synapse-hub 2.2.4 → 2.4.1

package/tools/verify_all.py

@@ -17,7 +17,7 @@ Verifies:
   Gate 5: Cleanup Blacklist: No temporary properties or debug dump files on disk.
   Gate 6: Credential Security: No plaintext passwords in Profiles/default.glbl or repository.
   Gate 7: Static Defect Sentinel: Meta Infer-style AST scan for fake passes and empty catches.
-  Gate 8: AST Micro-Mutation Sentinel: Injects syntactic faults to eliminate tautological tests (Mutation Score >= 80%).
+  Gate 8: Syntactic Micro-Mutation Sentinel: Injects syntactic faults to eliminate tautological tests (Mutation Score >= 80%).
 
 Supports:
   - Hub Mode: Verifies the centralized QA Hub / skills repository integrity.
@@ -32,6 +32,11 @@ import sys
 import subprocess
 import glob
 import re
+import json
+import io
+from datetime import datetime
+import ast
+import builtins
 import argparse
 
 # Enforce UTF-8 stdout encoding for Windows console compatibility
@@ -130,7 +135,7 @@ def resolve_target_repo(cli_target=None, cli_repo=None):
 
 
 def gate_0_author_integrity(repo_root, mode="AUTO"):
-    print("\n[GATE 0] Running Author Attribution & Anti-Tamper Integrity Guard...")
+    print("\n[GATE 0] Verifying Author Attribution & MIT License Integrity...")
     try:
         from author_integrity import (
             verify_author_attribution,
@@ -148,47 +153,89 @@ def gate_0_author_integrity(repo_root, mode="AUTO"):
             DEFAULT_REPO_ROOT,
         )
 
-    # 1. Cryptographic SHA-256 fingerprint verification
+    # 1. Author metadata hash verification
     if not verify_author_fingerprint():
-        print("[FAIL] Cryptographic author fingerprint mismatch! Original creator ('Thế Vị @TeeVee998') has been tampered with.")
+        print("[FAIL] Author attribution reference mismatch! Original creator ('Thế Vị @TeeVee998') has been altered.")
         return False
 
     # 2. In HUB mode, verify the Hub repository itself.
     # In TARGET mode, verify the Hub tools root to guarantee engine integrity.
     check_root = repo_root if mode == "HUB" else DEFAULT_REPO_ROOT
     valid, violations = verify_author_attribution(check_root)
-    if not valid:
-        print("[FAIL] Author Attribution & Copyright Integrity Violated:")
-        for v in violations:
+    license_violations = [v for v in violations if "LICENSE" in v]
+    if license_violations:
+        print("[FAIL] Author Attribution & MIT License Violated:")
+        for v in license_violations:
             print(f"   • {v}")
-        print("   Under MIT License, original author attribution to 'Thế Vị (@TeeVee998)' must be preserved.")
+        print("   Under MIT License, original author copyright notice to 'Thế Vị (@TeeVee998)' must be preserved in LICENSE.")
         return False
-    print(f"[PASS] Author Attribution & Cryptographic Provenance verified intact: {get_canonical_watermark()}")
+    elif not valid:
+        # Informational notices for downstream forks with customized package.json / README
+        print("[INFO] Downstream attribution notice:")
+        for v in violations:
+            print(f"   • {v}")
+    print(f"[PASS] Author Attribution & MIT License Provenance verified intact: {get_canonical_watermark()}")
     return True
 
 
+MOJIBAKE_INDICATORS = (
+    "\u00c3\u00a1",  # á
+    "\u00c3\u00a3",  # ã
+    "\u00c3\u00a9",  # é
+    "\u00c3\u00a8",  # è
+    "\u00c3\u00b3",  # ó
+    "\u00c3\u00b2",  # ò
+    "\ufffd",        # replacement char
+    "\u00e2\u20ac\u2014",  # double encoded em-dash
+    "\u00e2\u20ac\u0153",  # double encoded open quote
+    "\u00e2\u20ac\u009d",  # double encoded close quote
+)
+
+
 def gate_1_bom_check(repo_root, mode="AUTO"):
-    print("\n[GATE 1] Scanning UTF-8 No BOM across repository...")
-    violations = []
+    print("\n[GATE 1] Scanning UTF-8 No BOM and Encoding Integrity across repository...")
+    ignored_dirs = {".git", ".gradle", "node_modules", "allure-results", "graphify-out", "__pycache__", "build", "dist", "claude-ecosystem-repos"}
+    ignored_files = {"verify_all.py", "test_tools.py"}
+    bom_violations = []
+    mojibake_violations = []
     for root, dirs, files in os.walk(repo_root):
-        if any(ignored in root for ignored in [".git", ".gradle", "node_modules", "allure-results", "graphify-out"]):
-            continue
+        dirs[:] = [d for d in dirs if d not in ignored_dirs]
         for f in files:
             if f.endswith(BOM_EXTENSIONS):
                 full_path = os.path.join(root, f)
+                rel_path = os.path.relpath(full_path, repo_root)
+                if f in ignored_files:
+                    continue
                 try:
                     with open(full_path, "rb") as fp:
-                        if fp.read(3) == b"\xef\xbb\xbf":
-                            violations.append(os.path.relpath(full_path, repo_root))
-                except Exception:
+                        raw = fp.read()
+                        if raw[:3] == b"\xef\xbb\xbf":
+                            bom_violations.append(rel_path)
+                    try:
+                        text = raw.decode("utf-8")
+                        if any(ind in text for ind in MOJIBAKE_INDICATORS):
+                            mojibake_violations.append(rel_path)
+                    except UnicodeDecodeError:
+                        mojibake_violations.append(f"{rel_path} (Invalid UTF-8 decode)")
+                except (OSError, PermissionError):
                     pass
 
-    if violations:
-        print(f"[FAIL] {len(violations)} files contain UTF-8 BOM bytes:")
-        for v in violations:
+    failed = False
+    if bom_violations:
+        print(f"[FAIL] {len(bom_violations)} files contain UTF-8 BOM bytes:")
+        for v in bom_violations:
+            print(f"   - {v}")
+        failed = True
+    if mojibake_violations:
+        print(f"[FAIL] {len(mojibake_violations)} files contain Mojibake / Corrupted Encoding:")
+        for v in mojibake_violations:
             print(f"   - {v}")
+        failed = True
+
+    if failed:
         return False
-    print("[PASS] 100% UTF-8 No BOM verified across all source files.")
+
+    print("[PASS] 100% UTF-8 No BOM & Clean Encoding verified across all source files.")
     return True
 
 
@@ -197,11 +244,12 @@ def gate_2_path_portability(repo_root, mode="AUTO"):
     ignored_dirs = {
         ".git", ".gradle", "node_modules", "allure-results", "Screenshots",
         "Reports", "reports", "TestReports", "testreports", "bin", "Libs", ".settings", "graphify-out",
-        "__pycache__", "agent_qa.egg-info", "dist", "build"
+        "__pycache__", "agent_qa.egg-info", "dist", "build", "claude-ecosystem-repos"
     }
     ignored_files = {
         ".project", ".classpath", ".DS_Store", "memory_cache.db",
-        "verify_all.py", "git_pre_commit_guard.py", "agent_canary.py", "repo_map.txt", "repo_map.json"
+        "verify_all.py", "git_pre_commit_guard.py", "agent_canary.py", "repo_map.txt", "repo_map.json",
+        "PROJECT_HEALTH_REPORT.md", "PROJECT_STATE.md"
     }
     violations = []
     for root, dirs, files in os.walk(repo_root):
@@ -224,7 +272,7 @@ def gate_2_path_portability(repo_root, mode="AUTO"):
                         for pattern, desc in FORBIDDEN_PATH_PATTERNS:
                             if pattern.search(line):
                                 violations.append((rel_path, line_no, desc))
-            except Exception:
+            except (OSError, PermissionError):
                 pass
 
     if violations:
@@ -240,7 +288,7 @@ def gate_3_clean_pom(repo_root, mode="AUTO"):
     print("\n[GATE 3] Checking Clean POM & Flat Architecture in Test Scripts...")
     effective_mode = detect_repo_mode(repo_root) if mode == "AUTO" else mode
     if effective_mode == "HUB":
-        print("[PASS] Hub Mode: Repository contains QA Hub assets; Clean POM applies to target test suites.")
+        print("[N/A] Hub Mode: Not Applicable (Clean POM rules apply to target test suites in Spokes).")
         return True
 
     test_dirs = ["Scripts", "tests", "test", "e2e", "specs", "cypress"]
@@ -252,9 +300,14 @@ def gate_3_clean_pom(repo_root, mode="AUTO"):
                 test_files.extend(glob.glob(os.path.join(d, "**", ext), recursive=True))
 
     if not test_files:
-        print("[SKIP] No test scripts present in candidate directories (Scripts/, tests/, e2e/).")
+        print("[N/A] No test scripts present in candidate directories (Scripts/, tests/, e2e/).")
         return True
 
+    LOCATOR_CALL_PATTERN = re.compile(
+        r'(?:\.(?:click|dblclick|fill|type|press|check|locator|waitForSelector|hover|selectOption)|cy\.(?:get|find)|driver\.find[A-Za-z]*|WebUI\.[a-zA-Z]+)\s*\(\s*[\x22\x27](?P<sel>[^\x22\x27]+)[\x22\x27]'
+    )
+    RAW_XPATH_PATTERN = re.compile(r'[\x22\x27](?:xpath=|\/{2}[a-zA-Z*@\[])[^\x22\x27]*[\x22\x27]')
+
     violations = []
     for full_path in sorted(set(test_files)):
         rel_path = os.path.relpath(full_path, repo_root)
@@ -264,11 +317,22 @@ def gate_3_clean_pom(repo_root, mode="AUTO"):
                     stripped = line.strip()
                     if stripped.startswith("//") or stripped.startswith("/*") or stripped.startswith("#"):
                         continue
+                    # Ignore standard navigation statements to prevent false-positive XPath violations on URLs
+                    if re.search(r'\.(?:goto|get|open|navigate)\s*\(\s*[\x22\x27]https?:\/\/', stripped):
+                        continue
                     if "findTestObject" in line:
                         violations.append((rel_path, line_no, "Raw findTestObject"))
-                    if "//" in line and ("//table" in line or "//input" in line or "//button" in line):
-                        violations.append((rel_path, line_no, "Raw XPath"))
-        except Exception:
+                        continue
+                    # Check locator calls taking raw CSS/XPath selectors
+                    m = LOCATOR_CALL_PATTERN.search(stripped)
+                    if m:
+                        sel = m.group('sel').strip()
+                        if any(sel.startswith(p) for p in ('.', '#', '//', 'xpath=', '[')) or ' > ' in sel:
+                            violations.append((rel_path, line_no, f"Raw CSS/XPath Selector in Test Script: '{sel}'"))
+                            continue
+                    if RAW_XPATH_PATTERN.search(stripped):
+                        violations.append((rel_path, line_no, "Raw XPath literal in Test Script"))
+        except (OSError, PermissionError):
             pass
 
     if violations:
@@ -289,7 +353,11 @@ def gate_4_ai_docs_lint(repo_root, mode="AUTO"):
         print("[FAIL] lint_ai_docs.py not found in tools/!")
         return False
 
-    res = subprocess.run([sys.executable, linter_script, repo_root], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    try:
+        res = subprocess.run([sys.executable, linter_script, repo_root], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=60.0)
+    except subprocess.TimeoutExpired:
+        print("[FAIL] lint_ai_docs.py timed out after 60s!")
+        return False
     if res.returncode != 0:
         print(res.stdout)
         print(res.stderr)
@@ -352,7 +420,11 @@ def gate_6_credential_security(repo_root, mode="AUTO"):
     # 2. Universal Repository Scan for Hardcoded Plaintext Secrets
     secret_patterns = [
         (re.compile(r'\bghp_[0-9a-zA-Z]{36}\b'), "GitHub Personal Access Token"),
+        (re.compile(r'\bgithub_pat_[0-9a-zA-Z_]{82}\b'), "GitHub Fine-Grained Personal Access Token"),
         (re.compile(r'\bAKIA[0-9A-Z]{16}\b'), "AWS Access Key ID"),
+        (re.compile(r'\bsk_(?:live|test)_[0-9a-zA-Z]{24,}\b'), "Stripe Secret Key"),
+        (re.compile(r'\bxox[baprs]-[0-9a-zA-Z-]{10,}\b'), "Slack API Token"),
+        (re.compile(r'\bAIza[0-9A-Za-z-_]{35}\b'), "Google API Key"),
         (re.compile(r'-----BEGIN (?:RSA )?PRIVATE KEY-----'), "Private Key Header"),
         (re.compile(r'(?i)\b(?:Pass(?:word)?@?\d+|Admin@?\d+|Root@?\d+|Default@?\d+)\b'), "Known Default Password"),  # gate6-allowlist
         (re.compile(r'(?i)\b(?:password|passwd|pwd)\s*[:=]\s*[\x22\x27][^\x22\x27]{4,}[\x22\x27]'), "Hardcoded Plaintext Password Assignment"),  # gate6-allowlist
@@ -362,14 +434,14 @@ def gate_6_credential_security(repo_root, mode="AUTO"):
         "System.getenv", "os.getenv", "os.environ", "process.env",
         "dummy", "placeholder", "***", "<password>", "your_password",
         "test_password", "mock_", "NEO4J_PASSWORD", "DynamicTestPwd",
-        "secret_patterns", "PASSWORD", 'password = ""', "password = ''",
+        "secret_patterns", "<name>PASSWORD</name>", 'password = ""', "password = ''",
         "type=str", "help=", "# gate6-allowlist", "# nosec"
     ]
 
     ignored_dirs = {
         ".git", ".gradle", "node_modules", "allure-results", "Screenshots",
         "Reports", "reports", "TestReports", "testreports", "bin", "Libs", ".settings", "graphify-out",
-        "__pycache__", "agent_qa.egg-info", "dist", "build"
+        "__pycache__", "agent_qa.egg-info", "dist", "build", "claude-ecosystem-repos"
     }
 
     for root, dirs, files in os.walk(repo_root):
@@ -388,7 +460,7 @@ def gate_6_credential_security(repo_root, mode="AUTO"):
                         for pat, desc in secret_patterns:
                             if pat.search(line):
                                 violations.append((rel_path, line_no, desc))
-            except Exception:
+            except (OSError, PermissionError):
                 pass
 
     if violations:
@@ -401,12 +473,231 @@ def gate_6_credential_security(repo_root, mode="AUTO"):
     return True
 
 
+def check_python_ast_integrity(repo_root):
+    """
+    Performs static AST validation across all Python files in the repository.
+    Enforces F821 parity (zero undefined variable names) and zero syntax errors.
+    """
+    builtin_names = set(dir(builtins)) | {'__file__', '__name__', '__doc__', '__package__'}
+    py_files = []
+    ignored = {'.git', 'node_modules', '__pycache__', '.venv', 'venv', 'claude-ecosystem-repos', 'build', 'dist', '.gradle'}
+
+    for root, dirs, files in os.walk(repo_root):
+        dirs[:] = [d for d in dirs if d not in ignored]
+        for f in files:
+            if f.endswith('.py'):
+                py_files.append(os.path.join(root, f))
+
+    violations = []
+
+    for file_path in sorted(py_files):
+        rel_path = os.path.relpath(file_path, repo_root)
+        try:
+            with open(file_path, 'r', encoding='utf-8', errors='ignore') as fp:
+                content = fp.read()
+            tree = ast.parse(content, file_path)
+        except SyntaxError as e:
+            violations.append((rel_path, e.lineno or 1, f"SyntaxError: {e.msg}"))
+            continue
+
+        module_names = set(builtin_names)
+        for stmt in tree.body:
+            if isinstance(stmt, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+                module_names.add(stmt.name)
+            elif isinstance(stmt, ast.Import):
+                for a in stmt.names:
+                    module_names.add(a.asname or a.name.split('.')[0])
+            elif isinstance(stmt, ast.ImportFrom):
+                for a in stmt.names:
+                    module_names.add(a.asname or a.name)
+            elif isinstance(stmt, (ast.Assign, ast.AnnAssign)):
+                targets = [stmt.target] if isinstance(stmt, ast.AnnAssign) else stmt.targets
+                for t in targets:
+                    for n in ast.walk(t):
+                        if isinstance(n, ast.Name):
+                            module_names.add(n.id)
+            for n in ast.walk(stmt):
+                if hasattr(ast, 'NamedExpr') and isinstance(n, ast.NamedExpr) and isinstance(getattr(n, 'target', None), ast.Name):
+                    module_names.add(n.target.id)
+
+        class ScopeVisitor(ast.NodeVisitor):
+            def __init__(self):
+                self.scopes = [set(module_names)]
+                self.file_violations = []
+
+            def visit_FunctionDef(self, node):
+                self.scopes[-1].add(node.name)
+                fn_scope = set(self.scopes[-1])
+                for arg in node.args.posonlyargs + node.args.args + node.args.kwonlyargs:
+                    fn_scope.add(arg.arg)
+                if node.args.vararg:
+                    fn_scope.add(node.args.vararg.arg)
+                if node.args.kwarg:
+                    fn_scope.add(node.args.kwarg.arg)
+                self.scopes.append(fn_scope)
+                self.generic_visit(node)
+                self.scopes.pop()
+
+            visit_AsyncFunctionDef = visit_FunctionDef
+
+            def visit_ClassDef(self, node):
+                self.scopes[-1].add(node.name)
+                cls_scope = set(self.scopes[-1])
+                self.scopes.append(cls_scope)
+                self.generic_visit(node)
+                self.scopes.pop()
+
+            def visit_Assign(self, node):
+                for t in node.targets:
+                    for n in ast.walk(t):
+                        if isinstance(n, ast.Name):
+                            self.scopes[-1].add(n.id)
+                self.generic_visit(node)
+
+            def visit_AnnAssign(self, node):
+                if isinstance(node.target, ast.Name):
+                    self.scopes[-1].add(node.target.id)
+                self.generic_visit(node)
+
+            def visit_For(self, node):
+                for n in ast.walk(node.target):
+                    if isinstance(n, ast.Name):
+                        self.scopes[-1].add(n.id)
+                self.generic_visit(node)
+
+            def visit_With(self, node):
+                for item in node.items:
+                    if item.optional_vars:
+                        for n in ast.walk(item.optional_vars):
+                            if isinstance(n, ast.Name):
+                                self.scopes[-1].add(n.id)
+                self.generic_visit(node)
+
+            def visit_ExceptHandler(self, node):
+                if node.name:
+                    self.scopes[-1].add(node.name)
+                self.generic_visit(node)
+
+            def visit_NamedExpr(self, node):
+                if isinstance(node.target, ast.Name):
+                    for s in self.scopes:
+                        s.add(node.target.id)
+                self.generic_visit(node)
+
+            def visit_Match(self, node):
+                for case in getattr(node, 'cases', []):
+                    pattern = getattr(case, 'pattern', None)
+                    if pattern:
+                        for n in ast.walk(pattern):
+                            name = getattr(n, 'name', None)
+                            if isinstance(name, str):
+                                self.scopes[-1].add(name)
+                            rest = getattr(n, 'rest', None)
+                            if isinstance(rest, str):
+                                self.scopes[-1].add(rest)
+                self.generic_visit(node)
+
+            def visit_Global(self, node):
+                for name in node.names:
+                    for s in self.scopes:
+                        s.add(name)
+                self.generic_visit(node)
+
+            def visit_Nonlocal(self, node):
+                for name in node.names:
+                    self.scopes[-1].add(name)
+                self.generic_visit(node)
+
+            def visit_Import(self, node):
+                for a in node.names:
+                    self.scopes[-1].add(a.asname or a.name.split('.')[0])
+
+            def visit_ImportFrom(self, node):
+                for a in node.names:
+                    self.scopes[-1].add(a.asname or a.name)
+
+            def visit_ListComp(self, node):
+                comp_scope = set(self.scopes[-1])
+                for gen in node.generators:
+                    for n in ast.walk(gen.target):
+                        if isinstance(n, ast.Name):
+                            comp_scope.add(n.id)
+                self.scopes.append(comp_scope)
+                self.generic_visit(node)
+                self.scopes.pop()
+
+            visit_SetComp = visit_ListComp
+            visit_GeneratorExp = visit_ListComp
+            visit_DictComp = visit_ListComp
+
+            def visit_Lambda(self, node):
+                lam_scope = set(self.scopes[-1])
+                for arg in node.args.posonlyargs + node.args.args + node.args.kwonlyargs:
+                    lam_scope.add(arg.arg)
+                if node.args.vararg:
+                    lam_scope.add(node.args.vararg.arg)
+                if node.args.kwarg:
+                    lam_scope.add(node.args.kwarg.arg)
+                self.scopes.append(lam_scope)
+                self.generic_visit(node)
+                self.scopes.pop()
+
+            def visit_Name(self, node):
+                if isinstance(node.ctx, ast.Load):
+                    if node.id.startswith('__') and node.id.endswith('__'):
+                        return
+                    if not any(node.id in s for s in reversed(self.scopes)):
+                        self.file_violations.append((rel_path, node.lineno, f"Undefined name '{node.id}' (F821)"))
+
+        visitor = ScopeVisitor()
+        visitor.visit(tree)
+        violations.extend(visitor.file_violations)
+
+    return violations
+
+
 def gate_7_infer_linter(repo_root, mode="AUTO"):
     print("\n[GATE 7] Running Meta Infer-Style Static Defect & Fake-Pass Sentinel...")
     effective_mode = detect_repo_mode(repo_root) if mode == "AUTO" else mode
+
+    # Static Python AST & Undefined Name (F821) Sentinel
+    ast_violations = check_python_ast_integrity(repo_root)
+    if ast_violations:
+        print(f"[FAIL] Static Python AST Sentinel detected {len(ast_violations)} syntax errors or undefined names:")
+        for rel_file, line_no, desc in ast_violations:
+            print(f"   - {rel_file}:{line_no} -> {desc}")
+        return False
+    print("[PASS] 100% Python AST integrity verified (zero syntax errors, zero undefined variables).")
+
+    # In HUB mode: dogfood tools/ with baseline to prevent new unbaselined defects
     if effective_mode == "HUB":
-        print("[PASS] Hub Mode: Static Defect Sentinel active for target projects.")
-        return True
+        baseline_file = os.path.join(repo_root, "tools", ".infer_baseline.json")
+        infer_script = os.path.join(repo_root, "tools", "infer_linter.py")
+        if os.path.exists(baseline_file) and os.path.exists(infer_script):
+            tools_dir = os.path.join(repo_root, "tools")
+            try:
+                res = subprocess.run([
+                    sys.executable, infer_script, "--strict", "--baseline", baseline_file, "--dir", tools_dir
+                ], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=60.0)
+                if res.returncode != 0:
+                    print("[FAIL] Hub internal tools contain unbaselined critical defects:")
+                    print(res.stdout)
+                    return False
+            except subprocess.TimeoutExpired:
+                print("[FAIL] infer_linter.py timed out after 60s!")
+                return False
+            except (OSError, subprocess.SubprocessError):
+                pass
+
+        # Hub Mode Version Synchronization Verification
+        try:
+            import check_version_sync
+            synced, versions, canonical = check_version_sync.check_sync(repo_root)
+            if not synced:
+                print(f"[FAIL] Gate 7 Version Synchronization: Inconsistent versions detected across manifests: {versions}")
+                return False
+        except (ImportError, OSError):
+            pass
 
     test_dirs = ["Scripts", "tests", "test", "e2e", "specs", "cypress"]
     has_tests = False
@@ -423,7 +714,7 @@ def gate_7_infer_linter(repo_root, mode="AUTO"):
             break
 
     if not has_tests:
-        print("[SKIP] No test scripts (Groovy/TS/JS/Py) present in candidate test directories.")
+        print("[N/A] No test scripts (Groovy/TS/JS/Py) present in candidate test directories.")
         return True
 
     infer_script = os.path.join(SCRIPT_DIR, "infer_linter.py")
@@ -431,17 +722,22 @@ def gate_7_infer_linter(repo_root, mode="AUTO"):
         infer_script = os.path.join(repo_root, "tools", "infer_linter.py")
 
     if os.path.exists(infer_script):
-        res = subprocess.run([sys.executable, infer_script, "--dir", target_scan_dir], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-        if res.returncode != 0:
-            print("[FAIL] Static Defect Sentinel detected critical issues in test scripts:")
-            print(res.stdout)
+        try:
+            res = subprocess.run([sys.executable, infer_script, "--strict", "--dir", target_scan_dir], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=60.0)
+            if res.returncode != 0:
+                print("[FAIL] Static Defect Sentinel detected critical issues in test scripts:")
+                print(res.stdout)
+                return False
+        except subprocess.TimeoutExpired:
+            print("[FAIL] infer_linter.py timed out after 60s!")
             return False
-    print("[PASS] Zero critical defects / zero swallowed exceptions across test scripts.")
+    print("[PASS] Zero critical defects / zero swallowed exceptions across active test suites.")
     return True
 
 
-def gate_8_micro_mutator(repo_root, mode="AUTO"):
-    print("\n[GATE 8] Running AST Micro-Mutation Testing Sentinel (Min Mutation Score >= 80%)...")
+def gate_8_micro_mutator(repo_root, mode="AUTO", test_cmd=""):
+    eval_mode_desc = f"DYNAMIC EXECUTION MODE ({test_cmd})" if test_cmd else "HEURISTIC STATIC MODE"
+    print(f"\n[GATE 8] Running Assertion Sensitivity & Syntactic Mutation Sentinel [{eval_mode_desc}] (Min Score >= 80%)...")
     scripts_dir = os.path.join(repo_root, "Scripts")
     tests_dir = os.path.join(repo_root, "tests")
 
@@ -450,17 +746,17 @@ def gate_8_micro_mutator(repo_root, mode="AUTO"):
         groovy_files = [f for f in glob.glob(os.path.join(scripts_dir, "**", "*.groovy"), recursive=True)]
         if groovy_files:
             target_dir = scripts_dir
-    elif os.path.isdir(tests_dir):
+    if not target_dir and os.path.isdir(tests_dir):
         test_files = [f for f in glob.glob(os.path.join(tests_dir, "**", "*.*"), recursive=True) if f.endswith((".py", ".ts", ".js", ".groovy"))]
         if test_files:
             target_dir = tests_dir
 
     if not target_dir:
         if mode == "HUB":
-            print("[PASS] Hub Mode: AST Micro-Mutation engine verified and operational.")
+            print(f"[N/A] Hub Mode: Not Applicable (Assertion Sensitivity & Syntactic Mutation applies to target test suites in Spokes) [{eval_mode_desc}].")
             return True
         else:
-            print("[SKIP] No automated test scripts found in Scripts/ or tests/ to mutate.")
+            print("[N/A] No automated test scripts found in Scripts/ or tests/ to mutate.")
             return True
 
     mutator_script = os.path.join(SCRIPT_DIR, "micro_mutator.py")
@@ -468,68 +764,142 @@ def gate_8_micro_mutator(repo_root, mode="AUTO"):
         mutator_script = os.path.join(repo_root, "tools", "micro_mutator.py")
 
     if os.path.exists(mutator_script):
-        res = subprocess.run([sys.executable, mutator_script, target_dir, "--min-score", "80.0", "--json"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+        cmd = [sys.executable, mutator_script, target_dir, "--min-score", "80.0", "--json"]
+        if test_cmd:
+            cmd.extend(["--test-cmd", test_cmd])
+        try:
+            res = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=120.0)
+        except subprocess.TimeoutExpired:
+            print("[FAIL] Assertion Sensitivity Sentinel timed out after 120s!")
+            return False
         if res.returncode != 0:
-            print("[FAIL] AST Micro-Mutation Sentinel REJECTED: Mutation score < 80% or unasserted logic found.")
+            print("[FAIL] Assertion Sensitivity Sentinel REJECTED: Score < 80% or unasserted logic found.")
             try:
                 data = json.loads(res.stdout)
-                print(f"   Mutation Score: {data.get('mutation_score', 0)}% (Required: >= 80%)")
-                print(f"   Mutants Killed: {data.get('killed', 0)} / {data.get('total_mutants', 0)}")
-            except Exception:
+                print(f"   Assertion Sensitivity: {data.get('mutation_score', 0)}% (Required: >= 80%)")
+                print(f"   Mutants Caught: {data.get('killed', 0)} / {data.get('total_mutants', 0)}")
+            except (json.JSONDecodeError, ValueError, KeyError):
                 if res.stdout:
                     print(res.stdout)
             return False
         else:
             try:
                 data = json.loads(res.stdout)
-                print(f"[PASS] Mutation Score: {data.get('mutation_score', 100)}% >= 80% (Killed {data.get('killed', 0)}/{data.get('total_mutants', 0)} mutants). Zero Tautological Tests.")
-            except Exception:
-                print("[PASS] AST Micro-Mutation Sentinel passed: Mutation score >= 80%.")
+                mode_label = "DYNAMIC" if test_cmd else "HEURISTIC STATIC"
+                print(f"[PASS] Assertion Sensitivity [{mode_label}]: {data.get('mutation_score', 100)}% >= 80% (Caught {data.get('killed', 0)}/{data.get('total_mutants', 0)} syntactic mutants). Zero unasserted logic branches.")
+            except (json.JSONDecodeError, ValueError, KeyError):
+                print(f"[PASS] Assertion Sensitivity Sentinel passed: Score >= 80% [{eval_mode_desc}].")
             return True
 
-    print("[PASS] AST Micro-Mutation verified.")
+    print("[PASS] Assertion Sensitivity verified.")
     return True
 
 
-def main():
-    parser = argparse.ArgumentParser(description="Enterprise DoD Verification Sentinel")
-    parser.add_argument("target", nargs="?", default=None,
-                        help="Target repository path to verify (defaults to auto-detection from CWD or Hub)")
-    parser.add_argument("--repo", "--path", dest="repo_path", default=None,
-                        help="Target repository path to verify")
-    parser.add_argument("--mode", choices=["auto", "hub", "target"], default="auto",
-                        help="Execution mode (auto-detect, hub, or target test project)")
-    args = parser.parse_args()
+def load_synapse_config(repo_root=None, config_path=None):
+    """Loads configuration from synapse.config.json if present."""
+    if config_path and os.path.exists(config_path):
+        try:
+            with open(config_path, "r", encoding="utf-8") as f:
+                return json.load(f)
+        except (OSError, json.JSONDecodeError):
+            pass
+    root = repo_root or REPO_ROOT
+    cand = os.path.join(root, "synapse.config.json")
+    if os.path.exists(cand):
+        try:
+            with open(cand, "r", encoding="utf-8") as f:
+                return json.load(f)
+        except (OSError, json.JSONDecodeError):
+            pass
+    return {}
+
+
+def format_gates_junit(gate_results, repo_root):
+    """Formats 9 DoD Quality Gates result into JUnit XML testsuite."""
+    total = len(gate_results)
+    failures = len([g for g in gate_results if not g[1]])
+    lines = [
+        '<?xml version="1.0" encoding="utf-8"?>',
+        f'<testsuite name="synapse-quality-gates" tests="{total}" failures="{failures}" errors="0">'
+    ]
+    for name, success, reason in gate_results:
+        cname = "synapse.quality_gates"
+        tname = name.split(":")[0].strip().replace(" ", "_")
+        lines.append(f'  <testcase classname="{cname}" name="{tname}">')
+        if not success:
+            lines.append(f'    <failure message="Quality Gate Failed: {name}">{name} failed in repository {repo_root} ({reason})</failure>')
+        lines.append('  </testcase>')
+    lines.append('</testsuite>')
+    return "\n".join(lines)
 
-    try:
-        repo_root = resolve_target_repo(cli_target=args.target, cli_repo=args.repo_path)
-    except FileNotFoundError as e:
-        print(f"[ERROR] {e}")
-        return 1
 
-    effective_mode = detect_repo_mode(repo_root) if args.mode == "auto" else args.mode.upper()
+def run_all_gates(repo_root, mode="AUTO", test_cmd="", output_format="text", config_path=None):
+    """Programmatic entrypoint to execute all 9 DoD Quality Gates with config and format support."""
+    effective_mode = detect_repo_mode(repo_root) if mode.upper() == "AUTO" else mode.upper()
+    cfg = load_synapse_config(repo_root, config_path=config_path)
+    qg_cfg = cfg.get("quality_gates", {})
+    gate_toggles = qg_cfg.get("gates", {})
 
-    print_header(f"ENTERPRISE AUTOMATION - ONE-COMMAND DoD VERIFICATION [{effective_mode} MODE]")
-    print(f"Target Repository: {repo_root}")
-    print(f"Operational Mode : {effective_mode}")
+    if output_format == "text":
+        print_header(f"ENTERPRISE AUTOMATION - ONE-COMMAND DoD VERIFICATION [{effective_mode} MODE]")
+        print(f"Target Repository: {repo_root}")
+        print(f"Operational Mode : {effective_mode}")
 
     gates = [
-        ("Gate 0: Author Attribution & Integrity", gate_0_author_integrity),
-        ("Gate 1: UTF-8 No BOM", gate_1_bom_check),
-        ("Gate 2: Path Portability", gate_2_path_portability),
-        ("Gate 3: Clean POM & Flat Architecture", gate_3_clean_pom),
-        ("Gate 4: AI Documentation Linter", gate_4_ai_docs_lint),
-        ("Gate 5: Temporary Files Blacklist", gate_5_cleanup_blacklist),
-        ("Gate 6: Credential Security", gate_6_credential_security),
-        ("Gate 7: Static Defect Sentinel", gate_7_infer_linter),
-        ("Gate 8: AST Micro-Mutation Sentinel", gate_8_micro_mutator),
+        ("gate_0_author_integrity", "Gate 0: Author Attribution & Integrity", gate_0_author_integrity),
+        ("gate_1_bom_check", "Gate 1: UTF-8 No BOM", gate_1_bom_check),
+        ("gate_2_path_portability", "Gate 2: Path Portability", gate_2_path_portability),
+        ("gate_3_clean_pom", "Gate 3: Clean POM & Flat Architecture", gate_3_clean_pom),
+        ("gate_4_ai_docs_lint", "Gate 4: AI Documentation Linter", gate_4_ai_docs_lint),
+        ("gate_5_cleanup_blacklist", "Gate 5: Temporary Files Blacklist", gate_5_cleanup_blacklist),
+        ("gate_6_credential_security", "Gate 6: Credential Security", gate_6_credential_security),
+        ("gate_7_infer_linter", "Gate 7: Static Defect Sentinel", gate_7_infer_linter),
+        ("gate_8_micro_mutator", "Gate 8: Assertion Sensitivity & Syntactic Mutation Sentinel", lambda r, mode: gate_8_micro_mutator(r, mode=mode, test_cmd=test_cmd)),
     ]
 
     all_passed = True
-    for name, gate_fn in gates:
-        success = gate_fn(repo_root, mode=effective_mode)
-        if not success:
-            all_passed = False
+    gate_results = []
+
+    if output_format in ("json", "junit"):
+        old_stdout = sys.stdout
+        sys.stdout = io.StringIO()
+        try:
+            for g_key, name, gate_fn in gates:
+                if gate_toggles.get(g_key) is False:
+                    gate_results.append((name, True, "SKIPPED_BY_CONFIG"))
+                    continue
+                success = gate_fn(repo_root, mode=effective_mode)
+                gate_results.append((name, success, "PASS" if success else "FAIL"))
+                if not success:
+                    all_passed = False
+        finally:
+            sys.stdout = old_stdout
+    else:
+        for g_key, name, gate_fn in gates:
+            if gate_toggles.get(g_key) is False:
+                print(f"\n[{name.split(':')[0].upper()}] Disabled via synapse.config.json (SKIPPED)")
+                gate_results.append((name, True, "SKIPPED_BY_CONFIG"))
+                continue
+
+            success = gate_fn(repo_root, mode=effective_mode)
+            gate_results.append((name, success, "PASS" if success else "FAIL"))
+            if not success:
+                all_passed = False
+
+    if output_format == "json":
+        res_doc = {
+            "timestamp": datetime.now().isoformat(),
+            "target": repo_root,
+            "mode": effective_mode,
+            "all_passed": all_passed,
+            "gates": [{"name": g[0], "passed": g[1], "status": g[2]} for g in gate_results]
+        }
+        print(json.dumps(res_doc, indent=2))
+        return 0 if all_passed else 1
+
+    if output_format == "junit":
+        print(format_gates_junit(gate_results, repo_root))
+        return 0 if all_passed else 1
 
     print("\n" + "=" * 70)
     if all_passed:
@@ -544,5 +914,29 @@ def main():
         return 1
 
 
+def main():
+    parser = argparse.ArgumentParser(description="Enterprise DoD Verification Sentinel")
+    parser.add_argument("target", nargs="?", default=None,
+                        help="Target repository path to verify (defaults to auto-detection from CWD or Hub)")
+    parser.add_argument("--repo", "--path", dest="repo_path", default=None,
+                        help="Target repository path to verify")
+    parser.add_argument("--mode", choices=["auto", "hub", "target"], default="auto",
+                        help="Execution mode (auto-detect, hub, or target test project)")
+    parser.add_argument("--format", choices=["text", "json", "junit"], default="text",
+                        help="Output report format (default: text)")
+    parser.add_argument("--config", help="Path to synapse.config.json")
+    parser.add_argument("--test-cmd", default="",
+                        help="Optional test command for Gate 8 dynamic mutation testing (e.g. 'pytest' or 'npx playwright test')")
+    args = parser.parse_args()
+
+    try:
+        repo_root = resolve_target_repo(cli_target=args.target, cli_repo=args.repo_path)
+    except FileNotFoundError as e:
+        print(f"[ERROR] {e}")
+        return 1
+
+    return run_all_gates(repo_root, mode=args.mode, test_cmd=args.test_cmd, output_format=args.format, config_path=args.config)
+
+
 if __name__ == "__main__":
     sys.exit(main())