karajan-code 2.8.0 → 2.10.0

package/src/orchestrator/drivers/error-recovery.js

@@ -119,7 +119,7 @@ export async function handleStandbyResult({ stageResult, session, emitter, event
 }
 
 
-export function emitSolomonAlerts(alerts, emitter, eventBase, logger) {
+function emitSolomonAlerts(alerts, emitter, eventBase, logger) {
   for (const alert of alerts) {
     emitProgress(emitter, makeEvent("brain:rules-alert", { ...eventBase, stage: "brain" }, {
       status: alert.severity === "critical" ? "fail" : "warn",
@@ -198,7 +198,7 @@ export async function handleSolomonCheck({ config, session, emitter, eventBase,
   return { action: "continue" };
 }
 
-export async function checkSolomonCriticalAlerts({ rulesResult, askQuestion, session, i }) {
+async function checkSolomonCriticalAlerts({ rulesResult, askQuestion, session, i }) {
   if (!rulesResult.hasCritical || !askQuestion) return null;
 
   const alertSummary = rulesResult.alerts

package/src/orchestrator/drivers/iteration-loop.js

@@ -44,23 +44,13 @@ import { runQualityGateStages } from "./iteration-phases/quality-gates.js";
 import { runReviewerGateStage } from "./iteration-phases/reviewer-gate.js";
 import { handleApprovedReview } from "./iteration-phases/handle-approved.js";
 
-// Re-export for back-compat with any external caller; the canonical
-// definitions now live in ./iteration-phases/.
-export { runCoderAndRefactorerStages } from "./iteration-phases/coder-and-refactorer.js";
-export { runGuardStages } from "./iteration-phases/guards.js";
-export { runQualityGateStages } from "./iteration-phases/quality-gates.js";
-export { runReviewerGateStage } from "./iteration-phases/reviewer-gate.js";
-export { handleApprovedReview } from "./iteration-phases/handle-approved.js";
-
 // `runCoderAndRefactorerStages`, `runGuardStages`, `runQualityGateStages`,
 // `runReviewerGateStage` and `handleApprovedReview` were extracted to
 // ./iteration-phases/ in the v2.7.x audit follow-up (same pattern as
-// pre-loop-phases/). The imports above pull them back in; re-exports
-// keep the previous public surface for any external caller. Behaviour
-// is unchanged.
-
+// pre-loop-phases/). The back-compat re-exports were removed in
+// KJC-TSK-0354 PR-D — no caller imported them via this module.
 
-export async function runSingleIteration(ctx) {
+async function runSingleIteration(ctx) {
   // Use plannedTask (HU-scoped or planner-enriched) over the raw original task.
   // When running per-HU sub-pipelines, plannedTask is the HU's text, not the full spec.
   const { config, logger, emitter, eventBase, session, iteration: i } = ctx;

package/src/orchestrator/drivers/iteration-phases/quality-gates.js

@@ -18,6 +18,7 @@ import {
   runTddCheckStage, runSonarStage, runSonarCloudStage,
 } from "../../iteration-stages.js";
 import { runImpeccableStage } from "../../post-loop-stages.js";
+import { runPerfStage } from "../../stages/perf-stage.js";
 import { tryCiComment } from "../../ci-integration.js";
 
 export async function runQualityGateStages({ config, logger, emitter, eventBase, session, trackBudget, i, askQuestion, repeatDetector, budgetSummary, sonarState, task, stageResults, coderRole, pipelineFlags, brainCtx }) {
@@ -72,5 +73,16 @@ export async function runQualityGateStages({ config, logger, emitter, eventBase,
     }
   }
 
+  if (pipelineFlags?.perfEnabled) {
+    const perfResult = await runPerfStage({
+      config, logger, emitter, eventBase, session, trackBudget,
+      iteration: i, task, brainCtx
+    });
+    if (perfResult.stageResult) {
+      stageResults.perf = perfResult.stageResult;
+    }
+    if (perfResult.action === "continue") return { action: "continue" };
+  }
+
   return { action: "ok" };
 }

package/src/orchestrator/drivers/pre-loop.js

@@ -52,9 +52,6 @@ import { emitConfigDeprecations } from "./pre-loop-phases/config-deprecations.js
 import { ensureAddyosmaniSkills } from "./pre-loop-phases/ensure-addyosmani-skills.js";
 import { maybeGenerateAutoHuBatch } from "./pre-loop-phases/auto-hu-batch.js";
 
-// Re-export for back-compat with any external caller; the canonical
-// definitions now live in ./pre-loop-phases/.
-export { ensureAddyosmaniSkills };
 import {
   applyTriageOverrides, applyAutoSimplify, applyFlagOverrides,
   resolvePipelinePolicies, updateGitignoreForStack,
@@ -380,7 +377,7 @@ export async function runPreLoopStages({ config, logger, emitter, eventBase, ses
 
   return { plannedTask, updatedConfig };
 }
-export async function runPlanningPhases({ config, logger, emitter, eventBase, session, stageResults, pipelineFlags, coderRole, trackBudget, task, askQuestion, brainCtx }) {
+async function runPlanningPhases({ config, logger, emitter, eventBase, session, stageResults, pipelineFlags, coderRole, trackBudget, task, askQuestion, brainCtx }) {
   let researchContext = null;
   let plannedTask = task;
 

package/src/orchestrator/feedback-queue.js

@@ -149,4 +149,3 @@ export function deserialize(str) {
   }
 }
 
-export { SEVERITY_ORDER, CATEGORY_ORDER };

package/src/orchestrator/integrations.js

@@ -72,13 +72,6 @@ export function unregisterIntegration(name) {
   registry.delete(name);
 }
 
-/**
- * Clear the registry. Test-only; production never calls this.
- */
-export function __clearIntegrations() {
-  registry.clear();
-}
-
 /**
  * List registered integration names. Useful for bootstrap logging.
  * @returns {string[]}

package/src/orchestrator/role-output-compressor.js

@@ -187,4 +187,3 @@ export function measureCompression(original, compressed) {
   };
 }
 
-export { COMPRESSORS };

package/src/orchestrator/session-journal.js

@@ -2,7 +2,6 @@
 // Creates .reviews/session_*/ directories containing markdown files per stage.
 import fs from "node:fs/promises";
 import path from "node:path";
-import { runCommand } from "../utils/process.js";
 
 /**
  * Create the journal directory for a session.
@@ -174,29 +173,6 @@ export function formatDecision({ timestamp, trigger, context, action, reasoning
   return lines.join("\n");
 }
 
-// ── Tree of affected files ───────────────────────────────────────────────────
-
-export async function generateFileTree(baseRef) {
-  try {
-    const result = await runCommand("git", ["diff", "--name-status", `${baseRef}...HEAD`]);
-    if (result.exitCode !== 0 || !result.stdout?.trim()) return null;
-
-    const lines = ["# Affected Files\n"];
-    const statusMap = { M: "modified", A: "added", D: "deleted", R: "renamed" };
-
-    for (const line of result.stdout.trim().split("\n")) {
-      const [status, ...fileParts] = line.split("\t");
-      const file = fileParts.join("\t");
-      const label = statusMap[status?.[0]] || status;
-      lines.push(`- [${label}] ${file}`);
-    }
-
-    return lines.join("\n");
-  } catch {
-    return null;
-  }
-}
-
 // ── Summary ──────────────────────────────────────────────────────────────────
 
 export function generateSummary({ task, result, sessionId, iterations, durationMs, budget, stages, commits, files }) {
@@ -263,6 +239,7 @@ export function buildPlanSummary({ pipelineFlags, config, stageResults, task })
   if (pipelineFlags.testerEnabled) activeStages.push("Tester");
   if (pipelineFlags.securityEnabled) activeStages.push("Security");
   if (pipelineFlags.impeccableEnabled) activeStages.push("Impeccable");
+  if (pipelineFlags.perfEnabled) activeStages.push("Perf");
   lines.push(`│ Stages: ${activeStages.join(" → ")}`);
 
   // Config
@@ -325,20 +302,7 @@ export async function writeDecisionsJournal(journalDir, decisionEntries) {
   await writeJournalFile(journalDir, "decisions.md", content);
 }
 
-/**
- * Write the file tree.
- */
-export async function writeTreeJournal(journalDir, baseRef) {
-  const tree = await generateFileTree(baseRef);
-  if (tree) await writeJournalFile(journalDir, "tree.txt", tree);
-  return Boolean(tree);
-}
-
-/**
- * Write the session summary.
- */
-export async function writeSummaryJournal(journalDir, summaryData) {
-  const files = summaryData.files || [];
-  const content = generateSummary({ ...summaryData, files: [...files, "summary.md"] });
-  await writeJournalFile(journalDir, "summary.md", content);
-}
+// writeTreeJournal / writeSummaryJournal / generateFileTree were
+// superseded in v2.7.x by src/session/journal/{tree-writer,summary-writer}.js
+// (the V2 split). post-loop.js dynamically imports the V2 versions; this
+// orchestrator-side copy is no longer wired anywhere. KJC-TSK-0354 PR-D.

package/src/orchestrator/stages/perf-stage.js

@@ -0,0 +1,140 @@
+/**
+ * PerfStage — webperf quality gate inside the iteration loop.
+ *
+ * KJC-TSK-0151. Wraps PerfRole and slots into the existing
+ * runQualityGateStages flow alongside Sonar and Impeccable. Designed
+ * to be the simplest possible quality gate:
+ *
+ *   - PASS verdict (cwv.pass === true) → return ok, iteration continues.
+ *   - FAIL verdict → set reviewer feedback with the blocking metrics
+ *     so the coder receives concrete guidance next iteration. Returns
+ *     `continue` to retry the iteration loop. No repeat-detector +
+ *     retry-limit machinery: rerunning Lighthouse on the same URL
+ *     gives the same result unless the coder changes something, and
+ *     the iteration limit (max_iterations) is the natural ceiling.
+ *   - Scanner unavailable (lighthouse missing, URL unreachable, timeout)
+ *     → log a warn and return ok-skipped. Best-effort, never blocks
+ *     the pipeline by itself.
+ *
+ * The role surface (PerfRole) is responsible for persisting the result
+ * to ~/.karajan/webperf/<slug>/last.json so subsequent `kj audit` runs
+ * pick it up via the auto-discovery added in #602.
+ */
+
+import { PerfRole } from "../../roles/perf-role.js";
+import { setReviewerFeedback } from "../../session/mutators.js";
+import { saveSession } from "../../session/store.js";
+import { emitProgress, makeEvent } from "../../utils/events.js";
+
+/**
+ * Build the human-readable feedback line that goes back to the coder
+ * on FAIL. Concrete enough that the LLM can act on it without re-reading
+ * the whole report.
+ */
+function buildFeedback(roleResult) {
+  const { result } = roleResult;
+  const score = typeof result.performanceScore === "number" ? result.performanceScore : null;
+  const blocking = (result.cwv?.blocking || []).map(b => `${b.metric.toUpperCase()}=${Math.round(b.value)} (poor>${b.threshold})`);
+  const top = (result.issues || []).slice(0, 3).map(i => `${i.id}${i.savingsMs ? ` (~${Math.round(i.savingsMs)}ms)` : ""}`);
+
+  const lines = [`Webperf gate FAILED${score !== null ? ` (score ${score}/100)` : ""}.`];
+  if (blocking.length > 0) lines.push(`Blocking metrics: ${blocking.join(", ")}.`);
+  if (top.length > 0) lines.push(`Top opportunities: ${top.join(", ")}.`);
+  lines.push("Address the blocking metric(s) before the next iteration; rerunning without code changes will produce the same verdict.");
+  return lines.join(" ");
+}
+
+/**
+ * Run the perf gate against config.webperf.url.
+ *
+ * @returns {Promise<{action: "ok"|"continue", stageResult?: object, summary?: string}>}
+ */
+export async function runPerfStage({ config, logger, emitter, eventBase, session, trackBudget, iteration, task: _task, brainCtx }) {
+  if (!session) {
+    throw new Error("runPerfStage: `session` is required.");
+  }
+  logger.setContext({ iteration, stage: "perf" });
+  emitProgress(
+    emitter,
+    makeEvent("perf:start", { ...eventBase, stage: "perf" }, {
+      message: "WebPerf gate scanning",
+      detail: { url: config?.webperf?.url || null, preset: config?.webperf?.preset || "desktop" },
+    })
+  );
+
+  const role = new PerfRole({ config, logger, emitter });
+  const roleResult = await role.execute();
+
+  // Track budget — the role doesn't spawn an LLM but it does consume wall
+  // time; surface that in the budget summary alongside the agent calls.
+  if (trackBudget) {
+    try { trackBudget("perf", { tokens_in: 0, tokens_out: 0, cost_usd: 0 }); } catch { /* best-effort */ }
+  }
+
+  // Scanner unavailable → skip with warn. PerfRole returns ok=false for
+  // both "verdict FAIL" and "scanner failed", so we differentiate on the
+  // result.error field (set only by the second case).
+  if (!roleResult.ok && roleResult.result?.error) {
+    logger.warn(`Perf gate skipped: ${roleResult.result.error}`);
+    emitProgress(emitter, makeEvent("perf:end", { ...eventBase, stage: "perf" }, {
+      status: "warn",
+      message: `Perf gate skipped — ${roleResult.result.error}`,
+    }));
+    return { action: "ok", stageResult: { skipped: true, reason: roleResult.result.error } };
+  }
+
+  // PASS verdict
+  if (roleResult.ok === true) {
+    emitProgress(emitter, makeEvent("perf:end", { ...eventBase, stage: "perf" }, {
+      status: "ok",
+      message: roleResult.summary,
+    }));
+    return {
+      action: "ok",
+      stageResult: {
+        verdict: "PASS",
+        url: roleResult.result?.url,
+        performanceScore: roleResult.result?.performanceScore,
+        cwv: roleResult.result?.cwv,
+        savedPath: roleResult.result?.savedPath,
+        summary: roleResult.summary,
+      },
+    };
+  }
+
+  // FAIL verdict → push concrete feedback to the coder for next iteration.
+  const feedback = buildFeedback(roleResult);
+  setReviewerFeedback(session, feedback);
+  await saveSession(session);
+
+  // Brain: when enabled, surface perf feedback on the queue too.
+  if (brainCtx?.enabled) {
+    try {
+      const { processRoleOutput } = await import("../brain-coordinator.js");
+      processRoleOutput(brainCtx, {
+        roleName: "perf",
+        output: { verdict: "fail", summary: feedback },
+        iteration,
+      });
+    } catch (err) {
+      logger.warn(`Perf gate: brain queue push failed (non-blocking): ${err.message}`);
+    }
+  }
+
+  emitProgress(emitter, makeEvent("perf:end", { ...eventBase, stage: "perf" }, {
+    status: "fail",
+    message: roleResult.summary,
+  }));
+
+  return {
+    action: "continue",
+    stageResult: {
+      verdict: "FAIL",
+      url: roleResult.result?.url,
+      performanceScore: roleResult.result?.performanceScore,
+      cwv: roleResult.result?.cwv,
+      issues: roleResult.result?.issues,
+      summary: feedback,
+    },
+  };
+}

package/src/orchestrator/stages/stage-classes.js

@@ -82,5 +82,3 @@ export const stageRegistry = new StageRegistry();
 stageRegistry.register(new TriageStage());
 stageRegistry.register(new CoderStage());
 stageRegistry.register(new ReviewerStage());
-
-export { StageExecutor, StageRegistry };

package/src/plan/plan-store.js

@@ -114,20 +114,6 @@ export async function loadPlan(projectDir, planId) {
   }
 }
 
-/**
- * Update a plan on disk (partial merge).
- * @returns {Promise<boolean>}
- */
-export async function updatePlan(projectDir, planId, patch) {
-  const plan = await loadPlan(projectDir, planId);
-  if (!plan) return false;
-  Object.assign(plan, patch);
-  plan.updatedAt = new Date().toISOString();
-  const filePath = path.join(plansDir(projectDir), `${planId}.json`);
-  await fs.writeFile(filePath, JSON.stringify(plan, null, 2), "utf8");
-  return true;
-}
-
 /**
  * Delete a plan from disk.
  * @returns {Promise<boolean>}

package/src/planning-game/client.js

@@ -93,20 +93,6 @@ export async function createCard({ projectId, card, timeoutMs = DEFAULT_TIMEOUT_
   return parseJsonResponse(response);
 }
 
-export async function createAdr({ projectId, adr, timeoutMs = DEFAULT_TIMEOUT_MS }) {
-  const url = `${getApiUrl()}/projects/${encodeURIComponent(projectId)}/adrs`;
-  const response = await fetchWithRetry(
-    url,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(adr)
-    },
-    timeoutMs
-  );
-  return parseJsonResponse(response);
-}
-
 export async function relateCards({ projectId, sourceCardId, targetCardId, relationType, timeoutMs = DEFAULT_TIMEOUT_MS }) {
   const url = `${getApiUrl()}/projects/${encodeURIComponent(projectId)}/cards/relate`;
   const response = await fetchWithRetry(

package/src/planning-game/pipeline-adapter.js

@@ -42,7 +42,7 @@ export async function initPgAdapter({ session: _session, config, logger, pgTaskI
  * Handle PG task decomposition after triage.
  * Creates subtask cards in PG when triage recommends decomposition.
  */
-export async function handlePgDecomposition({ triageResult, pgTaskId, pgProject, config, askQuestion, emitter, eventBase, session, stageResults, logger }) {
+async function handlePgDecomposition({ triageResult, pgTaskId, pgProject, config, askQuestion, emitter, eventBase, session, stageResults, logger }) {
   const shouldDecompose = triageResult.stageResult?.shouldDecompose
     && triageResult.stageResult.subtasks?.length > 1
     && pgTaskId

package/src/prompts/audit.js

@@ -1,4 +1,12 @@
 import { extractFirstJson } from "../utils/json-extract.js";
+import { groupIssuesBySeverity } from "../audit/sonar-findings.js";
+import { groupVulnerabilitiesBySeverity } from "../audit/osv-findings.js";
+import { groupFindingsBySeverity as groupSemgrepBySeverity } from "../audit/semgrep-findings.js";
+import { formatCwvVerdict } from "../audit/webperf-input.js";
+
+const MAX_SONAR_ISSUES_IN_PROMPT = 50;
+const MAX_OSV_VULNS_IN_PROMPT = 50;
+const MAX_SEMGREP_FINDINGS_IN_PROMPT = 50;
 
 const SUBAGENT_PREAMBLE = [
   "IMPORTANT: You are running as a Karajan sub-agent.",
@@ -7,14 +15,20 @@ const SUBAGENT_PREAMBLE = [
   "DO NOT modify any files — this is a read-only analysis. Only use: Read, Grep, Glob, Bash (for analysis commands like wc, find, git log, du, npm ls)."
 ].join(" ");
 
-export const AUDIT_DIMENSIONS = ["security", "codeQuality", "performance", "architecture", "testing"];
+export const AUDIT_DIMENSIONS = ["security", "codeQuality", "performance", "architecture", "testing", "accessibility"];
+
+// Dimensions that only apply to frontend / fullstack projects. Auto-dropped
+// from the default dimension list when stack detection knows the project
+// is backend-only — preserves activation when the user explicitly opts in
+// via --dimensions=accessibility (KJC-TSK-0359).
+const FRONTEND_ONLY_DIMENSIONS = new Set(["accessibility"]);
 
 const VALID_HEALTH = new Set(["good", "fair", "poor", "critical"]);
 const VALID_SCORES = new Set(["A", "B", "C", "D", "F"]);
 const VALID_SEVERITIES = new Set(["critical", "high", "medium", "low"]);
 const VALID_IMPACT = new Set(["high", "medium", "low"]);
 
-export function buildAuditPrompt({ task, instructions, dimensions = null, context = null, basalCost = null, growthDelta = null }) {
+export function buildAuditPrompt({ task, instructions, dimensions = null, context = null, basalCost = null, growthDelta = null, stack = null, sonarFindings = null, webperf = null, osvFindings = null, semgrepFindings = null }) {
   const sections = [SUBAGENT_PREAMBLE];
 
   if (instructions) {
@@ -27,9 +41,46 @@ export function buildAuditPrompt({ task, instructions, dimensions = null, contex
     "DO NOT modify any files. This is a READ-ONLY analysis."
   );
 
-  const activeDimensions = dimensions
-    ? dimensions.filter(d => AUDIT_DIMENSIONS.includes(d))
-    : AUDIT_DIMENSIONS;
+  // Stack hint — when detected, tells the LLM what kind of project this is
+  // so it can filter out irrelevant heuristics (e.g. don't flag bundle size
+  // in an Express-only API; don't flag N+1 queries in a static Astro site).
+  // Detected by src/utils/stack-detect.js — KJC-TSK-0358.
+  if (stack && (stack.frameworks?.length > 0 || stack.language || stack.isFrontend || stack.isBackend)) {
+    const stackLines = ["## Project Stack"];
+    if (stack.language) stackLines.push(`- Language: ${stack.language}`);
+    if (stack.frameworks?.length) stackLines.push(`- Frameworks: ${stack.frameworks.join(", ")}`);
+    const tier = stack.isFullstack
+      ? "fullstack (frontend + backend)"
+      : stack.isFrontend
+        ? "frontend-only"
+        : stack.isBackend
+          ? "backend-only"
+          : "unknown";
+    stackLines.push(`- Tier: ${tier}`);
+    if (stack.isFullstack) {
+      stackLines.push("Apply BOTH backend heuristics (queries, sync I/O, caching) AND frontend heuristics (bundle size, lazy loading, render-blocking) where each layer applies.");
+    } else if (stack.isFrontend) {
+      stackLines.push("This project is frontend-only. SKIP findings about N+1 queries, sync file I/O in request handlers, missing pagination on list endpoints, and other backend-specific patterns. Focus on bundle size, lazy loading, render-blocking resources, image optimisation, and accessibility hints.");
+    } else if (stack.isBackend) {
+      stackLines.push("This project is backend-only. SKIP findings about bundle size, lazy loading, render-blocking resources, image optimisation, and frontend accessibility. Focus on queries, sync I/O, pagination, caching, auth/authz, and dependency hygiene.");
+    }
+    sections.push(stackLines.join("\n"));
+  }
+
+  // When dimensions are explicit, honour them verbatim — even frontend-only
+  // dimensions on a backend project (the user knows what they want).
+  // When dimensions are absent, default to all but drop frontend-only
+  // dimensions if the stack is provably backend-only. Unknown stack falls
+  // back to the full list (no false negatives — better an extra section
+  // than a missing one).
+  let activeDimensions;
+  if (dimensions) {
+    activeDimensions = dimensions.filter(d => AUDIT_DIMENSIONS.includes(d));
+  } else if (stack && stack.isBackend && !stack.isFrontend) {
+    activeDimensions = AUDIT_DIMENSIONS.filter(d => !FRONTEND_ONLY_DIMENSIONS.has(d));
+  } else {
+    activeDimensions = AUDIT_DIMENSIONS;
+  }
 
   if (activeDimensions.includes("security")) {
     sections.push(
@@ -105,9 +156,32 @@ export function buildAuditPrompt({ task, instructions, dimensions = null, contex
     );
   }
 
+  if (activeDimensions.includes("accessibility")) {
+    sections.push(
+      "## Accessibility Analysis (WCAG 2.x)",
+      [
+        "- Missing alt text on <img> tags (decorative images need empty alt=\"\", not absent)",
+        "- Form inputs without associated <label> or aria-label",
+        "- Heading hierarchy violations (h1 → h3 skipping h2; multiple h1 per page)",
+        "- Buttons / links containing only icons without aria-label or visually-hidden text",
+        "- Interactive elements built from <div>/<span> without role + keyboard handlers",
+        "- ARIA roles misused (presentation on focusable elements, redundant on native semantics)",
+        "- Focus management gaps (modals without focus trap, no visible :focus styles, tabindex misuse)",
+        "- Colour-only signalling (status indicated by red/green only, no icon or text)",
+        "- Static contrast — flag suspicious low-contrast colour pairs in CSS variables / token files",
+        "- Missing lang attribute on <html>, missing skip-to-content link, missing landmarks"
+      ].join("\n"),
+      "Skip findings about colour contrast that require runtime rendering (e.g. computed styles); flag the suspect CSS values and recommend an axe-core/Lighthouse runtime check."
+    );
+  }
+
+  // JSON schema — keep the per-dimension entries in sync with AUDIT_DIMENSIONS.
+  const schemaDimensions = AUDIT_DIMENSIONS
+    .map(d => `"${d}":{"score":"A|B|C|D|F","findings":[]}`)
+    .join(",");
   sections.push(
     "Return a single valid JSON object and nothing else.",
-    'JSON schema: {"ok":true,"result":{"summary":{"overallHealth":"good|fair|poor|critical","totalFindings":number,"critical":number,"high":number,"medium":number,"low":number},"dimensions":{"security":{"score":"A|B|C|D|F","findings":[]},"codeQuality":{"score":"A|B|C|D|F","findings":[]},"performance":{"score":"A|B|C|D|F","findings":[]},"architecture":{"score":"A|B|C|D|F","findings":[]},"testing":{"score":"A|B|C|D|F","findings":[]}},"topRecommendations":[{"priority":number,"dimension":string,"action":string,"impact":"high|medium|low","effort":"high|medium|low"}]},"summary":string}',
+    `JSON schema: {"ok":true,"result":{"summary":{"overallHealth":"good|fair|poor|critical","totalFindings":number,"critical":number,"high":number,"medium":number,"low":number},"dimensions":{${schemaDimensions}},"topRecommendations":[{"priority":number,"dimension":string,"action":string,"impact":"high|medium|low","effort":"high|medium|low"}]},"summary":string}`,
     'Each finding: {"severity":"critical|high|medium|low","file":string,"line":number,"rule":string,"description":string,"recommendation":string}',
     `Only include dimensions you were asked to analyze: ${activeDimensions.join(", ")}`
   );
@@ -146,6 +220,132 @@ export function buildAuditPrompt({ task, instructions, dimensions = null, contex
     sections.push(lines.join("\n"));
   }
 
+  // Sonar findings — KJC-TSK-0361. Deterministic input from a tool the
+  // codebase already runs (kj run + SonarStage). The audit reads existing
+  // open issues + quality-gate state instead of re-scanning. Capped at
+  // MAX_SONAR_ISSUES_IN_PROMPT total entries (50) across all severities to
+  // bound prompt size; the LLM is told the truncated count so it can
+  // prioritise.
+  if (sonarFindings?.available && (sonarFindings.total > 0 || sonarFindings.qualityGate)) {
+    const lines = ["## SonarQube Findings"];
+    if (sonarFindings.qualityGate?.status) {
+      lines.push(`- Quality gate: ${sonarFindings.qualityGate.status}`);
+    }
+    if (sonarFindings.total > 0) {
+      lines.push(`- Total open issues: ${sonarFindings.total}`);
+      const groups = groupIssuesBySeverity(sonarFindings.issues);
+      let remaining = MAX_SONAR_ISSUES_IN_PROMPT;
+      for (const [severity, issues] of Object.entries(groups)) {
+        if (issues.length === 0) continue;
+        lines.push("");
+        lines.push(`### ${severity} (${issues.length})`);
+        const slice = issues.slice(0, Math.max(0, remaining));
+        for (const issue of slice) {
+          const loc = issue.component ? `${issue.component}${issue.line ? `:${issue.line}` : ""}` : "";
+          const rule = issue.rule ? ` [${issue.rule}]` : "";
+          lines.push(`  - ${loc}${rule} ${issue.message || ""}`.trim());
+        }
+        if (issues.length > slice.length) {
+          lines.push(`  - ... and ${issues.length - slice.length} more in ${severity}`);
+        }
+        remaining -= slice.length;
+      }
+    }
+    lines.push("");
+    lines.push("Cross-reference these with your own findings. When your finding overlaps a Sonar rule, mention the rule ID in the `rule` field — that's a high-confidence match. Findings the LLM raises that Sonar can't see (architecture, naming, API design) are still valuable; mark them with rule names like \"AUDIT-ARCH-N\".");
+    sections.push(lines.join("\n"));
+  }
+
+  // WebPerf — KJC-TSK-0360. Two modes: a real CWV measurement when one is
+  // surfaced via config.webperf.lastResult (future `kj webperf` command)
+  // OR static frontend-perf hints for the LLM to look at the source code
+  // when no live measurement is available. Backend-only projects skip the
+  // section entirely (collectWebPerfInput returns available:false).
+  if (webperf?.available) {
+    const lines = ["## WebPerf — Frontend Performance"];
+    if (webperf.mode === "cwv-result") {
+      lines.push("Live Core Web Vitals measurement available — incorporate the verdict below into the performance dimension findings:");
+      lines.push("");
+      lines.push(formatCwvVerdict(webperf));
+      lines.push("");
+      lines.push("If a metric is `poor`, recommend a concrete code change (preconnect, lazy-load, image format, critical CSS, defer script). Cite the offending file or pattern when you can find it in the source.");
+    } else {
+      lines.push("No live CWV measurement was provided. Audit the source for these static frontend-perf patterns and include findings under the `performance` dimension:");
+      lines.push("");
+      lines.push("- Render-blocking `<link rel=\"stylesheet\">` or `<script>` without `defer`/`async` in `<head>`");
+      lines.push("- Large JavaScript bundles imported eagerly that could be `await import(...)` or split by route");
+      lines.push("- Non-modern image formats (only .jpg/.png) where webp/avif are widely supported");
+      lines.push("- `<img>` without `width`/`height` attributes (causes CLS)");
+      lines.push("- `<img>` without `loading=\"lazy\"` for off-screen images, or videos auto-playing without `preload=\"metadata\"`");
+      lines.push("- Web fonts loaded without `font-display: swap` or without `<link rel=\"preconnect\">` to the font origin");
+      lines.push("- Whole-library imports for one helper (e.g. `import _ from 'lodash'` instead of `lodash/get`)");
+      lines.push("- Missing critical CSS extraction or above-the-fold inlining strategy in build config");
+      lines.push("- Large third-party scripts (analytics, A/B, chat widgets) without defer + facade pattern");
+      lines.push("- Unbounded list rendering without virtualisation for very long collections");
+    }
+    sections.push(lines.join("\n"));
+  }
+
+  // OSV vulnerabilities — KJC-TSK-0365. Deterministic CVE/GHSA findings
+  // from osv-scanner across the dependency manifest. Capped at
+  // MAX_OSV_VULNS_IN_PROMPT entries; the LLM is told the truncated count.
+  // Findings fold into the `security` dimension with the upstream
+  // identifier (CVE-/GHSA-) as the rule.
+  if (osvFindings?.available && (osvFindings.total > 0)) {
+    const lines = ["## OSV Vulnerabilities"];
+    lines.push(`- Total open vulnerabilities in dependencies: ${osvFindings.total}`);
+    const groups = groupVulnerabilitiesBySeverity(osvFindings.vulnerabilities);
+    let remaining = MAX_OSV_VULNS_IN_PROMPT;
+    for (const [severity, vulns] of Object.entries(groups)) {
+      if (vulns.length === 0) continue;
+      lines.push("");
+      lines.push(`### ${severity} (${vulns.length})`);
+      const slice = vulns.slice(0, Math.max(0, remaining));
+      for (const vuln of slice) {
+        const where = vuln.package ? `${vuln.package}@${vuln.version || "?"}` : "(unknown package)";
+        const fixed = vuln.fixed ? ` → fixed in ${vuln.fixed}` : "";
+        lines.push(`  - ${vuln.id} ${where}${fixed}: ${vuln.summary || ""}`.trim());
+      }
+      if (vulns.length > slice.length) {
+        lines.push(`  - ... and ${vulns.length - slice.length} more in ${severity}`);
+      }
+      remaining -= slice.length;
+    }
+    lines.push("");
+    lines.push("These CVE/GHSA findings are GROUND TRUTH — incorporate them into the `security` dimension. Use the OSV id (CVE-XXXX-XXXX or GHSA-xxxx-xxxx-xxxx) as the `rule` field. Recommend the fixed version when available.");
+    sections.push(lines.join("\n"));
+  }
+
+  // Semgrep SAST findings — KJC-TSK-0366. Static analysis catches what
+  // sonar/CVE-DBs miss: SQL/Cmd injection, XSS, hardcoded secrets,
+  // taint flow, language-specific anti-patterns. Capped at
+  // MAX_SEMGREP_FINDINGS_IN_PROMPT entries; LLM is told these are
+  // deterministic and asked to use rule IDs as-is in findings.
+  if (semgrepFindings?.available && semgrepFindings.total > 0) {
+    const lines = ["## Semgrep SAST Findings"];
+    lines.push(`- Total findings: ${semgrepFindings.total}`);
+    const groups = groupSemgrepBySeverity(semgrepFindings.findings);
+    let remaining = MAX_SEMGREP_FINDINGS_IN_PROMPT;
+    for (const [severity, findings] of Object.entries(groups)) {
+      if (findings.length === 0) continue;
+      lines.push("");
+      lines.push(`### ${severity} (${findings.length})`);
+      const slice = findings.slice(0, Math.max(0, remaining));
+      for (const f of slice) {
+        const loc = f.file ? `${f.file}${f.line ? `:${f.line}` : ""}` : "";
+        const cwe = f.cwe ? ` (${Array.isArray(f.cwe) ? f.cwe.join(", ") : f.cwe})` : "";
+        lines.push(`  - ${loc} [${f.rule}]${cwe}: ${f.message || ""}`.trim());
+      }
+      if (findings.length > slice.length) {
+        lines.push(`  - ... and ${findings.length - slice.length} more in ${severity}`);
+      }
+      remaining -= slice.length;
+    }
+    lines.push("");
+    lines.push("These SAST findings are GROUND TRUTH — fold ERROR-severity ones into the `security` dimension as critical/high findings. Use the semgrep rule id (e.g. javascript.express.security.audit.xss.direct-response-write) verbatim in the `rule` field; that lets the developer look it up in the semgrep registry.");
+    sections.push(lines.join("\n"));
+  }
+
   if (context) {
     sections.push(`## Context\n${context}`);
   }

package/src/prompts/rtk-snippet.js

@@ -2,7 +2,7 @@
  * RTK (Rust Token Killer) prompt instruction snippet.
  * Injected into coder/reviewer prompts when RTK is detected.
  */
-export const RTK_INSTRUCTIONS = [
+const RTK_INSTRUCTIONS = [
   "## Token Optimization (RTK detected)",
   "RTK is installed. Prefix ALL Bash tool calls with `rtk` to reduce token usage:",
   "- Use `rtk git status` instead of `git status`",