vibe-coding-master 0.7.21 → 0.7.22

package/dist/backend/services/gate-review-service.js

@@ -33,7 +33,9 @@ const VALIDATION_ANALYSIS_FIELDS = [
     "Changed Behavior And Risk",
     "Coverage Mapping",
     "Baseline Coverage",
-    "Integration And E2E Coverage",
+    "L2 Integration Coverage",
+    "L3 Trigger Assessment",
+    "L3 End-To-End Coverage",
     "Boundary And Failure Coverage",
     "Public Contract Coverage",
     "Test Integrity",

package/dist/backend/templates/handoff.js

@@ -157,6 +157,28 @@ TBD
 
 TBD
 
+## L3 Coverage
+
+L3 Required: yes|no
+
+### Trigger Assessment
+
+TBD
+
+### Affected End-To-End Flows
+
+| Flow | Trigger | Case ID | Test File | Entry Point | Final Observable Result | Action | Result |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| TBD | TBD | TBD | TBD | TBD | TBD | TBD | TBD |
+
+### L3 Commands And Evidence
+
+TBD
+
+### Not-Required Evidence
+
+TBD
+
 ## Commands Run Or Checked
 
 TBD

package/dist/backend/templates/harness/gate-review.js

@@ -150,6 +150,31 @@ UI, CLI/tooling, hook, session,
 persistence, worktree, external-process, and other important user or system
 paths have integration or E2E coverage that exercises real behavior.
 
+Independently apply the Tester L3 trigger rules to the accepted task, actual
+production changes, public contracts, and documented L3 flows. Do not accept
+\`L3 Required: no\` merely because Tester selected it.
+
+For every affected end-to-end flow:
+
+- Verify that the trigger assessment matches the actual production path.
+- Inspect the actual L3 test file and case.
+- Verify that the case starts from the documented system entry point and reaches
+  the final observable result through the project-owned production path.
+- Verify that internal production wiring is not mocked, replaced, or bypassed.
+- Verify that the assertions directly cover the changed behavior and any changed
+  failure, retry, recovery, or lifecycle path.
+- Verify that an existing case was updated when its prior assertions did not
+  cover the change.
+- Verify the recorded command and result.
+
+Request changes when required L3 coverage is missing, replaced by L2, not
+executed, mapped only to an old case without relevant assertions, bypasses the
+production path, or is classified as unnecessary without satisfying every
+not-required condition.
+
+A required L3 gap is acceptable only when \`test-report.md\` contains the user's
+exact approval for that specific Coverage Gap.
+
 Inspect boundary, failure, cancellation, retry, restart, recovery,
 concurrency, repeated-action, stale-state, cleanup, and compatibility paths
 when they are relevant to the changed behavior. Check that tests were not
@@ -160,9 +185,8 @@ Do not approve only because \`Test Result: pass\` or all recorded commands are
 green. Request changes when the report is incomplete or inconsistent with the
 actual tests, validation level does not match risk, an important behavior has
 no concrete coverage mapping, a required check was skipped, required coverage
-is unavailable, or a current-task coverage gap remains. A concrete risk-based
-reason may show that integration or E2E coverage is unnecessary; unavailable
-required coverage without exact user approval is not an approval reason.
+is unavailable, or a current-task coverage gap remains. Required coverage
+without exact user approval is not an approval reason.
 
 Treat every unresolved required-coverage item as gate-blocking unless
 \`test-report.md\` contains the user's exact approval routed by project-manager.
@@ -278,7 +302,9 @@ Use this findings structure:
 - Changed Behavior And Risk:
 - Coverage Mapping:
 - Baseline Coverage:
-- Integration And E2E Coverage:
+- L2 Integration Coverage:
+- L3 Trigger Assessment:
+- L3 End-To-End Coverage:
 - Boundary And Failure Coverage:
 - Public Contract Coverage:
 - Test Integrity:
@@ -339,7 +365,9 @@ If there are no findings, write:
 - Changed Behavior And Risk:
 - Coverage Mapping:
 - Baseline Coverage:
-- Integration And E2E Coverage:
+- L2 Integration Coverage:
+- L3 Trigger Assessment:
+- L3 End-To-End Coverage:
 - Boundary And Failure Coverage:
 - Public Contract Coverage:
 - Test Integrity:

package/dist/backend/templates/harness/tester-agent.js

@@ -29,9 +29,7 @@ ${renderRoleMemoryRules("tester")}
 - If required L0/L1 coverage is missing or weak, add or update the required tests. If the coverage cannot be completed, return \`Test Result: fail\` with concrete blocking evidence.
 - Own L2/L3/L4 final-validation design, execution, and acceptance evidence.
 - Targeted diagnostic L2 checks run by Coder or Architect are implementation evidence only and do not replace Tester final validation.
-- Choose validation level by risk. Unit tests are not sufficient when the change crosses module boundaries, public contracts, UI flows, CLI/tooling flows, hooks, sessions, persistence, worktrees, or external process behavior; require integration or E2E coverage, or document a concrete risk-based reason why it is unnecessary. Unavailable required coverage is a blocking validation gap.
-- For important new behavior, public workflows, cross-module behavior, UI/CLI/tooling flows, persistence/session/worktree behavior, hooks, or external process behavior, add a new integration/E2E case or extend an existing one with assertions that directly cover the new behavior.
-- Do not treat an existing integration/E2E command as sufficient unless it includes assertions for the new behavior or important regression path. Add or modify the required case; inability to complete required coverage makes \`Test Result: fail\`.
+- Use L2 integration coverage when changed behavior crosses internal module or component boundaries and can be completely proved from a stable integration entry point without triggering the mandatory L3 rules below.
 - When tests were changed during the task, check whether assertions were weakened, removed, over-mocked, or rewritten to match the implementation instead of the approved behavior. Report this as a validation gap unless the approved contract changed.
 - Apply \`docs/CODING_STANDARDS.md\` to changed tests, fixtures, test-only helpers, baseline-test coverage, and test integrity.
 - Before final validation, perform a full cache cleanup, then rerun validation from a clean state.
@@ -51,7 +49,6 @@ ${renderRoleMemoryRules("tester")}
 - Add anti-hardcode coverage when risk warrants it: use non-fixture inputs, boundary values, negative cases, repeated actions, and assertions through public/runtime paths.
 - Do not accept tests that only prove the current implementation shape; tests must prove the approved behavior contract.
 - Treat architect-flagged public contracts, migrations, auth, data flow, routing, or dependency changes as inputs for tester-owned validation design.
-- Record skipped L3 checks in \`.ai/vcm/handoffs/test-report.md\` with the reason.
 - Treat validation coverage gaps for accepted task scope, changed behavior, or required public contracts as blocking validation issues; \`Test Result: pass\` cannot include them.
 - Before exact user approval is routed by project-manager, record missing required coverage under \`Blocking Validation Issues\`, keep \`Coverage Gaps\` as \`None\`, and return \`Test Result: fail\`.
 - Add a Coverage Gap only after project-manager routes the user's exact approval for that specific unresolved gap. Record the approval verbatim in \`User Approval Evidence\`.
@@ -59,6 +56,59 @@ ${renderRoleMemoryRules("tester")}
 - If a required validation check is skipped or cannot complete, \`Test Result\` must be \`fail\`.
 - Update \`docs/TESTING.md\` when validation strategy, commands, level mapping, integration/E2E case definitions, selection rules, final-validation cleanup, test gaps, or test expectations change.
 
+### Mandatory L3 End-To-End Coverage
+
+L3 validates a complete externally observable flow from a project-defined
+system entry point, through the actual project-owned production path, to its
+final observable result.
+
+Do not mock, replace, or bypass the project-owned production path being
+validated. External dependencies may use controlled substitutes only when
+allowed by \`docs/TESTING.md\`.
+
+L3 is required when any of the following is true:
+
+- The accepted task adds a new externally reachable end-to-end flow.
+- The task changes the input, output, error result, persisted result, external
+  side effect, or other observable behavior of an end-to-end flow.
+- The changed production path is covered by an existing L3 case in
+  \`docs/TESTING.md\`.
+- The task changes completion, failure, cancellation, retry, recovery, timeout,
+  idempotency, duplicate-event, or out-of-order behavior that affects the final
+  result of an end-to-end flow.
+- The task changes a public API, event, message, storage, migration, or other
+  external contract used by an end-to-end flow.
+- The task changes a cross-component critical invariant that can be proved only
+  through the complete production path.
+- The task fixes a defect that passed L1/L2 but occurred in an integrated,
+  staging, production, or other complete-system flow.
+
+L3 is not required only when all of the following are true:
+
+- No externally observable end-to-end behavior is added or changed.
+- No production path covered by a documented L3 case is affected.
+- No end-to-end lifecycle, external contract, or critical invariant is changed.
+- L1 or L2 can completely prove the accepted behavior from a stable test entry
+  point.
+
+Task size, changed-file count, implementation size, existing unit tests, or a
+green L2 result are not reasons to skip required L3 coverage.
+
+For every affected end-to-end flow:
+
+- Run an existing L3 case when its assertions already cover the changed behavior.
+- Update an existing L3 case when the flow is covered but the changed behavior
+  is not asserted.
+- Add a new L3 case when the task creates a new flow or no existing case covers
+  it.
+- Add or update assertions for any failure, retry, recovery, or lifecycle path
+  changed by the task.
+
+Required L3 coverage cannot be replaced by L2. If the required case cannot be
+added or executed, return \`Test Result: fail\` and record the missing coverage as
+a blocking validation issue unless the user has explicitly approved that exact
+Coverage Gap.
+
 ### Testing Documentation
 
 - Own \`docs/TESTING.md\` as the project's current validation strategy, not as a task log or diagnostic history.
@@ -76,6 +126,27 @@ ${renderRoleMemoryRules("tester")}
 ### Outputs
 
 - Write \`.ai/vcm/handoffs/test-report.md\` with \`Test Result: pass|fail\`, evidence reviewed, tests added or updated, coverage mapping, commands run or checked, validation results, failed expectations, reproduction steps, skipped checks with reasons, coverage gaps, blocking validation issues, and user approval evidence.
+- \`test-report.md\` must include this L3 section:
+
+\`\`\`md
+## L3 Coverage
+
+L3 Required: yes|no
+
+### Trigger Assessment
+
+### Affected End-To-End Flows
+
+| Flow | Trigger | Case ID | Test File | Entry Point | Final Observable Result | Action | Result |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+
+### L3 Commands And Evidence
+
+### Not-Required Evidence
+\`\`\`
+
+- When \`L3 Required: yes\`, include at least one complete flow-to-case mapping. \`Action\` must be \`run-existing\`, \`updated\`, or \`added\`.
+- When \`L3 Required: no\`, use \`Not-Required Evidence\` to prove every condition in the L3 not-required rule.
 - In Validation-Only Flow, if tests, fixtures, test-only helpers, or \`docs/TESTING.md\` changed, commit those changes before reporting and record the changed files and commit in \`test-report.md\`. If no tracked files changed, record that no commit was required.
 - \`test-report.md\` is the current validation evidence, not a log; when rewriting it, carry forward still-unresolved findings or explicitly mark them resolved instead of dropping them.
 - In \`Coverage Mapping\`, map each accepted changed behavior or relevant risk to its validation level, actual test file and case or external evidence, exercised entry path and key assertions, result, and any remaining gap.
@@ -85,7 +156,7 @@ ${renderRoleMemoryRules("tester")}
 - When \`Test Result: fail\`, \`Blocking Validation Issues\` must list concrete blocking evidence.
 - When \`Coverage Gaps\` is not \`None\`, \`Test Result\` must be \`fail\`, \`User Approval Evidence\` must contain the user's exact authorization, and every recorded gap must match that authorization.
 - When no gap has been approved, \`User Approval Evidence\` must be \`None\`.
-- For feature or cross-boundary changes, state which new or updated integration/E2E cases cover the important paths, or give the concrete risk-based reason such coverage is unnecessary. If required coverage is unavailable, report it as a blocking issue.
+- For feature or cross-boundary changes, map required L2 integration coverage and mandatory L3 coverage separately. If required coverage is unavailable, report it as a blocking issue.
 - For changed or newly added tests, state why the assertions prove real behavior rather than fixture-specific, implementation-specific, or mock-only behavior.
 - Report confirmed unresolved issues that should survive current-task cleanup in \`.ai/vcm/handoffs/test-report.md\`; do not write \`.ai/vcm/handoffs/known-issues.md\` (architect-owned).
 

package/dist/shared/validation/artifact-check.js

@@ -39,6 +39,11 @@ const REQUIRED_HEADINGS = {
         "Evidence Reviewed",
         "Tests Added Or Updated",
         "Coverage Mapping",
+        "L3 Coverage",
+        "Trigger Assessment",
+        "Affected End-To-End Flows",
+        "L3 Commands And Evidence",
+        "Not-Required Evidence",
         "Commands Run Or Checked",
         "Validation Results",
         "Failed Expectations",
@@ -139,6 +144,28 @@ function validateArtifactFields(kind, content) {
         const invalidFields = result === "pass" || result === "fail"
             ? []
             : ["Test Result must be pass or fail."];
+        const l3Required = /^\s*L3 Required\s*:\s*(\S+)\s*$/im.exec(content)?.[1]?.toLowerCase();
+        if (l3Required !== "yes" && l3Required !== "no") {
+            invalidFields.push("L3 Required must be yes or no.");
+        }
+        const l3TriggerAssessment = readArtifactSectionValue(content, "Trigger Assessment");
+        const l3AffectedFlows = readArtifactSectionContent(content, "Affected End-To-End Flows");
+        const l3Commands = readArtifactSectionValue(content, "L3 Commands And Evidence");
+        const l3NotRequiredEvidence = readArtifactSectionValue(content, "Not-Required Evidence");
+        if (l3Required === "yes") {
+            if (!hasSubstantiveSectionValue(l3TriggerAssessment)) {
+                invalidFields.push("Trigger Assessment is required when L3 Required is yes.");
+            }
+            if (!hasCompleteL3FlowMapping(l3AffectedFlows)) {
+                invalidFields.push("Affected End-To-End Flows are required when L3 Required is yes.");
+            }
+            if (!hasSubstantiveSectionValue(l3Commands)) {
+                invalidFields.push("L3 Commands And Evidence are required when L3 Required is yes.");
+            }
+        }
+        if (l3Required === "no" && !hasSubstantiveSectionValue(l3NotRequiredEvidence)) {
+            invalidFields.push("Not-Required Evidence is required when L3 Required is no.");
+        }
         const coverageGaps = readArtifactSectionValue(content, "Coverage Gaps");
         const blockingIssues = readArtifactSectionValue(content, "Blocking Validation Issues");
         const userApproval = readArtifactSectionValue(content, "User Approval Evidence");
@@ -187,6 +214,25 @@ function validateArtifactFields(kind, content) {
     }
     return [];
 }
+function hasSubstantiveSectionValue(value) {
+    return Boolean(value && !/^(none|tbd)\.?$/i.test(value.trim()));
+}
+function hasCompleteL3FlowMapping(value) {
+    if (!value) {
+        return false;
+    }
+    const allowedActions = new Set(["run-existing", "updated", "added"]);
+    return value
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith("|") && line.endsWith("|"))
+        .some((line) => {
+        const cells = line.slice(1, -1).split("|").map((cell) => cell.trim());
+        return cells.length === 8
+            && allowedActions.has(cells[6]?.toLowerCase() ?? "")
+            && cells.every((cell) => Boolean(cell) && !/^(none|tbd)\.?$/i.test(cell));
+    });
+}
 function validateDecision(content, allowed) {
     const decision = readArtifactSectionValue(content, "Decision")?.toLowerCase();
     return decision && allowed.includes(decision)
@@ -194,6 +240,12 @@ function validateDecision(content, allowed) {
         : [`Decision must be one of: ${allowed.join(", ")}.`];
 }
 export function readArtifactSectionValue(content, heading) {
+    return readArtifactSectionContent(content, heading)
+        ?.split(/\r?\n/)
+        .map((line) => line.trim())
+        .find(Boolean);
+}
+function readArtifactSectionContent(content, heading) {
     const match = new RegExp(`^#{1,6}\\s+${escapeRegExp(heading)}\\s*$`, "im").exec(content);
     if (!match || match.index === undefined) {
         return undefined;
@@ -203,7 +255,7 @@ export function readArtifactSectionValue(content, heading) {
     const section = nextHeading?.index === undefined
         ? afterHeading
         : afterHeading.slice(0, nextHeading.index);
-    return section.split(/\r?\n/).map((line) => line.trim()).find(Boolean);
+    return section.trim();
 }
 function hasHeading(content, heading) {
     const pattern = new RegExp(`^#{1,6}\\s+${escapeRegExp(heading)}\\s*$`, "im");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibe-coding-master",
-  "version": "0.7.21",
+  "version": "0.7.22",
   "description": "Local GUI session cockpit for Claude Code role sessions.",
   "type": "module",
   "files": [