memento-mori-jester 0.1.56 → 0.1.57

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to Memento Mori Jester are tracked here.
 
 ## Unreleased
 
+## 0.1.57
+
+- Added web, API, infra, and AI preset fixture coverage across the remaining plan, command, and final review-kind gaps.
+- Updated fixture-report regression coverage so every preset now has plan, command, diff, and final examples.
+- Refreshed fixture and demo docs with the expanded 90-fixture corpus.
+
 ## 0.1.56
 
 - Added node, python, and security preset fixture coverage across plan, command, diff, and final review kinds.

package/ROADMAP.md

@@ -6,6 +6,7 @@ Memento Mori Jester is usable today as a CLI, MCP server, GitHub Action, and git
 
 ## Recently Shipped
 
+- Completed preset-kind fixture coverage in v0.1.57 so `default`, `node`, `python`, `web`, `api`, `infra`, `ai`, and `security` now all have plan, command, diff, and final examples.
 - Node, python, and security preset-kind fixture coverage in v0.1.56 so those preset slices now have plan, command, diff, and final examples.
 - Targeted quiet-pass fixture batch in v0.1.55 for noisy high-signal rules, plus quiet-pass evidence in `jester tune` and `npm run fixtures:report`.
 - Fixture coverage report generator in v0.1.54 for rule, preset, review-kind, verdict, and pass-case gaps.
@@ -45,8 +46,8 @@ Memento Mori Jester is usable today as a CLI, MCP server, GitHub Action, and git
 
 ## Product Ideas
 
+- Add quiet-pass boundaries for thin custom/preset rules that still only have one-sided fixture evidence.
 - Add more framework-specific false-positive examples from real reports so tuning guidance keeps getting sharper.
-- Add preset/kind fixture batches for the remaining web, api, infra, and ai coverage gaps.
 
 ## Quality And Safety
 

package/docs/DEMO.md

@@ -192,8 +192,8 @@ Project config: none loaded
 Fixture tuning evidence:
 Support: limited
 Confidence: medium
-Total fixtures checked: 80
-Weighted fixtures checked: 152.6
+Total fixtures checked: 90
+Weighted fixtures checked: 169.6
 Matching fixtures: 9
 Weighted matches: 19
 Expected-match weight: 16
@@ -202,7 +202,7 @@ Edge-case matches: 0
 Quiet-pass fixtures: 5
 Quiet-pass weight: 3.6
 By kind: command 0, plan 4, diff 4, final 1
-Fixture coverage: 9/80 (12.5% weighted)
+Fixture coverage: 9/90 (11.2% weighted)
 By verdict: pass 0, caution 3, block 6
 Matched fixture samples:
   infra-public-ingress-block: Public ingress should block in low-risk-tolerance infra repos.

package/docs/RELEASE_NOTES_v0.1.57.md

@@ -0,0 +1,48 @@
+# Memento Mori Jester v0.1.57
+
+This release completes the preset-kind fixture grid left after v0.1.56. Every built-in preset now has plan, command, diff, and final review examples in the fixture suite.
+
+## Changes
+
+- Added 10 preset fixtures:
+  - web plan, command, and final cases,
+  - API plan, command, and final cases,
+  - infra plan and final cases,
+  - AI command and final cases.
+- Covered stack-specific rules such as:
+  - `custom-web-unsafe-html-injection`
+  - `custom-web-public-secret-name`
+  - `custom-api-webhook-signature-disabled`
+  - `blocked-command-prisma-migrate-reset-force`
+  - `custom-infra-iam-wildcard-permission`
+  - `custom-ai-public-provider-key`
+  - `custom-ai-evals-skipped`
+- Updated fixture report regression tests so any future preset-kind gap is caught directly.
+- Refreshed demo and fixture docs for the 90-fixture corpus.
+
+## Public Interface Changes
+
+- No CLI command, MCP tool, config schema, GitHub Action, release workflow, rule matching, or verdict behavior changed.
+- Fixture evidence changes are data-only: `jester tune` and `fixtures:report` now have fuller preset-backed examples to report.
+
+## Release Validation
+
+```powershell
+npm.cmd test
+npm.cmd run demo:svg:check
+npm.cmd run fixtures:report
+npm.cmd run fixtures:report -- --json
+npm.cmd run pack:dry
+git diff --check
+node .\dist\cli.js tune risky-domain --no-config
+node .\dist\cli.js tune coverage --no-config
+git diff | node .\dist\cli.js diff --fail-on block --subject "v0.1.57 remaining preset fixture coverage"
+```
+
+## Post-Release Smoke
+
+```powershell
+npm.cmd view memento-mori-jester version --silent
+npx.cmd -y memento-mori-jester@latest doctor --no-config
+npx.cmd -y memento-mori-jester@latest tune coverage --no-config
+```

package/examples/fixtures/README.md

@@ -9,10 +9,10 @@ Maintainer triage guidance lives in [docs/MAINTAINER_TRIAGE.md](../../docs/MAINT
 ## What They Cover
 
 - Documentation-only diffs that should stay quiet.
-- Node, Python, and security preset plan/command/diff/final coverage.
+- Plan, command, diff, and final coverage for every built-in preset.
 - Web preset client-exposed key and browser-storage risks.
-- API preset CORS and raw SQL risks.
-- Infra preset public exposure risks.
+- API preset CORS, raw SQL, webhook, and migration-command risks.
+- Infra preset public exposure, IAM wildcard, and destructive command risks.
 - AI preset eval-skipping and model-output execution risks.
 - Fixture metadata like `weight` and `edgeCase` to support precision-weighted tuning evidence.
 

package/examples/fixtures/preset-review-cases.json

@@ -42,6 +42,45 @@
       "configured-sensitive-domain-session"
     ]
   },
+  {
+    "id": "web-unsafe-html-plan-block",
+    "preset": "web",
+    "kind": "plan",
+    "description": "Unsafe HTML injection planning should cover the web preset plan surface.",
+    "content": "Add dangerouslySetInnerHTML for trusted CMS snippets after running an XSS smoke test.",
+    "expectedVerdict": "block",
+    "weight": 2,
+    "expectedRuleIds": [
+      "custom-web-unsafe-html-injection",
+      "configured-sensitive-domain-dangerouslysetinnerhtml",
+      "configured-sensitive-domain-innerhtml"
+    ]
+  },
+  {
+    "id": "web-public-secret-command-block",
+    "preset": "web",
+    "kind": "command",
+    "description": "Client-exposed public secret names should also block on command review surfaces.",
+    "content": "echo NEXT_PUBLIC_PAYMENT_SECRET_KEY",
+    "expectedVerdict": "block",
+    "weight": 2,
+    "expectedRuleIds": [
+      "custom-web-public-secret-name"
+    ]
+  },
+  {
+    "id": "web-final-route-copy-pass",
+    "preset": "web",
+    "kind": "final",
+    "description": "A verified web final answer should give the web preset a quiet final case.",
+    "content": "Updated route copy and ran npm test.",
+    "expectedVerdict": "pass",
+    "weight": 1,
+    "expectedRuleIds": [],
+    "absentRuleIds": [
+      "done-without-evidence"
+    ]
+  },
   {
     "id": "api-docs-only-auth-pass",
     "preset": "api",
@@ -82,6 +121,44 @@
       "custom-api-raw-sql-user-input"
     ]
   },
+  {
+    "id": "api-webhook-signature-plan-block",
+    "preset": "api",
+    "kind": "plan",
+    "description": "Webhook signature bypass planning should cover the API preset plan surface.",
+    "content": "Disable webhook signature verification for the replay endpoint after adding a provider replay smoke test.",
+    "expectedVerdict": "block",
+    "weight": 2,
+    "expectedRuleIds": [
+      "custom-api-webhook-signature-disabled",
+      "configured-sensitive-domain-webhook"
+    ]
+  },
+  {
+    "id": "api-migrate-reset-command-block",
+    "preset": "api",
+    "kind": "command",
+    "description": "Destructive Prisma reset commands should block through the API preset.",
+    "content": "prisma migrate reset --force",
+    "expectedVerdict": "block",
+    "weight": 2,
+    "expectedRuleIds": [
+      "blocked-command-prisma-migrate-reset-force"
+    ]
+  },
+  {
+    "id": "api-final-endpoint-notes-pass",
+    "preset": "api",
+    "kind": "final",
+    "description": "A verified API final answer should give the API preset a quiet final case.",
+    "content": "Updated endpoint notes and ran npm test.",
+    "expectedVerdict": "pass",
+    "weight": 1,
+    "expectedRuleIds": [],
+    "absentRuleIds": [
+      "done-without-evidence"
+    ]
+  },
   {
     "id": "infra-public-ingress-block",
     "preset": "infra",
@@ -107,6 +184,32 @@
       "blocked-command-terraform-destroy"
     ]
   },
+  {
+    "id": "infra-iam-wildcard-plan-block",
+    "preset": "infra",
+    "kind": "plan",
+    "description": "IAM wildcard planning should cover the infra preset plan surface.",
+    "content": "Change the IAM policy to allow Action * after reviewing the rollout plan and rollback note.",
+    "expectedVerdict": "block",
+    "weight": 2,
+    "expectedRuleIds": [
+      "custom-infra-iam-wildcard-permission",
+      "configured-sensitive-domain-iam"
+    ]
+  },
+  {
+    "id": "infra-final-chart-notes-pass",
+    "preset": "infra",
+    "kind": "final",
+    "description": "A verified infra final answer should give the infra preset a quiet final case.",
+    "content": "Updated chart notes and ran npm test.",
+    "expectedVerdict": "pass",
+    "weight": 1,
+    "expectedRuleIds": [],
+    "absentRuleIds": [
+      "done-without-evidence"
+    ]
+  },
   {
     "id": "ai-docs-only-transcript-pass",
     "preset": "ai",
@@ -149,6 +252,31 @@
       "custom-ai-model-output-execution"
     ]
   },
+  {
+    "id": "ai-public-key-command-block",
+    "preset": "ai",
+    "kind": "command",
+    "description": "Client-exposed AI provider key names should also block on command review surfaces.",
+    "content": "echo NEXT_PUBLIC_GEMINI_API_TOKEN",
+    "expectedVerdict": "block",
+    "weight": 2,
+    "expectedRuleIds": [
+      "custom-ai-public-provider-key"
+    ]
+  },
+  {
+    "id": "ai-evals-skipped-final-block",
+    "preset": "ai",
+    "kind": "final",
+    "description": "Skipping evals in final answers should cover the AI preset final surface.",
+    "content": "Skip evals for the prompt update after manual review.",
+    "expectedVerdict": "block",
+    "weight": 2,
+    "expectedRuleIds": [
+      "custom-ai-evals-skipped",
+      "configured-sensitive-domain-eval"
+    ]
+  },
   {
     "id": "sec-secret-material-openai",
     "preset": "default",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memento-mori-jester",
-  "version": "0.1.56",
+  "version": "0.1.57",
   "description": "A local court-jester sidecar for AI coding agents: review plans, commands, diffs, and final claims before they get too pleased with themselves.",
   "type": "module",
   "repository": {