qa360 2.2.1 → 2.2.13

package/cli/dist/core/vault/index.js

@@ -0,0 +1,1042 @@
+/**
+ * QA360 Evidence Vault Engine
+ * SQLite WAL-based storage with idempotence and CAS integration
+ */
+import sqlite3pkg from 'sqlite3';
+const { Database } = sqlite3pkg;
+import { existsSync, mkdirSync } from 'fs';
+import { join, resolve } from 'path';
+import { randomUUID } from 'crypto';
+import { createHash } from 'crypto';
+import { ContentAddressableStorage } from './cas.js';
+import { SecurityRedactor } from '../security/redactor.js';
+export class EvidenceVault {
+    db;
+    cas;
+    redactor;
+    dbPath;
+    baseDir;
+    constructor(config) {
+        this.baseDir = resolve(config.baseDir);
+        this.dbPath = join(this.baseDir, 'vault.db');
+        this.cas = new ContentAddressableStorage(join(this.baseDir, 'runs'));
+        this.redactor = SecurityRedactor.forReports();
+        this.ensureDirectories();
+        this.initializeDatabase(config);
+    }
+    /**
+     * Open vault connection and initialize schema
+     */
+    static async open(baseDir, config) {
+        const fullConfig = {
+            baseDir,
+            enableWAL: true,
+            maxConnections: 10,
+            retentionDays: 90,
+            ...config
+        };
+        const vault = new EvidenceVault(fullConfig);
+        await vault.initializeSchema();
+        return vault;
+    }
+    /**
+     * Begin a new run with idempotence support
+     */
+    async beginRun(options) {
+        // Check for existing run with same run_key
+        if (options.run_key) {
+            const existing = await this.getRunByKey(options.run_key);
+            if (existing) {
+                console.log(`[VAULT] RUN_IDEMPOTENT_REUSED: ${existing.id} (key: ${options.run_key})`);
+                return { runId: existing.id, isReused: true };
+            }
+        }
+        const runId = randomUUID();
+        const now = options.started_at ?? Date.now(); // Use provided timestamp or current time
+        const run = {
+            id: runId,
+            run_key: options.run_key,
+            started_at: now,
+            pack_hash: options.pack_hash,
+            pack_path: options.pack_path,
+            status: 'running',
+            weights_json: options.weights ? JSON.stringify(options.weights) : undefined,
+            pinned: 0,
+            created_at: now,
+            updated_at: now
+        };
+        await this.insertRun(run);
+        console.log(`[VAULT] RUN_STARTED: ${runId} (key: ${options.run_key || 'none'})`);
+        return { runId, isReused: false };
+    }
+    /**
+     * Finish a run with final status and signature
+     */
+    async finishRun(runId, options) {
+        const now = Date.now();
+        const updates = {
+            ended_at: now,
+            status: options.status,
+            trust_score: options.trust_score,
+            signature_hex: options.signature,
+            updated_at: now
+        };
+        if (options.weights) {
+            updates.weights_json = JSON.stringify(options.weights);
+        }
+        if (options.proof_pdf_sha) {
+            const artifact = await this.getArtifact(options.proof_pdf_sha);
+            if (artifact) {
+                updates.proof_pdf_path = artifact.cas_path;
+                await this.attachArtifact(runId, { sha256: options.proof_pdf_sha, label: 'proof_pdf' });
+            }
+        }
+        await this.updateRun(runId, updates);
+        console.log(`[VAULT] RUN_FINISHED: ${runId} (status: ${options.status}, trust: ${options.trust_score})`);
+    }
+    /**
+     * Record gate execution result
+     */
+    async recordGate(runId, gate) {
+        const gateRecord = {
+            run_id: runId,
+            created_at: Date.now(),
+            ...gate
+        };
+        const gateId = await this.insertGate(gateRecord);
+        console.log(`[VAULT] GATE_RECORDED: ${runId}/${gate.name} (status: ${gate.status}, duration: ${gate.duration_ms}ms)`);
+        return gateId;
+    }
+    /**
+     * Record security/quality finding
+     */
+    async recordFinding(runId, finding) {
+        // Redact sensitive information
+        const redactedFinding = {
+            run_id: runId,
+            created_at: Date.now(),
+            ...finding,
+            message: this.redactor.redact(finding.message),
+            raw_output: finding.raw_output ? this.redactor.redact(finding.raw_output) : undefined,
+            fingerprint: finding.fingerprint || this.generateFindingFingerprint(finding)
+        };
+        const findingId = await this.insertFinding(redactedFinding);
+        console.log(`[VAULT] FINDING_RECORDED: ${runId}/${finding.gate} (severity: ${finding.severity}, rule: ${finding.rule})`);
+        return findingId;
+    }
+    /**
+     * Record flakiness analysis result
+     */
+    async recordFlakiness(runId, flakiness) {
+        const flakinessRecord = {
+            run_id: runId,
+            created_at: Date.now(),
+            ...flakiness
+        };
+        const flakinessId = await this.insertFlakiness(flakinessRecord);
+        console.log(`[VAULT] FLAKINESS_RECORDED: ${runId}/${flakiness.test_name} (score: ${flakiness.score}, category: ${flakiness.category})`);
+        return flakinessId;
+    }
+    /**
+     * Record detected flakiness pattern
+     */
+    async recordFlakinessPattern(pattern) {
+        const now = Date.now();
+        // Check if pattern already exists for this test
+        const existing = await this.getFlakinessPattern(pattern.test_id, pattern.pattern_type);
+        if (existing) {
+            // Update existing pattern
+            await this.updateFlakinessPattern(existing.id, {
+                last_detected: now,
+                detection_count: (existing.detection_count || 0) + 1,
+                updated_at: now
+            });
+            console.log(`[VAULT] FLAKY_PATTERN_UPDATED: ${pattern.test_name} (${pattern.pattern_type})`);
+            return existing.id;
+        }
+        // Insert new pattern
+        const patternRecord = {
+            first_detected: now,
+            last_detected: now,
+            detection_count: 1,
+            created_at: now,
+            updated_at: now,
+            ...pattern
+        };
+        const patternId = await this.insertFlakinessPattern(patternRecord);
+        console.log(`[VAULT] FLAKY_PATTERN_DETECTED: ${pattern.test_name} (${pattern.pattern_type})`);
+        return patternId;
+    }
+    /**
+     * Add test to quarantine
+     */
+    async addToQuarantine(quarantine) {
+        const now = Date.now();
+        // Check if already in quarantine
+        const existing = await this.getQuarantine(quarantine.test_id);
+        if (existing && !existing.resolved_at) {
+            console.log(`[VAULT] ALREADY_IN_QUARANTINE: ${quarantine.test_name}`);
+            return existing.id;
+        }
+        const quarantineRecord = {
+            created_at: now,
+            updated_at: now,
+            ...quarantine
+        };
+        const quarantineId = await this.insertQuarantine(quarantineRecord);
+        console.log(`[VAULT] QUARANTINED: ${quarantine.test_name} (${quarantine.category})`);
+        return quarantineId;
+    }
+    /**
+     * Remove test from quarantine
+     */
+    async removeFromQuarantine(testId, resolvedBy, notes) {
+        await this.updateQuarantine(testId, {
+            resolved_at: Date.now(),
+            resolved_by: resolvedBy,
+            notes,
+            updated_at: Date.now()
+        });
+        console.log(`[VAULT] QUARANTINE_REMOVED: ${testId} (by: ${resolvedBy})`);
+    }
+    /**
+     * Get flakiness history for a test
+     */
+    async getFlakinessHistory(testId, limit = 50) {
+        return new Promise((resolve, reject) => {
+            this.db.all(`SELECT * FROM flakiness_history WHERE test_id = ? ORDER BY created_at DESC LIMIT ?`, [testId, limit], (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get flakiness history for a run
+     */
+    async getRunFlakiness(runId) {
+        return new Promise((resolve, reject) => {
+            this.db.all(`SELECT * FROM flakiness_history WHERE run_id = ? ORDER BY score ASC`, [runId], (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get all quarantined tests
+     */
+    async getQuarantinedTests(includeResolved = false) {
+        let query = 'SELECT * FROM flakiness_quarantine WHERE 1=1';
+        const params = [];
+        if (!includeResolved) {
+            query += ' AND resolved_at IS NULL';
+        }
+        query += ' ORDER BY quarantined_at DESC';
+        return new Promise((resolve, reject) => {
+            this.db.all(query, params, (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get quarantine record for a test
+     */
+    async getQuarantine(testId) {
+        return new Promise((resolve, reject) => {
+            this.db.get('SELECT * FROM flakiness_quarantine WHERE test_id = ? ORDER BY created_at DESC LIMIT 1', [testId], (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row || null);
+            });
+        });
+    }
+    /**
+     * Get flakiness pattern for a test
+     */
+    async getFlakinessPattern(testId, patternType) {
+        return new Promise((resolve, reject) => {
+            this.db.get('SELECT * FROM flakiness_patterns WHERE test_id = ? AND pattern_type = ?', [testId, patternType], (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row || null);
+            });
+        });
+    }
+    /**
+     * Get flakiness trends for a test
+     */
+    async getFlakinessTrends(testId, days = 30) {
+        const cutoff = Date.now() - (days * 24 * 60 * 60 * 1000);
+        return new Promise((resolve, reject) => {
+            this.db.all(`SELECT created_at, score FROM flakiness_history WHERE test_id = ? AND created_at >= ? ORDER BY created_at ASC`, [testId, cutoff], (err, rows) => {
+                if (err) {
+                    reject(err);
+                }
+                else {
+                    const rawPoints = rows;
+                    // Convert to expected format with 'date' property
+                    const dataPoints = rawPoints.map(p => ({ date: p.created_at, score: p.score }));
+                    if (dataPoints.length === 0) {
+                        resolve({
+                            testId,
+                            currentScore: 100,
+                            averageScore: 100,
+                            trend: 'stable',
+                            dataPoints: []
+                        });
+                        return;
+                    }
+                    const currentScore = dataPoints[dataPoints.length - 1].score;
+                    const averageScore = Math.round(dataPoints.reduce((sum, p) => sum + p.score, 0) / dataPoints.length);
+                    // Calculate trend
+                    let trend = 'stable';
+                    if (dataPoints.length >= 3) {
+                        const recent = dataPoints.slice(-3);
+                        const older = dataPoints.slice(0, -3);
+                        const recentAvg = recent.reduce((sum, p) => sum + p.score, 0) / recent.length;
+                        const olderAvg = older.reduce((sum, p) => sum + p.score, 0) / older.length;
+                        if (recentAvg > olderAvg + 5)
+                            trend = 'improving';
+                        else if (recentAvg < olderAvg - 5)
+                            trend = 'degrading';
+                    }
+                    resolve({
+                        testId,
+                        currentScore,
+                        averageScore,
+                        trend,
+                        dataPoints
+                    });
+                }
+            });
+        });
+    }
+    /**
+     * Store artifact in CAS and link to run
+     */
+    async storeArtifact(runId, content, mimeType, label, originalName) {
+        const casArtifact = await this.cas.saveArtifact(content, mimeType, originalName);
+        // Store artifact metadata
+        const artifact = {
+            sha256: casArtifact.sha256,
+            mime_type: mimeType,
+            size_bytes: casArtifact.size,
+            cas_path: casArtifact.path,
+            original_name: originalName,
+            created_at: Date.now(),
+            last_accessed: Date.now()
+        };
+        await this.insertArtifact(artifact);
+        await this.attachArtifact(runId, { sha256: casArtifact.sha256, label });
+        console.log(`[VAULT] ARTIFACT_STORED: ${runId}/${label} (sha256: ${casArtifact.sha256.substring(0, 8)}..., size: ${casArtifact.size})`);
+        return casArtifact;
+    }
+    /**
+     * Attach existing artifact to run
+     */
+    async attachArtifact(runId, link) {
+        const linkRecord = {
+            run_id: runId,
+            sha256: link.sha256,
+            label: link.label,
+            created_at: Date.now()
+        };
+        await this.insertRunArtifact(linkRecord);
+    }
+    /**
+     * Get run by ID
+     */
+    async getRun(runId) {
+        return new Promise((resolve, reject) => {
+            this.db.get('SELECT * FROM runs WHERE id = ?', [runId], (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row || null);
+            });
+        });
+    }
+    /**
+     * Get run by ID prefix (e.g., "6ce422f7" for shortened display)
+     * Returns null if multiple or no runs match the prefix
+     */
+    async getRunByPrefix(prefix) {
+        const allRuns = await this.listRuns({});
+        const matching = allRuns.filter(r => r.id.startsWith(prefix));
+        if (matching.length === 0) {
+            return null;
+        }
+        if (matching.length > 1) {
+            // Ambiguous prefix - return null to indicate error
+            return null;
+        }
+        return matching[0];
+    }
+    /**
+     * Get run by run_key
+     */
+    async getRunByKey(runKey) {
+        return new Promise((resolve, reject) => {
+            this.db.get('SELECT * FROM runs WHERE run_key = ?', [runKey], (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row || null);
+            });
+        });
+    }
+    /**
+     * List runs with filters
+     */
+    async listRuns(filters) {
+        let query = 'SELECT * FROM runs WHERE 1=1';
+        const params = [];
+        if (filters?.status?.length) {
+            query += ` AND status IN (${filters.status.map(() => '?').join(',')})`;
+            params.push(...filters.status);
+        }
+        if (filters?.since) {
+            query += ' AND started_at >= ?';
+            params.push(filters.since.getTime());
+        }
+        if (filters?.until) {
+            query += ' AND started_at <= ?';
+            params.push(filters.until.getTime());
+        }
+        if (filters?.pack_hash) {
+            query += ' AND pack_hash = ?';
+            params.push(filters.pack_hash);
+        }
+        query += ' ORDER BY started_at DESC';
+        if (filters?.limit) {
+            query += ' LIMIT ?';
+            params.push(filters.limit);
+            if (filters?.offset) {
+                query += ' OFFSET ?';
+                params.push(filters.offset);
+            }
+        }
+        return new Promise((resolve, reject) => {
+            this.db.all(query, params, (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get gates for a run
+     */
+    async getGates(runId) {
+        return new Promise((resolve, reject) => {
+            this.db.all('SELECT * FROM gates WHERE run_id = ? ORDER BY created_at', [runId], (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get findings for a run
+     */
+    async getFindings(runId, gate) {
+        let query = 'SELECT * FROM findings WHERE run_id = ?';
+        const params = [runId];
+        if (gate) {
+            query += ' AND gate = ?';
+            params.push(gate);
+        }
+        query += ' ORDER BY severity DESC, created_at';
+        return new Promise((resolve, reject) => {
+            this.db.all(query, params, (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get artifacts for a run
+     */
+    async getRunArtifacts(runId) {
+        return new Promise((resolve, reject) => {
+            this.db.all(`
+        SELECT a.*, ra.label 
+        FROM artifacts a
+        JOIN run_artifacts ra ON a.sha256 = ra.sha256
+        WHERE ra.run_id = ?
+        ORDER BY ra.created_at
+      `, [runId], (err, rows) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(rows);
+            });
+        });
+    }
+    /**
+     * Get artifact by SHA256
+     */
+    async getArtifact(sha256) {
+        return new Promise((resolve, reject) => {
+            this.db.get('SELECT * FROM artifacts WHERE sha256 = ?', [sha256], (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row || null);
+            });
+        });
+    }
+    /**
+     * Pin/unpin run to protect from GC
+     */
+    async pinRun(runId, pinned = true) {
+        await this.updateRun(runId, { pinned: pinned ? 1 : 0 });
+        console.log(`[VAULT] RUN_${pinned ? 'PINNED' : 'UNPINNED'}: ${runId}`);
+    }
+    /**
+     * Calculate pack hash for idempotence
+     */
+    static calculatePackHash(packContent) {
+        // Normalize pack content (remove comments, sort keys, etc.)
+        const normalized = packContent
+            .split('\n')
+            .filter(line => !line.trim().startsWith('#'))
+            .join('\n')
+            .trim();
+        return createHash('sha256').update(normalized).digest('hex');
+    }
+    /**
+     * Get vault statistics
+     */
+    async getStats() {
+        const queries = [
+            'SELECT COUNT(*) as count FROM runs',
+            'SELECT COUNT(*) as count FROM gates',
+            'SELECT COUNT(*) as count FROM findings',
+            'SELECT COUNT(*) as count FROM artifacts',
+            'SELECT MIN(started_at) as oldest, MAX(started_at) as newest FROM runs'
+        ];
+        const results = await Promise.all(queries.map(query => new Promise((resolve, reject) => {
+            this.db.get(query, (err, row) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(row);
+            });
+        })));
+        const casStats = await this.cas.getStats();
+        return {
+            totalRuns: results[0].count,
+            totalGates: results[1].count,
+            totalFindings: results[2].count,
+            totalArtifacts: results[3].count,
+            vaultSizeBytes: casStats.totalBytes,
+            oldestRun: results[4].oldest ? new Date(results[4].oldest) : undefined,
+            newestRun: results[4].newest ? new Date(results[4].newest) : undefined
+        };
+    }
+    // Private helper methods
+    async insertRun(run) {
+        const fields = Object.keys(run).join(', ');
+        const placeholders = Object.keys(run).map(() => '?').join(', ');
+        const values = Object.values(run);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO runs (${fields}) VALUES (${placeholders})`, values, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async updateRun(runId, updates) {
+        const fields = Object.keys(updates).map(key => `${key} = ?`).join(', ');
+        const values = [...Object.values(updates), runId];
+        return new Promise((resolve, reject) => {
+            this.db.run(`UPDATE runs SET ${fields} WHERE id = ?`, values, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async insertGate(gate) {
+        const fields = Object.keys(gate).join(', ');
+        const placeholders = Object.keys(gate).map(() => '?').join(', ');
+        const values = Object.values(gate);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO gates (${fields}) VALUES (${placeholders})`, values, function (err) {
+                if (err)
+                    reject(err);
+                else
+                    resolve(this.lastID);
+            });
+        });
+    }
+    async insertFinding(finding) {
+        const fields = Object.keys(finding).join(', ');
+        const placeholders = Object.keys(finding).map(() => '?').join(', ');
+        const values = Object.values(finding);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO findings (${fields}) VALUES (${placeholders})`, values, function (err) {
+                if (err)
+                    reject(err);
+                else
+                    resolve(this.lastID);
+            });
+        });
+    }
+    async insertArtifact(artifact) {
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT OR IGNORE INTO artifacts (sha256, mime_type, size_bytes, cas_path, original_name, created_at, last_accessed) 
+         VALUES (?, ?, ?, ?, ?, ?, ?)`, [
+                artifact.sha256,
+                artifact.mime_type,
+                artifact.size_bytes,
+                artifact.cas_path,
+                artifact.original_name,
+                artifact.created_at,
+                artifact.last_accessed
+            ], (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async insertRunArtifact(link) {
+        return new Promise((resolve, reject) => {
+            this.db.run('INSERT OR IGNORE INTO run_artifacts (run_id, sha256, label, created_at) VALUES (?, ?, ?, ?)', [link.run_id, link.sha256, link.label, link.created_at], (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async insertFlakiness(flakiness) {
+        const fields = Object.keys(flakiness).join(', ');
+        const placeholders = Object.keys(flakiness).map(() => '?').join(', ');
+        const values = Object.values(flakiness);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO flakiness_history (${fields}) VALUES (${placeholders})`, values, function (err) {
+                if (err)
+                    reject(err);
+                else
+                    resolve(this.lastID);
+            });
+        });
+    }
+    async insertFlakinessPattern(pattern) {
+        const fields = Object.keys(pattern).join(', ');
+        const placeholders = Object.keys(pattern).map(() => '?').join(', ');
+        const values = Object.values(pattern);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO flakiness_patterns (${fields}) VALUES (${placeholders})`, values, function (err) {
+                if (err)
+                    reject(err);
+                else
+                    resolve(this.lastID);
+            });
+        });
+    }
+    async updateFlakinessPattern(id, updates) {
+        const fields = Object.keys(updates).map(key => `${key} = ?`).join(', ');
+        const values = [...Object.values(updates), id];
+        return new Promise((resolve, reject) => {
+            this.db.run(`UPDATE flakiness_patterns SET ${fields} WHERE id = ?`, values, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    async insertQuarantine(quarantine) {
+        const fields = Object.keys(quarantine).join(', ');
+        const placeholders = Object.keys(quarantine).map(() => '?').join(', ');
+        const values = Object.values(quarantine);
+        return new Promise((resolve, reject) => {
+            this.db.run(`INSERT INTO flakiness_quarantine (${fields}) VALUES (${placeholders})`, values, function (err) {
+                if (err)
+                    reject(err);
+                else
+                    resolve(this.lastID);
+            });
+        });
+    }
+    async updateQuarantine(testId, updates) {
+        const fields = Object.keys(updates).map(key => `${key} = ?`).join(', ');
+        const values = [...Object.values(updates), testId];
+        return new Promise((resolve, reject) => {
+            this.db.run(`UPDATE flakiness_quarantine SET ${fields} WHERE test_id = ?`, values, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    generateFindingFingerprint(finding) {
+        const content = `${finding.gate}:${finding.rule}:${finding.location || ''}:${finding.message}`;
+        return createHash('sha256').update(content).digest('hex').substring(0, 16);
+    }
+    /**
+     * Initialize database connection
+     */
+    initializeDatabase(config) {
+        this.db = new Database(this.dbPath);
+        if (config.enableWAL) {
+            this.db.exec('PRAGMA journal_mode = WAL');
+            this.db.exec('PRAGMA synchronous = NORMAL');
+        }
+        this.db.exec('PRAGMA foreign_keys = ON');
+        this.db.exec('PRAGMA cache_size = 10000');
+        this.db.exec('PRAGMA temp_store = MEMORY');
+    }
+    /**
+     * Initialize database schema
+     */
+    async initializeSchema() {
+        const schema = `
+-- QA360 Evidence Vault Schema
+-- SQLite WAL mode for concurrent access and performance
+
+-- Runs table: core execution records
+CREATE TABLE IF NOT EXISTS runs (
+    id TEXT PRIMARY KEY,
+    run_key TEXT UNIQUE,
+    started_at INTEGER NOT NULL,
+    ended_at INTEGER,
+    pack_hash TEXT NOT NULL,
+    pack_path TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'running',
+    trust_score INTEGER,
+    weights_json TEXT,
+    sign_alg TEXT DEFAULT 'ed25519',
+    signature_hex TEXT,
+    proof_pdf_path TEXT,
+    pinned INTEGER DEFAULT 0,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Gates table: individual test gate results
+CREATE TABLE IF NOT EXISTS gates (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    status TEXT NOT NULL,
+    duration_ms INTEGER,
+    metrics_json TEXT,
+    budgets_json TEXT,
+    started_at INTEGER,
+    ended_at INTEGER,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Findings table: security and quality findings
+CREATE TABLE IF NOT EXISTS findings (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+    gate TEXT NOT NULL,
+    severity TEXT NOT NULL,
+    rule TEXT NOT NULL,
+    location TEXT,
+    message TEXT,
+    raw_output TEXT,
+    fingerprint TEXT,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Artifacts table: Content-Addressable Storage metadata
+CREATE TABLE IF NOT EXISTS artifacts (
+    sha256 TEXT PRIMARY KEY,
+    mime_type TEXT NOT NULL,
+    size_bytes INTEGER NOT NULL,
+    cas_path TEXT NOT NULL,
+    original_name TEXT,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    last_accessed INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Run artifacts table: N-N relationship between runs and artifacts
+CREATE TABLE IF NOT EXISTS run_artifacts (
+    run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+    sha256 TEXT NOT NULL REFERENCES artifacts(sha256) ON DELETE CASCADE,
+    label TEXT NOT NULL,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    PRIMARY KEY (run_id, sha256, label)
+);
+
+-- Flakiness history table: tracks test reliability over time
+CREATE TABLE IF NOT EXISTS flakiness_history (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    run_id TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+    test_id TEXT NOT NULL,
+    test_name TEXT NOT NULL,
+    gate TEXT NOT NULL,
+    file_path TEXT NOT NULL,
+    score INTEGER NOT NULL CHECK (score >= 0 AND score <= 100),
+    category TEXT NOT NULL CHECK (category IN ('legendary', 'solid', 'good', 'shaky', 'unstable')),
+    total_runs INTEGER NOT NULL,
+    successful_runs INTEGER NOT NULL,
+    avg_duration_ms INTEGER NOT NULL,
+    pattern_type TEXT,
+    suggested_fix TEXT,
+    confidence REAL,
+    first_seen INTEGER NOT NULL,
+    last_seen INTEGER NOT NULL,
+    current_streak INTEGER,
+    streak_type TEXT CHECK (streak_type IN ('pass', 'fail')),
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Flakiness patterns table: detected patterns for flaky tests
+CREATE TABLE IF NOT EXISTS flakiness_patterns (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    test_id TEXT NOT NULL,
+    test_name TEXT NOT NULL,
+    pattern_type TEXT NOT NULL CHECK (pattern_type IN ('timing', 'race_condition', 'external_dependency', 'environment_specific', 'selector_issue', 'unknown')),
+    description TEXT NOT NULL,
+    suggested_fix TEXT NOT NULL,
+    confidence REAL NOT NULL CHECK (confidence >= 0 AND confidence <= 1),
+    auto_fix_possible INTEGER NOT NULL DEFAULT 0,
+    first_detected INTEGER NOT NULL,
+    last_detected INTEGER NOT NULL,
+    detection_count INTEGER NOT NULL DEFAULT 1,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    UNIQUE(test_id, pattern_type)
+);
+
+-- Flakiness quarantine table: tests quarantined for flakiness
+CREATE TABLE IF NOT EXISTS flakiness_quarantine (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    test_id TEXT NOT NULL UNIQUE,
+    test_name TEXT NOT NULL,
+    gate TEXT NOT NULL,
+    file_path TEXT NOT NULL,
+    reason TEXT NOT NULL,
+    score INTEGER NOT NULL CHECK (score >= 0 AND score <= 100),
+    category TEXT NOT NULL CHECK (category IN ('shaky', 'unstable')),
+    quarantined_at INTEGER NOT NULL,
+    quarantined_by TEXT NOT NULL,
+    resolved_at INTEGER,
+    resolved_by TEXT,
+    notes TEXT,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Vault metadata table: schema version and configuration
+CREATE TABLE IF NOT EXISTS vault_metadata (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000)
+);
+
+-- Indexes for performance
+CREATE INDEX IF NOT EXISTS idx_runs_started_at ON runs(started_at DESC);
+CREATE INDEX IF NOT EXISTS idx_runs_run_key ON runs(run_key) WHERE run_key IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+CREATE INDEX IF NOT EXISTS idx_runs_pack_hash ON runs(pack_hash);
+CREATE INDEX IF NOT EXISTS idx_runs_pinned ON runs(pinned) WHERE pinned = 1;
+
+CREATE INDEX IF NOT EXISTS idx_gates_run_id ON gates(run_id);
+CREATE INDEX IF NOT EXISTS idx_gates_run_name ON gates(run_id, name);
+CREATE INDEX IF NOT EXISTS idx_gates_status ON gates(status);
+CREATE INDEX IF NOT EXISTS idx_gates_name ON gates(name);
+
+CREATE INDEX IF NOT EXISTS idx_findings_run_id ON findings(run_id);
+CREATE INDEX IF NOT EXISTS idx_findings_run_gate ON findings(run_id, gate);
+CREATE INDEX IF NOT EXISTS idx_findings_severity ON findings(severity);
+CREATE INDEX IF NOT EXISTS idx_findings_rule ON findings(rule);
+CREATE INDEX IF NOT EXISTS idx_findings_fingerprint ON findings(fingerprint);
+
+CREATE INDEX IF NOT EXISTS idx_artifacts_mime_type ON artifacts(mime_type);
+CREATE INDEX IF NOT EXISTS idx_artifacts_size ON artifacts(size_bytes);
+CREATE INDEX IF NOT EXISTS idx_artifacts_created_at ON artifacts(created_at);
+CREATE INDEX IF NOT EXISTS idx_artifacts_last_accessed ON artifacts(last_accessed);
+
+CREATE INDEX IF NOT EXISTS idx_run_artifacts_run_id ON run_artifacts(run_id);
+CREATE INDEX IF NOT EXISTS idx_run_artifacts_sha256 ON run_artifacts(sha256);
+CREATE INDEX IF NOT EXISTS idx_run_artifacts_label ON run_artifacts(label);
+
+-- Flakiness indexes
+CREATE INDEX IF NOT EXISTS idx_flakiness_run_id ON flakiness_history(run_id);
+CREATE INDEX IF NOT EXISTS idx_flakiness_test_id ON flakiness_history(test_id);
+CREATE INDEX IF NOT EXISTS idx_flakiness_score ON flakiness_history(score);
+CREATE INDEX IF NOT EXISTS idx_flakiness_category ON flakiness_history(category);
+CREATE INDEX IF NOT EXISTS idx_flakiness_created_at ON flakiness_history(created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_flaky_patterns_test_id ON flakiness_patterns(test_id);
+CREATE INDEX IF NOT EXISTS idx_flaky_patterns_pattern_type ON flakiness_patterns(pattern_type);
+CREATE INDEX IF NOT EXISTS idx_flaky_patterns_detection_count ON flakiness_patterns(detection_count DESC);
+
+CREATE INDEX IF NOT EXISTS idx_quarantine_test_id ON flakiness_quarantine(test_id);
+CREATE INDEX IF NOT EXISTS idx_quarantine_quarantined_at ON flakiness_quarantine(quarantined_at DESC);
+CREATE INDEX IF NOT EXISTS idx_quarantine_resolved_at ON flakiness_quarantine(resolved_at);
+CREATE INDEX IF NOT EXISTS idx_quarantine_category ON flakiness_quarantine(category);
+
+-- Insert initial metadata
+INSERT OR IGNORE INTO vault_metadata (key, value) VALUES
+    ('schema_version', '2.0.0'),
+    ('created_at', strftime('%s', 'now') * 1000),
+    ('vault_format', 'qa360-evidence-vault-v2');
+
+-- Triggers for updated_at timestamps
+CREATE TRIGGER IF NOT EXISTS trigger_runs_updated_at
+    AFTER UPDATE ON runs
+    BEGIN
+        UPDATE runs SET updated_at = strftime('%s', 'now') * 1000 WHERE id = NEW.id;
+    END;
+
+CREATE TRIGGER IF NOT EXISTS trigger_artifacts_last_accessed
+    AFTER UPDATE ON artifacts
+    BEGIN
+        UPDATE artifacts SET last_accessed = strftime('%s', 'now') * 1000 WHERE sha256 = NEW.sha256;
+    END;
+
+CREATE TRIGGER IF NOT EXISTS trigger_flakiness_patterns_updated_at
+    AFTER UPDATE ON flakiness_patterns
+    BEGIN
+        UPDATE flakiness_patterns SET updated_at = strftime('%s', 'now') * 1000 WHERE id = NEW.id;
+    END;
+
+CREATE TRIGGER IF NOT EXISTS trigger_quarantine_updated_at
+    AFTER UPDATE ON flakiness_quarantine
+    BEGIN
+        UPDATE flakiness_quarantine SET updated_at = strftime('%s', 'now') * 1000 WHERE id = NEW.id;
+    END;
+
+-- Views for common queries
+CREATE VIEW IF NOT EXISTS v_recent_runs AS
+SELECT 
+    r.id,
+    r.run_key,
+    r.started_at,
+    r.ended_at,
+    r.status,
+    r.trust_score,
+    r.pack_path,
+    COUNT(g.id) as gate_count,
+    COUNT(CASE WHEN g.status = 'passed' THEN 1 END) as gates_passed,
+    COUNT(CASE WHEN g.status = 'failed' THEN 1 END) as gates_failed,
+    COUNT(f.id) as finding_count,
+    COUNT(CASE WHEN f.severity IN ('high', 'critical') THEN 1 END) as critical_findings
+FROM runs r
+LEFT JOIN gates g ON r.id = g.run_id
+LEFT JOIN findings f ON r.id = f.run_id
+GROUP BY r.id
+ORDER BY r.started_at DESC;
+
+CREATE VIEW IF NOT EXISTS v_gate_trends AS
+SELECT
+    g.name,
+    g.status,
+    r.started_at,
+    r.trust_score,
+    g.duration_ms,
+    g.metrics_json
+FROM gates g
+JOIN runs r ON g.run_id = r.id
+WHERE r.status IN ('passed', 'failed')
+ORDER BY r.started_at DESC;
+
+-- Flakiness summary view: aggregate flakiness stats by test
+CREATE VIEW IF NOT EXISTS v_flakiness_summary AS
+SELECT
+    test_id,
+    test_name,
+    gate,
+    file_path,
+    MAX(score) as latest_score,
+    MIN(score) as worst_score,
+    AVG(score) as avg_score,
+    COUNT(*) as total_analyses,
+    MAX(category) as latest_category,
+    MAX(last_seen) as last_analyzed,
+    MAX(first_seen) as first_seen
+FROM flakiness_history
+GROUP BY test_id, test_name, gate, file_path
+ORDER BY latest_score ASC;
+
+-- Flakiness trends view: time series analysis
+CREATE VIEW IF NOT EXISTS v_flakiness_trends AS
+SELECT
+    DATE(created_at / 1000, 'unixepoch') as analysis_date,
+    category,
+    COUNT(*) as test_count,
+    AVG(score) as avg_score
+FROM flakiness_history
+WHERE created_at >= strftime('%s', 'now', '-30 days') * 1000
+GROUP BY analysis_date, category
+ORDER BY analysis_date DESC, category DESC;
+
+-- Quarantined tests view
+CREATE VIEW IF NOT EXISTS v_quarantined_tests AS
+SELECT
+    q.*,
+    fh.score as current_score,
+    fh.category as current_category
+FROM flakiness_quarantine q
+LEFT JOIN (
+    SELECT test_id, score, category
+    FROM flakiness_history fh1
+    WHERE fh1.created_at = (
+        SELECT MAX(fh2.created_at)
+        FROM flakiness_history fh2
+        WHERE fh2.test_id = fh1.test_id
+    )
+) fh ON q.test_id = fh.test_id
+WHERE q.resolved_at IS NULL
+ORDER BY q.quarantined_at DESC;
+`;
+        return new Promise((resolve, reject) => {
+            this.db.exec(schema, (err) => {
+                if (err) {
+                    reject(new Error(`Failed to initialize schema: ${err.message}`));
+                }
+                else {
+                    resolve();
+                }
+            });
+        });
+    }
+    /**
+     * Ensure required directories exist
+     */
+    ensureDirectories() {
+        if (!existsSync(this.baseDir)) {
+            mkdirSync(this.baseDir, { recursive: true });
+        }
+    }
+    /**
+     * Close database connection
+     */
+    async close() {
+        return new Promise((resolve, reject) => {
+            this.db.close((err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+}