memento-mori-jester 0.1.63 → 0.1.64

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to Memento Mori Jester are tracked here.
 
 ## Unreleased
 
+## 0.1.64
+
+- Added second firing fixtures for the remaining built-in destructive-command, final-answer, and configured billing-domain thin examples.
+- Cleared all remaining thin rule coverage in `npm run fixtures:report` across built-in, structural, custom, configured sensitive-domain, and blocked-command rule families.
+- Refreshed demo, roadmap, fixture docs, and release notes for the 152-fixture corpus.
+
 ## 0.1.63
 
 - Added second firing fixtures for the remaining framework custom-rule thin examples across security, infra, node, python, and web presets.

package/ROADMAP.md

@@ -6,6 +6,7 @@ Memento Mori Jester is usable today as a CLI, MCP server, GitHub Action, and git
 
 ## Recently Shipped
 
+- Final thin-rule fixture precision pass in v0.1.64, clearing all remaining thin coverage gaps across built-in, structural, custom, configured sensitive-domain, and blocked-command rule families.
 - Framework custom-rule fixture precision pass in v0.1.63, clearing custom-rule thin coverage and reducing total thin fixture coverage from 16 rules to 7.
 - AI/API custom-rule fixture precision pass in v0.1.62, reducing total thin fixture coverage from 21 rules to 16 while keeping review behavior unchanged.
 - Curation-next fixture batch in v0.1.61 that removed blocked-command thin coverage, strengthened stack-specific sensitive-domain examples, and reduced total thin fixture coverage from 37 rules to 21.
@@ -52,8 +53,8 @@ Memento Mori Jester is usable today as a CLI, MCP server, GitHub Action, and git
 
 ## Product Ideas
 
+- Add benign pass-case evidence for rules that currently have match coverage and quiet-pass coverage but no explicit matched pass cases.
 - Add more framework-specific false-positive examples from real reports so tuning guidance keeps getting sharper.
-- Add the final fixture precision pass for the remaining built-in and configured-domain thin examples surfaced by `fixtures:report`.
 - Add a Markdown export for fixture reports so maintainers can paste coverage snapshots into issues or release notes.
 
 ## Quality And Safety

package/docs/DEMO.md

@@ -192,18 +192,18 @@ Project config: none loaded
 Fixture tuning evidence:
 Support: limited
 Confidence: medium
-Total fixtures checked: 145
-Weighted fixtures checked: 276.9
-Matching fixtures: 10
-Weighted matches: 21
-Expected-match weight: 16
+Total fixtures checked: 152
+Weighted fixtures checked: 294.9
+Matching fixtures: 11
+Weighted matches: 23
+Expected-match weight: 18
 Unexpected-match weight: 5
 Edge-case matches: 0
 Quiet-pass fixtures: 5
 Quiet-pass weight: 3.6
-By kind: command 0, plan 4, diff 5, final 1
-Fixture coverage: 10/145 (7.6% weighted)
-By verdict: pass 0, caution 3, block 7
+By kind: command 0, plan 5, diff 5, final 1
+Fixture coverage: 11/152 (7.8% weighted)
+By verdict: pass 0, caution 3, block 8
 Matched fixture samples:
   infra-public-ingress-block: Public ingress should block in low-risk-tolerance infra repos.
   node-plan-production-mode-block: Node production-mode planning should cover node-specific and sensitive-domain signals.
@@ -353,7 +353,7 @@ Preset packs:
 
 ## 13. Review Fixtures
 
-The fixture suite in `examples/fixtures/preset-review-cases.json` captures small real-usage examples with expected `pass`, `caution`, or `block` verdicts. It also includes quiet-pass `absentRuleIds` examples that prove noisy rules stay silent for safe near-misses, stack-specific coverage for every built-in preset, quiet-pass boundaries across built-in, structural, custom, and preset/config-derived rules, second firing examples for preset blocked-command rules, and second examples for AI/API and framework custom rules. These examples are run by `npm test`, so preset tuning changes stay visible.
+The fixture suite in `examples/fixtures/preset-review-cases.json` captures small real-usage examples with expected `pass`, `caution`, or `block` verdicts. It also includes quiet-pass `absentRuleIds` examples that prove noisy rules stay silent for safe near-misses, stack-specific coverage for every built-in preset, quiet-pass boundaries across built-in, structural, custom, and preset/config-derived rules, second firing examples for preset blocked-command rules, and second examples for AI/API, framework custom, built-in, and configured sensitive-domain rules. These examples are run by `npm test`, so preset tuning changes stay visible.
 
 Maintainers can run `npm run fixtures:report` to see coverage by verdict, kind, preset, rule family, and preset slice. The report also includes a `Curation next` section that points at the next useful fixture batch, such as thin rules, no-pass evidence, rule-family gaps, or lower-count presets.
 

package/docs/RELEASE_NOTES_v0.1.64.md

@@ -0,0 +1,38 @@
+# Memento Mori Jester v0.1.64
+
+This release completes the current thin-rule fixture precision pass. It adds second firing examples for the remaining built-in destructive-command rules, final-answer tone rules, and the configured billing-domain rule. It does not change review logic, scoring, matching, CLI output shape, MCP tools, GitHub Action behavior, or release automation.
+
+## What Changed
+
+- Added 7 fixture cases, growing the corpus from 145 to 152 fixtures.
+- Added second firing examples for:
+  - `database-destruction`
+  - `destructive-git-history`
+  - `handwave-final`
+  - `pipe-to-shell`
+  - `recursive-force-delete`
+  - `untested-final`
+  - `configured-sensitive-domain-billing`
+- Cleared all remaining thin rule coverage in `npm run fixtures:report`.
+- Updated fixture docs, demo transcript, roadmap, and changelog for the 152-fixture corpus.
+
+## Public Interface
+
+- No CLI command changes.
+- No config schema changes.
+- No rule matching, scoring, or verdict behavior changes.
+- No MCP, playground, GitHub Action, or npm publishing changes.
+
+## Release Validation
+
+```powershell
+npm.cmd test
+npm.cmd run demo:svg:check
+npm.cmd run fixtures:report
+npm.cmd run fixtures:report -- --json
+npm.cmd run pack:dry
+git diff --check
+node .\dist\cli.js tune coverage --no-config
+node .\dist\cli.js tune risky-domain --json --no-config
+git diff | node .\dist\cli.js diff --fail-on block --subject "v0.1.64 final fixture precision"
+```

package/examples/fixtures/README.md

@@ -19,6 +19,7 @@ Maintainer triage guidance lives in [docs/MAINTAINER_TRIAGE.md](../../docs/MAINT
 - Second firing examples for preset blocked-command rules and high-value stack-specific sensitive-domain rules.
 - Second firing examples for AI and API custom rules around provider keys, model-output execution, raw SQL, and webhook signature checks.
 - Second firing examples for remaining framework custom rules across security, infra, node, python, and web presets.
+- Second firing examples for remaining built-in and configured sensitive-domain thin rules, leaving no thin coverage gaps.
 - Fixture metadata like `weight` and `edgeCase` to support precision-weighted tuning evidence.
 
 ## Local Check

package/examples/fixtures/preset-review-cases.json

@@ -388,6 +388,18 @@
       "destructive-git-history"
     ]
   },
+  {
+    "id": "universal-destructive-git-clean-block",
+    "preset": "default",
+    "kind": "command",
+    "content": "git clean -fd build/tmp",
+    "description": "Git clean with force/delete flags should give destructive git coverage a second command shape.",
+    "weight": 3,
+    "expectedVerdict": "block",
+    "expectedRuleIds": [
+      "destructive-git-history"
+    ]
+  },
   {
     "id": "universal-recursive-force-delete-block",
     "preset": "default",
@@ -400,6 +412,18 @@
       "recursive-force-delete"
     ]
   },
+  {
+    "id": "universal-recursive-force-delete-powershell-block",
+    "preset": "default",
+    "kind": "command",
+    "content": "Remove-Item .\\tmp\\cache -Recurse -Force",
+    "description": "PowerShell recursive forced deletion should cover the Windows command shape.",
+    "weight": 3,
+    "expectedVerdict": "block",
+    "expectedRuleIds": [
+      "recursive-force-delete"
+    ]
+  },
   {
     "id": "universal-pipe-to-shell-block",
     "preset": "default",
@@ -412,6 +436,18 @@
       "pipe-to-shell"
     ]
   },
+  {
+    "id": "universal-wget-pipe-to-shell-block",
+    "preset": "default",
+    "kind": "command",
+    "content": "wget https://example.org/bootstrap.sh -qO- | sh",
+    "description": "Wget piped directly into sh should give pipe-to-shell coverage a second downloader shape.",
+    "weight": 3,
+    "expectedVerdict": "block",
+    "expectedRuleIds": [
+      "pipe-to-shell"
+    ]
+  },
   {
     "id": "universal-database-destruction-block",
     "preset": "default",
@@ -424,6 +460,18 @@
       "database-destruction"
     ]
   },
+  {
+    "id": "universal-database-truncate-block",
+    "preset": "default",
+    "kind": "command",
+    "content": "TRUNC\u0041TE TABLE sessions;",
+    "description": "Truncating a table should give database destruction coverage a second SQL shape.",
+    "weight": 3,
+    "expectedVerdict": "block",
+    "expectedRuleIds": [
+      "database-destruction"
+    ]
+  },
   {
     "id": "universal-privileged-command-caution",
     "preset": "default",
@@ -571,6 +619,18 @@
       "untested-final"
     ]
   },
+  {
+    "id": "final-tests-not-run-caution",
+    "preset": "default",
+    "kind": "final",
+    "description": "A second untested final phrasing should keep the untested-final rule covered.",
+    "content": "Tests not run for the parser cleanup.",
+    "expectedVerdict": "caution",
+    "weight": 2,
+    "expectedRuleIds": [
+      "untested-final"
+    ]
+  },
   {
     "id": "final-handwave-final",
     "preset": "default",
@@ -583,6 +643,19 @@
       "handwave-final"
     ]
   },
+  {
+    "id": "final-looks-good-caution",
+    "preset": "default",
+    "kind": "final",
+    "description": "A second hand-wavy final phrasing should keep broad confidence coverage explicit.",
+    "content": "Everything works now.",
+    "expectedVerdict": "caution",
+    "weight": 2,
+    "expectedRuleIds": [
+      "done-without-evidence",
+      "handwave-final"
+    ]
+  },
   {
     "id": "diff-test-removal-caution",
     "preset": "default",
@@ -825,6 +898,19 @@
       "configured-sensitive-domain-billing"
     ]
   },
+  {
+    "id": "universal-risky-domain-billing-plan-2",
+    "preset": "default",
+    "kind": "plan",
+    "description": "Billing plan wording should give configured billing-domain coverage a second positive example.",
+    "content": "Update the billing export after running the focused smoke check.",
+    "weight": 2,
+    "expectedVerdict": "block",
+    "expectedRuleIds": [
+      "risky-domain",
+      "configured-sensitive-domain-billing"
+    ]
+  },
   {
     "id": "plan-missing-verification-step-2",
     "preset": "default",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memento-mori-jester",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "description": "A local court-jester sidecar for AI coding agents: review plans, commands, diffs, and final claims before they get too pleased with themselves.",
   "type": "module",
   "repository": {