qa360 2.1.2 → 2.1.4

package/core/src/runner/phase3-runner.ts

@@ -0,0 +1,1236 @@
+/**
+ * QA360 Phase 3 Runner
+ * Orchestrates hooks, adapters, and proof generation
+ * Supports both Pack v1 and Pack v2 configurations
+ */
+
+import { existsSync, writeFileSync, mkdirSync } from 'fs';
+import { join } from 'path';
+import { createHash } from 'crypto';
+import chalk from 'chalk';
+import { PackConfigV1 } from '../types/pack-v1.js';
+import { PackConfigV2, AuthConfigV2, GateConfigV2 } from '../types/pack-v2.js';
+import { HooksRunner } from '../hooks/runner.js';
+import { PlaywrightNativeApiAdapter } from '../adapters/playwright-native-api.js';
+import { PlaywrightUiAdapter } from '../adapters/playwright-ui.js';
+import { K6PerfAdapter } from '../adapters/k6-perf.js';
+import { SemgrepSastAdapter } from '../adapters/semgrep-sast.js';
+import { SecurityRedactor } from '../security/redactor.js';
+import { initializeKeys, sign, KeyPair } from '../proof/signer.js';
+import { canonicalize } from '../proof/canonicalize.js';
+import { EvidenceVault, RunRecord, GateRecord, FindingRecord } from '../vault/index.js';
+import { AuthManager, AuthConfig, AuthCredentials } from '../auth/index.js';
+import {
+  FlakinessDetector,
+  TestResult as FlakyTestResult,
+  FlakinessResult,
+  FlakinessCategory,
+  formatFlakinessScore,
+  generateTestId,
+  DEFAULT_FLAKINESS_OPTIONS
+} from '../flakiness/index.js';
+
+export type PackConfig = PackConfigV1 | PackConfigV2;
+
+export interface Phase3RunnerOptions {
+  workingDir: string;
+  pack: PackConfig;
+  outputDir?: string;
+  /** Enable flakiness detection (runs tests N times consecutively) */
+  flakyDetect?: boolean;
+  /** Number of consecutive runs for flakiness detection (default: 3) */
+  flakyRuns?: number;
+}
+
+export interface GateResult {
+  gate: string;
+  success: boolean;
+  duration: number;
+  adapter: string;
+  results: any;
+  junit?: string;
+  error?: string;
+}
+
+export interface Phase3RunResult {
+  success: boolean;
+  pack: PackConfig;
+  duration: number;
+  gates: GateResult[];
+  hooks: {
+    beforeAll: any[];
+    beforeEach: any[];
+    afterEach: any[];
+    afterAll: any[];
+  };
+  summary: {
+    total: number;
+    passed: number;
+    failed: number;
+    trustScore: number;
+  };
+  /** Flakiness analysis results (if enabled) */
+  flakiness?: FlakinessResult[];
+  proofPath?: string;
+  /** Vault run ID for this execution */
+  runId?: string;
+  error?: string;
+}
+
+export class Phase3Runner {
+  private workingDir: string;
+  private pack: PackConfig;
+  private outputDir: string;
+  private redactor: SecurityRedactor;
+  private hooksRunner: HooksRunner;
+  private keyPair?: KeyPair;
+  private vault?: EvidenceVault;
+  private authManager: AuthManager;
+  private authCredentialsCache = new Map<string, AuthCredentials>();
+  private flakyDetect: boolean;
+  private flakyRuns: number;
+  private flakinessDetector: FlakinessDetector;
+
+  constructor(options: Phase3RunnerOptions) {
+    this.workingDir = options.workingDir;
+    this.pack = options.pack;
+    this.outputDir = options.outputDir || join(this.workingDir, '.qa360', 'runs');
+    this.redactor = SecurityRedactor.forLogs();
+    this.authManager = new AuthManager();
+    this.flakyDetect = options.flakyDetect || false;
+    this.flakyRuns = options.flakyRuns || DEFAULT_FLAKINESS_OPTIONS.consecutiveRuns;
+    this.flakinessDetector = new FlakinessDetector({
+      consecutiveRuns: this.flakyRuns,
+      minRuns: 2,
+      enablePatternDetection: true
+    });
+
+    // Initialize hooks runner (convert v2 hooks to v1 format if needed)
+    const hooks = this.isPackV2(options.pack)
+      ? this.convertV2HooksToV1(options.pack.hooks)
+      : options.pack.hooks;
+
+    this.hooksRunner = new HooksRunner({
+      workingDir: this.workingDir,
+      hooks: hooks || {},
+      execution: this.isPackV2(options.pack) ? this.convertV2ExecutionToV1(options.pack.execution) : options.pack.execution,
+      redactor: this.redactor
+    });
+
+    // Register auth profiles from pack v2
+    if (this.isPackV2(options.pack) && options.pack.auth?.profiles) {
+      this.registerAuthProfiles(options.pack.auth.profiles);
+    }
+  }
+
+  /**
+   * Type guard to check if pack is v2
+   */
+  private isPackV2(pack: PackConfig): pack is PackConfigV2 {
+    return (pack as PackConfigV2).version === 2;
+  }
+
+  /**
+   * Register authentication profiles from pack config
+   */
+  private registerAuthProfiles(profiles: Record<string, any>): void {
+    for (const [name, profile] of Object.entries(profiles)) {
+      // Convert v2 auth profile to auth module format
+      const authConfig: AuthConfig = {
+        type: profile.type || 'none',
+        ...profile.config
+      };
+      this.authManager.registerProfile(name, authConfig);
+    }
+  }
+
+  /**
+   * Get auth profile name for a specific gate
+   */
+  private getAuthProfileForGate(gateName: string): string | undefined {
+    if (!this.isPackV2(this.pack) || !this.pack.auth) {
+      return undefined;
+    }
+
+    const authConfig = this.pack.auth as AuthConfigV2;
+
+    // Check if gate has specific auth override
+    const gateConfig = (this.pack.gates as Record<string, GateConfigV2>)[gateName];
+    if (gateConfig?.auth) {
+      return gateConfig.auth;
+    }
+
+    // Use default based on gate type
+    if (gateName === 'api_smoke' || gateName === 'api') {
+      return authConfig.api;
+    }
+    if (gateName === 'ui' || gateName === 'a11y') {
+      return authConfig.ui;
+    }
+
+    return undefined;
+  }
+
+  /**
+   * Authenticate and get credentials for a gate
+   */
+  private async getCredentialsForGate(gateName: string): Promise<AuthCredentials | undefined> {
+    const profileName = this.getAuthProfileForGate(gateName);
+
+    if (!profileName) {
+      return undefined;
+    }
+
+    // Check cache first
+    if (this.authCredentialsCache.has(profileName)) {
+      return this.authCredentialsCache.get(profileName);
+    }
+
+    // Authenticate
+    const result = await this.authManager.authenticate(profileName);
+
+    if (result.success && result.credentials) {
+      this.authCredentialsCache.set(profileName, result.credentials);
+      return result.credentials;
+    }
+
+    console.log(chalk.yellow(`    ⚠️  Auth failed for profile '${profileName}': ${result.error}`));
+    return undefined;
+  }
+
+  /**
+   * Convert v2 hooks to v1 format
+   */
+  private convertV2HooksToV1(hooks?: any): any {
+    if (!hooks) return undefined;
+
+    // v2 hooks use { type, command, ... } format
+    // v1 hooks use { run, timeout } format
+    const converted: any = {
+      beforeAll: [],
+      afterAll: [],
+      beforeEach: [],
+      afterEach: []
+    };
+
+    for (const [phase, phaseHooks] of Object.entries(hooks)) {
+      if (Array.isArray(phaseHooks)) {
+        converted[phase] = (phaseHooks as any[]).map((h: any) => {
+          if (h.type === 'run' || h.type === 'script') {
+            return { run: h.command, timeout: h.timeout, cwd: h.cwd, env: h.env };
+          }
+          if (h.type === 'wait_on') {
+            return { run: `npx wait-on ${h.wait_for?.resource || h.command}`, timeout: h.timeout };
+          }
+          if (h.type === 'docker') {
+            return { run: `docker compose ${h.compose?.command || 'up -d'}`, timeout: h.timeout };
+          }
+          return h;
+        });
+      }
+    }
+
+    return converted;
+  }
+
+  /**
+   * Convert v2 execution config to v1 format
+   */
+  private convertV2ExecutionToV1(execution?: any): any {
+    if (!execution) return undefined;
+
+    return {
+      timeout: execution.default_timeout || execution.timeout,
+      max_retries: execution.default_retries || execution.retries,
+      on_failure: execution.on_failure || 'continue'
+    };
+  }
+
+  /**
+   * Get gates array from pack (handles v1 and v2)
+   */
+  private getGatesArray(): string[] {
+    if (this.isPackV2(this.pack)) {
+      return Object.keys(this.pack.gates).filter(gateName => {
+        const gateConfig = (this.pack.gates as Record<string, GateConfigV2>)[gateName];
+        return gateConfig?.enabled !== false;
+      });
+    }
+    return (this.pack as PackConfigV1).gates || [];
+  }
+
+  /**
+   * Execute complete Phase 3 workflow
+   */
+  async run(): Promise<Phase3RunResult> {
+    const startTime = Date.now();
+
+    const gatesArray = this.getGatesArray();
+
+    console.log(chalk.bold.blue(`\n🚀 QA360 Phase 3 Runner - ${this.pack.name}`));
+    console.log(chalk.gray(`Gates: ${gatesArray.join(', ')}`));
+    
+    try {
+      // Ensure output directory exists
+      this.ensureOutputDir();
+      
+      // Initialize cryptographic keys
+      console.log(chalk.blue('\n🔑 Initializing Ed25519 keys...'));
+      this.keyPair = await initializeKeys();
+      console.log(chalk.green('   ✅ Keys ready'));
+      
+      // Initialize Evidence Vault
+      console.log(chalk.blue('\n🗄️  Initializing Evidence Vault...'));
+      const vaultDir = join(this.workingDir, '.qa360');
+      this.vault = await EvidenceVault.open(vaultDir);
+      console.log(chalk.green('   ✅ Vault ready'));
+      
+      // Execute beforeAll hooks
+      console.log(chalk.blue('\n🔗 Phase 1: Setup Hooks'));
+      const beforeAllResults = await this.hooksRunner.executeHooks('beforeAll');
+      
+      // Check if setup failed and should stop
+      const setupFailed = beforeAllResults.some(r => !r.success);
+      if (setupFailed && this.pack.execution?.on_failure === 'stop') {
+        throw new Error('Setup hooks failed, stopping execution');
+      }
+      
+      // Execute gates
+      console.log(chalk.blue('\n🎯 Phase 2: Quality Gates'));
+      const gateResults: GateResult[] = [];
+
+      for (const gate of gatesArray) {
+        const gateResult = await this.executeGate(gate);
+        gateResults.push(gateResult);
+
+        // Check if gate failed and should stop
+        if (!gateResult.success && this.pack.execution?.on_failure === 'stop') {
+          console.log(chalk.yellow(`🛑 Gate ${gate} failed, stopping execution`));
+          break;
+        }
+      }
+
+      // Flakiness Detection Phase (Vision 2.0)
+      let flakinessResults: FlakinessResult[] | undefined;
+      if (this.flakyDetect) {
+        console.log(chalk.blue(`\n🎲 Phase 2.5: Flakiness Detection (${this.flakyRuns} consecutive runs)`));
+        flakinessResults = await this.detectFlakiness(gateResults);
+
+        // Display flakiness summary
+        const unstableCount = flakinessResults.filter(f =>
+          f.category === FlakinessCategory.UNSTABLE || f.category === FlakinessCategory.SHAKY
+        ).length;
+
+        if (unstableCount > 0) {
+          console.log(chalk.yellow(`   ⚠️  ${unstableCount} test(s) show flaky behavior`));
+        } else {
+          console.log(chalk.green('   ✅ All tests stable - no flakiness detected'));
+        }
+      }
+
+      // Execute afterAll hooks
+      console.log(chalk.blue('\n🔗 Phase 3: Cleanup Hooks'));
+      const afterAllResults = await this.hooksRunner.executeHooks('afterAll');
+      
+      // Calculate results
+      const duration = Date.now() - startTime;
+      const summary = this.calculateSummary(gateResults);
+      const success = summary.failed === 0;
+
+      // Generate proof
+      console.log(chalk.blue('\n📋 Phase 4: Proof Generation'));
+      const proofPath = await this.generateProof({
+        success,
+        pack: this.pack,
+        duration,
+        gates: gateResults,
+        hooks: {
+          beforeAll: beforeAllResults,
+          beforeEach: [],
+          afterEach: [],
+          afterAll: afterAllResults
+        },
+        summary
+      });
+
+      // Save to Evidence Vault
+      console.log(chalk.blue('\n💾 Phase 5: Evidence Storage'));
+      const proofRunId = proofPath.split('/').pop()?.replace('-proof.json', '') || 'unknown';
+      const vaultRunId = await this.saveToVault(proofRunId, {
+        success,
+        pack: this.pack,
+        duration,
+        gates: gateResults,
+        hooks: {
+          beforeAll: beforeAllResults,
+          beforeEach: [],
+          afterEach: [],
+          afterAll: afterAllResults
+        },
+        summary,
+        proofPath
+      }, proofPath, flakinessResults, startTime);
+
+      // Final summary
+      console.log(chalk.blue('\n📊 Execution Summary'));
+      console.log(`  Duration: ${duration}ms`);
+      console.log(`  Gates: ${summary.passed}/${summary.total} passed`);
+      console.log(`  Trust Score: ${summary.trustScore}%`);
+      console.log(`  Proof: ${proofPath}`);
+
+      // Display flakiness details if enabled
+      if (flakinessResults && flakinessResults.length > 0) {
+        console.log(chalk.blue('\n🎲 Flakiness Scores:'));
+        for (const f of flakinessResults) {
+          const scoreFormatted = formatFlakinessScore(f.score);
+          const categoryMeta = {
+            [FlakinessCategory.LEGENDARY]: { emoji: '🟢', color: chalk.green },
+            [FlakinessCategory.SOLID]: { emoji: '🟢', color: chalk.green },
+            [FlakinessCategory.GOOD]: { emoji: '🟡', color: chalk.yellow },
+            [FlakinessCategory.SHAKY]: { emoji: '🟠', color: chalk.hex('#F97316') },
+            [FlakinessCategory.UNSTABLE]: { emoji: '🔴', color: chalk.red }
+          }[f.category];
+
+          console.log(`  ${categoryMeta.color(`${f.testName}: ${scoreFormatted}`)} (${f.successfulRuns}/${f.totalRuns} passes)`);
+          if (f.suggestedFix) {
+            console.log(chalk.gray(`     💡 ${f.suggestedFix}`));
+          }
+        }
+      }
+
+      if (success) {
+        console.log(chalk.green('\n✅ All quality gates passed!'));
+      } else {
+        console.log(chalk.red(`\n❌ ${summary.failed} quality gate(s) failed`));
+      }
+
+      return {
+        success,
+        pack: this.pack,
+        duration,
+        gates: gateResults,
+        hooks: {
+          beforeAll: beforeAllResults,
+          beforeEach: [],
+          afterEach: [],
+          afterAll: afterAllResults
+        },
+        summary,
+        flakiness: flakinessResults,
+        proofPath,
+        runId: vaultRunId
+      };
+      
+    } catch (error) {
+      const duration = Date.now() - startTime;
+      
+      // Ensure cleanup even on error
+      try {
+        await this.hooksRunner.executeHooks('afterAll');
+      } catch {
+        // Ignore cleanup errors
+      }
+      
+      return {
+        success: false,
+        pack: this.pack,
+        duration,
+        gates: [],
+        hooks: { beforeAll: [], beforeEach: [], afterEach: [], afterAll: [] },
+        summary: { total: 0, passed: 0, failed: 0, trustScore: 0 },
+        error: this.redactor.redact(error instanceof Error ? error.message : 'Unknown error')
+      };
+    }
+  }
+
+  /**
+   * Execute a single quality gate
+   */
+  private async executeGate(gate: string): Promise<GateResult> {
+    const startTime = Date.now();
+
+    console.log(chalk.cyan(`\n  🎯 Gate: ${gate}`));
+
+    try {
+      let result: any;
+      let adapter: string;
+
+      // Check if this is a v2 pack with dynamic gate configuration
+      if (this.isPackV2(this.pack)) {
+        const gateConfig = (this.pack.gates as Record<string, any>)[gate];
+        if (gateConfig) {
+          return await this.executeDynamicGate(gate, gateConfig);
+        }
+      }
+
+      // Legacy v1 gates or predefined gates
+      switch (gate) {
+        case 'api_smoke':
+          adapter = 'playwright-native-api';
+          result = await this.runApiSmokeGate();
+          break;
+
+        case 'ui':
+          adapter = 'playwright-ui';
+          result = await this.runUiGate();
+          break;
+
+        case 'a11y':
+          adapter = 'playwright-ui';
+          result = await this.runA11yGate();
+          break;
+
+        case 'perf':
+          adapter = 'k6';
+          result = await this.runPerfGate();
+          break;
+
+        case 'sast':
+          adapter = 'semgrep';
+          result = await this.runSastGate();
+          break;
+
+        case 'dast':
+          adapter = 'zap';
+          result = await this.runDastGate();
+          break;
+
+        default:
+          throw new Error(`Unknown gate: ${gate}`);
+      }
+
+      const duration = Date.now() - startTime;
+
+      if (result.success) {
+        console.log(chalk.green(`    ✅ ${gate} passed (${duration}ms)`));
+      } else {
+        console.log(chalk.red(`    ❌ ${gate} failed (${duration}ms)`));
+        if (result.error) {
+          console.log(chalk.red(`    🔍 ${result.error}`));
+        }
+      }
+
+      return {
+        gate,
+        success: result.success,
+        duration,
+        adapter,
+        results: result,
+        junit: result.junit,
+        error: result.error
+      };
+      
+    } catch (error) {
+      const duration = Date.now() - startTime;
+      const errorMessage = this.redactor.redact(error instanceof Error ? error.message : 'Unknown error');
+
+      console.log(chalk.red(`    💥 ${gate} crashed (${duration}ms): ${errorMessage}`));
+
+      return {
+        gate,
+        success: false,
+        duration,
+        adapter: 'unknown',
+        results: null,
+        error: errorMessage
+      };
+    }
+  }
+
+  /**
+   * Execute a dynamic v2 gate
+   */
+  private async executeDynamicGate(gateName: string, gateConfig: any): Promise<GateResult> {
+    const startTime = Date.now();
+    const adapterType = gateConfig.adapter || gateConfig.type;
+
+    if (!adapterType) {
+      throw new Error(`Gate '${gateName}' must specify an adapter`);
+    }
+
+    // Get auth credentials for this gate
+    const credentials = await this.getCredentialsForGate(gateName);
+
+    // Map adapter type to implementation
+    let result: GateResult;
+    switch (adapterType) {
+      case 'playwright-api':
+        result = await this.executePlaywrightApiGate(gateName, gateConfig, credentials);
+        break;
+
+      case 'playwright-ui':
+        result = await this.executePlaywrightUiGate(gateName, gateConfig, credentials);
+        break;
+
+      case 'k6':
+      case 'k6-perf':
+        result = await this.executeK6PerfGate(gateName, gateConfig);
+        break;
+
+      case 'semgrep':
+      case 'sast':
+        result = await this.executeSemgrepSastGate(gateName, gateConfig);
+        break;
+
+      default:
+        throw new Error(`Unsupported adapter: '${adapterType}' for gate '${gateName}'`);
+    }
+
+    // Set duration
+    result.duration = Date.now() - startTime;
+
+    // Log result
+    if (result.success) {
+      console.log(chalk.green(`    ✅ ${gateName} passed (${result.duration}ms)`));
+    } else {
+      console.log(chalk.red(`    ❌ ${gateName} failed (${result.duration}ms)`));
+      if (result.error) {
+        console.log(chalk.red(`    🔍 ${result.error}`));
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Execute Playwright API gate with v2 config
+   * Uses PlaywrightNativeApiAdapter for zero-overhead HTTP testing
+   */
+  private async executePlaywrightApiGate(gateName: string, gateConfig: any, credentials?: any): Promise<GateResult> {
+    const { PlaywrightNativeApiAdapter } = await import('../adapters/playwright-native-api.js');
+    const adapter = new PlaywrightNativeApiAdapter();
+
+    // Transform v2 config to adapter format
+    const gateConfigData = gateConfig.config || {};
+    const gateOptions = gateConfig.options || {};
+
+    const config = {
+      target: {
+        baseUrl: gateConfigData.baseUrl,
+        smoke: gateConfigData.smoke
+      },
+      budgets: gateConfigData.budgets,
+      timeout: gateOptions.timeout || gateConfigData.timeout,
+      retries: gateOptions.retries || gateConfigData.retries,
+      auth: credentials
+    };
+
+    const result = await adapter.runSmokeTests(config);
+    return {
+      gate: gateName,
+      success: result.success,
+      duration: 0, // Will be set by caller
+      adapter: 'playwright-native-api',
+      results: result,
+      junit: result.junit
+    };
+  }
+
+  /**
+   * Execute Playwright UI gate with v2 config
+   */
+  private async executePlaywrightUiGate(gateName: string, gateConfig: any, credentials?: any): Promise<GateResult> {
+    const { PlaywrightUiAdapter } = await import('../adapters/playwright-ui.js');
+    const adapter = new PlaywrightUiAdapter();
+
+    // Transform v2 config to adapter format
+    // v2: { baseUrl, pages: [{ url: '/', expectedElements: [...] }] }
+    // adapter expects: { target: { baseUrl, pages: ['https://.../'] } }
+    const gateConfigData = gateConfig.config || {};
+    const gateOptions = gateConfig.options || {};
+
+    // Transform page objects to full URLs
+    // v2 pages format: [{ url: '/', expectedElements: [...] }] or ['/', '/about']
+    const rawPages = gateConfigData.pages;
+    let pages: string[] | undefined;
+    if (rawPages && Array.isArray(rawPages) && rawPages.length > 0) {
+      const baseUrl = gateConfigData.baseUrl || '';
+      pages = rawPages.map((p: any) => {
+        if (typeof p === 'string') {
+          // Already a URL string - make it absolute if relative
+          return p.startsWith('http') ? p : `${baseUrl.replace(/\/$/, '')}${p}`;
+        } else if (p && typeof p === 'object' && p.url) {
+          // Page object { url: '/', ... } - convert to full URL
+          const url = p.url;
+          return url.startsWith('http') ? url : `${baseUrl.replace(/\/$/, '')}${url}`;
+        }
+        return p;
+      });
+    } else if (gateConfigData.baseUrl) {
+      pages = [gateConfigData.baseUrl];
+    }
+
+    const config = {
+      target: {
+        baseUrl: gateConfigData.baseUrl,
+        pages: pages
+      },
+      budgets: gateConfigData.budgets,
+      timeout: gateOptions.timeout || gateConfigData.timeout,
+      auth: credentials,
+      // Playwright++ features
+      artifacts: gateConfigData.artifacts,
+      htmlReport: gateConfigData.htmlReport,
+      bail: gateConfigData.bail
+    };
+
+    const result = await adapter.runSmokeTests(config);
+    return {
+      gate: gateName,
+      success: result.success,
+      duration: 0, // Will be set by caller
+      adapter: 'playwright-ui',
+      results: result,
+      junit: result.junit
+    };
+  }
+
+  /**
+   * Execute K6 Performance gate with v2 config
+   */
+  private async executeK6PerfGate(gateName: string, gateConfig: any): Promise<GateResult> {
+    const { K6PerfAdapter } = await import('../adapters/k6-perf.js');
+    const adapter = new K6PerfAdapter(this.workingDir);
+
+    const config = {
+      baseUrl: gateConfig.config?.baseUrl,
+      ...gateConfig.config
+    };
+
+    const result = await adapter.runPerfTest(config);
+    return {
+      gate: gateName,
+      success: result.success,
+      duration: 0,
+      adapter: 'k6',
+      results: result,
+      junit: result.junit
+    };
+  }
+
+  /**
+   * Execute Semgrep SAST gate with v2 config
+   */
+  private async executeSemgrepSastGate(gateName: string, gateConfig: any): Promise<GateResult> {
+    const { SemgrepSastAdapter } = await import('../adapters/semgrep-sast.js');
+    const adapter = new SemgrepSastAdapter();
+
+    const config = {
+      workingDir: this.workingDir,
+      ...gateConfig.config
+    };
+
+    const result = await adapter.runSastScan(config);
+    return {
+      gate: gateName,
+      success: result.success,
+      duration: 0,
+      adapter: 'semgrep',
+      results: result,
+      junit: result.junit
+    };
+  }
+
+  /**
+   * Run API smoke gate
+   * Uses PlaywrightNativeApiAdapter for zero-overhead HTTP testing
+   */
+  private async runApiSmokeGate() {
+    const target = this.getTargetApi();
+    if (!target) {
+      throw new Error('API smoke gate requires targets.api configuration or gate config with baseUrl');
+    }
+
+    const credentials = await this.getCredentialsForGate('api_smoke');
+
+    const adapter = new PlaywrightNativeApiAdapter();
+    return await adapter.runSmokeTests({
+      target,
+      budgets: this.getBudgets(),
+      timeout: this.getExecutionTimeout() || 10000,
+      retries: this.getExecutionRetries() || 1,
+      auth: credentials
+    });
+  }
+
+  /**
+   * Run UI gate (includes basic accessibility)
+   */
+  private async runUiGate() {
+    const target = this.getTargetWeb();
+    if (!target) {
+      throw new Error('UI gate requires targets.web configuration or gate config with baseUrl');
+    }
+
+    const credentials = await this.getCredentialsForGate('ui');
+
+    const adapter = new PlaywrightUiAdapter();
+    return await adapter.runSmokeTests({
+      target,
+      budgets: this.getBudgets(),
+      timeout: this.getExecutionTimeout() || 30000,
+      auth: credentials
+    });
+  }
+
+  /**
+   * Run A11y gate (focused accessibility testing)
+   */
+  private async runA11yGate() {
+    // Same as UI gate but focused on accessibility
+    return await this.runUiGate();
+  }
+
+  /**
+   * Run performance gate
+   */
+  private async runPerfGate() {
+    const baseUrl = (this.pack as PackConfigV1).targets?.web?.baseUrl || (this.pack as PackConfigV1).targets?.api?.baseUrl;
+    if (!baseUrl) {
+      throw new Error('Performance gate requires web or api target');
+    }
+
+    const adapter = new K6PerfAdapter(this.workingDir);
+    return await adapter.runPerfTest({
+      baseUrl,
+      budgets: (this.pack as PackConfigV1).budgets,
+      duration: '30s',
+      vus: 5,
+      timeout: 120000
+    });
+  }
+
+  /**
+   * Run SAST gate
+   */
+  private async runSastGate() {
+    const adapter = new SemgrepSastAdapter();
+    return await adapter.runSastScan({
+      workingDir: this.workingDir,
+      security: (this.pack as PackConfigV1).security,
+      rules: ['auto'],
+      paths: ['src/', 'lib/', '.'],
+      timeout: 120000
+    });
+  }
+
+  /**
+   * Run DAST gate (mock implementation)
+   */
+  private async runDastGate() {
+    // Mock DAST implementation for Phase 3
+    console.log(chalk.yellow('    ⚠️  DAST gate: Mock implementation (ZAP integration in Phase 4)'));
+    
+    return {
+      success: true,
+      findings: [],
+      summary: { total: 0, high: 0, medium: 0, low: 0 },
+      junit: `<?xml version="1.0" encoding="UTF-8"?>
+<testsuite name="DAST Mock" tests="1" failures="0" time="0">
+  <testcase name="Mock DAST Scan" time="0"></testcase>
+</testsuite>`
+    };
+  }
+
+  /**
+   * Calculate execution summary
+   */
+  private calculateSummary(gateResults: GateResult[]): Phase3RunResult['summary'] {
+    const total = gateResults.length;
+    const passed = gateResults.filter(g => g.success).length;
+    const failed = total - passed;
+    
+    // Calculate trust score (weighted by gate importance)
+    const gateWeights: Record<string, number> = {
+      'api_smoke': 20,
+      'ui': 15,
+      'perf': 15,
+      'sast': 20,
+      'dast': 20,
+      'a11y': 10
+    };
+    
+    let totalWeight = 0;
+    let passedWeight = 0;
+    
+    for (const gate of gateResults) {
+      const weight = gateWeights[gate.gate] || 10;
+      totalWeight += weight;
+      if (gate.success) {
+        passedWeight += weight;
+      }
+    }
+    
+    const trustScore = totalWeight > 0 ? Math.round((passedWeight / totalWeight) * 100) : 0;
+    
+    return { total, passed, failed, trustScore };
+  }
+
+  /**
+   * Generate cryptographically signed proof document
+   */
+  private async generateProof(result: Phase3RunResult): Promise<string> {
+    const timestamp = new Date().toISOString();
+    const runId = `run-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+    
+    // Build proof payload (without signature)
+    const proofPayload = {
+      version: '3.0.0',
+      runId,
+      timestamp,
+      pack: {
+        name: result.pack.name,
+        version: result.pack.version,
+        gates: result.pack.gates
+      },
+      execution: {
+        duration: result.duration,
+        success: result.success,
+        trustScore: result.summary.trustScore
+      },
+      gates: result.gates.map(g => {
+        const gateObj: any = {
+          gate: g.gate,
+          adapter: g.adapter,
+          success: g.success,
+          duration: g.duration
+        };
+        // Only include error if it exists (avoid undefined fields)
+        if (g.error !== undefined) {
+          gateObj.error = g.error;
+        }
+        return gateObj;
+      }),
+      hooks: {
+        beforeAll: result.hooks.beforeAll.length,
+        afterAll: result.hooks.afterAll.length
+      }
+    };
+    
+    // Canonicalize the payload for signing (must match verification: canonical + newline)
+    const canonicalPayload = canonicalize(proofPayload) + '\n';
+
+    // Sign with Ed25519
+    let signatureValue: string;
+    let algorithm: string;
+    let publicKeyB64: string;
+
+    if (this.keyPair) {
+      signatureValue = sign(canonicalPayload, this.keyPair.secretKey);
+      algorithm = 'ed25519';
+      publicKeyB64 = Buffer.from(this.keyPair.publicKey).toString('base64');
+      console.log(chalk.green('   🔏 Proof signed with Ed25519'));
+    } else {
+      signatureValue = `unsigned-${runId}`;
+      algorithm = 'none';
+      publicKeyB64 = '';
+      console.log(chalk.yellow('   ⚠️  Proof unsigned (no keys available)'));
+    }
+    
+    // Build complete proof with signature
+    const proof = {
+      ...proofPayload,
+      signature: {
+        algorithm,
+        publicKey: publicKeyB64,
+        value: signatureValue,
+        timestamp
+      }
+    };
+    
+    // Save proof
+    const proofPath = join(this.outputDir, `${runId}-proof.json`);
+    writeFileSync(proofPath, JSON.stringify(proof, null, 2));
+    
+    return proofPath;
+  }
+
+  /**
+   * Save run results to Evidence Vault
+   * @returns The vault run ID
+   */
+  private async saveToVault(
+    runId: string,
+    result: Phase3RunResult,
+    proofPath: string,
+    flakinessResults?: FlakinessResult[],
+    startTime?: number
+  ): Promise<string | undefined> {
+    if (!this.vault) {
+      console.log(chalk.yellow('   ⚠️  Vault not initialized, skipping storage'));
+      return undefined;
+    }
+
+    try {
+      // Begin run in vault (returns actual runId used)
+      // Use startTime if provided to correctly calculate duration
+      const { runId: vaultRunId } = await this.vault.beginRun({
+        pack_path: `${(this.pack as any).name || 'pack'}.yaml`,
+        pack_hash: this.hashPack(result.pack),
+        started_at: startTime  // Use actual run start time for accurate duration
+      });
+
+      // Finish run with final status
+      await this.vault.finishRun(vaultRunId, {
+        status: result.success ? 'passed' : 'failed',
+        trust_score: result.summary.trustScore,
+        signature: this.keyPair ? 'ed25519-signed' : undefined
+      });
+
+      // Record gate executions
+      for (const gate of result.gates) {
+        await this.vault.recordGate(vaultRunId, {
+          name: gate.gate,
+          status: gate.success ? 'passed' : 'failed',
+          duration_ms: gate.duration,
+          metrics_json: JSON.stringify(gate.results?.summary || {})
+        });
+
+        // Record finding if gate has error
+        if (gate.error) {
+          await this.vault.recordFinding(vaultRunId, {
+            gate: gate.gate,
+            severity: 'high',
+            rule: 'gate-failure',
+            message: gate.error
+          });
+        }
+      }
+
+      // Record flakiness results if available
+      if (flakinessResults && flakinessResults.length > 0) {
+        for (const flaky of flakinessResults) {
+          // Record unstable/shaky tests as findings
+          if (flaky.category === FlakinessCategory.UNSTABLE || flaky.category === FlakinessCategory.SHAKY) {
+            await this.vault.recordFinding(vaultRunId, {
+              gate: flaky.gate,
+              severity: flaky.category === FlakinessCategory.UNSTABLE ? 'high' : 'medium',
+              rule: 'flaky-test-detected',
+              message: `Test "${flaky.testName}" is ${flaky.category}: ${flaky.score}% reliability (${flaky.successfulRuns}/${flaky.totalRuns} passes)`
+            });
+          }
+        }
+        console.log(chalk.green(`   💾 ${flakinessResults.length} flakiness analysis(es) saved`));
+      }
+
+      console.log(chalk.green('   💾 Run saved to Evidence Vault'));
+      return vaultRunId;
+
+    } catch (error) {
+      console.log(chalk.yellow(`   ⚠️  Failed to save to vault: ${error}`));
+      return undefined;
+    }
+  }
+
+  /**
+   * Detect flakiness by running tests multiple times consecutively
+   * @param gateResults Original gate results from first run
+   * @returns Flakiness analysis results
+   */
+  private async detectFlakiness(gateResults: GateResult[]): Promise<FlakinessResult[]> {
+    const flakinessMap = new Map<string, FlakyTestResult[]>();
+    const timestamp = Date.now();
+
+    // First, collect results from the initial run
+    for (const gateResult of gateResults) {
+      for (const [testId, testResult] of this.extractTestResults(gateResult, timestamp)) {
+        if (!flakinessMap.has(testId)) {
+          flakinessMap.set(testId, []);
+        }
+        flakinessMap.get(testId)!.push(testResult);
+      }
+    }
+
+    // Run additional consecutive runs
+    for (let run = 1; run < this.flakyRuns; run++) {
+      console.log(chalk.gray(`     🔄 Consecutive run ${run + 1}/${this.flakyRuns}...`));
+
+      for (const gateResult of gateResults) {
+        // Re-run all gates to detect flakiness
+        try {
+          const retryResult = await this.executeGate(gateResult.gate);
+
+          // Extract and store test results
+          for (const [testId, testResult] of this.extractTestResults(retryResult, timestamp)) {
+            if (!flakinessMap.has(testId)) {
+              flakinessMap.set(testId, []);
+            }
+            flakinessMap.get(testId)!.push(testResult);
+          }
+        } catch (error) {
+          console.log(chalk.yellow(`     ⚠️  Failed to re-run ${gateResult.gate}: ${error}`));
+        }
+      }
+    }
+
+    // Analyze all collected results
+    return this.flakinessDetector.analyzeAll(flakinessMap);
+  }
+
+  /**
+   * Extract test results from a gate result
+   * Returns a map of testId to TestResult for flakiness tracking
+   */
+  private extractTestResults(gateResult: GateResult, timestamp: number): Map<string, FlakyTestResult> {
+    const results = new Map<string, FlakyTestResult>();
+
+    // Extract test results from adapter output
+    const adapterResults = gateResult.results;
+
+    if (adapterResults?.results && Array.isArray(adapterResults.results)) {
+      // Check for Playwright Native API adapter format
+      const firstResult = adapterResults.results[0];
+
+      if (firstResult && 'endpoint' in firstResult && 'method' in firstResult) {
+        // PlaywrightNativeApiAdapter format: { endpoint, method, status, success, error, ... }
+        for (const test of adapterResults.results as Array<{endpoint: string; method: string; status: number; success: boolean; error?: string; responseTime?: number}>) {
+          // Extract just the path from full URL for cleaner test names
+          const url = new URL(test.endpoint);
+          const path = url.pathname + url.search;
+          const testName = `${test.method} ${path} -> ${test.status}`;
+          const testId = generateTestId(testName, gateResult.gate);
+          results.set(testId, {
+            testId,
+            testName,
+            filePath: gateResult.gate,
+            gate: gateResult.gate,
+            success: test.success,
+            durationMs: test.responseTime || 0,
+            errorMessage: test.error,
+            timestamp: timestamp + Math.random(), // Small offset for ordering
+            environment: process.env.NODE_ENV || 'local'
+          });
+        }
+      } else {
+        // Generic adapter format with results array
+        for (const test of adapterResults.results as Array<{name?: string; passed?: boolean; status?: string; duration?: number; error?: {message?: string; type?: string}}>) {
+          const testName = test.name || gateResult.gate;
+          const testId = generateTestId(testName, gateResult.gate);
+          results.set(testId, {
+            testId,
+            testName,
+            filePath: gateResult.gate,
+            gate: gateResult.gate,
+            success: test.passed || test.status === 'passed',
+            durationMs: test.duration || 0,
+            errorType: test.error?.type,
+            errorMessage: test.error?.message,
+            timestamp: timestamp + Math.random(),
+            environment: process.env.NODE_ENV || 'local'
+          });
+        }
+      }
+    } else if (adapterResults?.summary) {
+      // Generic adapter with summary only (no detailed results)
+      const testId = generateTestId(gateResult.gate, gateResult.gate);
+      results.set(testId, {
+        testId,
+        testName: gateResult.gate,
+        filePath: gateResult.gate,
+        gate: gateResult.gate,
+        success: gateResult.success,
+        durationMs: gateResult.duration,
+        errorMessage: gateResult.error,
+        timestamp,
+        environment: process.env.NODE_ENV || 'local'
+      });
+    } else {
+      // Fallback: create single test result from gate
+      const testId = generateTestId(gateResult.gate, gateResult.gate);
+      results.set(testId, {
+        testId,
+        testName: gateResult.gate,
+        filePath: gateResult.gate,
+        gate: gateResult.gate,
+        success: gateResult.success,
+        durationMs: gateResult.duration,
+        errorMessage: gateResult.error,
+        timestamp,
+        environment: process.env.NODE_ENV || 'local'
+      });
+    }
+
+    return results;
+  }
+
+  /**
+   * Generate hash of pack configuration
+   */
+  private hashPack(pack: PackConfig): string {
+    return createHash('sha256')
+      .update(JSON.stringify(pack))
+      .digest('hex')
+      .substring(0, 16);
+  }
+
+  /**
+   * Get API target (v1 or v2 format)
+   */
+  private getTargetApi(): any {
+    if (this.isPackV2(this.pack)) {
+      // In v2, target is in the gate config
+      const gateConfig = this.pack.gates['api_smoke'] || this.pack.gates['api'];
+      if (gateConfig && (gateConfig as any).config?.baseUrl) {
+        return (gateConfig as any).config;
+      }
+      return undefined;
+    }
+    return this.pack.targets?.api;
+  }
+
+  /**
+   * Get Web target (v1 or v2 format)
+   */
+  private getTargetWeb(): any {
+    if (this.isPackV2(this.pack)) {
+      // In v2, target is in the gate config
+      const gateConfig = this.pack.gates['ui'] || this.pack.gates['a11y'];
+      if (gateConfig && (gateConfig as any).config?.baseUrl) {
+        return (gateConfig as any).config;
+      }
+      return undefined;
+    }
+    return this.pack.targets?.web;
+  }
+
+  /**
+   * Get budgets (v1 or v2 format)
+   */
+  private getBudgets(): any {
+    if (this.isPackV2(this.pack)) {
+      // In v2, budgets can be in gate config or global
+      // For now, return undefined - budgets are gate-specific in v2
+      return undefined;
+    }
+    return this.pack.budgets;
+  }
+
+  /**
+   * Get execution timeout (v1 or v2 format)
+   */
+  private getExecutionTimeout(): number | undefined {
+    if (this.isPackV2(this.pack)) {
+      return this.pack.execution?.default_timeout;
+    }
+    return this.pack.execution?.timeout;
+  }
+
+  /**
+   * Get execution retries (v1 or v2 format)
+   */
+  private getExecutionRetries(): number | undefined {
+    if (this.isPackV2(this.pack)) {
+      return this.pack.execution?.default_retries;
+    }
+    return this.pack.execution?.max_retries;
+  }
+
+  /**
+   * Ensure output directory exists
+   */
+  private ensureOutputDir(): void {
+    if (!existsSync(this.outputDir)) {
+      mkdirSync(this.outputDir, { recursive: true });
+    }
+  }
+}