code-factory-2-forge 0.10.2__tar.gz → 0.10.4__tar.gz

{code_factory_2_forge-0.10.2/code_factory_2_forge.egg-info → code_factory_2_forge-0.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-factory-2-forge
-Version: 0.10.2
+Version: 0.10.4
 Summary: ForgeLine — the autonomous outer loop for AI software factories. A CLI-backed state machine that drives intent -> spec -> plan -> code -> adversarial review -> ship, orchestrating SpecLine (spec governance) and Harness Software Factory (compiled decisions), with self-improving skills and architecture-as-a-CI-gate.
 License-Expression: MIT OR Apache-2.0
 Project-URL: Homepage, https://github.com/zrk222/code-factory-2-forge
@@ -135,9 +135,24 @@ files and includes before/after SHA-256 values. Existing targets are reported as
 conflicts and leave both the files and feature state unchanged. An intentional
 replacement requires `--force`; ForgeLine first writes timestamped backups under
 `.forge/scaffold-backups/`, validates every generated file, and restores every
-modified target if any replacement fails. Python, TypeScript, and TSX scaffolds
-use extension-specific generators and structure checks; unsupported extensions
-are rejected rather than receiving Python syntax.
+modified target if any replacement fails. Python, JavaScript (including ESM
+`.mjs`), TypeScript, and TSX scaffolds use extension-specific generators and
+structure checks; unsupported extensions are rejected rather than receiving
+Python syntax.
+
+**Feature-scoped, language-aware QA.** `forge qa <feature> --ssat <contract>`
+only grades files declared by that contract. Dependency, build, cache, VCS, and
+reparse-point trees are pruned. Python is parsed with Python; JavaScript/ESM is
+syntax-checked by Node and inventories exported and local functions; TypeScript
+uses its matching parser. An unavailable parser is reported as
+`PARSER_UNSUPPORTED`, never disguised as a syntax error. A slice without
+discoverable functions is explicitly inventory-only, not behavioral-proof green.
+
+**Fresh proof inputs.** `forge verify-tests` hashes its SSAT, declared source,
+smoke manifests, tests, command, and tool version. Any mismatch invalidates the
+prior reverse-classical receipt and reruns the proof. Inspect the active binary
+with `forge version --json`; it reports version, origin, build hash, runtime,
+and whether source identity is complete.
 
 **The grumpy adversary.** A review agent that *assumes your code is broken and
 insecure* and makes the generator prove otherwise. Executable heuristics catch
@@ -182,6 +197,8 @@ forge arch-gate <feature> <ssat>    architecture CI gate
 forge verify-tests <feature> <ssat>  prove smoke checks fail on generated stubs
 forge verify-tests-ts <feature>      prove existing TypeScript tests fail on reviewed source mutants
 forge challenge <feature> <ssat>     write a Factory Passport challenge receipt
+forge qa <feature> --ssat <ssat> --strict  run scoped language-aware QA
+forge version --json                 print install and build provenance
 forge smoke <feature>                runtime behavior gate
 forge ship <feature>                seal it
 forge handoff <feature> <spec>      route decision tables to HSF

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/README.md

@@ -117,9 +117,24 @@ files and includes before/after SHA-256 values. Existing targets are reported as
 conflicts and leave both the files and feature state unchanged. An intentional
 replacement requires `--force`; ForgeLine first writes timestamped backups under
 `.forge/scaffold-backups/`, validates every generated file, and restores every
-modified target if any replacement fails. Python, TypeScript, and TSX scaffolds
-use extension-specific generators and structure checks; unsupported extensions
-are rejected rather than receiving Python syntax.
+modified target if any replacement fails. Python, JavaScript (including ESM
+`.mjs`), TypeScript, and TSX scaffolds use extension-specific generators and
+structure checks; unsupported extensions are rejected rather than receiving
+Python syntax.
+
+**Feature-scoped, language-aware QA.** `forge qa <feature> --ssat <contract>`
+only grades files declared by that contract. Dependency, build, cache, VCS, and
+reparse-point trees are pruned. Python is parsed with Python; JavaScript/ESM is
+syntax-checked by Node and inventories exported and local functions; TypeScript
+uses its matching parser. An unavailable parser is reported as
+`PARSER_UNSUPPORTED`, never disguised as a syntax error. A slice without
+discoverable functions is explicitly inventory-only, not behavioral-proof green.
+
+**Fresh proof inputs.** `forge verify-tests` hashes its SSAT, declared source,
+smoke manifests, tests, command, and tool version. Any mismatch invalidates the
+prior reverse-classical receipt and reruns the proof. Inspect the active binary
+with `forge version --json`; it reports version, origin, build hash, runtime,
+and whether source identity is complete.
 
 **The grumpy adversary.** A review agent that *assumes your code is broken and
 insecure* and makes the generator prove otherwise. Executable heuristics catch
@@ -164,6 +179,8 @@ forge arch-gate <feature> <ssat>    architecture CI gate
 forge verify-tests <feature> <ssat>  prove smoke checks fail on generated stubs
 forge verify-tests-ts <feature>      prove existing TypeScript tests fail on reviewed source mutants
 forge challenge <feature> <ssat>     write a Factory Passport challenge receipt
+forge qa <feature> --ssat <ssat> --strict  run scoped language-aware QA
+forge version --json                 print install and build provenance
 forge smoke <feature>                runtime behavior gate
 forge ship <feature>                seal it
 forge handoff <feature> <spec>      route decision tables to HSF

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4/code_factory_2_forge.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-factory-2-forge
-Version: 0.10.2
+Version: 0.10.4
 Summary: ForgeLine — the autonomous outer loop for AI software factories. A CLI-backed state machine that drives intent -> spec -> plan -> code -> adversarial review -> ship, orchestrating SpecLine (spec governance) and Harness Software Factory (compiled decisions), with self-improving skills and architecture-as-a-CI-gate.
 License-Expression: MIT OR Apache-2.0
 Project-URL: Homepage, https://github.com/zrk222/code-factory-2-forge
@@ -135,9 +135,24 @@ files and includes before/after SHA-256 values. Existing targets are reported as
 conflicts and leave both the files and feature state unchanged. An intentional
 replacement requires `--force`; ForgeLine first writes timestamped backups under
 `.forge/scaffold-backups/`, validates every generated file, and restores every
-modified target if any replacement fails. Python, TypeScript, and TSX scaffolds
-use extension-specific generators and structure checks; unsupported extensions
-are rejected rather than receiving Python syntax.
+modified target if any replacement fails. Python, JavaScript (including ESM
+`.mjs`), TypeScript, and TSX scaffolds use extension-specific generators and
+structure checks; unsupported extensions are rejected rather than receiving
+Python syntax.
+
+**Feature-scoped, language-aware QA.** `forge qa <feature> --ssat <contract>`
+only grades files declared by that contract. Dependency, build, cache, VCS, and
+reparse-point trees are pruned. Python is parsed with Python; JavaScript/ESM is
+syntax-checked by Node and inventories exported and local functions; TypeScript
+uses its matching parser. An unavailable parser is reported as
+`PARSER_UNSUPPORTED`, never disguised as a syntax error. A slice without
+discoverable functions is explicitly inventory-only, not behavioral-proof green.
+
+**Fresh proof inputs.** `forge verify-tests` hashes its SSAT, declared source,
+smoke manifests, tests, command, and tool version. Any mismatch invalidates the
+prior reverse-classical receipt and reruns the proof. Inspect the active binary
+with `forge version --json`; it reports version, origin, build hash, runtime,
+and whether source identity is complete.
 
 **The grumpy adversary.** A review agent that *assumes your code is broken and
 insecure* and makes the generator prove otherwise. Executable heuristics catch
@@ -182,6 +197,8 @@ forge arch-gate <feature> <ssat>    architecture CI gate
 forge verify-tests <feature> <ssat>  prove smoke checks fail on generated stubs
 forge verify-tests-ts <feature>      prove existing TypeScript tests fail on reviewed source mutants
 forge challenge <feature> <ssat>     write a Factory Passport challenge receipt
+forge qa <feature> --ssat <ssat> --strict  run scoped language-aware QA
+forge version --json                 print install and build provenance
 forge smoke <feature>                runtime behavior gate
 forge ship <feature>                seal it
 forge handoff <feature> <spec>      route decision tables to HSF

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/forgeline/__init__.py

@@ -11,4 +11,4 @@ hard CI gate, and learning from every run via an evolving skill memory.
                          └──────── refine loop ─────────┘
                                    skill memory learns each pass
 """
-__version__ = "0.10.2"
+__version__ = "0.10.4"

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/forgeline/gates/qa_audit.py

@@ -14,10 +14,10 @@ COMPLEXITY_LIMIT = 10
 
 @dataclass
 class QAReport:
-    coverage_intent: float = 0.0
+    coverage_intent: float | None = 0.0
     max_complexity: int = 0
     security_score: int = 100
-    doc_ratio: float = 0.0
+    doc_ratio: float | None = 0.0
     grade: str = "F"
     findings: list[str] = field(default_factory=list)
     metrics: dict = field(default_factory=dict)
@@ -52,9 +52,6 @@ class QAReport:
                 units.append(UnitResult(f"qa_audit:{finding.split()[1]}", "qa_audit", False, finding, FailureClass.PARSER_UNSUPPORTED))
             elif finding.startswith("QA_SYNTAX"):
                 units.append(UnitResult(f"qa_audit:{finding.split()[1]}", "qa_audit", False, finding, FailureClass.SYNTAX_ERROR))
-        if not units:
-            units.append(UnitResult("qa_audit:<no-public-functions>", "qa_audit", False,
-                                    "no supported public functions were available to grade", FailureClass.PARSER_UNSUPPORTED))
         return Attribution("qa_audit", len(units), sum(unit.passed for unit in units), units)
 
 
@@ -130,20 +127,26 @@ def qa_audit(src_dir: Path, *, source_paths: Iterable[Path] | None = None) -> QA
                 report.security_score -= deduction
                 report.findings.append(f"QA_SEC[{severity}] {message} in {path.relative_to(root).as_posix()}")
 
-    count = len(report.function_metrics) or 1
-    report.coverage_intent = round(sum(metric["tested"] for metric in report.function_metrics) / count, 2)
-    report.doc_ratio = round(sum(metric["documented"] for metric in report.function_metrics) / count, 2)
+    count = len(report.function_metrics)
+    report.coverage_intent = round(sum(metric["tested"] for metric in report.function_metrics) / count, 2) if count else None
+    report.doc_ratio = round(sum(metric["documented"] for metric in report.function_metrics) / count, 2) if count else None
     report.max_complexity = max((metric["complexity"] for metric in report.function_metrics), default=0)
     report.security_score = max(report.security_score, 0)
     for metric in report.function_metrics:
         if metric["complexity"] > COMPLEXITY_LIMIT:
             report.findings.append(f"QA_COMPLEXITY {metric['function']} complexity {metric['complexity']} > {COMPLEXITY_LIMIT}; policy=hard")
 
-    score = 35 * report.coverage_intent
+    # A source slice with no declared functions has no coverage *claim*. It is
+    # syntax/security inventory only, rather than a synthetic zero-coverage D.
+    score = 35 * report.coverage_intent if report.coverage_intent is not None else 35
     score += 25 * (1 if report.max_complexity <= COMPLEXITY_LIMIT else max(0, 1 - (report.max_complexity - COMPLEXITY_LIMIT) / 10))
     score += 25 * (report.security_score / 100)
-    score += 15 * report.doc_ratio
+    score += 15 * report.doc_ratio if report.doc_ratio is not None else 15
     report.grade = "A" if score >= 85 else "B" if score >= 70 else "C" if score >= 55 else "D" if score >= 40 else "F"
+    # No executable symbols means no behavioral proof, only a syntax/security
+    # inventory. Do not surface that inventory as an aggregate green result.
+    if not count and report.grade == "A":
+        report.grade = "B"
     if report.max_complexity > COMPLEXITY_LIMIT and report.grade in {"A", "B"}:
         report.grade = "C"
     if any(finding.startswith(("QA_SYNTAX", "QA_PARSER_UNSUPPORTED")) for finding in report.findings):
@@ -152,6 +155,8 @@ def qa_audit(src_dir: Path, *, source_paths: Iterable[Path] | None = None) -> QA
         "coverage_intent": report.coverage_intent, "max_complexity": report.max_complexity,
         "security_score": report.security_score, "doc_ratio": report.doc_ratio,
         "composite": round(score, 1), "complexity_policy": "hard",
+        "coverage_assessment": "measured" if count else "not_applicable_no_declared_functions",
+        "behavioral_proof_status": "available" if count else "unavailable_no_declared_functions",
         "scope": report.scope, "skipped_paths": report.skipped_paths,
     }
     return report

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/forgeline/orchestrator.py

@@ -3,7 +3,7 @@ governance and HSF for decision compilation when a spec carries a decision
 table. Everything is a receipt; every gate failure records a skill lesson and
 routes to the refine loop."""
 from __future__ import annotations
-import shutil, subprocess, sys
+import hashlib, json, shutil, subprocess, sys
 from pathlib import Path
 from .states import State, can_transition, IllegalTransition, HUMAN_GATES
 from .run_store import RunStore
@@ -14,6 +14,7 @@ from .source_scope import declared_paths
 from .skill_memory import record_lesson, inject_lessons_block, lessons_for
 from .learning import LearningKernel
 from .attribution import Attribution, FailureClass, UnitResult
+from . import __version__
 
 MAX_REFINE = 3
 
@@ -60,6 +61,29 @@ def _judge_failure_class(findings: list[str]) -> FailureClass:
             return failure_class
     return FailureClass.INCONSISTENT_LOGIC
 
+
+def _verify_tests_fingerprint(root: Path, feature: str, ssat_path: Path) -> dict:
+    """Hash every verified input so stale reverse-classical receipts cannot pass."""
+    from .source_scope import iter_source_files
+    root = Path(root).resolve()
+    ssat_path = Path(ssat_path).resolve()
+    ssat = load_ssat(ssat_path)
+    components: dict[str, str] = {"ssat": hashlib.sha256(Path(ssat_path).read_bytes()).hexdigest()}
+    for path in declared_paths(root, ssat):
+        key = f"source:{path.relative_to(root).as_posix()}"
+        components[key] = hashlib.sha256(path.read_bytes()).hexdigest() if path.exists() else "MISSING"
+    smoke_paths = [root / "smoke" / f"{feature}.json", root / "smoke" / "smoke.json"]
+    for path in smoke_paths:
+        if path.exists():
+            components[f"smoke:{path.relative_to(root).as_posix()}"] = hashlib.sha256(path.read_bytes()).hexdigest()
+    for path in iter_source_files(root):
+        if path.name.startswith("test_") or path.parent.name in {"tests", "test", "__tests__"} or ".test." in path.name or ".spec." in path.name:
+            components[f"test:{path.relative_to(root).as_posix()}"] = hashlib.sha256(path.read_bytes()).hexdigest()
+    components["command"] = "forge verify-tests"
+    components["tool_version"] = __version__
+    canonical = json.dumps(components, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    return {"sha256": hashlib.sha256(canonical).hexdigest(), "components": components}
+
 class Orchestrator:
     def __init__(self, root: Path, feature: str):
         self.root = Path(root); self.feature = feature
@@ -274,17 +298,35 @@ class Orchestrator:
     def verify_tests(self, ssat_path: Path) -> dict:
         """Verify smoke checks can fail before trusting smoke results."""
         from .gates.reverse_classical import verify_tests
+        fingerprint = _verify_tests_fingerprint(self.root, self.feature, Path(ssat_path))
         if self.store.state == State.SHIPPED:
-            return {"verified": True, "note": "already shipped"}
+            previous = self.store.latest_receipt("verify_tests")
+            if previous and previous.get("input_fingerprint") == fingerprint["sha256"]:
+                return {"verified": True, "note": "already shipped", "input_fingerprint": fingerprint["sha256"]}
+            return {
+                "verified": False,
+                "reason": "shipped artifact has stale verify-tests evidence; open a new feature run",
+                "input_fingerprint": fingerprint["sha256"],
+                "previous_fingerprint": previous.get("input_fingerprint") if previous else None,
+            }
         if self.store.state in {State.TESTS_VERIFIED, State.SMOKED}:
-            return {"verified": True, "note": "already verified"}
+            previous = self.store.latest_receipt("verify_tests")
+            if previous and previous.get("input_fingerprint") == fingerprint["sha256"]:
+                return {"verified": True, "note": "already verified", "input_fingerprint": fingerprint["sha256"]}
+            # Source, tests, SSAT, command, or tool version changed. Invalidate
+            # downstream proof before rerunning rather than returning stale green.
+            self.store.set_state(State.ARCH_GATED, "verify-tests inputs changed; stale receipt invalidated")
+            self.store.receipt(phase="verify_tests_cache", verified=False,
+                               reason="input fingerprint changed", input_fingerprint=fingerprint["sha256"],
+                               previous_fingerprint=previous.get("input_fingerprint") if previous else None)
         if self.store.state not in {State.ARCH_GATED, State.BLOCKED}:
             return {"verified": False,
                     "reason": "architecture gate not passed - run `forge arch-gate` first"}
         gate = verify_tests(self.root, self.feature, Path(ssat_path))
         attr = gate.attribution.to_dict()
         if not gate.passed:
-            self.store.receipt(phase="verify_tests", verified=False, attribution=attr)
+            self.store.receipt(phase="verify_tests", verified=False, attribution=attr,
+                               input_fingerprint=fingerprint["sha256"], input_components=fingerprint["components"])
             if self.store.state != State.BLOCKED:
                 self._advance(State.BLOCKED, "reverse-classical test verification failed")
             return {"verified": False,
@@ -292,8 +334,10 @@ class Orchestrator:
                     "attribution": attr}
         self._advance(State.TESTS_VERIFIED, "smoke checks proven non-hollow",
                       attribution=attr)
-        self.store.receipt(phase="verify_tests", verified=True, attribution=attr)
-        return {"verified": True, "checks": gate.attribution.n_checked, "attribution": attr}
+        self.store.receipt(phase="verify_tests", verified=True, attribution=attr,
+                           input_fingerprint=fingerprint["sha256"], input_components=fingerprint["components"])
+        return {"verified": True, "checks": gate.attribution.n_checked, "attribution": attr,
+                "input_fingerprint": fingerprint["sha256"]}
 
     def refine(self, evaluate, propose, apply, revert, max_iters: int = 6) -> dict:
         """Run deterministic localized refinement.

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/forgeline/provenance.py

@@ -3,14 +3,45 @@ from __future__ import annotations
 
 import importlib.metadata
 import json
+import hashlib
+import os
+import subprocess
 import sys
 from pathlib import Path
 
 from . import __version__
 
 
+def _source_commit(module_dir: Path) -> str | None:
+    """Return a checked-out source revision when one is actually available."""
+    source_root = module_dir.parent
+    manifest = source_root / "pyproject.toml"
+    if not (source_root / ".git").exists() or not manifest.exists():
+        return None
+    if 'name = "code-factory-2-forge"' not in manifest.read_text(encoding="utf-8"):
+        return None
+    try:
+        result = subprocess.run(
+            ["git", "rev-parse", "HEAD"], cwd=source_root, capture_output=True,
+            text=True, timeout=3, check=False,
+        )
+    except OSError:
+        return None
+    return result.stdout.strip() if result.returncode == 0 else None
+
+
+def _build_hash(module_dir: Path) -> str:
+    """Stable hash of the installed Python package payload, not a claimed commit."""
+    digest = hashlib.sha256()
+    for path in sorted(module_dir.rglob("*.py")):
+        digest.update(path.relative_to(module_dir).as_posix().encode("utf-8"))
+        digest.update(path.read_bytes())
+    return digest.hexdigest()
+
+
 def provenance() -> dict:
     """Return only facts available from the active installed distribution."""
+    module_dir = Path(__file__).resolve().parent
     install_origin = "unknown"
     direct_url: dict | None = None
     try:
@@ -19,17 +50,19 @@ def provenance() -> dict:
         if metadata_path.name.endswith(".egg-info"):
             install_origin = "source-tree"
         installed_module = Path(distribution.locate_file("forgeline")).resolve()
-        if installed_module != Path(__file__).resolve().parent:
+        if installed_module != module_dir:
             return {
                 "schema": "forgeline.provenance.v1",
                 "package": "code-factory-2-forge",
                 "version": __version__,
                 "source_commit": None,
-                "build_hash": None,
+                "build_hash": _build_hash(module_dir),
                 "install_origin": "source-tree",
                 "direct_url": None,
                 "python": sys.version.split()[0],
+                "runtime": {"python": sys.version.split()[0], "implementation": sys.implementation.name},
                 "receipt_schema": "forge.receipt.v1",
+                "identity_complete": False,
             }
         direct_url_text = distribution.read_text("direct_url.json")
         if direct_url_text:
@@ -39,14 +72,18 @@ def provenance() -> dict:
             install_origin = "site-packages"
     except importlib.metadata.PackageNotFoundError:
         pass
+    source_commit = _source_commit(module_dir)
+    build_hash = _build_hash(module_dir)
     return {
         "schema": "forgeline.provenance.v1",
         "package": "code-factory-2-forge",
         "version": __version__,
-        "source_commit": None,
-        "build_hash": None,
+        "source_commit": source_commit,
+        "build_hash": build_hash,
         "install_origin": install_origin,
         "direct_url": direct_url.get("url") if direct_url else None,
         "python": sys.version.split()[0],
+        "runtime": {"python": sys.version.split()[0], "implementation": sys.implementation.name},
         "receipt_schema": "forge.receipt.v1",
+        "identity_complete": bool(source_commit and build_hash),
     }

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/forgeline/run_store.py

@@ -41,3 +41,17 @@ class RunStore:
         fields = {"h": hashlib.sha256(line.encode()).hexdigest()[:12], **fields}
         with self.receipts.open("a") as f:
             f.write(json.dumps(fields, sort_keys=True) + "\n")
+
+    def latest_receipt(self, phase: str) -> dict | None:
+        """Return the most recent receipt for one phase without trusting state."""
+        if not self.receipts.exists():
+            return None
+        latest = None
+        for line in self.receipts.read_text(encoding="utf-8").splitlines():
+            try:
+                item = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            if item.get("phase") == phase:
+                latest = item
+        return latest

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/forgeline/source_scope.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import ast
 import json
 import os
+import re
 import shutil
 import subprocess
 from pathlib import Path
@@ -167,6 +168,20 @@ def analyze_source(path: Path, root: Path) -> dict:
     node = shutil.which("node")
     if node is None:
         return {"status": "parser_unsupported", "language": language, "text": text, "reason": "node is unavailable"}
+    # Node's parser is authoritative for JavaScript/ESM and does not need the
+    # optional TypeScript package. That makes .mjs support deterministic in a
+    # normal Node installation instead of silently producing zero symbols.
+    if language == "javascript":
+        try:
+            checked = subprocess.run(
+                [node, "--check", str(path)], cwd=Path(root), capture_output=True,
+                text=True, timeout=10, check=False,
+            )
+        except (OSError, subprocess.TimeoutExpired) as error:
+            return {"status": "parser_unsupported", "language": language, "text": text, "reason": type(error).__name__}
+        if checked.returncode != 0:
+            return {"status": "syntax_error", "language": language, "text": text, "error": checked.stderr.strip()}
+        return {"status": "ok", "language": language, "text": text, "functions": _javascript_functions(text), "parser": "node-check"}
     try:
         completed = subprocess.run(
             [node, "-e", _NODE_TYPESCRIPT_AST, str(path), language], cwd=Path(root),
@@ -183,15 +198,47 @@ def analyze_source(path: Path, root: Path) -> dict:
             if payload["errors"]:
                 return {"status": "syntax_error", "language": language, "text": text, "error": "; ".join(payload["errors"])}
             return {"status": "ok", "language": language, "text": text, "functions": payload["functions"]}
-    if language == "javascript":
-        try:
-            checked = subprocess.run(
-                [node, "--check", str(path)], cwd=Path(root), capture_output=True,
-                text=True, timeout=10, check=False,
-            )
-        except (OSError, subprocess.TimeoutExpired) as error:
-            return {"status": "parser_unsupported", "language": language, "text": text, "reason": type(error).__name__}
-        if checked.returncode == 0:
-            return {"status": "ok", "language": language, "text": text, "functions": [], "parser": "node-check"}
-        return {"status": "syntax_error", "language": language, "text": text, "error": checked.stderr.strip()}
     return {"status": "parser_unsupported", "language": language, "text": text, "reason": completed.stderr.strip() or "typescript parser is unavailable"}
+
+
+def _javascript_functions(source: str) -> list[dict]:
+    """Extract named ESM/local functions after Node has validated the source.
+
+    This is intentionally an inventory, not a second syntax parser. Node owns
+    syntax validity; the conservative scanner supplies stable symbols and
+    branch counts for feature-scoped QA without requiring an npm dependency.
+    """
+    patterns = (
+        re.compile(r"(?:^|\n)\s*(?:export\s+)?(?:default\s+)?(?:async\s+)?function\s+([A-Za-z_$][\w$]*)\s*\([^)]*\)[^{]*\{", re.MULTILINE),
+        re.compile(r"(?:^|\n)\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>", re.MULTILINE),
+    )
+    functions: list[dict] = []
+    seen: set[str] = set()
+    for pattern in patterns:
+        for match in pattern.finditer(source):
+            name = match.group(1)
+            if name in seen:
+                continue
+            seen.add(name)
+            start = match.start()
+            brace = source.find("{", match.end() - 1)
+            end = len(source)
+            if brace >= 0:
+                depth = 0
+                for index in range(brace, len(source)):
+                    if source[index] == "{":
+                        depth += 1
+                    elif source[index] == "}":
+                        depth -= 1
+                        if depth == 0:
+                            end = index + 1
+                            break
+            body = source[start:end]
+            complexity = 1 + len(re.findall(r"\b(?:if|for|while|case|catch)\b|&&|\|\||\?", body))
+            prefix = source[max(0, start - 400):start]
+            functions.append({
+                "name": name,
+                "complexity": complexity,
+                "documented": bool(re.search(r"/\*\*[^*]*(?:\*(?!/)[^*]*)*\*/\s*$", prefix, re.DOTALL)),
+            })
+    return functions

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/forgeline/ssat.py

@@ -80,7 +80,15 @@ class ScaffoldReport:
         }
 
 
-_LANGUAGE_BY_SUFFIX = {".py": "python", ".ts": "typescript", ".tsx": "typescript"}
+_LANGUAGE_BY_SUFFIX = {
+    ".py": "python",
+    ".js": "javascript",
+    ".jsx": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".ts": "typescript",
+    ".tsx": "typescript",
+}
 
 
 def load_ssat(path: Path) -> dict:
@@ -147,11 +155,39 @@ def _render_typescript(module: dict) -> str:
     return "\n".join(lines)
 
 
+def _javascript_args(args: list[str]) -> str:
+    """Remove TypeScript-only annotations while preserving ordinary JS syntax."""
+    cleaned: list[str] = []
+    for arg in args:
+        value = arg.split(":", 1)[0].strip().rstrip("?")
+        if not value:
+            raise ValueError("JavaScript SSAT arguments must include a parameter name")
+        cleaned.append(value)
+    return ", ".join(cleaned)
+
+
+def _render_javascript(module: dict) -> str:
+    lines = ["/** AUTO-SCAFFOLD from SSAT. Fill bodies only; do not change signatures. */"]
+    lines.extend(_typescript_import(imp) for imp in module.get("imports", []))
+    lines.append("")
+    for function in module.get("functions", []):
+        lines.extend([
+            f"/** {function.get('doc', 'TODO')} */",
+            f"export function {function['name']}({_javascript_args(function.get('args', []))}) {{",
+            '  throw new Error("NotImplementedError: FILL");',
+            "}",
+            "",
+        ])
+    return "\n".join(lines)
+
+
 def _render_module(module: dict, target: Path) -> str:
     language = _language_for(target)
     if language == "python":
         return _render_python(module)
-    return _render_typescript(module)
+    if language == "typescript":
+        return _render_typescript(module)
+    return _render_javascript(module)
 
 
 def _validate_generated_source(source: str, target: Path) -> None:
@@ -160,10 +196,17 @@ def _validate_generated_source(source: str, target: Path) -> None:
         ast.parse(source)
         return
     if re.search(r"^\s*def\s+", source, flags=re.MULTILINE) or source.count("{") != source.count("}"):
-        raise ValueError(f"generated invalid TypeScript for {target}")
+        raise ValueError(f"generated invalid {language} for {target}")
     for line in source.splitlines():
-        if "export function " in line and not re.search(r"export function \w+\(.*\):\s*[^\s]+\s*\{", line):
-            raise ValueError(f"generated invalid TypeScript signature for {target}")
+        if "export function " not in line:
+            continue
+        signature = (
+            r"export function \w+\(.*\):\s*[^\s]+\s*\{"
+            if language == "typescript"
+            else r"export function \w+\(.*\)\s*\{"
+        )
+        if not re.search(signature, line):
+            raise ValueError(f"generated invalid {language} signature for {target}")
 
 
 def scaffold_from_ssat(
@@ -268,8 +311,8 @@ def _module_of(path: str, ssat: dict) -> str | None:
     return None
 
 
-def _typescript_erosion(module: dict, path: Path, names: dict, allowed: set[tuple[str, str]]) -> list[ArchViolation]:
-    """A TypeScript-specific structure check. Python's AST is never used here."""
+def _javascript_erosion(module: dict, path: Path, names: dict, allowed: set[tuple[str, str]]) -> list[ArchViolation]:
+    """A JavaScript/TypeScript structure check. Python's AST is never used here."""
     source = path.read_text(encoding="utf-8")
     violations: list[ArchViolation] = []
     if re.search(r"^\s*def\s+", source, flags=re.MULTILINE) or source.count("{") != source.count("}"):
@@ -401,8 +444,8 @@ def check_erosion(ssat: dict, src_dir: Path) -> list[ArchViolation]:
         except ValueError as exc:
             violations.append(ArchViolation("E_UNSUPPORTED_LANGUAGE", str(exc), module["path"]))
             continue
-        if language == "typescript":
-            violations.extend(_typescript_erosion(module, path, names, allowed))
+        if language in {"typescript", "javascript"}:
+            violations.extend(_javascript_erosion(module, path, names, allowed))
             continue
         try:
             tree = ast.parse(path.read_text(encoding="utf-8"))

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-factory-2-forge"
-version = "0.10.2"
+version = "0.10.4"
 description = "ForgeLine — the autonomous outer loop for AI software factories. A CLI-backed state machine that drives intent -> spec -> plan -> code -> adversarial review -> ship, orchestrating SpecLine (spec governance) and Harness Software Factory (compiled decisions), with self-improving skills and architecture-as-a-CI-gate."
 readme = "README.md"
 requires-python = ">=3.11"

{code_factory_2_forge-0.10.2 → code_factory_2_forge-0.10.4}/tests/test_forgeline.py

@@ -105,6 +105,19 @@ def test_typescript_ssat_generates_typescript_and_compiles_when_tsc_is_available
     assert completed.returncode == 0, completed.stdout + completed.stderr
 
 
+def test_mjs_ssat_generates_valid_esm_without_python_syntax(proj):
+    report = scaffold_from_ssat(_typescript_ssat(["src/memory.mjs"]), proj)
+    target = proj / "src" / "memory.mjs"
+    source = target.read_text(encoding="utf-8")
+    assert len(report) == 1
+    assert "export function render(name)" in source
+    assert "def render" not in source
+    node = shutil.which("node")
+    if node is not None:
+        completed = subprocess.run([node, "--check", str(target)], capture_output=True, text=True)
+        assert completed.returncode == 0, completed.stdout + completed.stderr
+
+
 def test_mixed_language_ssat_generates_each_language_and_rejects_unknown_extensions(proj):
     report = scaffold_from_ssat(_typescript_ssat(["src/memory.ts", "src/worker.py"]), proj)
     assert len(report.created) == 2
@@ -317,6 +330,39 @@ def test_qa_feature_slice_ignores_unrelated_python_and_never_python_parses_mjs(p
     assert not any("bad.py" in finding for finding in report.findings)
 
 
+def test_mjs_qa_extracts_esm_and_local_symbols_with_measured_coverage(proj):
+    from forgeline.gates.qa_audit import qa_audit
+
+    feature = proj / "services" / "memory.mjs"
+    feature.parent.mkdir()
+    feature.write_text(
+        "/** Recall a saved value. */\n"
+        "export function recall(id) { if (!id) return null; return id; }\n"
+        "const normalize = (value) => value.trim();\n",
+        encoding="utf-8",
+    )
+    tests = proj / "services" / "memory.test.mjs"
+    tests.write_text("import { recall } from './memory.mjs';\nrecall('x'); normalize?.(' x ');\n", encoding="utf-8")
+
+    report = qa_audit(proj, source_paths=[feature])
+    names = {metric["function"].split(":")[-1] for metric in report.function_metrics}
+    assert {"recall", "normalize"} <= names
+    assert report.coverage_intent is not None and report.coverage_intent > 0
+    assert report.metrics["coverage_assessment"] == "measured"
+    assert not any("PARSER_UNSUPPORTED" in finding or "QA_SYNTAX" in finding for finding in report.findings)
+
+
+def test_mjs_invalid_syntax_is_not_misattributed_as_python_error(proj):
+    from forgeline.source_scope import analyze_source
+
+    feature = proj / "services" / "broken.mjs"
+    feature.parent.mkdir()
+    feature.write_text("export function broken( {\n", encoding="utf-8")
+    parsed = analyze_source(feature, proj)
+    assert parsed["language"] == "javascript"
+    assert parsed["status"] == "syntax_error"
+
+
 def test_qa_complexity_threshold_is_hard_and_cannot_pass_with_grade_b(proj):
     from forgeline.gates.qa_audit import qa_audit
 
@@ -390,7 +436,7 @@ def test_cli_requires_feature_scope_and_reports_machine_provenance(proj, capsys)
     main(["version", "--json"])
     provenance = json.loads(capsys.readouterr().out)
     assert provenance["package"] == "code-factory-2-forge"
-    assert provenance["version"] == "0.10.2"
+    assert provenance["version"] == "0.10.4"
     assert {"source_commit", "build_hash", "install_origin", "python"} <= provenance.keys()
 
 def test_learning_kernel_promotes_recurring_lessons(proj):
@@ -590,6 +636,21 @@ def test_verify_tests_passes_real_behavioral_check(proj):
     assert r["attribution"]["rate"] == 1.0
 
 
+def test_verify_tests_invalidates_receipt_when_source_changes(proj):
+    o = _to_arch_gated(proj)
+    write_smoke_manifest(proj, passing=True)
+    first = o.verify_tests(proj / "notifier.ssat.yaml")
+    assert first["verified"] is True
+    target = proj / "slices" / "notifier" / "formatter.py"
+    target.write_text(target.read_text(encoding="utf-8") + "\n# source changed\n", encoding="utf-8")
+
+    second = o.verify_tests(proj / "notifier.ssat.yaml")
+    assert second["verified"] is True
+    assert second["input_fingerprint"] != first["input_fingerprint"]
+    cache = o.store.latest_receipt("verify_tests_cache")
+    assert cache is not None and cache["reason"] == "input fingerprint changed"
+
+
 def test_verify_tests_catches_assert_true_hollow_check(proj):
     from forgeline.states import State
     o = _to_arch_gated(proj)