qa360 2.1.7 → 2.2.0

package/dist/core/runner/phase3-runner.js

@@ -1,1041 +0,0 @@
-/**
- * QA360 Phase 3 Runner
- * Orchestrates hooks, adapters, and proof generation
- * Supports both Pack v1 and Pack v2 configurations
- */
-import { existsSync, writeFileSync, mkdirSync } from 'fs';
-import { join } from 'path';
-import { createHash } from 'crypto';
-import chalk from 'chalk';
-import { HooksRunner } from '../hooks/runner.js';
-import { PlaywrightNativeApiAdapter } from '../adapters/playwright-native-api.js';
-import { PlaywrightUiAdapter } from '../adapters/playwright-ui.js';
-import { K6PerfAdapter } from '../adapters/k6-perf.js';
-import { SemgrepSastAdapter } from '../adapters/semgrep-sast.js';
-import { SecurityRedactor } from '../security/redactor.js';
-import { initializeKeys, sign } from '../proof/signer.js';
-import { canonicalize } from '../proof/canonicalize.js';
-import { EvidenceVault } from '../vault/index.js';
-import { AuthManager } from '../auth/index.js';
-import { FlakinessDetector, FlakinessCategory, formatFlakinessScore, generateTestId, DEFAULT_FLAKINESS_OPTIONS } from '../flakiness/index.js';
-export class Phase3Runner {
-    workingDir;
-    pack;
-    outputDir;
-    redactor;
-    hooksRunner;
-    keyPair;
-    vault;
-    authManager;
-    authCredentialsCache = new Map();
-    flakyDetect;
-    flakyRuns;
-    flakinessDetector;
-    constructor(options) {
-        this.workingDir = options.workingDir;
-        this.pack = options.pack;
-        this.outputDir = options.outputDir || join(this.workingDir, '.qa360', 'runs');
-        this.redactor = SecurityRedactor.forLogs();
-        this.authManager = new AuthManager();
-        this.flakyDetect = options.flakyDetect || false;
-        this.flakyRuns = options.flakyRuns || DEFAULT_FLAKINESS_OPTIONS.consecutiveRuns;
-        this.flakinessDetector = new FlakinessDetector({
-            consecutiveRuns: this.flakyRuns,
-            minRuns: 2,
-            enablePatternDetection: true
-        });
-        // Initialize hooks runner (convert v2 hooks to v1 format if needed)
-        const hooks = this.isPackV2(options.pack)
-            ? this.convertV2HooksToV1(options.pack.hooks)
-            : options.pack.hooks;
-        this.hooksRunner = new HooksRunner({
-            workingDir: this.workingDir,
-            hooks: hooks || {},
-            execution: this.isPackV2(options.pack) ? this.convertV2ExecutionToV1(options.pack.execution) : options.pack.execution,
-            redactor: this.redactor
-        });
-        // Register auth profiles from pack v2
-        if (this.isPackV2(options.pack) && options.pack.auth?.profiles) {
-            this.registerAuthProfiles(options.pack.auth.profiles);
-        }
-    }
-    /**
-     * Type guard to check if pack is v2
-     */
-    isPackV2(pack) {
-        return pack.version === 2;
-    }
-    /**
-     * Register authentication profiles from pack config
-     */
-    registerAuthProfiles(profiles) {
-        for (const [name, profile] of Object.entries(profiles)) {
-            // Convert v2 auth profile to auth module format
-            const authConfig = {
-                type: profile.type || 'none',
-                ...profile.config
-            };
-            this.authManager.registerProfile(name, authConfig);
-        }
-    }
-    /**
-     * Get auth profile name for a specific gate
-     */
-    getAuthProfileForGate(gateName) {
-        if (!this.isPackV2(this.pack) || !this.pack.auth) {
-            return undefined;
-        }
-        const authConfig = this.pack.auth;
-        // Check if gate has specific auth override
-        const gateConfig = this.pack.gates[gateName];
-        if (gateConfig?.auth) {
-            return gateConfig.auth;
-        }
-        // Use default based on gate type
-        if (gateName === 'api_smoke' || gateName === 'api') {
-            return authConfig.api;
-        }
-        if (gateName === 'ui' || gateName === 'a11y') {
-            return authConfig.ui;
-        }
-        return undefined;
-    }
-    /**
-     * Authenticate and get credentials for a gate
-     */
-    async getCredentialsForGate(gateName) {
-        const profileName = this.getAuthProfileForGate(gateName);
-        if (!profileName) {
-            return undefined;
-        }
-        // Check cache first
-        if (this.authCredentialsCache.has(profileName)) {
-            return this.authCredentialsCache.get(profileName);
-        }
-        // Authenticate
-        const result = await this.authManager.authenticate(profileName);
-        if (result.success && result.credentials) {
-            this.authCredentialsCache.set(profileName, result.credentials);
-            return result.credentials;
-        }
-        console.log(chalk.yellow(`    ⚠️  Auth failed for profile '${profileName}': ${result.error}`));
-        return undefined;
-    }
-    /**
-     * Convert v2 hooks to v1 format
-     */
-    convertV2HooksToV1(hooks) {
-        if (!hooks)
-            return undefined;
-        // v2 hooks use { type, command, ... } format
-        // v1 hooks use { run, timeout } format
-        const converted = {
-            beforeAll: [],
-            afterAll: [],
-            beforeEach: [],
-            afterEach: []
-        };
-        for (const [phase, phaseHooks] of Object.entries(hooks)) {
-            if (Array.isArray(phaseHooks)) {
-                converted[phase] = phaseHooks.map((h) => {
-                    if (h.type === 'run' || h.type === 'script') {
-                        return { run: h.command, timeout: h.timeout, cwd: h.cwd, env: h.env };
-                    }
-                    if (h.type === 'wait_on') {
-                        return { run: `npx wait-on ${h.wait_for?.resource || h.command}`, timeout: h.timeout };
-                    }
-                    if (h.type === 'docker') {
-                        return { run: `docker compose ${h.compose?.command || 'up -d'}`, timeout: h.timeout };
-                    }
-                    return h;
-                });
-            }
-        }
-        return converted;
-    }
-    /**
-     * Convert v2 execution config to v1 format
-     */
-    convertV2ExecutionToV1(execution) {
-        if (!execution)
-            return undefined;
-        return {
-            timeout: execution.default_timeout || execution.timeout,
-            max_retries: execution.default_retries || execution.retries,
-            on_failure: execution.on_failure || 'continue'
-        };
-    }
-    /**
-     * Get gates array from pack (handles v1 and v2)
-     */
-    getGatesArray() {
-        if (this.isPackV2(this.pack)) {
-            return Object.keys(this.pack.gates).filter(gateName => {
-                const gateConfig = this.pack.gates[gateName];
-                return gateConfig?.enabled !== false;
-            });
-        }
-        return this.pack.gates || [];
-    }
-    /**
-     * Execute complete Phase 3 workflow
-     */
-    async run() {
-        const startTime = Date.now();
-        const gatesArray = this.getGatesArray();
-        console.log(chalk.bold.blue(`\n🚀 QA360 Phase 3 Runner - ${this.pack.name}`));
-        console.log(chalk.gray(`Gates: ${gatesArray.join(', ')}`));
-        try {
-            // Ensure output directory exists
-            this.ensureOutputDir();
-            // Initialize cryptographic keys
-            console.log(chalk.blue('\n🔑 Initializing Ed25519 keys...'));
-            this.keyPair = await initializeKeys();
-            console.log(chalk.green('   ✅ Keys ready'));
-            // Initialize Evidence Vault
-            console.log(chalk.blue('\n🗄️  Initializing Evidence Vault...'));
-            const vaultDir = join(this.workingDir, '.qa360');
-            this.vault = await EvidenceVault.open(vaultDir);
-            console.log(chalk.green('   ✅ Vault ready'));
-            // Execute beforeAll hooks
-            console.log(chalk.blue('\n🔗 Phase 1: Setup Hooks'));
-            const beforeAllResults = await this.hooksRunner.executeHooks('beforeAll');
-            // Check if setup failed and should stop
-            const setupFailed = beforeAllResults.some(r => !r.success);
-            if (setupFailed && this.pack.execution?.on_failure === 'stop') {
-                throw new Error('Setup hooks failed, stopping execution');
-            }
-            // Execute gates
-            console.log(chalk.blue('\n🎯 Phase 2: Quality Gates'));
-            const gateResults = [];
-            for (const gate of gatesArray) {
-                const gateResult = await this.executeGate(gate);
-                gateResults.push(gateResult);
-                // Check if gate failed and should stop
-                if (!gateResult.success && this.pack.execution?.on_failure === 'stop') {
-                    console.log(chalk.yellow(`🛑 Gate ${gate} failed, stopping execution`));
-                    break;
-                }
-            }
-            // Flakiness Detection Phase (Vision 2.0)
-            let flakinessResults;
-            if (this.flakyDetect) {
-                console.log(chalk.blue(`\n🎲 Phase 2.5: Flakiness Detection (${this.flakyRuns} consecutive runs)`));
-                flakinessResults = await this.detectFlakiness(gateResults);
-                // Display flakiness summary
-                const unstableCount = flakinessResults.filter(f => f.category === FlakinessCategory.UNSTABLE || f.category === FlakinessCategory.SHAKY).length;
-                if (unstableCount > 0) {
-                    console.log(chalk.yellow(`   ⚠️  ${unstableCount} test(s) show flaky behavior`));
-                }
-                else {
-                    console.log(chalk.green('   ✅ All tests stable - no flakiness detected'));
-                }
-            }
-            // Execute afterAll hooks
-            console.log(chalk.blue('\n🔗 Phase 3: Cleanup Hooks'));
-            const afterAllResults = await this.hooksRunner.executeHooks('afterAll');
-            // Calculate results
-            const duration = Date.now() - startTime;
-            const summary = this.calculateSummary(gateResults);
-            const success = summary.failed === 0;
-            // Generate proof
-            console.log(chalk.blue('\n📋 Phase 4: Proof Generation'));
-            const proofPath = await this.generateProof({
-                success,
-                pack: this.pack,
-                duration,
-                gates: gateResults,
-                hooks: {
-                    beforeAll: beforeAllResults,
-                    beforeEach: [],
-                    afterEach: [],
-                    afterAll: afterAllResults
-                },
-                summary
-            });
-            // Save to Evidence Vault
-            console.log(chalk.blue('\n💾 Phase 5: Evidence Storage'));
-            const proofRunId = proofPath.split('/').pop()?.replace('-proof.json', '') || 'unknown';
-            const vaultRunId = await this.saveToVault(proofRunId, {
-                success,
-                pack: this.pack,
-                duration,
-                gates: gateResults,
-                hooks: {
-                    beforeAll: beforeAllResults,
-                    beforeEach: [],
-                    afterEach: [],
-                    afterAll: afterAllResults
-                },
-                summary,
-                proofPath
-            }, proofPath, flakinessResults, startTime);
-            // Final summary
-            console.log(chalk.blue('\n📊 Execution Summary'));
-            console.log(`  Duration: ${duration}ms`);
-            console.log(`  Gates: ${summary.passed}/${summary.total} passed`);
-            console.log(`  Trust Score: ${summary.trustScore}%`);
-            console.log(`  Proof: ${proofPath}`);
-            // Display flakiness details if enabled
-            if (flakinessResults && flakinessResults.length > 0) {
-                console.log(chalk.blue('\n🎲 Flakiness Scores:'));
-                for (const f of flakinessResults) {
-                    const scoreFormatted = formatFlakinessScore(f.score);
-                    const categoryMeta = {
-                        [FlakinessCategory.LEGENDARY]: { emoji: '🟢', color: chalk.green },
-                        [FlakinessCategory.SOLID]: { emoji: '🟢', color: chalk.green },
-                        [FlakinessCategory.GOOD]: { emoji: '🟡', color: chalk.yellow },
-                        [FlakinessCategory.SHAKY]: { emoji: '🟠', color: chalk.hex('#F97316') },
-                        [FlakinessCategory.UNSTABLE]: { emoji: '🔴', color: chalk.red }
-                    }[f.category];
-                    console.log(`  ${categoryMeta.color(`${f.testName}: ${scoreFormatted}`)} (${f.successfulRuns}/${f.totalRuns} passes)`);
-                    if (f.suggestedFix) {
-                        console.log(chalk.gray(`     💡 ${f.suggestedFix}`));
-                    }
-                }
-            }
-            if (success) {
-                console.log(chalk.green('\n✅ All quality gates passed!'));
-            }
-            else {
-                console.log(chalk.red(`\n❌ ${summary.failed} quality gate(s) failed`));
-            }
-            return {
-                success,
-                pack: this.pack,
-                duration,
-                gates: gateResults,
-                hooks: {
-                    beforeAll: beforeAllResults,
-                    beforeEach: [],
-                    afterEach: [],
-                    afterAll: afterAllResults
-                },
-                summary,
-                flakiness: flakinessResults,
-                proofPath,
-                runId: vaultRunId
-            };
-        }
-        catch (error) {
-            const duration = Date.now() - startTime;
-            // Ensure cleanup even on error
-            try {
-                await this.hooksRunner.executeHooks('afterAll');
-            }
-            catch {
-                // Ignore cleanup errors
-            }
-            return {
-                success: false,
-                pack: this.pack,
-                duration,
-                gates: [],
-                hooks: { beforeAll: [], beforeEach: [], afterEach: [], afterAll: [] },
-                summary: { total: 0, passed: 0, failed: 0, trustScore: 0 },
-                error: this.redactor.redact(error instanceof Error ? error.message : 'Unknown error')
-            };
-        }
-    }
-    /**
-     * Execute a single quality gate
-     */
-    async executeGate(gate) {
-        const startTime = Date.now();
-        console.log(chalk.cyan(`\n  🎯 Gate: ${gate}`));
-        try {
-            let result;
-            let adapter;
-            // Check if this is a v2 pack with dynamic gate configuration
-            if (this.isPackV2(this.pack)) {
-                const gateConfig = this.pack.gates[gate];
-                if (gateConfig) {
-                    return await this.executeDynamicGate(gate, gateConfig);
-                }
-            }
-            // Legacy v1 gates or predefined gates
-            switch (gate) {
-                case 'api_smoke':
-                    adapter = 'playwright-native-api';
-                    result = await this.runApiSmokeGate();
-                    break;
-                case 'ui':
-                    adapter = 'playwright-ui';
-                    result = await this.runUiGate();
-                    break;
-                case 'a11y':
-                    adapter = 'playwright-ui';
-                    result = await this.runA11yGate();
-                    break;
-                case 'perf':
-                    adapter = 'k6';
-                    result = await this.runPerfGate();
-                    break;
-                case 'sast':
-                    adapter = 'semgrep';
-                    result = await this.runSastGate();
-                    break;
-                case 'dast':
-                    adapter = 'zap';
-                    result = await this.runDastGate();
-                    break;
-                default:
-                    throw new Error(`Unknown gate: ${gate}`);
-            }
-            const duration = Date.now() - startTime;
-            if (result.success) {
-                console.log(chalk.green(`    ✅ ${gate} passed (${duration}ms)`));
-            }
-            else {
-                console.log(chalk.red(`    ❌ ${gate} failed (${duration}ms)`));
-                if (result.error) {
-                    console.log(chalk.red(`    🔍 ${result.error}`));
-                }
-            }
-            return {
-                gate,
-                success: result.success,
-                duration,
-                adapter,
-                results: result,
-                junit: result.junit,
-                error: result.error
-            };
-        }
-        catch (error) {
-            const duration = Date.now() - startTime;
-            const errorMessage = this.redactor.redact(error instanceof Error ? error.message : 'Unknown error');
-            console.log(chalk.red(`    💥 ${gate} crashed (${duration}ms): ${errorMessage}`));
-            return {
-                gate,
-                success: false,
-                duration,
-                adapter: 'unknown',
-                results: null,
-                error: errorMessage
-            };
-        }
-    }
-    /**
-     * Execute a dynamic v2 gate
-     */
-    async executeDynamicGate(gateName, gateConfig) {
-        const startTime = Date.now();
-        const adapterType = gateConfig.adapter || gateConfig.type;
-        if (!adapterType) {
-            throw new Error(`Gate '${gateName}' must specify an adapter`);
-        }
-        // Get auth credentials for this gate
-        const credentials = await this.getCredentialsForGate(gateName);
-        // Map adapter type to implementation
-        let result;
-        switch (adapterType) {
-            case 'playwright-api':
-                result = await this.executePlaywrightApiGate(gateName, gateConfig, credentials);
-                break;
-            case 'playwright-ui':
-                result = await this.executePlaywrightUiGate(gateName, gateConfig, credentials);
-                break;
-            case 'k6':
-            case 'k6-perf':
-                result = await this.executeK6PerfGate(gateName, gateConfig);
-                break;
-            case 'semgrep':
-            case 'sast':
-                result = await this.executeSemgrepSastGate(gateName, gateConfig);
-                break;
-            default:
-                throw new Error(`Unsupported adapter: '${adapterType}' for gate '${gateName}'`);
-        }
-        // Set duration
-        result.duration = Date.now() - startTime;
-        // Log result
-        if (result.success) {
-            console.log(chalk.green(`    ✅ ${gateName} passed (${result.duration}ms)`));
-        }
-        else {
-            console.log(chalk.red(`    ❌ ${gateName} failed (${result.duration}ms)`));
-            if (result.error) {
-                console.log(chalk.red(`    🔍 ${result.error}`));
-            }
-        }
-        return result;
-    }
-    /**
-     * Execute Playwright API gate with v2 config
-     * Uses PlaywrightNativeApiAdapter for zero-overhead HTTP testing
-     */
-    async executePlaywrightApiGate(gateName, gateConfig, credentials) {
-        const { PlaywrightNativeApiAdapter } = await import('../adapters/playwright-native-api.js');
-        const adapter = new PlaywrightNativeApiAdapter();
-        // Transform v2 config to adapter format
-        const gateConfigData = gateConfig.config || {};
-        const gateOptions = gateConfig.options || {};
-        const config = {
-            target: {
-                baseUrl: gateConfigData.baseUrl,
-                smoke: gateConfigData.smoke
-            },
-            budgets: gateConfigData.budgets,
-            timeout: gateOptions.timeout || gateConfigData.timeout,
-            retries: gateOptions.retries || gateConfigData.retries,
-            auth: credentials
-        };
-        const result = await adapter.runSmokeTests(config);
-        return {
-            gate: gateName,
-            success: result.success,
-            duration: 0, // Will be set by caller
-            adapter: 'playwright-native-api',
-            results: result,
-            junit: result.junit
-        };
-    }
-    /**
-     * Execute Playwright UI gate with v2 config
-     */
-    async executePlaywrightUiGate(gateName, gateConfig, credentials) {
-        const { PlaywrightUiAdapter } = await import('../adapters/playwright-ui.js');
-        const adapter = new PlaywrightUiAdapter();
-        // Transform v2 config to adapter format
-        // v2: { baseUrl, pages: [{ url: '/', expectedElements: [...] }] }
-        // adapter expects: { target: { baseUrl, pages: ['https://.../'] } }
-        const gateConfigData = gateConfig.config || {};
-        const gateOptions = gateConfig.options || {};
-        // Transform page objects to full URLs
-        // v2 pages format: [{ url: '/', expectedElements: [...] }] or ['/', '/about']
-        const rawPages = gateConfigData.pages;
-        let pages;
-        if (rawPages && Array.isArray(rawPages) && rawPages.length > 0) {
-            const baseUrl = gateConfigData.baseUrl || '';
-            pages = rawPages.map((p) => {
-                if (typeof p === 'string') {
-                    // Already a URL string - make it absolute if relative
-                    return p.startsWith('http') ? p : `${baseUrl.replace(/\/$/, '')}${p}`;
-                }
-                else if (p && typeof p === 'object' && p.url) {
-                    // Page object { url: '/', ... } - convert to full URL
-                    const url = p.url;
-                    return url.startsWith('http') ? url : `${baseUrl.replace(/\/$/, '')}${url}`;
-                }
-                return p;
-            });
-        }
-        else if (gateConfigData.baseUrl) {
-            pages = [gateConfigData.baseUrl];
-        }
-        const config = {
-            target: {
-                baseUrl: gateConfigData.baseUrl,
-                pages: pages
-            },
-            budgets: gateConfigData.budgets,
-            timeout: gateOptions.timeout || gateConfigData.timeout,
-            auth: credentials,
-            // Playwright++ features
-            artifacts: gateConfigData.artifacts,
-            htmlReport: gateConfigData.htmlReport,
-            bail: gateConfigData.bail
-        };
-        const result = await adapter.runSmokeTests(config);
-        return {
-            gate: gateName,
-            success: result.success,
-            duration: 0, // Will be set by caller
-            adapter: 'playwright-ui',
-            results: result,
-            junit: result.junit
-        };
-    }
-    /**
-     * Execute K6 Performance gate with v2 config
-     */
-    async executeK6PerfGate(gateName, gateConfig) {
-        const { K6PerfAdapter } = await import('../adapters/k6-perf.js');
-        const adapter = new K6PerfAdapter(this.workingDir);
-        const config = {
-            baseUrl: gateConfig.config?.baseUrl,
-            ...gateConfig.config
-        };
-        const result = await adapter.runPerfTest(config);
-        return {
-            gate: gateName,
-            success: result.success,
-            duration: 0,
-            adapter: 'k6',
-            results: result,
-            junit: result.junit
-        };
-    }
-    /**
-     * Execute Semgrep SAST gate with v2 config
-     */
-    async executeSemgrepSastGate(gateName, gateConfig) {
-        const { SemgrepSastAdapter } = await import('../adapters/semgrep-sast.js');
-        const adapter = new SemgrepSastAdapter();
-        const config = {
-            workingDir: this.workingDir,
-            ...gateConfig.config
-        };
-        const result = await adapter.runSastScan(config);
-        return {
-            gate: gateName,
-            success: result.success,
-            duration: 0,
-            adapter: 'semgrep',
-            results: result,
-            junit: result.junit
-        };
-    }
-    /**
-     * Run API smoke gate
-     * Uses PlaywrightNativeApiAdapter for zero-overhead HTTP testing
-     */
-    async runApiSmokeGate() {
-        const target = this.getTargetApi();
-        if (!target) {
-            throw new Error('API smoke gate requires targets.api configuration or gate config with baseUrl');
-        }
-        const credentials = await this.getCredentialsForGate('api_smoke');
-        const adapter = new PlaywrightNativeApiAdapter();
-        return await adapter.runSmokeTests({
-            target,
-            budgets: this.getBudgets(),
-            timeout: this.getExecutionTimeout() || 10000,
-            retries: this.getExecutionRetries() || 1,
-            auth: credentials
-        });
-    }
-    /**
-     * Run UI gate (includes basic accessibility)
-     */
-    async runUiGate() {
-        const target = this.getTargetWeb();
-        if (!target) {
-            throw new Error('UI gate requires targets.web configuration or gate config with baseUrl');
-        }
-        const credentials = await this.getCredentialsForGate('ui');
-        const adapter = new PlaywrightUiAdapter();
-        return await adapter.runSmokeTests({
-            target,
-            budgets: this.getBudgets(),
-            timeout: this.getExecutionTimeout() || 30000,
-            auth: credentials
-        });
-    }
-    /**
-     * Run A11y gate (focused accessibility testing)
-     */
-    async runA11yGate() {
-        // Same as UI gate but focused on accessibility
-        return await this.runUiGate();
-    }
-    /**
-     * Run performance gate
-     */
-    async runPerfGate() {
-        const baseUrl = this.pack.targets?.web?.baseUrl || this.pack.targets?.api?.baseUrl;
-        if (!baseUrl) {
-            throw new Error('Performance gate requires web or api target');
-        }
-        const adapter = new K6PerfAdapter(this.workingDir);
-        return await adapter.runPerfTest({
-            baseUrl,
-            budgets: this.pack.budgets,
-            duration: '30s',
-            vus: 5,
-            timeout: 120000
-        });
-    }
-    /**
-     * Run SAST gate
-     */
-    async runSastGate() {
-        const adapter = new SemgrepSastAdapter();
-        return await adapter.runSastScan({
-            workingDir: this.workingDir,
-            security: this.pack.security,
-            rules: ['auto'],
-            paths: ['src/', 'lib/', '.'],
-            timeout: 120000
-        });
-    }
-    /**
-     * Run DAST gate (mock implementation)
-     */
-    async runDastGate() {
-        // Mock DAST implementation for Phase 3
-        console.log(chalk.yellow('    ⚠️  DAST gate: Mock implementation (ZAP integration in Phase 4)'));
-        return {
-            success: true,
-            findings: [],
-            summary: { total: 0, high: 0, medium: 0, low: 0 },
-            junit: `<?xml version="1.0" encoding="UTF-8"?>
-<testsuite name="DAST Mock" tests="1" failures="0" time="0">
-  <testcase name="Mock DAST Scan" time="0"></testcase>
-</testsuite>`
-        };
-    }
-    /**
-     * Calculate execution summary
-     */
-    calculateSummary(gateResults) {
-        const total = gateResults.length;
-        const passed = gateResults.filter(g => g.success).length;
-        const failed = total - passed;
-        // Calculate trust score (weighted by gate importance)
-        const gateWeights = {
-            'api_smoke': 20,
-            'ui': 15,
-            'perf': 15,
-            'sast': 20,
-            'dast': 20,
-            'a11y': 10
-        };
-        let totalWeight = 0;
-        let passedWeight = 0;
-        for (const gate of gateResults) {
-            const weight = gateWeights[gate.gate] || 10;
-            totalWeight += weight;
-            if (gate.success) {
-                passedWeight += weight;
-            }
-        }
-        const trustScore = totalWeight > 0 ? Math.round((passedWeight / totalWeight) * 100) : 0;
-        return { total, passed, failed, trustScore };
-    }
-    /**
-     * Generate cryptographically signed proof document
-     */
-    async generateProof(result) {
-        const timestamp = new Date().toISOString();
-        const runId = `run-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
-        // Build proof payload (without signature)
-        const proofPayload = {
-            version: '3.0.0',
-            runId,
-            timestamp,
-            pack: {
-                name: result.pack.name,
-                version: result.pack.version,
-                gates: result.pack.gates
-            },
-            execution: {
-                duration: result.duration,
-                success: result.success,
-                trustScore: result.summary.trustScore
-            },
-            gates: result.gates.map(g => {
-                const gateObj = {
-                    gate: g.gate,
-                    adapter: g.adapter,
-                    success: g.success,
-                    duration: g.duration
-                };
-                // Only include error if it exists (avoid undefined fields)
-                if (g.error !== undefined) {
-                    gateObj.error = g.error;
-                }
-                return gateObj;
-            }),
-            hooks: {
-                beforeAll: result.hooks.beforeAll.length,
-                afterAll: result.hooks.afterAll.length
-            }
-        };
-        // Canonicalize the payload for signing (must match verification: canonical + newline)
-        const canonicalPayload = canonicalize(proofPayload) + '\n';
-        // Sign with Ed25519
-        let signatureValue;
-        let algorithm;
-        let publicKeyB64;
-        if (this.keyPair) {
-            signatureValue = sign(canonicalPayload, this.keyPair.secretKey);
-            algorithm = 'ed25519';
-            publicKeyB64 = Buffer.from(this.keyPair.publicKey).toString('base64');
-            console.log(chalk.green('   🔏 Proof signed with Ed25519'));
-        }
-        else {
-            signatureValue = `unsigned-${runId}`;
-            algorithm = 'none';
-            publicKeyB64 = '';
-            console.log(chalk.yellow('   ⚠️  Proof unsigned (no keys available)'));
-        }
-        // Build complete proof with signature
-        const proof = {
-            ...proofPayload,
-            signature: {
-                algorithm,
-                publicKey: publicKeyB64,
-                value: signatureValue,
-                timestamp
-            }
-        };
-        // Save proof
-        const proofPath = join(this.outputDir, `${runId}-proof.json`);
-        writeFileSync(proofPath, JSON.stringify(proof, null, 2));
-        return proofPath;
-    }
-    /**
-     * Save run results to Evidence Vault
-     * @returns The vault run ID
-     */
-    async saveToVault(runId, result, proofPath, flakinessResults, startTime) {
-        if (!this.vault) {
-            console.log(chalk.yellow('   ⚠️  Vault not initialized, skipping storage'));
-            return undefined;
-        }
-        try {
-            // Begin run in vault (returns actual runId used)
-            // Use startTime if provided to correctly calculate duration
-            const { runId: vaultRunId } = await this.vault.beginRun({
-                pack_path: `${this.pack.name || 'pack'}.yaml`,
-                pack_hash: this.hashPack(result.pack),
-                started_at: startTime // Use actual run start time for accurate duration
-            });
-            // Finish run with final status
-            await this.vault.finishRun(vaultRunId, {
-                status: result.success ? 'passed' : 'failed',
-                trust_score: result.summary.trustScore,
-                signature: this.keyPair ? 'ed25519-signed' : undefined
-            });
-            // Record gate executions
-            for (const gate of result.gates) {
-                await this.vault.recordGate(vaultRunId, {
-                    name: gate.gate,
-                    status: gate.success ? 'passed' : 'failed',
-                    duration_ms: gate.duration,
-                    metrics_json: JSON.stringify(gate.results?.summary || {})
-                });
-                // Record finding if gate has error
-                if (gate.error) {
-                    await this.vault.recordFinding(vaultRunId, {
-                        gate: gate.gate,
-                        severity: 'high',
-                        rule: 'gate-failure',
-                        message: gate.error
-                    });
-                }
-            }
-            // Record flakiness results if available
-            if (flakinessResults && flakinessResults.length > 0) {
-                for (const flaky of flakinessResults) {
-                    // Record unstable/shaky tests as findings
-                    if (flaky.category === FlakinessCategory.UNSTABLE || flaky.category === FlakinessCategory.SHAKY) {
-                        await this.vault.recordFinding(vaultRunId, {
-                            gate: flaky.gate,
-                            severity: flaky.category === FlakinessCategory.UNSTABLE ? 'high' : 'medium',
-                            rule: 'flaky-test-detected',
-                            message: `Test "${flaky.testName}" is ${flaky.category}: ${flaky.score}% reliability (${flaky.successfulRuns}/${flaky.totalRuns} passes)`
-                        });
-                    }
-                }
-                console.log(chalk.green(`   💾 ${flakinessResults.length} flakiness analysis(es) saved`));
-            }
-            console.log(chalk.green('   💾 Run saved to Evidence Vault'));
-            return vaultRunId;
-        }
-        catch (error) {
-            console.log(chalk.yellow(`   ⚠️  Failed to save to vault: ${error}`));
-            return undefined;
-        }
-    }
-    /**
-     * Detect flakiness by running tests multiple times consecutively
-     * @param gateResults Original gate results from first run
-     * @returns Flakiness analysis results
-     */
-    async detectFlakiness(gateResults) {
-        const flakinessMap = new Map();
-        const timestamp = Date.now();
-        // First, collect results from the initial run
-        for (const gateResult of gateResults) {
-            for (const [testId, testResult] of this.extractTestResults(gateResult, timestamp)) {
-                if (!flakinessMap.has(testId)) {
-                    flakinessMap.set(testId, []);
-                }
-                flakinessMap.get(testId).push(testResult);
-            }
-        }
-        // Run additional consecutive runs
-        for (let run = 1; run < this.flakyRuns; run++) {
-            console.log(chalk.gray(`     🔄 Consecutive run ${run + 1}/${this.flakyRuns}...`));
-            for (const gateResult of gateResults) {
-                // Re-run all gates to detect flakiness
-                try {
-                    const retryResult = await this.executeGate(gateResult.gate);
-                    // Extract and store test results
-                    for (const [testId, testResult] of this.extractTestResults(retryResult, timestamp)) {
-                        if (!flakinessMap.has(testId)) {
-                            flakinessMap.set(testId, []);
-                        }
-                        flakinessMap.get(testId).push(testResult);
-                    }
-                }
-                catch (error) {
-                    console.log(chalk.yellow(`     ⚠️  Failed to re-run ${gateResult.gate}: ${error}`));
-                }
-            }
-        }
-        // Analyze all collected results
-        return this.flakinessDetector.analyzeAll(flakinessMap);
-    }
-    /**
-     * Extract test results from a gate result
-     * Returns a map of testId to TestResult for flakiness tracking
-     */
-    extractTestResults(gateResult, timestamp) {
-        const results = new Map();
-        // Extract test results from adapter output
-        const adapterResults = gateResult.results;
-        if (adapterResults?.results && Array.isArray(adapterResults.results)) {
-            // Check for Playwright Native API adapter format
-            const firstResult = adapterResults.results[0];
-            if (firstResult && 'endpoint' in firstResult && 'method' in firstResult) {
-                // PlaywrightNativeApiAdapter format: { endpoint, method, status, success, error, ... }
-                for (const test of adapterResults.results) {
-                    // Extract just the path from full URL for cleaner test names
-                    const url = new URL(test.endpoint);
-                    const path = url.pathname + url.search;
-                    const testName = `${test.method} ${path} -> ${test.status}`;
-                    const testId = generateTestId(testName, gateResult.gate);
-                    results.set(testId, {
-                        testId,
-                        testName,
-                        filePath: gateResult.gate,
-                        gate: gateResult.gate,
-                        success: test.success,
-                        durationMs: test.responseTime || 0,
-                        errorMessage: test.error,
-                        timestamp: timestamp + Math.random(), // Small offset for ordering
-                        environment: process.env.NODE_ENV || 'local'
-                    });
-                }
-            }
-            else {
-                // Generic adapter format with results array
-                for (const test of adapterResults.results) {
-                    const testName = test.name || gateResult.gate;
-                    const testId = generateTestId(testName, gateResult.gate);
-                    results.set(testId, {
-                        testId,
-                        testName,
-                        filePath: gateResult.gate,
-                        gate: gateResult.gate,
-                        success: test.passed || test.status === 'passed',
-                        durationMs: test.duration || 0,
-                        errorType: test.error?.type,
-                        errorMessage: test.error?.message,
-                        timestamp: timestamp + Math.random(),
-                        environment: process.env.NODE_ENV || 'local'
-                    });
-                }
-            }
-        }
-        else if (adapterResults?.summary) {
-            // Generic adapter with summary only (no detailed results)
-            const testId = generateTestId(gateResult.gate, gateResult.gate);
-            results.set(testId, {
-                testId,
-                testName: gateResult.gate,
-                filePath: gateResult.gate,
-                gate: gateResult.gate,
-                success: gateResult.success,
-                durationMs: gateResult.duration,
-                errorMessage: gateResult.error,
-                timestamp,
-                environment: process.env.NODE_ENV || 'local'
-            });
-        }
-        else {
-            // Fallback: create single test result from gate
-            const testId = generateTestId(gateResult.gate, gateResult.gate);
-            results.set(testId, {
-                testId,
-                testName: gateResult.gate,
-                filePath: gateResult.gate,
-                gate: gateResult.gate,
-                success: gateResult.success,
-                durationMs: gateResult.duration,
-                errorMessage: gateResult.error,
-                timestamp,
-                environment: process.env.NODE_ENV || 'local'
-            });
-        }
-        return results;
-    }
-    /**
-     * Generate hash of pack configuration
-     */
-    hashPack(pack) {
-        return createHash('sha256')
-            .update(JSON.stringify(pack))
-            .digest('hex')
-            .substring(0, 16);
-    }
-    /**
-     * Get API target (v1 or v2 format)
-     */
-    getTargetApi() {
-        if (this.isPackV2(this.pack)) {
-            // In v2, target is in the gate config
-            const gateConfig = this.pack.gates['api_smoke'] || this.pack.gates['api'];
-            if (gateConfig && gateConfig.config?.baseUrl) {
-                return gateConfig.config;
-            }
-            return undefined;
-        }
-        return this.pack.targets?.api;
-    }
-    /**
-     * Get Web target (v1 or v2 format)
-     */
-    getTargetWeb() {
-        if (this.isPackV2(this.pack)) {
-            // In v2, target is in the gate config
-            const gateConfig = this.pack.gates['ui'] || this.pack.gates['a11y'];
-            if (gateConfig && gateConfig.config?.baseUrl) {
-                return gateConfig.config;
-            }
-            return undefined;
-        }
-        return this.pack.targets?.web;
-    }
-    /**
-     * Get budgets (v1 or v2 format)
-     */
-    getBudgets() {
-        if (this.isPackV2(this.pack)) {
-            // In v2, budgets can be in gate config or global
-            // For now, return undefined - budgets are gate-specific in v2
-            return undefined;
-        }
-        return this.pack.budgets;
-    }
-    /**
-     * Get execution timeout (v1 or v2 format)
-     */
-    getExecutionTimeout() {
-        if (this.isPackV2(this.pack)) {
-            return this.pack.execution?.default_timeout;
-        }
-        return this.pack.execution?.timeout;
-    }
-    /**
-     * Get execution retries (v1 or v2 format)
-     */
-    getExecutionRetries() {
-        if (this.isPackV2(this.pack)) {
-            return this.pack.execution?.default_retries;
-        }
-        return this.pack.execution?.max_retries;
-    }
-    /**
-     * Ensure output directory exists
-     */
-    ensureOutputDir() {
-        if (!existsSync(this.outputDir)) {
-            mkdirSync(this.outputDir, { recursive: true });
-        }
-    }
-}