mjolnir-qa 0.5.15 → 0.5.17

package/CHANGELOG.md

@@ -9,7 +9,19 @@ Rule behavior changes (new rules, FP-rate changes against the corpus,
 severity changes) are first-class entries here — rule IDs are immutable
 once shipped, so this file is the record of what changed between versions.
 
-# [0.5.4] — 2026-09-06
+## [0.5.17] — 2026-09-07
+
+### Changes since 0.5.16
+
+- Fixture integrity gate: Layer A structural typecheck, doctor fixture-integrity, Python tier (F1, D9, G3) (#53)
+
+## [0.5.16] — 2026-09-07
+
+### Changes since 0.5.15
+
+- Curation + mechanical hygiene: QA-PW-124 D3 alignment, F7-F10 closures (#51)
+
+## [0.5.4] — 2026-09-06
 
 ### Agent Handoff + Minimized Reporting (plan 1788599400000)
 

package/dist/cli.d.mts

@@ -699,7 +699,7 @@ declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniver
  * `scripts/sync-sarif-version.cjs` on release and guarded by
  * `tests/version-consistency.spec.ts` locally.
  */
-declare const CLI_VERSION = "0.5.15";
+declare const CLI_VERSION = "0.5.17";
 /** A usage-error detail: the offending token, when one exists. */
 interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */

package/dist/cli.mjs

@@ -5403,6 +5403,13 @@ const pwNoTraceOnRetry = defineRule({
 * QA-PW-124 — Projects defined but no smoke/regression split.
 * Severity: info · Confidence: high · deterministic-defect
 * One monolithic project forces full-suite-or-nothing; PR feedback dies.
+*
+* detectorRevision 2 (certification-audit D3, 2026-09-07): the rule is now
+* DECLARED as a config-gated rule (`configRule` + `configFiles`) instead of
+* relying only on its internal basename gate — same gating surface as
+* QA-PW-121/122/141/143/144. Detection logic is unchanged (the internal
+* basename gate remains as defense in depth), so scan output is
+* byte-identical; the revision bump declares the metadata change per §07.
 */
 const pwNoProjectSplit = defineRule({
 	id: "QA-PW-124",
@@ -5413,13 +5420,16 @@ const pwNoProjectSplit = defineRule({
 	findingType: "heuristic-risk",
 	qaImpact: "HYGIENE",
 	appliesTo: "test-files",
+	configRule: true,
+	configFiles: ["^playwright\\.config\\.(?:ts|js|mjs|cts)$"],
 	languages: ["typescript", "javascript"],
 	frameworks: ["playwright"],
 	falsePositiveRisk: "low",
 	autofix: false,
 	detectionStrategy: "LEXICAL",
-	detectionNotes: "regex heuristic",
+	detectionNotes: "regex heuristic over playwright.config.* (adapter-gated)",
 	introduced: "0.3.0",
+	detectorRevision: 2,
 	run(ctx) {
 		const text = ctx.text;
 		const findings = [];
@@ -13254,7 +13264,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.15",
+			version: "0.5.17",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -17816,6 +17826,63 @@ function checkQuarantineEnforcement(rules = RULES) {
 		details
 	};
 }
+/**
+* Check 8 (certification-audit Phase 2.5, plan G3 Layer A support):
+* fixture-integrity — deterministic structural census of the fixture
+* trees. Complements the fixture firewall (which proves must-fire /
+* must-not-fire PRESENCE per rule) with: orphaned fixture dirs (no
+* registered rule), empty dirs, and the Layer A typecheck allowlist
+* census. Blocking: an orphaned dir or an empty fixture dir means the
+* structural layer has silently drifted.
+*/
+function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
+	const details = [];
+	let ok = true;
+	const registeredIds = new Set(rules.map((r) => r.id));
+	const fixtureRoots = [fixturesRoot, join(fixturesRoot, "..", "corpus", "positive-fixtures")];
+	let fixtureFiles = 0;
+	let fixtureDirs = 0;
+	for (const root of fixtureRoots) {
+		if (!existsSync(root)) continue;
+		for (const entry of readdirSync(root, { withFileTypes: true })) {
+			if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
+			fixtureDirs++;
+			const ruleId = entry.name;
+			if (!registeredIds.has(ruleId)) {
+				ok = false;
+				details.push(`orphaned fixture dir (no registered rule): ${ruleId}`);
+				continue;
+			}
+			const sub = join(root, ruleId);
+			for (const child of readdirSync(sub, { withFileTypes: true })) if (child.isDirectory()) {
+				const files = nonHiddenFiles(join(sub, child.name));
+				fixtureFiles += files.length;
+				if (files.length === 0) {
+					ok = false;
+					details.push(`empty fixture dir: ${ruleId}/${child.name}`);
+				}
+			} else if (!child.name.startsWith(".")) fixtureFiles++;
+		}
+	}
+	const allowlistPath = join(fixturesRoot, "typecheck-allowlist.json");
+	if (existsSync(allowlistPath)) try {
+		const parsed = JSON.parse(readFileSync(allowlistPath, "utf8"));
+		if (Array.isArray(parsed.entries)) details.push(`Layer A typecheck allowlist: ${parsed.entries.length} justified entr(ies)`);
+		else {
+			ok = false;
+			details.push("typecheck-allowlist.json entries is not an array");
+		}
+	} catch {
+		ok = false;
+		details.push("typecheck-allowlist.json is unreadable/malformed");
+	}
+	details.unshift(`fixture trees: ${fixtureDirs} rule dirs, ${fixtureFiles} fixture files — orphaned dirs and empty dirs are blocking`);
+	return {
+		name: "fixture-integrity",
+		ok,
+		details
+	};
+}
 function runDoctorSelfAudit(fixturesRoot) {
 	const verdictsDir = join(fixturesRoot, "..", "corpus", "verdicts");
 	const checks = [
@@ -17825,7 +17892,8 @@ function runDoctorSelfAudit(fixturesRoot) {
 		checkEvidenceHonesty(),
 		checkTierEnforcement(verdictsDir),
 		checkAntiCreep(),
-		checkQuarantineEnforcement()
+		checkQuarantineEnforcement(),
+		checkFixtureIntegrity(fixturesRoot)
 	];
 	return {
 		checks,
@@ -18064,7 +18132,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.15";
+const CLI_VERSION = "0.5.17";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",

package/dist/mcp/stdio.mjs

@@ -5402,6 +5402,13 @@ const pwNoTraceOnRetry = defineRule({
 * QA-PW-124 — Projects defined but no smoke/regression split.
 * Severity: info · Confidence: high · deterministic-defect
 * One monolithic project forces full-suite-or-nothing; PR feedback dies.
+*
+* detectorRevision 2 (certification-audit D3, 2026-09-07): the rule is now
+* DECLARED as a config-gated rule (`configRule` + `configFiles`) instead of
+* relying only on its internal basename gate — same gating surface as
+* QA-PW-121/122/141/143/144. Detection logic is unchanged (the internal
+* basename gate remains as defense in depth), so scan output is
+* byte-identical; the revision bump declares the metadata change per §07.
 */
 const pwNoProjectSplit = defineRule({
 	id: "QA-PW-124",
@@ -5412,13 +5419,16 @@ const pwNoProjectSplit = defineRule({
 	findingType: "heuristic-risk",
 	qaImpact: "HYGIENE",
 	appliesTo: "test-files",
+	configRule: true,
+	configFiles: ["^playwright\\.config\\.(?:ts|js|mjs|cts)$"],
 	languages: ["typescript", "javascript"],
 	frameworks: ["playwright"],
 	falsePositiveRisk: "low",
 	autofix: false,
 	detectionStrategy: "LEXICAL",
-	detectionNotes: "regex heuristic",
+	detectionNotes: "regex heuristic over playwright.config.* (adapter-gated)",
 	introduced: "0.3.0",
+	detectorRevision: 2,
 	run(ctx) {
 		const text = ctx.text;
 		const findings = [];
@@ -13253,7 +13263,7 @@ function renderSarif(result, repoRootUri) {
 		tool: { driver: {
 			name: "Mjölnir",
 			informationUri: "https://github.com/Sergey-Bar/Mjolnir",
-			version: "0.5.15",
+			version: "0.5.17",
 			rules: [...rules.values()].map((r) => {
 				const meta = RULES.find((x) => x.id === r.id);
 				return {
@@ -17298,6 +17308,63 @@ function checkQuarantineEnforcement(rules = RULES) {
 		details
 	};
 }
+/**
+* Check 8 (certification-audit Phase 2.5, plan G3 Layer A support):
+* fixture-integrity — deterministic structural census of the fixture
+* trees. Complements the fixture firewall (which proves must-fire /
+* must-not-fire PRESENCE per rule) with: orphaned fixture dirs (no
+* registered rule), empty dirs, and the Layer A typecheck allowlist
+* census. Blocking: an orphaned dir or an empty fixture dir means the
+* structural layer has silently drifted.
+*/
+function checkFixtureIntegrity(fixturesRoot, rules = RULES) {
+	const details = [];
+	let ok = true;
+	const registeredIds = new Set(rules.map((r) => r.id));
+	const fixtureRoots = [fixturesRoot, join(fixturesRoot, "..", "corpus", "positive-fixtures")];
+	let fixtureFiles = 0;
+	let fixtureDirs = 0;
+	for (const root of fixtureRoots) {
+		if (!existsSync(root)) continue;
+		for (const entry of readdirSync(root, { withFileTypes: true })) {
+			if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
+			fixtureDirs++;
+			const ruleId = entry.name;
+			if (!registeredIds.has(ruleId)) {
+				ok = false;
+				details.push(`orphaned fixture dir (no registered rule): ${ruleId}`);
+				continue;
+			}
+			const sub = join(root, ruleId);
+			for (const child of readdirSync(sub, { withFileTypes: true })) if (child.isDirectory()) {
+				const files = nonHiddenFiles(join(sub, child.name));
+				fixtureFiles += files.length;
+				if (files.length === 0) {
+					ok = false;
+					details.push(`empty fixture dir: ${ruleId}/${child.name}`);
+				}
+			} else if (!child.name.startsWith(".")) fixtureFiles++;
+		}
+	}
+	const allowlistPath = join(fixturesRoot, "typecheck-allowlist.json");
+	if (existsSync(allowlistPath)) try {
+		const parsed = JSON.parse(readFileSync(allowlistPath, "utf8"));
+		if (Array.isArray(parsed.entries)) details.push(`Layer A typecheck allowlist: ${parsed.entries.length} justified entr(ies)`);
+		else {
+			ok = false;
+			details.push("typecheck-allowlist.json entries is not an array");
+		}
+	} catch {
+		ok = false;
+		details.push("typecheck-allowlist.json is unreadable/malformed");
+	}
+	details.unshift(`fixture trees: ${fixtureDirs} rule dirs, ${fixtureFiles} fixture files — orphaned dirs and empty dirs are blocking`);
+	return {
+		name: "fixture-integrity",
+		ok,
+		details
+	};
+}
 function runDoctorSelfAudit(fixturesRoot) {
 	const verdictsDir = join(fixturesRoot, "..", "corpus", "verdicts");
 	const checks = [
@@ -17307,7 +17374,8 @@ function runDoctorSelfAudit(fixturesRoot) {
 		checkEvidenceHonesty(),
 		checkTierEnforcement(verdictsDir),
 		checkAntiCreep(),
-		checkQuarantineEnforcement()
+		checkQuarantineEnforcement(),
+		checkFixtureIntegrity(fixturesRoot)
 	];
 	return {
 		checks,
@@ -17700,7 +17768,7 @@ const { runScan, buildUniversalRules, fallbackWorkspace, pathMatchesGlob, isVali
 * `scripts/sync-sarif-version.cjs` on release and guarded by
 * `tests/version-consistency.spec.ts` locally.
 */
-const CLI_VERSION = "0.5.15";
+const CLI_VERSION = "0.5.17";
 function parseArgs(argv, onError) {
 	const args = {
 		target: ".",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mjolnir-qa",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "Mjölnir — the Verification Trust Engine for QA. Audits test suites and CI pipelines, reports a worthiness score and prioritized findings.",
   "type": "module",
   "engines": {
@@ -28,7 +28,7 @@
     "test:watch": "vitest",
     "lint": "eslint . --max-warnings=0 && prettier --check .",
     "format": "prettier --write .",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json && tsx scripts/typecheck-fixtures.ts",
     "golden:update": "tsx tests/golden/gen.ts",
     "corpus:regression": "tsx tests/corpus/audit.ts",
     "corpus:regression:update": "tsx tests/corpus/audit.ts --update",
@@ -87,7 +87,6 @@
     "@playwright/test": "^1.50.0",
     "@types/node": "^26.4.0",
     "@vitest/coverage-istanbul": "^4.1.11",
-    "@vitest/coverage-v8": "^4.1.11",
     "axe-core": "^4.13.0",
     "eslint": "^10.9.1",
     "eslint-plugin-regexp": "^3.3.0",