qa360 1.1.3 → 1.1.5

package/dist/commands/doctor.js

@@ -251,7 +251,7 @@ export class QA360Doctor {
     }
     async checkProofKeys() {
         try {
-            const { ensureProofKeys } = await import('qa360-core');
+            const { ensureProofKeys } = await import('../core/index.js');
             const result = await ensureProofKeys(this.qa360Dir);
             // Validate result
             if (!result) {
@@ -328,7 +328,7 @@ export class QA360Doctor {
     }
     async checkProofRoundtrip() {
         try {
-            const coreModule = await import('qa360-core');
+            const coreModule = await import('../core/index.js');
             const { generateKeys, createProofBundle, verifyProofBundle } = coreModule;
             // Guard: Verify exports are functions
             if (typeof generateKeys !== 'function') {

package/dist/core/proof/verifier.js

@@ -263,9 +263,9 @@ export async function verifyPhase3Proof(filePath) {
         }
         // Decode public key from proof
         const publicKey = new Uint8Array(Buffer.from(signature.publicKey, 'base64'));
-        // Canonicalize payload
+        // Canonicalize payload (same way it was signed)
         const { canonicalize } = await import('./canonicalize.js');
-        const canonical = canonicalize(payload);
+        const canonical = canonicalize(payload) + '\n';
         // Verify signature
         const isValid = verify(canonical, signature.value, publicKey);
         if (!isValid) {

package/dist/core/runner/phase3-runner.js

@@ -429,7 +429,7 @@ export class Phase3Runner {
             });
             // Record gate executions
             for (const gate of result.gates) {
-                await this.vault.recordGate(runId, {
+                await this.vault.recordGate(vaultRunId, {
                     name: gate.gate,
                     status: gate.success ? 'passed' : 'failed',
                     duration_ms: gate.duration,
@@ -437,7 +437,7 @@ export class Phase3Runner {
                 });
                 // Record finding if gate has error
                 if (gate.error) {
-                    await this.vault.recordFinding(runId, {
+                    await this.vault.recordFinding(vaultRunId, {
                         gate: gate.gate,
                         severity: 'high',
                         rule: 'gate-failure',

package/dist/schemas/pack.schema.json

@@ -0,0 +1,236 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://qa360.dev/schemas/pack.v1.json",
+  "title": "QA360 Pack Configuration v1",
+  "description": "Schema for QA360 test pack configuration files",
+  "type": "object",
+  "required": ["version", "name", "gates"],
+  "properties": {
+    "version": {
+      "type": "integer",
+      "const": 1,
+      "description": "Pack schema version"
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 100,
+      "pattern": "^[a-zA-Z0-9_-]+$",
+      "description": "Pack name (alphanumeric, underscore, hyphen only)"
+    },
+    "description": {
+      "type": "string",
+      "maxLength": 500,
+      "description": "Human-readable pack description"
+    },
+    "gates": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "enum": ["api_smoke", "ui", "perf", "sast", "dast", "a11y"]
+      },
+      "description": "Quality gates to execute"
+    },
+    "targets": {
+      "type": "object",
+      "properties": {
+        "api": {
+          "type": "object",
+          "properties": {
+            "baseUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "Base URL for API testing"
+            },
+            "smoke": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "pattern": "^(GET|POST|PUT|DELETE|PATCH) .+ -> \\d{3}$",
+                "description": "Smoke test definition: METHOD path -> expectedStatus"
+              }
+            }
+          },
+          "required": ["baseUrl"]
+        },
+        "web": {
+          "type": "object",
+          "properties": {
+            "baseUrl": {
+              "type": "string",
+              "format": "uri",
+              "description": "Base URL for web testing"
+            },
+            "pages": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "description": "Page paths to test"
+              }
+            }
+          },
+          "required": ["baseUrl"]
+        }
+      },
+      "description": "Test targets configuration"
+    },
+    "budgets": {
+      "type": "object",
+      "properties": {
+        "perf_p95_ms": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 30000,
+          "description": "Performance budget: 95th percentile response time in ms"
+        },
+        "a11y_min": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100,
+          "description": "Accessibility minimum score (0-100)"
+        }
+      },
+      "description": "Performance and quality budgets"
+    },
+    "security": {
+      "type": "object",
+      "properties": {
+        "sast_max_high": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Maximum allowed high-severity SAST findings"
+        },
+        "secrets_leak": {
+          "type": "integer",
+          "const": 0,
+          "description": "Secrets leak tolerance (must be 0)"
+        }
+      },
+      "description": "Security constraints"
+    },
+    "data": {
+      "type": "object",
+      "properties": {
+        "profile": {
+          "type": "string",
+          "enum": ["demo", "staging", "production"],
+          "description": "Data profile to use"
+        },
+        "seed": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Random seed for reproducible data generation"
+        }
+      },
+      "description": "Test data configuration"
+    },
+    "hooks": {
+      "type": "object",
+      "properties": {
+        "beforeAll": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "run": {
+                "type": "string",
+                "description": "Command to execute"
+              },
+              "timeout": {
+                "type": "integer",
+                "minimum": 1000,
+                "default": 30000,
+                "description": "Timeout in milliseconds"
+              }
+            },
+            "required": ["run"]
+          },
+          "description": "Commands to run before all tests"
+        },
+        "afterAll": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "run": {
+                "type": "string",
+                "description": "Command to execute"
+              },
+              "timeout": {
+                "type": "integer",
+                "minimum": 1000,
+                "default": 30000,
+                "description": "Timeout in milliseconds"
+              }
+            },
+            "required": ["run"]
+          },
+          "description": "Commands to run after all tests"
+        }
+      },
+      "description": "Lifecycle hooks"
+    },
+    "execution": {
+      "type": "object",
+      "properties": {
+        "retry_on": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["ECONNRESET", "ETIMEDOUT", "502", "503", "504", "element-detached", "navigation-timeout"]
+          },
+          "description": "Error patterns that trigger retries"
+        },
+        "max_retries": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 5,
+          "default": 1,
+          "description": "Maximum number of retries per test"
+        },
+        "fail_on_readiness": {
+          "type": "boolean",
+          "default": true,
+          "description": "Fail if readiness checks fail"
+        },
+        "timeout": {
+          "type": "integer",
+          "minimum": 1000,
+          "default": 30000,
+          "description": "Global timeout per test in milliseconds"
+        }
+      },
+      "description": "Execution configuration"
+    },
+    "observability": {
+      "type": "object",
+      "properties": {
+        "metrics": {
+          "type": "boolean",
+          "default": true,
+          "description": "Enable metrics collection"
+        },
+        "trace": {
+          "type": "string",
+          "enum": ["none", "basic", "detailed"],
+          "default": "basic",
+          "description": "Tracing level"
+        }
+      },
+      "description": "Observability settings"
+    },
+    "environment": {
+      "type": "object",
+      "patternProperties": {
+        "^[A-Z_][A-Z0-9_]*$": {
+          "type": "string",
+          "description": "Environment variable value or secret reference"
+        }
+      },
+      "description": "Environment variables and secrets"
+    }
+  },
+  "additionalProperties": false
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qa360",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "QA360 Proof CLI - Quality as Cryptographic Proof",
   "type": "module",
   "main": "dist/index.js",