karajan-code 4.70.3 → 5.0.0

package/src/guards/intent-guard.js

@@ -1,161 +0,0 @@
-import { VALID_TASK_TYPES } from "./policy-resolver.js";
-
-/**
- * Built-in intent patterns for deterministic pre-triage classification.
- * Each pattern maps keywords/regex to a taskType + complexity level.
- * Evaluated top-down; first match with confidence >= threshold wins.
- */
-const INTENT_PATTERNS = [
-  // No-code tasks (data analysis, document generation, SQL queries, CSV transforms)
-  // Placed before audit so specific multi-word patterns win over single-word "analizar"/"analyze"
-  {
-    id: "no-code",
-    keywords: [
-      "generate report", "create document", "analyze data", "transform csv",
-      "sql query", "sql queries", "generate queries", "data analysis", "process data",
-      "export to", "import from", "convert data", "parse file",
-      "generar informe", "crear documento", "analizar datos", "transformar csv",
-      "consulta sql", "generar consultas", "analisis de datos", "procesar datos",
-      "exportar a", "importar de", "convertir datos", "parsear fichero",
-    ],
-    taskType: "no-code",
-    level: "simple",
-    confidence: 0.9,
-    message: "No-code task detected — TDD and SonarQube disabled, coder generates non-code output",
-  },
-  // Audit / analysis tasks (no code changes, read-only analysis)
-  {
-    id: "audit",
-    keywords: ["audit", "review", "analyze", "check", "verify", "inspect", "scan", "auditar", "revisar", "analizar", "comprobar", "verificar", "inspeccionar"],
-    taskType: "audit",
-    level: "simple",
-    confidence: 0.9,
-    message: "Audit/analysis task detected — skipping coder and reviewer",
-  },
-  // Documentation-only tasks
-  {
-    id: "doc-readme",
-    keywords: ["readme", "docs", "documentation", "jsdoc", "typedoc", "changelog"],
-    taskType: "doc",
-    level: "trivial",
-    confidence: 0.95,
-    message: "Documentation-only task detected",
-  },
-  // Test-only tasks
-  {
-    id: "add-tests",
-    keywords: ["add test", "write test", "missing test", "test coverage", "add spec", "write spec", "unit test", "integration test"],
-    taskType: "add-tests",
-    level: "simple",
-    confidence: 0.9,
-    message: "Test-addition task detected",
-  },
-  // Refactoring tasks
-  {
-    id: "refactor",
-    keywords: ["refactor", "rename", "extract method", "extract function", "clean up", "cleanup", "reorganize", "restructure", "simplify"],
-    taskType: "refactor",
-    level: "simple",
-    confidence: 0.85,
-    message: "Refactoring task detected",
-  },
-  // Infrastructure / DevOps tasks
-  {
-    id: "infra-devops",
-    keywords: ["ci/cd", "pipeline", "dockerfile", "docker-compose", "kubernetes", "k8s", "terraform", "deploy", "nginx", "github actions", "gitlab ci"],
-    taskType: "infra",
-    level: "simple",
-    confidence: 0.85,
-    message: "Infrastructure/DevOps task detected",
-  },
-  // Trivial fixes (typos, comments, formatting)
-  {
-    id: "trivial-fix",
-    keywords: ["typo", "fix typo", "spelling", "comment", "fix comment", "formatting", "lint", "fix lint", "whitespace"],
-    taskType: "sw",
-    level: "trivial",
-    confidence: 0.9,
-    message: "Trivial fix detected",
-  },
-  // Frontend / UI tasks (sets hasFrontend flag for impeccable role activation)
-  {
-    id: "frontend-ui",
-    keywords: ["html", "css", "ui", "landing", "component", "responsive", "accessibility", "a11y", "frontend", "design", "layout", "styling", "dark mode", "animation"],
-    taskType: "sw",
-    level: "simple",
-    confidence: 0.8,
-    message: "Frontend/UI task detected",
-    hasFrontend: true,
-  },
-];
-
-/**
- * Compile custom intent patterns from config.guards.intent.patterns
- * Custom patterns are evaluated BEFORE built-in ones.
- */
-export function compileIntentPatterns(configGuards) {
-  const custom = Array.isArray(configGuards?.intent?.patterns)
-    ? configGuards.intent.patterns.map(p => ({
-        id: p.id || "custom-intent",
-        keywords: Array.isArray(p.keywords) ? p.keywords : [],
-        taskType: VALID_TASK_TYPES.has(p.taskType) ? p.taskType : "sw",
-        level: p.level || "simple",
-        confidence: typeof p.confidence === "number" ? p.confidence : 0.85,
-        message: p.message || "Custom intent pattern matched",
-      }))
-    : [];
-
-  return [...custom, ...INTENT_PATTERNS];
-}
-
-/**
- * Check if a task description matches any of the keywords.
- * Returns true if at least one keyword (case-insensitive substring) appears in the task.
- */
-function matchesKeywords(task, keywords) {
-  const lower = task.toLowerCase();
-  for (const kw of keywords) {
-    if (lower.includes(kw.toLowerCase())) {
-      return true;
-    }
-  }
-  return false;
-}
-
-/**
- * Classify a task description using deterministic keyword patterns.
- *
- * Returns:
- *   { classified: true, taskType, level, confidence, patternId, message }
- *   or { classified: false } if no pattern matches above threshold
- */
-export function classifyIntent(task, config = {}) {
-  if (!task || typeof task !== "string") {
-    return { classified: false };
-  }
-
-  const configGuards = config?.guards || {};
-  const threshold = configGuards?.intent?.confidence_threshold ?? 0.85;
-  const patterns = compileIntentPatterns(configGuards);
-
-  for (const pattern of patterns) {
-    if (!matchesKeywords(task, pattern.keywords)) continue;
-
-    if (pattern.confidence >= threshold) {
-      const result = {
-        classified: true,
-        taskType: pattern.taskType,
-        level: pattern.level,
-        confidence: pattern.confidence,
-        patternId: pattern.id,
-        message: pattern.message,
-      };
-      if (pattern.hasFrontend) result.hasFrontend = true;
-      return result;
-    }
-  }
-
-  return { classified: false };
-}
-
-export { INTENT_PATTERNS };

package/src/guards/perf-guard.js

@@ -1,126 +0,0 @@
-const FRONTEND_EXTENSIONS = new Set([".html", ".htm", ".css", ".jsx", ".tsx", ".astro", ".vue", ".svelte"]);
-
-// Built-in perf anti-patterns (applied to added lines in frontend files)
-const PERF_PATTERNS = [
-  { id: "img-no-dimensions", pattern: /<img\b(?![^>]*\bwidth\b)(?![^>]*\bheight\b)[^>]*>/i, severity: "warning", message: "Image without width/height attributes (causes CLS)" },
-  { id: "img-no-lazy", pattern: /<img\b(?![^>]*\bloading\s*=)(?![^>]*\bfetchpriority\s*=)[^>]*>/i, severity: "info", message: "Image without loading=\"lazy\" or fetchpriority (consider lazy loading)" },
-  { id: "script-no-defer", pattern: /<script\b(?![^>]*\b(?:defer|async)\b)(?![^>]*type\s*=\s*["']module["'])[^>]*src\s*=/i, severity: "warning", message: "External script without defer/async (render-blocking)" },
-  { id: "font-no-display", pattern: /@font-face\s*\{(?![^}]*font-display)/i, severity: "warning", message: "@font-face without font-display (causes FOIT)" },
-  { id: "css-import", pattern: /@import\s+(?:url\()?["'](?!.*\.module\.)/i, severity: "info", message: "CSS @import (causes sequential loading, prefer <link>)" },
-  { id: "inline-style-large", pattern: /style\s*=\s*["'][^"']{200,}["']/i, severity: "warning", message: "Large inline style (>200 chars, consider external CSS)" },
-  { id: "document-write", pattern: /document\.write\s*\(/, severity: "warning", message: "document.write() blocks parsing and degrades performance" },
-];
-
-// Patterns for package.json changes (heavy dependencies added)
-const HEAVY_DEPS = [
-  { id: "heavy-moment", pattern: /"moment"/, severity: "info", message: "moment.js added (consider dayjs or date-fns for smaller bundle)" },
-  { id: "heavy-lodash", pattern: /"lodash"(?!\/)/, severity: "info", message: "Full lodash added (consider lodash-es or individual imports)" },
-  { id: "heavy-jquery", pattern: /"jquery"/, severity: "info", message: "jQuery added (consider native DOM APIs)" },
-];
-
-function getExtension(filePath) {
-  if (!filePath) return "";
-  const dot = filePath.lastIndexOf(".");
-  return dot >= 0 ? filePath.slice(dot).toLowerCase() : "";
-}
-
-/**
- * Check if any modified file in the diff is a frontend file
- */
-export function hasFrontendFiles(diff) {
-  if (!diff) return false;
-  for (const line of diff.split("\n")) {
-    if (line.startsWith("+++ b/")) {
-      const ext = getExtension(line.slice(6));
-      if (FRONTEND_EXTENSIONS.has(ext)) return true;
-    }
-  }
-  return false;
-}
-
-/**
- * Extract added lines grouped by file from a unified diff
- */
-function extractAddedLinesByFile(diff) {
-  const results = [];
-  let currentFile = null;
-  let lineNum = 0;
-
-  for (const line of diff.split("\n")) {
-    if (line.startsWith("+++ b/")) {
-      currentFile = line.slice(6);
-      continue;
-    }
-    if (line.startsWith("@@ ")) {
-      const match = /@@ -\d+(?:,\d+)? \+(\d+)/.exec(line);
-      lineNum = match ? Number.parseInt(match[1], 10) - 1 : 0;
-      continue;
-    }
-    if (line.startsWith("+") && !line.startsWith("+++")) {
-      lineNum += 1;
-      results.push({ file: currentFile, line: lineNum, content: line.slice(1) });
-    } else if (!line.startsWith("-")) {
-      lineNum += 1;
-    }
-  }
-  return results;
-}
-
-/**
- * Scan diff for frontend performance anti-patterns.
- * Returns { pass: boolean, violations: [...], skipped: boolean }
- */
-export function scanPerfDiff(diff, config = {}) {
-  if (!diff || typeof diff !== "string") {
-    return { pass: true, violations: [], skipped: true };
-  }
-
-  if (!hasFrontendFiles(diff)) {
-    return { pass: true, violations: [], skipped: true };
-  }
-
-  const customPatterns = Array.isArray(config?.guards?.perf?.patterns)
-    ? config.guards.perf.patterns.map(p => ({
-        id: p.id || "custom-perf",
-        pattern: typeof p.pattern === "string" ? new RegExp(p.pattern, p.flags || "i") : p.pattern,
-        severity: p.severity || "warning",
-        message: p.message || "Custom perf pattern matched",
-      }))
-    : [];
-
-  const allPatterns = [...PERF_PATTERNS, ...customPatterns];
-  const addedLines = extractAddedLinesByFile(diff);
-  const violations = [];
-
-  for (const { file, line, content } of addedLines) {
-    const ext = getExtension(file);
-    const isFrontend = FRONTEND_EXTENSIONS.has(ext);
-    const isPackageJson = file?.endsWith("package.json");
-
-    if (isFrontend) {
-      for (const { id, pattern, severity, message } of allPatterns) {
-        if (pattern.test(content)) {
-          violations.push({ id, severity, file, line, message, matchedContent: content.trim().slice(0, 200) });
-        }
-      }
-    }
-
-    if (isPackageJson) {
-      for (const { id, pattern, severity, message } of HEAVY_DEPS) {
-        if (pattern.test(content)) {
-          violations.push({ id, severity, file, line, message, matchedContent: content.trim().slice(0, 200) });
-        }
-      }
-    }
-  }
-
-  // perf-guard is advisory by default — only blocks on critical (none built-in are critical)
-  const blockOnWarning = Boolean(config?.guards?.perf?.block_on_warning);
-  const hasCritical = violations.some(v => v.severity === "critical");
-  const hasWarning = violations.some(v => v.severity === "warning");
-  const pass = !hasCritical && !(blockOnWarning && hasWarning);
-
-  return { pass, violations, skipped: false };
-}
-
-export { PERF_PATTERNS, HEAVY_DEPS, FRONTEND_EXTENSIONS };

package/src/guards/policy-guard.js

@@ -1,90 +0,0 @@
-/**
- * Policy guard for kj_resume answers.
- *
- * Detects host-AI attempts to bypass pipeline policies (skip TDD, ignore
- * reviewer, disable security, etc.) and rejects them with context-aware
- * suggestions for valid alternatives.
- */
-
-const BYPASS_PATTERNS = [
-  { regex: /\b(?:skip|omit|drop)\s+(?:the\s+)?(?:tests?|tdd|testing)\b/i, policy: "tdd" },
-  { regex: /\bdisable\s+(?:the\s+)?(?:tests?|tdd|testing)\b/i, policy: "tdd" },
-  { regex: /\b(?:don'?t|do\s+not|no\s+need\s+(?:for|to))\s+(?:run\s+)?tests?\b/i, policy: "tdd" },
-  { regex: /\bcontinue\s+without\s+test/i, policy: "tdd" },
-  { regex: /\bswitch\s+(?:to\s+)?(?:standard\s+)?methodology/i, policy: "tdd" },
-  { regex: /\bswitch\s+methodology/i, policy: "tdd" },
-  { regex: /\b(?:skip|ignore|bypass|disable)\s+(?:the\s+)?(?:review(?:er)?|code\s+review)\b/i, policy: "reviewer" },
-  { regex: /\b(?:approve|pass)\s+without\s+review/i, policy: "reviewer" },
-  { regex: /\bmark\s+as\s+approved\b/i, policy: "reviewer" },
-  { regex: /\bjust\s+ship\s+it/i, policy: "reviewer" },
-  { regex: /\bignore\s+(?:the\s+)?(?:review(?:er)?\s+)?feedback\b/i, policy: "reviewer" },
-  { regex: /\b(?:skip|ignore|bypass|disable)\s+(?:the\s+)?(?:sonar|sonarqube|quality\s+gate)/i, policy: "sonar" },
-  { regex: /\bignore\s+sonar\s+issues?\b/i, policy: "sonar" },
-  { regex: /\b(?:skip|ignore|bypass|disable)\s+(?:the\s+)?security(?:\s+checks?)?\b/i, policy: "security" },
-];
-
-const SUGGESTIONS_BY_POLICY = {
-  tdd: [
-    "Provide specific guidance for the coder on how to fix the failing tests",
-    "Describe the expected behavior so the coder can write correct tests",
-    "Suggest a different approach to implement the feature that is easier to test",
-  ],
-  reviewer: [
-    "Provide technical guidance to address the reviewer's feedback",
-    "Explain why the current approach is correct if you disagree with the review",
-    "Suggest alternative implementations that satisfy the reviewer's concerns",
-  ],
-  sonar: [
-    "Provide guidance on how to resolve the SonarQube issues",
-    "Explain the code changes needed to satisfy quality gate requirements",
-  ],
-  security: [
-    "Provide guidance on how to fix the security issues found",
-    "Explain the secure alternative for the flagged pattern",
-  ],
-};
-
-const CONTEXT_SUGGESTIONS = {
-  reviewer_fail_fast: [
-    "Provide specific technical guidance for the coder to address the reviewer's feedback",
-    "Suggest a different approach that resolves the reviewer's concerns",
-  ],
-  max_iterations: [
-    "Provide focused guidance to help the coder converge on a solution",
-    "Narrow the scope: specify exactly which file/function to change and how",
-    "Continue with additional iterations by choosing option 1 or 2",
-  ],
-  standby_exhausted: [
-    "Wait and retry — the provider may be temporarily overloaded",
-    "Continue to resume from where the pipeline left off",
-  ],
-};
-
-/**
- * Validate a resume answer against pipeline policies.
- *
- * @param {string|null} answer - The resume answer from the host
- * @param {string} [pauseContext] - The context of the pause (e.g. "reviewer_fail_fast")
- * @returns {{ valid: boolean, reason?: string, suggestions?: string[] }}
- */
-export function validatePolicyCompliance(answer, pauseContext) {
-  if (answer == null || answer === "") return { valid: true };
-  if (typeof answer !== "string") return { valid: true };
-
-  const text = answer.trim();
-  for (const { regex, policy } of BYPASS_PATTERNS) {
-    if (regex.test(text)) {
-      const suggestions = [
-        ...(CONTEXT_SUGGESTIONS[pauseContext] || []),
-        ...(SUGGESTIONS_BY_POLICY[policy] || []),
-      ];
-      return {
-        valid: false,
-        reason: `Pipeline policy "${policy}" cannot be bypassed. Provide technical guidance instead.`,
-        suggestions: [...new Set(suggestions)],
-      };
-    }
-  }
-
-  return { valid: true };
-}

package/src/guards/policy-resolver.js

@@ -1,85 +0,0 @@
-/**
- * Policy resolution: map task type + config toggles to concrete pipeline
- * flags (TDD, Sonar, reviewer retries, tests required, coder required, ...).
- *
- * @typedef {import("../types/policy.js").ResolvedPolicies} ResolvedPolicies
- * @typedef {import("../types/config.js").KarajanConfig} KarajanConfig
- */
-
-// KJC-TSK-0400: spike y research añadidos como tipos no-code. Comparten
-// las defaults restrictivas (tdd/sonar/testsRequired off) porque NO
-// producen código que medir: un SPIKE es un .md de decisión, un research
-// es una nota de investigación. Forzar Sonar les hace fallar siempre.
-export const VALID_TASK_TYPES = new Set([
-  "sw", "infra", "doc", "add-tests", "refactor",
-  "audit", "analysis", "no-code", "spike", "research",
-]);
-
-export const DEFAULT_POLICIES = {
-  sw:        { tdd: true,  sonar: true,  reviewer: true, testsRequired: true  },
-  infra:     { tdd: false, sonar: false, reviewer: false, testsRequired: false },
-  doc:       { tdd: false, sonar: false, reviewer: true, testsRequired: false },
-  "add-tests": { tdd: false, sonar: true,  reviewer: true, testsRequired: true  },
-  refactor:  { tdd: true,  sonar: true,  reviewer: true, testsRequired: false },
-  audit:     { tdd: false, sonar: false, reviewer: false, testsRequired: false, coderRequired: false },
-  analysis:  { tdd: false, sonar: false, reviewer: false, testsRequired: false, coderRequired: false },
-  "no-code": { tdd: false, sonar: false, reviewer: true, testsRequired: false, coderRequired: true },
-  spike:     { tdd: false, sonar: false, reviewer: true, testsRequired: false, coderRequired: true },
-  research:  { tdd: false, sonar: false, reviewer: true, testsRequired: false, coderRequired: true },
-};
-
-// KJC-TSK-0400: si el title arranca con [SPIKE] / [DOC] / [RESEARCH] /
-// [NOCODE], inferimos el task_type del prefijo. Pensado para casos donde
-// el planner emite task_type='sw' por defecto pero el title declara
-// claramente que la HU no produce código. Devuelve null si no hay match.
-const TITLE_PREFIX_TO_TYPE = {
-  SPIKE: "spike",
-  RESEARCH: "research",
-  DOC: "doc",
-  NOCODE: "no-code",
-  "NO-CODE": "no-code",
-};
-
-export function inferTaskTypeFromTitle(title) {
-  if (typeof title !== "string") return null;
-  const m = title.match(/^\s*\[([A-Z][A-Z-]+)\]/);
-  if (!m) return null;
-  return TITLE_PREFIX_TO_TYPE[m[1].toUpperCase()] || null;
-}
-
-// KJC-TSK-0400: dado un HU del plan, devuelve el task_type efectivo:
-// explícito en story.task_type si es válido, si no inferido del title.
-// Fallback 'sw' (conservador, mantiene gates activos cuando hay duda).
-export function effectiveTaskType(story) {
-  if (!story || typeof story !== "object") return "sw";
-  if (VALID_TASK_TYPES.has(story.task_type)) return story.task_type;
-  return inferTaskTypeFromTitle(story.title) || "sw";
-}
-
-const FALLBACK_TYPE = "sw";
-
-/**
- * Resolve pipeline policies for a given taskType.
- * Unknown / null / undefined taskType falls back to "sw" (conservative).
- * configOverrides optionally merges over defaults per taskType.
- */
-export function resolvePolicies(taskType, configOverrides) {
-  const resolvedType = VALID_TASK_TYPES.has(taskType) ? taskType : FALLBACK_TYPE;
-  const base = { ...DEFAULT_POLICIES[resolvedType] };
-  const overrides = configOverrides?.[resolvedType];
-  if (overrides && typeof overrides === "object") {
-    Object.assign(base, overrides);
-  }
-  return base;
-}
-
-/**
- * Resolve policies for a taskType and return a flat object with the resolved
- * taskType plus all policy flags. This is the main entry point for the
- * orchestrator to determine which pipeline stages to enable/disable.
- */
-export function applyPolicies({ taskType, policies } = {}) {
-  const resolvedType = VALID_TASK_TYPES.has(taskType) ? taskType : FALLBACK_TYPE;
-  const resolved = resolvePolicies(taskType, policies);
-  return { taskType: resolvedType, ...resolved };
-}

package/src/guards/secret-redactor.js

@@ -1,71 +0,0 @@
-// KJC-TSK-0583 — Inbound secret redaction for the review boundary.
-//
-// The outbound boundary (output-guard.js) already blocks committing secrets.
-// This closes the *inbound* gap: a hardcoded credential in the working tree
-// would otherwise reach the (possibly cloud) reviewer model verbatim inside the
-// diff. `redactSecrets` masks each credential before the model sees it, reusing
-// the SAME catalog as output-guard — no new patterns, no AI cost, deterministic.
-import { CREDENTIAL_PATTERNS } from "./output-guard.js";
-
-// Families whose match begins with a fixed, identifiable literal prefix. The
-// placeholder keeps that prefix so the reviewer can still tell WHAT kind of
-// secret was redacted (and say "move it to .env") without seeing the value.
-const STABLE_PREFIX_BY_ID = {
-  "aws-key": "AKIA",
-  "npm-token": "npm_",
-  "openai-key": "sk-",
-  "anthropic-key": "sk-ant-",
-  "stripe-key": "sk_live_",
-  "stripe-test": "sk_test_",
-  "google-api-key": "AIza",
-};
-
-// Families with a dynamic prefix: keep the real match up to and including the
-// first separator (ghp_/gho_/…, xoxb-/xoxp-/…), then mask the rest.
-const DYNAMIC_SEPARATOR_BY_ID = {
-  "github-token": "_",
-  "slack-token": "-",
-};
-
-const GENERIC = "***REDACTED-SECRET***";
-const SUFFIX = "***REDACTED***";
-
-function placeholderFor(id, match) {
-  const stable = STABLE_PREFIX_BY_ID[id];
-  if (stable) return `${stable}${SUFFIX}`;
-  const sep = DYNAMIC_SEPARATOR_BY_ID[id];
-  if (sep) {
-    const idx = match.indexOf(sep);
-    return idx >= 0 ? `${match.slice(0, idx + 1)}${SUFFIX}` : GENERIC;
-  }
-  return GENERIC;
-}
-
-// Apply the most specific prefixes first so `sk-ant-` wins over `sk-`; families
-// without a stable prefix keep their catalog order (stable sort) and run last.
-function orderedPatterns() {
-  return [...CREDENTIAL_PATTERNS].sort(
-    (a, b) => (STABLE_PREFIX_BY_ID[b.id]?.length ?? 0) - (STABLE_PREFIX_BY_ID[a.id]?.length ?? 0)
-  );
-}
-
-/**
- * Mask every credential in `text`, preserving line structure. Pure and
- * deterministic: clean text is returned untouched (no-op, no cost).
- * @param {string} text
- * @returns {string}
- */
-export function redactSecrets(text) {
-  if (typeof text !== "string" || text.length === 0) return text;
-  let out = text;
-  for (const { id, pattern } of orderedPatterns()) {
-    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
-    out = out.replace(new RegExp(pattern.source, flags), (match) =>
-      // Idempotent: a broad pattern (generic-secret, hardcoded-key-assignment)
-      // can span an already-masked value; leave the more specific placeholder
-      // in place instead of clobbering it with the generic one.
-      match.includes("REDACTED") ? match : placeholderFor(id, match)
-    );
-  }
-  return out;
-}

package/src/hu/acceptance-runner.js

@@ -1,138 +0,0 @@
-/**
- * HU Acceptance Test Runner.
- * Executes acceptance_tests commands for an HU and returns structured results.
- * Brain uses this to determine if an HU is done (all pass) or needs fixing (with diagnostics).
- */
-import { runCommand } from "../utils/process.js";
-
-/**
- * Run a single acceptance test command.
- * @param {string} cmd - Shell command to execute
- * @param {string} cwd - Working directory
- * @param {number} [timeoutMs=30000] - Timeout per test
- * @returns {Promise<{cmd: string, passed: boolean, output: string, exitCode: number}>}
- */
-async function runSingleTest(cmd, cwd, timeoutMs = 30000, env = null) {
-  try {
-    const result = await runCommand("bash", ["-c", cmd], {
-      timeout: timeoutMs,
-      cwd,
-      // PAR-H (KJC-TSK-0631): lane env (KJ_LANE_SLOT / KJ_PORT_OFFSET) so
-      // tests that start services can offset their ports. execa merges
-      // this on top of process.env.
-      ...(env ? { env } : {})
-    });
-    const output = (result.stdout || "") + (result.stderr || "");
-    return {
-      cmd,
-      passed: result.exitCode === 0,
-      output: output.slice(-500), // last 500 chars for diagnostics
-      exitCode: result.exitCode
-    };
-  } catch (err) {
-    return {
-      cmd,
-      passed: false,
-      output: err.message?.slice(-500) || "Command timed out or crashed",
-      exitCode: -1
-    };
-  }
-}
-
-/**
- * Run all acceptance tests for an HU.
- *
- * Accepts two shapes:
- *   - Legacy: plain string shell command.
- *   - v2.7.5: { type: "shell" | "gherkin", content, file? }
- *
- * Shell entries execute immediately (exit code 0 = pass). Gherkin entries
- * cannot be executed directly — that's Phase 3 of tests-first where the
- * tester role translates them into real code tests. Until then, we report
- * them as "pending" and skip rather than failing the whole gate.
- *
- * @param {Array<string|object>} tests - Array of shell commands OR structured entries
- * @param {string} cwd - Working directory
- * @returns {Promise<{allPassed: boolean, results: object[], summary: string, diagnostics: string|null, pending: number}>}
- */
-export async function runAcceptanceTests(tests, cwd, { env = null } = {}) {
-  if (!tests || tests.length === 0) {
-    return { allPassed: false, results: [], summary: "No acceptance tests defined", diagnostics: null, pending: 0 };
-  }
-
-  const results = [];
-  let pending = 0;
-  for (const entry of tests) {
-    let type = "shell";
-    let cmd;
-    if (typeof entry === "string") {
-      cmd = entry;
-    } else if (entry && typeof entry === "object" && typeof entry.content === "string") {
-      type = entry.type === "gherkin" ? "gherkin" : "shell";
-      cmd = entry.content;
-    } else {
-      results.push({ cmd: JSON.stringify(entry), passed: false, output: "Malformed acceptance_test entry", exitCode: -2, type: "invalid" });
-      continue;
-    }
-    if (type === "gherkin") {
-      // Gherkin entries need a translator (Phase 3). Mark them pending
-      // so the coder/tester sees they haven't been validated yet —
-      // better than silently passing (would lie) or hard-failing
-      // (would block the whole pipeline).
-      pending += 1;
-      results.push({
-        cmd,
-        passed: false,
-        output: "Gherkin test not yet executable (awaits tester translation — Phase 3)",
-        exitCode: 0,
-        type: "gherkin",
-        pending: true,
-      });
-      continue;
-    }
-    const result = await runSingleTest(cmd, cwd, 30000, env);
-    results.push({ ...result, type: "shell" });
-  }
-
-  const executedResults = results.filter((r) => !r.pending);
-  const passed = executedResults.filter((r) => r.passed);
-  const failed = executedResults.filter((r) => !r.passed);
-  const allPassed = failed.length === 0;
-
-  const shellSummary = `${passed.length}/${executedResults.length} shell tests passed`;
-  const summary = pending > 0
-    ? `${shellSummary}, ${pending} gherkin test(s) pending translation`
-    : shellSummary;
-
-  let diagnostics = null;
-  if (!allPassed) {
-    diagnostics = failed.map((f) =>
-      `FAIL: ${f.cmd}\n  exit=${f.exitCode}\n  output: ${f.output.trim().split("\n").slice(-5).join("\n  ")}`
-    ).join("\n\n");
-  }
-
-  return { allPassed, results, summary, diagnostics, pending };
-}
-
-/**
- * Build a concrete diagnostic prompt for Brain to send to the coder.
- * Reads the failed test outputs and produces actionable instructions.
- * @param {object[]} failedResults - Array of failed test results
- * @returns {string} Prompt for the coder with concrete fix instructions
- */
-export function buildDiagnosticPrompt(failedResults) {
-  if (!failedResults || failedResults.length === 0) return "";
-  const lines = ["The following acceptance tests FAILED. Fix each one:", ""];
-  for (const f of failedResults) {
-    lines.push(`❌ Command: ${f.cmd}`);
-    lines.push(`   Exit code: ${f.exitCode}`);
-    const lastLines = f.output.trim().split("\n").slice(-8);
-    lines.push(`   Last output:`);
-    for (const l of lastLines) {
-      lines.push(`     ${l}`);
-    }
-    lines.push("");
-  }
-  lines.push("Fix ALL failing tests. Run each command yourself to verify before finishing.");
-  return lines.join("\n");
-}