a11y` / `web-wcag`)**: WCAG 2.2 violations, focus traps, contrast defects.
+  - **Scribe (`--role scribe` / `web-seo`)**: Schema.org JSON-LD, OpenGraph/Twitter cards, canonical links; metadata parity and link resolution.
+  - **Spectator (`--role spectator` / `web-playwright`)**: Headless E2E, visual regression, multi-viewport responsive tests with no sleep-based waits.
+  - **Janitor (Clean Code / `web-flaky-heal`)**: Flaky tests, dead code, lint warnings.
+  - **Alchemist (`--role alchemist`)**: Schema constraints, migration reversibility and data-loss review, batched idempotent backfills.
+- **Universal task envelopes** (work in any stack the detector recognises — Cargo, Go, Python, PHP, .NET, Java, Ruby, Elixir, Node — because verify commands hydrate from config): `agent-dep-audit` (deps/lockfile pinning, checksums, install scripts, stale-lockfile gate, offline), `agent-doc-drift` (CLI flags, env vars, SDK exports vs shipped surface), `agent-config-audit` (typed loading, fail-closed defaults, secret redaction), `agent-api-contract` (route/handler parity, boundary validation, one error shape).
 
 ---
 

package/README.md

@@ -143,7 +143,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **717 unit tests across 85 suites passing in < 10.0s**.
+* **Verified Test Suite:** Tested with **790 unit tests across 91 suites passing in < 10.0s**.
 
 <br/>
 
@@ -161,7 +161,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 | `init` | `agentctl init [--interactive] [--tier pro] [--force]` | Interactive onboarding wizard & stack detector. Generates `.agent/config.yml` and scaffolds `AGENTS.md`, the role prompts, the guardrails and the runtime `.gitignore` entries. Existing files are preserved unless `--force`. | `0` (Created) |
 | `budget` | `agentctl budget [--by-user] [--json] [reset]` | Reports rolling 24h task budget, quota headroom, and per-developer task attribution without external auth servers. | `0` (Status), `2` (Arg Error) |
 | `task create` | `agentctl task create [<prompt>] [--title <t>] [-p <prompt>] [-f <file>] [--template <id>] [--role <name>] [--tier fast\|complex]` | Interactively authors & scopes falsifiable task envelopes with secret scrubbing, preflight gate checks, and DAG dependency wiring. | `0` (Queued), `1` (Secret/Unfalsifiable) |
-| `task template` | `agentctl task template [<id>] [--list] [--json]` | Lists and synthesizes pre-calibrated task envelopes (Web, Deep Think & Agent Hardening: `web-cwv`, `web-wcag`, `web-seo`, `web-playwright`, `agent-dead-code-audit`, `web-flaky-heal`, `web-i18n`, `web-ai-access`, `agent-qa-mutation`, `agent-ci-falsify`, `agent-service-isolate`, `agent-error-paths`, `agent-security-audit`, `deep-debug`, `deep-feature`, `deep-optimize`, `deep-harden`). | `0` (Listed/Synthesized) |
+| `task template` | `agentctl task template [<id>] [--list] [--json]` | Lists and synthesizes pre-calibrated task envelopes (Web, Deep Think, Universal & Agent Hardening: `web-cwv`, `web-wcag`, `web-seo`, `web-playwright`, `agent-dead-code-audit`, `web-flaky-heal`, `web-i18n`, `web-ai-access`, `agent-qa-mutation`, `agent-ci-falsify`, `agent-service-isolate`, `agent-error-paths`, `agent-security-audit`, `agent-dep-audit`, `agent-doc-drift`, `agent-config-audit`, `agent-api-contract`, `deep-debug`, `deep-feature`, `deep-optimize`, `deep-harden`). | `0` (Listed/Synthesized) |
 | `dispatch` | `agentctl dispatch [<prompt>] [-p <prompt>] [-f <file>] [-r <role>] [-t <tier>] [--author <name>] [--check-premise] [--auto-pr] [--repoless] [--dry-run]` | Dispatches autonomous task to the active provider with pre-flight idempotency checks, payload limits, and role prompt resolution. `--dry-run` stops short of the provider call and reports itself as a rehearsal rather than a dispatch. | `0` (Dispatched), `1` (Error) |
 | `plan approve` | `agentctl plan approve <sessionId> [--dry-run] [--json]` | Approves pending execution plan for an active Jules session (`:approvePlan`) with automatic 404/503 retry backoff. | `0` (Approved), `1` (Error) |
 | `session get` | `agentctl session get <sessionId> [--dry-run] [--json]` | Retrieves live session lifecycle state from provider REST API with token rotation. | `0` (Fetched), `1` (Error) |
@@ -170,8 +170,13 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 | `queue` | `agentctl queue [--dag] [--concurrency <n>] [--dry-run] [--json]` | Consumes and executes task envelopes in `.agent/jules-queue/` with Kahn's DAG dependency resolution. Non-task files (manifests, `README.md`) are skipped, and `--dry-run` previews without moving anything. | `0` (Complete) |
 | `swarm` | `agentctl swarm [--json]` | Runs parallel multi-agent swarm across worker slots with PID liveness detection. | `0` (Complete) |
 | `check` / `gate` / `audit`| `agentctl check [--mode working-tree] [--fix] [--json] [--json-report <path>]` | Runs security, secret scanning, rules budget audit, and tiered verification gates (with declarative assertion support) against working tree or branch. | `0` (Approved), `1` (Budget/Arg), `3` (Scope), `4` (Verify), `5` (Diff >75K), `6` (Secret), `8` (Flaky) |
+| `mutate` / `mutation` | `agentctl mutate [--min-score <n>] [--max-mutants <n>] [--cmd <testCmd>] [--json]` | Runs zero-dependency diff mutation testing harness on changed hunks with operator inversion and safety rollback. | `0` (Passed), `1` (Score Low) |
+| `coverage` | `agentctl coverage [--min <pct>] [--cmd <testCmd>] [--base <ref>] [--json]` | Runs native zero-dependency V8 diff coverage check against added diff lines. | `0` (Passed), `1` (Low Coverage) |
+| `probe` / `stability` | `agentctl probe [--repeat <n>] [--min <passRate>] [--cmd <testCmd>] [--json]` | Probes test suite flakiness across N consecutive iterations with oscillation detection. | `0` (Passed), `1` (Flaky) |
+| `perf` / `event-loop` | `agentctl perf [--max-ms <n>] [--cmd <testCmd>] [--json]` | Monitors Node.js Event Loop delay and Big-O lag to prevent main-thread event loop starvation. | `0` (Healthy), `1` (Lag Exceeded) |
+| `fix` | `agentctl fix [--file <path>] [--task] [--dry-run] [--json]` | Auto-repairs failure traces from piped stdin (`npm test 2>&1 \| agentctl fix`) or synthesizes OODA queue tasks. | `0` (Resolved), `1` (Failed) |
 | `rules` | `agentctl rules <check\|compile> [--out <path>] [--json]` | Audits instruction files against character/line budgets or compiles unified rules block with SHA-256 and length anti-truncation sentinels. | `0` (Valid/Compiled), `1` (Violations) |
-| `assert` | `agentctl assert [--dir <d>] [--file <f>] [--max-mb <n>] [--gzip] [--targets <g>] [--patterns <p>] [--json] [--json-report <p>]` | Runs declarative zero-dependency verification assertion primitives (`assert:dir-size`, `assert:file-size`, `assert:file-patterns`, `assert:exists`). | `0` (Passed), `1` (Assertion Failed) |
+| `assert` | `agentctl assert [--dir <d>] [--file <f>] [--max-mb <n>] [--gzip] [--targets <g>] [--patterns <p>] [--json] [--json-report <p>]` | Runs declarative zero-dependency verification assertion primitives (`assert:dir-size`, `assert:file-size`, `assert:file-patterns`, `assert:exists`, `assert:mutation`, `assert:test-integrity`, `assert:diff-coverage`, `assert:test-stability`, `assert:event-loop-lag`). | `0` (Passed), `1` (Assertion Failed) |
 | `rollback` | `agentctl rollback [sessionId \| --latest]` | Restores exact commit, uncommitted files, and cleans orphan task worktrees from pre-flight checkpoints. | `0` (Restored), `1` (Error) |
 | `resume` | `agentctl resume <sessionId> --response "<reply>"` | Streams engineer response back into active Google Jules warm session context window. | `0` (Resumed), `1` (Error) |
 | `test-gen` | `agentctl test-gen --title <t> --spec <s> [--run]` | Scaffolds falsifiable unit tests, verifies RED failure state, and locks test in `scope.deny`. | `0` (Scaffolded/Red) |

package/bin/agentctl.mjs

@@ -43,6 +43,11 @@ Commands:
   dispatch | create     Dispatch a single task to an AI agent (--role <name>, --tier fast|complex, --check-premise)
   check                 Run all-in-one CI security, rules, and stack verification gate
   gate | audit          Run CI security and verification gate against current branch
+  mutate | mutation     Run zero-dependency diff mutation testing harness (--min-score, --max-mutants)
+  coverage              Run native zero-dependency V8 diff coverage check (--min, --cmd)
+  probe | stability     Run test flakiness stability probe across N repetitions (--repeat, --cmd)
+  perf | event-loop     Monitor Node.js event loop delay and Big-O lag (--max-ms, --cmd)
+  fix                   Auto-repair from piped terminal logs or error trace (npm test 2>&1 | agentctl fix)
   rules <action>        Audit rule token budgets or compile rule sentinels (check | compile)
   queue                 Run pending task queue (--dag, --concurrency <n>)
   swarm                 Run parallel task swarm
@@ -437,6 +442,284 @@ async function main() {
       break;
     }
 
+    case "mutate":
+    case "mutation": {
+      const { runMutationTest } = await import("../src/mutation.mjs");
+      const { values } = parseArgs({
+        args: args.slice(1),
+        options: {
+          base: { type: "string", short: "b", default: config.baseBranch || "main" },
+          mode: { type: "string", short: "m", default: "working-tree" },
+          "working-tree": { type: "boolean" },
+          staged: { type: "boolean" },
+          committed: { type: "boolean" },
+          "min-score": { type: "string", default: "80" },
+          "max-mutants": { type: "string", default: "20" },
+          cmd: { type: "string" },
+          json: { type: "boolean", short: "j" },
+        },
+        allowPositionals: true,
+      });
+
+      let selectedMode = values.mode || "working-tree";
+      if (values.staged) selectedMode = "staged";
+      if (values.committed) selectedMode = "committed";
+      if (values["working-tree"]) selectedMode = "working-tree";
+
+      const minScore = Number(values["min-score"]) || 80;
+      const maxMutants = Number(values["max-mutants"]) || 20;
+      const testCmd = values.cmd || config.verify?.test || "npm test";
+
+      if (!values.json) {
+        console.log(`\n🧬 Jules Diff Mutation Testing Harness (Base: ${values.base}, Mode: ${selectedMode})`);
+        console.log(`------------------------------------------------------------------`);
+        console.log(`Evaluating candidate mutants against test command: "${testCmd}"...\n`);
+      }
+
+      const report = runMutationTest({
+        root,
+        base: values.base,
+        mode: selectedMode,
+        minScore,
+        maxMutants,
+        testCmd,
+      });
+
+      if (values.json) {
+        console.log(JSON.stringify(report, null, 2));
+      } else {
+        console.log(`Mutation Test Results:`);
+        console.log(`  • Total Mutants Evaluated : ${report.totalMutants}`);
+        console.log(`  • Mutants Killed (Fail)   : ${report.killedMutants} ✅`);
+        console.log(`  • Mutants Survived (Pass) : ${report.survivedMutants} ${report.survivedMutants > 0 ? "⚠️" : ""}`);
+        console.log(`  • Errors / Timeouts       : ${report.errorMutants}`);
+        console.log(`  • Mutation Score          : ${report.mutationScore}% (Required: ${report.minScore}%)`);
+        console.log(`  • Duration                : ${report.durationMs}ms\n`);
+
+        if (report.survivors.length > 0) {
+          console.log(`⚠️ Survived Mutants (Tests passed despite corrupted implementation):`);
+          for (const s of report.survivors) {
+            console.log(`  - [${s.mutant.mutationType}] ${s.mutant.file}:${s.mutant.line}`);
+            console.log(`    Original: ${s.mutant.originalLine.trim()}`);
+            console.log(`    Mutated : ${s.mutant.mutatedLine.trim()}`);
+            console.log(`    Reason  : ${s.mutant.description}\n`);
+          }
+        }
+
+        console.log(`------------------------------------------------------------------`);
+        console.log(`Overall Result: ${report.ok ? "APPROVED (Exit 0)" : "REJECTED (Mutation score below threshold — Exit 1)"}\n`);
+      }
+
+      process.exit(report.ok ? 0 : 1);
+      break;
+    }
+
+    case "coverage": {
+      const { runV8Coverage, calculateDiffCoverage, diffText, resolveRoot } = await import("../index.mjs");
+      const { values } = parseArgs({
+        args: args.slice(1),
+        options: {
+          min: { type: "string", short: "m" },
+          "min-coverage": { type: "string" },
+          cmd: { type: "string", short: "c" },
+          base: { type: "string", short: "b" },
+          mode: { type: "string" },
+          json: { type: "boolean", short: "j" },
+        },
+        allowPositionals: true,
+      });
+
+      const root = resolveRoot();
+      const minCoverage = values.min ? parseFloat(values.min) : (values["min-coverage"] ? parseFloat(values["min-coverage"]) : 100);
+      const diffStr = diffText(root, values.base || "main", values.mode || "working-tree");
+
+      const covRes = runV8Coverage(values.cmd, { root });
+      const report = calculateDiffCoverage(covRes.coverageByFile, diffStr, { root, minCoverage });
+
+      if (values.json) {
+        console.log(JSON.stringify({ ...report, testPass: covRes.ok }, null, 2));
+      } else {
+        console.log(`\n📊 V8 Native Diff Coverage Report (Base: ${values.base || "main"})`);
+        console.log(`------------------------------------------------------------------`);
+        console.log(`  Target Min Coverage : ${report.minCoverage}%`);
+        console.log(`  Achieved Coverage   : ${report.score}%`);
+        console.log(`  Covered Added Lines : ${report.coveredLines} / ${report.totalLines}`);
+        console.log(`  Missed Lines Count  : ${report.missedLines}`);
+
+        if (report.missedLines > 0) {
+          console.log(`\n❌ Uncovered Added Lines by File:`);
+          for (const [file, lines] of Object.entries(report.missedByFile)) {
+            console.log(`  - ${file}: lines ${lines.join(", ")}`);
+          }
+        }
+
+        console.log(`------------------------------------------------------------------`);
+        console.log(`Overall Result: ${report.ok && covRes.ok ? "APPROVED (Exit 0)" : "REJECTED (Coverage below threshold — Exit 1)"}\n`);
+      }
+
+      process.exit(report.ok && covRes.ok ? 0 : 1);
+      break;
+    }
+
+    case "probe":
+    case "stability": {
+      const { runStabilityProbe, resolveRoot } = await import("../index.mjs");
+      const { values } = parseArgs({
+        args: args.slice(1),
+        options: {
+          repeat: { type: "string", short: "r" },
+          iterations: { type: "string", short: "n" },
+          min: { type: "string", short: "m" },
+          "min-pass-rate": { type: "string" },
+          cmd: { type: "string", short: "c" },
+          json: { type: "boolean", short: "j" },
+        },
+        allowPositionals: true,
+      });
+
+      const root = resolveRoot();
+      const repeat = values.repeat ? parseInt(values.repeat, 10) : (values.iterations ? parseInt(values.iterations, 10) : 5);
+      const minPassRate = values.min ? parseFloat(values.min) : (values["min-pass-rate"] ? parseFloat(values["min-pass-rate"]) : 1.0);
+
+      const report = runStabilityProbe(values.cmd, { root, repeat, minPassRate });
+
+      if (values.json) {
+        console.log(JSON.stringify(report, null, 2));
+      } else {
+        console.log(`\n🎲 Test Flakiness Stability Probe (${report.repeat} iterations)`);
+        console.log(`------------------------------------------------------------------`);
+        console.log(`  Required Pass Rate  : ${Math.round(minPassRate * 100)}%`);
+        console.log(`  Observed Pass Rate  : ${Math.round(report.passRate * 100)}% (${report.passes}/${report.repeat} passed)`);
+        console.log(`  Test Oscillation    : ${report.oscillation}`);
+        console.log(`  Total Duration      : ${report.durationMs}ms`);
+
+        if (report.failures > 0) {
+          console.log(`\n❌ Failed Iterations:`);
+          for (const r of report.runs.filter((run) => !run.pass)) {
+            console.log(`  - Iteration #${r.iteration}: Exit Code ${r.exitCode} (${r.durationMs}ms)`);
+          }
+        }
+
+        console.log(`------------------------------------------------------------------`);
+        console.log(`Overall Result: ${report.ok ? "APPROVED (Deterministic 100% Pass — Exit 0)" : "REJECTED (Flaky / Intermittent Failures — Exit 1)"}\n`);
+      }
+
+      process.exit(report.ok ? 0 : 1);
+      break;
+    }
+
+    case "perf":
+    case "event-loop": {
+      const { measureEventLoopDelay, resolveRoot } = await import("../index.mjs");
+      const { values } = parseArgs({
+        args: args.slice(1),
+        options: {
+          "max-ms": { type: "string", short: "m" },
+          threshold: { type: "string", short: "t" },
+          cmd: { type: "string", short: "c" },
+          resolution: { type: "string", short: "r" },
+          json: { type: "boolean", short: "j" },
+        },
+        allowPositionals: true,
+      });
+
+      const root = resolveRoot();
+      const maxDelayMs = values["max-ms"] ? parseFloat(values["max-ms"]) : (values.threshold ? parseFloat(values.threshold) : 50);
+      const resolution = values.resolution ? parseInt(values.resolution, 10) : 10;
+
+      const report = measureEventLoopDelay(values.cmd, { root, maxDelayMs, resolution });
+
+      if (values.json) {
+        console.log(JSON.stringify(report, null, 2));
+      } else {
+        console.log(`\n⏱️ Node.js Event Loop Lag & Big-O Monitor`);
+        console.log(`------------------------------------------------------------------`);
+        console.log(`  Threshold Max / p99 : ${report.thresholdMs}ms`);
+        console.log(`  Observed p99 Delay  : ${report.p99Ms}ms`);
+        console.log(`  Observed Max Delay  : ${report.maxMs}ms`);
+        console.log(`  Observed Mean Delay : ${report.meanMs}ms`);
+        console.log(`  Total Test Duration : ${report.durationMs}ms`);
+        console.log(`  Exit Code           : ${report.exitCode}`);
+        console.log(`------------------------------------------------------------------`);
+        console.log(`Overall Result: ${report.ok ? "APPROVED (Event Loop Healthy — Exit 0)" : "REJECTED (High Event Loop Lag / O(n^2) Starvation — Exit 1)"}\n`);
+      }
+
+      process.exit(report.ok ? 0 : 1);
+      break;
+    }
+
+    case "fix": {
+      const { repair, planTaskCreate, resolveRoot, redactSecrets } = await import("../index.mjs");
+      const { values, positionals } = parseArgs({
+        args: args.slice(1),
+        options: {
+          input: { type: "string", short: "i" },
+          file: { type: "string", short: "f" },
+          cmd: { type: "string", short: "c" },
+          task: { type: "boolean", short: "t" },
+          author: { type: "string" },
+          json: { type: "boolean", short: "j" },
+          "dry-run": { type: "boolean" },
+        },
+        allowPositionals: true,
+      });
+
+      const root = resolveRoot();
+      let errorInput = "";
+
+      if (values.file && existsSync(values.file)) {
+        errorInput = readFileSync(values.file, "utf-8");
+      } else if (values.input) {
+        errorInput = values.input;
+      } else if (positionals.slice(1).length > 0) {
+        errorInput = positionals.slice(1).join(" ");
+      } else if (!process.stdin.isTTY) {
+        errorInput = readFileSync(0, "utf-8");
+      }
+
+      if (!errorInput.trim()) {
+        console.error("❌ Error: No error log or failure input provided. Pipe stdout/stderr via `npm test 2>&1 | agentctl fix` or provide --file/--input.");
+        process.exit(1);
+      }
+
+      const cleanTrace = redactSecrets(errorInput);
+
+      if (values.task) {
+        // Synthesize task envelope for queue
+        const taskEnvelope = planTaskCreate(root, {
+          prompt: `Fix the following test/build failure:\n\n${cleanTrace.slice(0, 4000)}`,
+          title: "Automated Failure Repair",
+          verifyCmd: values.cmd || "npm test",
+        });
+
+        if (values.json) {
+          console.log(JSON.stringify(taskEnvelope, null, 2));
+        } else {
+          console.log(`\n📋 Synthesized OODA Repair Task Envelope:`);
+          console.log(`  ID     : ${taskEnvelope.taskId}`);
+          console.log(`  Verify : ${taskEnvelope.verifyCmd}`);
+          console.log(`  Prompt : ${taskEnvelope.prompt.slice(0, 100)}...`);
+        }
+        process.exit(0);
+      } else {
+        console.log(`\n🔧 Dispatching OODA Repair Loop for captured failure trace...`);
+        const repairRes = await repair(
+          { stderr: cleanTrace, command: values.cmd || "verify" },
+          { root, dryRun: values["dry-run"], author: values.author }
+        );
+
+        if (values.json) {
+          console.log(JSON.stringify(repairRes, null, 2));
+        } else {
+          console.log(`------------------------------------------------------------------`);
+          console.log(`Repair Status: ${repairRes.ok ? "RESOLVED (Exit 0)" : `FAILED (${repairRes.finalStatus} — Exit 1)`}`);
+        }
+
+        process.exit(repairRes.ok ? 0 : 1);
+      }
+      break;
+    }
+
     case "assert": {
       const { runAssertion, parseYaml } = await import("../index.mjs");
       const { values } = parseArgs({
@@ -1893,7 +2176,7 @@ async function main() {
 
     case "rules": {
       const subcmd = args[1] || "check";
-      const { checkRulesBudget, compileRules } = await import("../src/rules_budget.mjs");
+      const { checkRulesBudget, compileRules } = await import("../src/rules-budget.mjs");
 
       if (subcmd === "check") {
         const { values } = parseArgs({

package/index.mjs

@@ -16,6 +16,7 @@ export {
   hasEncodedSecret,
   checkEdgeRuntimeImports,
   checkCrossPackageImports,
+  checkTestTampering,
 } from "./src/security.mjs";
 export { sanitizeUntrustedData, buildAgentEnvelope } from "./src/prompt-guard.mjs";
 export { isolateMcpStdout, writeMcpFrame } from "./src/mcp.mjs";
@@ -76,7 +77,26 @@ export {
 } from "./src/execution-envelope.mjs";
 export { checkAssetIntegrity } from "./src/asset-integrity.mjs";
 export { classifyRiskTier, RISK_TIERS } from "./src/risk.mjs";
-export { recordRemediation, queryRemediations } from "./src/remediation.mjs";
+export { recordRemediation, queryRemediations, createThrashDetector, createWhackAMoleDetector } from "./src/remediation.mjs";
+export {
+  runMutationTest,
+  generateMutants,
+  generateDiffMutants,
+  executeMutant,
+  getStringLiteralRanges,
+  getFileStringLiteralLineMap,
+  MUTATION_RULES,
+  isExcludedFromMutation,
+} from "./src/mutation.mjs";
+export {
+  runV8Coverage,
+  mapV8RangesToLines,
+  calculateDiffCoverage,
+  extractAddedLinesFromDiff,
+  isExcludedFromCoverage,
+} from "./src/coverage.mjs";
+export { runStabilityProbe } from "./src/stability.mjs";
+export { measureEventLoopDelay } from "./src/perf.mjs";
 export { DagExecutor, DagCycleError } from "./src/dag-engine.mjs";
 export { journalIntent, journalDone, reapOrphanedIntents, reapStaleMutexDirs } from "./src/journal.mjs";
 
@@ -159,6 +179,11 @@ export {
   assertFileSize,
   assertFilePatterns,
   assertFileExists,
+  assertMutation,
+  assertTestIntegrity,
+  assertDiffCoverage,
+  assertTestStability,
+  assertEventLoopLag,
   runAssertion,
   formatBytes,
   resolveBytesLimit,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.42.0",
+  "version": "0.51.0",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for Google Jules (jules) autonomous agents.",
   "repository": {
     "type": "git",

package/scripts/asset-integrity-check.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { checkAssetIntegrity } from "../src/asset_integrity.mjs";
+import { checkAssetIntegrity } from "../src/asset-integrity.mjs";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 

package/scripts/rules-lint.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { checkRulesBudget } from "../src/rules_budget.mjs";
+import { checkRulesBudget } from "../src/rules-budget.mjs";
 
 const root = process.cwd();
 const res = checkRulesBudget(root);