qaas-python 0.2.2__tar.gz → 0.3.0__tar.gz

{qaas_python-0.2.2 → qaas_python-0.3.0}/CLAUDE.md

@@ -52,8 +52,8 @@ default `pytest` run is offline and free, and must stay that way.
 ### Phase pipeline (`conductor.py`)
 
 ```
-map -> discover -> reproduce -> file -> verify
-CARTOGRAPHER   CONDUIT/SURFACE   FORGE   CLERK   PROOF
+map -> discover -> reproduce -> file -> verify -> report
+CARTOGRAPHER   CONDUIT/SURFACE/…   FORGE   CLERK   PROOF   CHRONICLE
 ```
 
 Discovery agents run concurrently up to the mode's cap; FORGE runs **once per
@@ -80,7 +80,9 @@ adding an agent as a sign something is wrong. Constraints enforced in
 `config.py`: at most 6 MCP servers per agent (§5.3, tool-selection accuracy),
 and every `must_call` tool must name a server the agent actually has.
 
-Adding a discovery agent is a prompt file plus a YAML file and no Python --
+Discovery AND reporting agents dispatch **by layer**; every other phase
+dispatches by name. So adding a discovery or reporting agent is a prompt file
+plus a YAML file and no Python --
 `_phase_discover` falls back to `tasks.discovery` for anything without a
 bespoke builder. VAULT and WARDEN were added that way and found that it was
 not true before them.

{qaas_python-0.2.2 → qaas_python-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: qaas-python
-Version: 0.2.2
+Version: 0.3.0
 Summary: A multi-agent QA system: finds real defects, reproduces them, files tickets, fixes them, and proves the fix
 Project-URL: Homepage, https://github.com/allaabdella2-us/qa-multi-agent-system
 Project-URL: Repository, https://github.com/allaabdella2-us/qa-multi-agent-system
@@ -84,6 +84,31 @@ Nothing crosses between the loops except a ticket — which is also the audit tr
 
 ---
 
+## 🤖 The roster
+
+| agent | layer | what it does |
+|---|---|---|
+| 🗺️ CARTOGRAPHER | map | services, routes, schema, ownership → the system map everything reads |
+| 🏛️ KEYSTONE | discovery | circular deps, layering violations, god modules, dead code |
+| 🔌 CONDUIT | discovery | API contract drift, authz gaps, error-shape inconsistency |
+| 🖱️ SURFACE | discovery | drives the UI through real journeys |
+| 🗄️ VAULT | discovery | schema constraints the code assumes and the database does not enforce |
+| 🔒 WARDEN | discovery | missing authorization, secrets, vulnerable dependencies, leaks |
+| 📡 PULSE | discovery | WebSocket auth, reconnect, ordering, backpressure |
+| 🧭 USHER | discovery | whether a person can *find* a feature, not just whether it works |
+| ⏱️ GAUGE | discovery | N+1 queries, unindexed hot paths, unbounded results, bundle outliers |
+| 🔨 FORGE | triage | reproduces, minimises, measures flake, commits a failing test |
+| 📝 CLERK | triage | dedupes, scores severity, routes, files — the only tracker writer |
+| 🔧 MENDER | remediation | the minimal fix, on a branch |
+| ⚖️ ARBITER | remediation | adversarial review: APPROVE / REQUEST_CHANGES / ESCALATE |
+| ✅ PROOF | verify | re-runs the original test → VERIFIED / NOT_FIXED / REGRESSED |
+| 📊 CHRONICLE | reporting | what the run found, what recurred, and what it could not reach |
+
+**CONDUCTOR** is the sixteenth. It is the Python state machine rather than an
+agent — a model cannot enforce a budget it is itself spending.
+
+---
+
 ## 🚀 Quickstart in 60 seconds
 
 ```bash
@@ -318,8 +343,8 @@ precision is measured rather than assumed.
 
 Honest about what exists:
 
-- ✅ **10 of the 16 agents** in the design are built — CARTOGRAPHER, CONDUIT, SURFACE, VAULT, WARDEN, FORGE, CLERK, MENDER, ARBITER, PROOF. CONDUCTOR is the Python state machine rather than an agent. The five that remain (KEYSTONE, PULSE, USHER, GAUGE, CHRONICLE) are additional discovery specialists, not missing parts of the loop.
-- ✅ **Adding an agent needs a prompt file and a YAML file — no Python.** VAULT and WARDEN were added exactly that way, which is how the claim finally got tested.
+- ✅ **All 16 agents in the design are built.**
+- ✅ **Adding one needs a prompt file and a YAML file — no Python.** Six were added that way, which is how the claim got tested.
 - ✅ The fix loop has closed end to end on a real defect: `NOT_FIXED → MENDER → ARBITER APPROVE → VERIFIED`.
 - ✅ 30 skills, 7 in-process MCP servers, 649 offline tests.
 - ⚠️ Running the bundled demo needs `export CORVID_PASSWORD=password123` — credentials come from the environment, including the demo's.

{qaas_python-0.2.2 → qaas_python-0.3.0}/README.md

@@ -54,6 +54,31 @@ Nothing crosses between the loops except a ticket — which is also the audit tr
 
 ---
 
+## 🤖 The roster
+
+| agent | layer | what it does |
+|---|---|---|
+| 🗺️ CARTOGRAPHER | map | services, routes, schema, ownership → the system map everything reads |
+| 🏛️ KEYSTONE | discovery | circular deps, layering violations, god modules, dead code |
+| 🔌 CONDUIT | discovery | API contract drift, authz gaps, error-shape inconsistency |
+| 🖱️ SURFACE | discovery | drives the UI through real journeys |
+| 🗄️ VAULT | discovery | schema constraints the code assumes and the database does not enforce |
+| 🔒 WARDEN | discovery | missing authorization, secrets, vulnerable dependencies, leaks |
+| 📡 PULSE | discovery | WebSocket auth, reconnect, ordering, backpressure |
+| 🧭 USHER | discovery | whether a person can *find* a feature, not just whether it works |
+| ⏱️ GAUGE | discovery | N+1 queries, unindexed hot paths, unbounded results, bundle outliers |
+| 🔨 FORGE | triage | reproduces, minimises, measures flake, commits a failing test |
+| 📝 CLERK | triage | dedupes, scores severity, routes, files — the only tracker writer |
+| 🔧 MENDER | remediation | the minimal fix, on a branch |
+| ⚖️ ARBITER | remediation | adversarial review: APPROVE / REQUEST_CHANGES / ESCALATE |
+| ✅ PROOF | verify | re-runs the original test → VERIFIED / NOT_FIXED / REGRESSED |
+| 📊 CHRONICLE | reporting | what the run found, what recurred, and what it could not reach |
+
+**CONDUCTOR** is the sixteenth. It is the Python state machine rather than an
+agent — a model cannot enforce a budget it is itself spending.
+
+---
+
 ## 🚀 Quickstart in 60 seconds
 
 ```bash
@@ -288,8 +313,8 @@ precision is measured rather than assumed.
 
 Honest about what exists:
 
-- ✅ **10 of the 16 agents** in the design are built — CARTOGRAPHER, CONDUIT, SURFACE, VAULT, WARDEN, FORGE, CLERK, MENDER, ARBITER, PROOF. CONDUCTOR is the Python state machine rather than an agent. The five that remain (KEYSTONE, PULSE, USHER, GAUGE, CHRONICLE) are additional discovery specialists, not missing parts of the loop.
-- ✅ **Adding an agent needs a prompt file and a YAML file — no Python.** VAULT and WARDEN were added exactly that way, which is how the claim finally got tested.
+- ✅ **All 16 agents in the design are built.**
+- ✅ **Adding one needs a prompt file and a YAML file — no Python.** Six were added that way, which is how the claim got tested.
 - ✅ The fix loop has closed end to end on a real defect: `NOT_FIXED → MENDER → ARBITER APPROVE → VERIFIED`.
 - ✅ 30 skills, 7 in-process MCP servers, 649 offline tests.
 - ⚠️ Running the bundled demo needs `export CORVID_PASSWORD=password123` — credentials come from the environment, including the demo's.

{qaas_python-0.2.2 → qaas_python-0.3.0}/pyproject.toml

@@ -2,7 +2,7 @@
 # Distribution name is `qaas-python` (`qaas` was taken); the import package and
 # the CLI are both `qaas`.
 name = "qaas-python"
-version = "0.2.2"
+version = "0.3.0"
 description = "A multi-agent QA system: finds real defects, reproduces them, files tickets, fixes them, and proves the fix"
 readme = "README.md"
 license = "MIT"

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/cli.py

@@ -500,14 +500,18 @@ def validate(config_dir: Path | None = ConfigDir) -> None:
     # never dispatched. The mode meant for every pull request could not file a
     # ticket. It took a live run to notice; this check makes it free.
     for mode_name, mode in sorted(cfg.run_modes.items()):
-        needed = sum(
-            cfg.agents[a].max_budget_usd for a in mode.agents if a in cfg.agents
-        )
-        if needed > mode.max_budget_usd:
+        # Only meaningful when both sides declare a cap. The shipped config
+        # declares none, so this check simply does not fire there.
+        agent_caps = [
+            cfg.agents[a].max_budget_usd for a in mode.agents
+            if a in cfg.agents and cfg.agents[a].max_budget_usd is not None
+        ]
+        needed = sum(agent_caps)
+        if mode.max_budget_usd is not None and agent_caps and needed > mode.max_budget_usd:
             missing = [a for a in mode.agents if a in cfg.agents][-1]
             problems.append(
-                f"mode '{mode_name}': agents can spend ${needed:.2f} but the cap is "
-                f"${mode.max_budget_usd:.2f}, so the run stops before it reaches "
+                f"mode '{mode_name}': the agents' caps exceed the mode's cap, so "
+                f"its cap, so the run stops before it reaches "
                 f"{missing} and files nothing. Raise max_budget_usd or drop an agent"
             )
 
@@ -567,7 +571,7 @@ def validate(config_dir: Path | None = ConfigDir) -> None:
         filing = "" if rm.files_tickets else "  [dim](no filing)[/dim]"
         console.print(
             f"[bold]{mode}[/bold]: {', '.join(rm.agents)}  "
-            f"[dim]budget ${rm.max_budget_usd:.2f}, {rm.max_wall_clock_s}s[/dim]{filing}"
+            f"[dim]{rm.max_wall_clock_s}s[/dim]{filing}"
         )
 
     if notes:
@@ -834,7 +838,7 @@ def runs(root: Path = Root, limit: int = 10) -> None:
         console.print("[dim]no runs yet[/dim]")
         return
     table = Table(header_style="bold")
-    for col in ("run", "envelopes", "agents", "cost"):
+    for col in ("run", "envelopes", "agents"):
         table.add_column(col)
     for run_id in ids:
         store = RunStore(run_id, root)
@@ -843,7 +847,6 @@ def runs(root: Path = Root, limit: int = 10) -> None:
             run_id,
             str(len(store.envelopes())),
             str(len(results)),
-            f"${store.total_cost_usd():.2f}",
         )
     console.print(table)
 
@@ -872,9 +875,6 @@ def show(run_id: str, root: Path = Root) -> None:
         header.append(f"started {summary.started:%Y-%m-%d %H:%M:%S}Z")
     if summary.duration_s is not None:
         header.append(f"duration {summary.duration_s:.0f}s")
-    header.append(f"cost ${summary.cost_usd:.2f}")
-    if summary.budget_usd:
-        header.append(f"of ${summary.budget_usd:.2f} budget")
     console.print("  " + "  ".join(header))
     if summary.target_sha:
         dirty = " [yellow](dirty tree)[/yellow]" if summary.target_dirty else ""
@@ -960,7 +960,6 @@ def trace(
     table.add_column("agent", style="cyan")
     table.add_column("kind")
     table.add_column("detail", overflow="fold")
-    table.add_column("cost", justify="right", style="dim")
     for row in trace_mod.timeline(entries):
         label = f"{row.kind} ×{row.count}" if row.count > 1 else row.kind
         table.add_row(
@@ -968,7 +967,6 @@ def trace(
             row.agent,
             f"[{KIND_STYLE.get(row.kind, 'white')}]{label}[/]",
             row.detail,
-            f"${row.cost_usd:.2f}" if row.cost_usd is not None else "",
         )
     console.print(table)
     console.print(f"\n[dim]{len(entries)} entries[/dim]")
@@ -1082,7 +1080,7 @@ def run(
     rm = cfg.run_modes[mode]
     console.print(
         f"[bold]{mode}[/bold] — {len(specs)} agents, "
-        f"budget ${rm.max_budget_usd:.2f}, concurrency {rm.max_concurrency}"
+        f"concurrency {rm.max_concurrency}"
     )
 
     if dry_run:
@@ -1093,7 +1091,7 @@ def run(
             d = describe(spec, prompt_dirs)
             console.print(
                 f"  [bold]{spec.name:14s}[/bold] {spec.model:18s} effort={spec.effort:7s} "
-                f"turns<={spec.max_turns:<3d} ${spec.max_budget_usd:.2f}"
+                f"turns<={spec.max_turns}"
             )
             console.print(f"    tools: {', '.join(d['allowed_tools'])}")
             console.print(f"    prompt: {d['prompt_chars']} chars")
@@ -1101,11 +1099,11 @@ def run(
 
     def on_event(kind: str, detail: dict) -> None:
         if kind == "agent_started":
-            console.print(f"[dim]->[/dim] {detail.get('agent')} [dim](${detail.get('budget', 0):.2f})[/dim]")
+            console.print(f"[dim]->[/dim] {detail.get('agent')}")
         elif kind == "finished":
             console.print(
                 f"[dim]<-[/dim] {detail.get('agent')} "
-                f"[dim]${detail.get('cost', 0):.3f}, {detail.get('envelopes', 0)} findings[/dim]"
+                f"[dim]{detail.get('envelopes', 0)} findings[/dim]"
             )
         elif kind == "stopped":
             console.print(f"[yellow]stopped: {detail.get('reason')}[/yellow]")
@@ -1172,11 +1170,6 @@ def score(
     table.add_row("false positives", f"{s['false_positives']} ({s['false_positive_rate']:.0%})")
     table.add_row("duplicates", f"{s['duplicates']} ({s['duplicate_rate']:.0%})")
     table.add_row("severity agreement", f"{s['severity_agreement']:.0%}")
-    table.add_row("cost", f"${s['cost_usd']:.2f}")
-    table.add_row(
-        "cost per accepted",
-        f"${s['cost_per_accepted']:.2f}" if s["cost_per_accepted"] is not None else "-",
-    )
     console.print(table)
 
     if card.matches:

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/conductor.py

@@ -110,7 +110,7 @@ class RunReport:
 class Budget:
     """The spend and wall-clock governor. Checked before every dispatch."""
 
-    def __init__(self, max_usd: float, max_seconds: int, *, already_spent: float = 0.0):
+    def __init__(self, max_usd: float | None, max_seconds: int, *, already_spent: float = 0.0):
         self.max_usd = max_usd
         self.max_seconds = max_seconds
         #: What this run has already cost, including earlier invocations.
@@ -130,23 +130,28 @@ class Budget:
         return time.monotonic() - self.started
 
     @property
-    def remaining_usd(self) -> float:
-        return max(0.0, self.max_usd - self.spent)
+    def remaining_usd(self) -> float | None:
+        return None if self.max_usd is None else max(0.0, self.max_usd - self.spent)
 
     def spend(self, amount: float) -> None:
         self.spent += amount
 
     def check(self) -> None:
-        if self.spent >= self.max_usd:
+        # `max_usd is None` means no spend ceiling -- the shipped config sets
+        # none, because a dollar figure bakes one vendor's pricing into a tool
+        # meant to run against local models too. The wall-clock cap and each
+        # agent's `max_turns` still bound a run; those are model-agnostic.
+        if self.max_usd is not None and self.spent >= self.max_usd:
             raise BudgetExceeded(f"spend cap reached: ${self.spent:.2f} of ${self.max_usd:.2f}")
         if self.elapsed >= self.max_seconds:
             raise BudgetExceeded(
                 f"wall-clock cap reached: {self.elapsed:.0f}s of {self.max_seconds}s"
             )
 
-    def allowance(self, spec: AgentSpec) -> float:
-        """What this agent may spend: its own cap, or what the run has left."""
-        return max(0.01, min(spec.max_budget_usd, self.remaining_usd))
+    def allowance(self, spec: AgentSpec) -> float | None:
+        """What this agent may spend, or None when neither it nor the run caps it."""
+        caps = [c for c in (spec.max_budget_usd, self.remaining_usd) if c is not None]
+        return max(0.01, min(caps)) if caps else None
 
 
 class Conductor:
@@ -234,6 +239,7 @@ class Conductor:
             else:
                 store.log("skipped", reason="mode does not file tickets", mode=mode)
             await self._phase_verify(specs, store, budget, report, map_version)
+            await self._phase_report(specs, store, budget, report, mode, map_version)
         except BudgetExceeded as exc:
             report.stopped_early = str(exc)
             report.escalations.append(str(exc))
@@ -311,6 +317,30 @@ class Conductor:
 
         await self._gather(jobs, store, budget, report, map_version, self.config.run_modes[mode].max_concurrency)
 
+    async def _phase_report(self, specs, store, budget, report, mode, map_version) -> None:
+        """Reporting agents run last, over what the run itself produced.
+
+        Dispatched by LAYER, like discovery, and deliberately not by name. Every
+        other phase looks up a specific agent (`specs.get("FORGE")`), which is
+        why CHRONICLE could be configured, validated, assembled and shown in
+        `--dry-run` while never running: no phase asked for it. That is the same
+        silent skip VAULT and WARDEN exposed for discovery, and it is worth
+        fixing the shape rather than the instance -- a second reporting agent
+        now needs no Python either.
+
+        A run with no reporting agent is the ordinary case and not worth a log
+        line; most modes have none.
+        """
+        reporting = [s for s in specs.values() if s.layer == "reporting"]
+        if not reporting:
+            return
+
+        for spec in reporting:
+            budget.check()
+            await self._dispatch(
+                spec, store, budget, report, tasks.report(self.config, mode), map_version
+            )
+
     async def _phase_reproduce(self, specs, store, budget, report, map_version) -> None:
         """One FORGE invocation per finding.
 

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/config.py

@@ -74,7 +74,8 @@ class AgentSpec(BaseModel):
     model: str = "claude-opus-5"
     effort: Literal["low", "medium", "high", "xhigh", "max"] = "high"
     max_turns: int = 40
-    max_budget_usd: float = 2.0
+    max_budget_usd: float | None = None
+
 
     mcp_servers: list[str] = Field(default_factory=list)
     builtin_tools: list[str] = Field(default_factory=list)
@@ -165,7 +166,8 @@ class RunMode(BaseModel):
 
     trigger: str
     agents: list[str]
-    max_budget_usd: float = 10.0
+    max_budget_usd: float | None = None
+
     max_wall_clock_s: int = 3600
     max_concurrency: int = 3
     files_tickets: bool = True

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/arbiter.yaml

@@ -9,7 +9,6 @@ prompt: ARBITER.md
 model: claude-opus-5
 effort: high
 max_turns: 50
-max_budget_usd: 3.0
 mcp_servers: [envelope, vcs, contract_diff, test_runner]
 builtin_tools: [Read, Grep, Glob]
 skills: [adversarial-review, root-cause-vs-symptom, regression-risk-scoring, test-quality-audit]

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/cartographer.yaml

@@ -7,7 +7,6 @@ prompt: CARTOGRAPHER.md
 model: claude-sonnet-5      # extraction, not judgment
 effort: medium
 max_turns: 60
-max_budget_usd: 2.0
 mcp_servers: [envelope]
 builtin_tools: [Read, Grep, Glob]
 policy: {}                  # read-only

qaas_python-0.3.0/src/qaas/defaults/config/agents/chronicle.yaml

@@ -0,0 +1,19 @@
+name: CHRONICLE
+layer: reporting
+role: >
+  Reporting analyst. Reads what a run produced -- findings, verdicts, denials,
+  escalations, recurrence -- and reports the pattern across them, including what
+  the run could not reach. Audits the run, never the application.
+prompt: CHRONICLE.md
+model: claude-sonnet-5
+effort: medium
+max_turns: 40
+mcp_servers: [envelope, defect_memory, tracker]
+builtin_tools: [Read]
+policy: {}
+
+skills: [severity-rubric, dedupe-strategy, verdict-reporting]
+
+# No must_call: a run that found nothing still deserves a report saying so, and
+# a report is not an envelope. Requiring an emission would turn "nothing to say"
+# into an invented finding.

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/clerk.yaml

@@ -8,7 +8,6 @@ prompt: CLERK.md
 model: claude-sonnet-5      # composition against a fixed rubric and house format
 effort: high
 max_turns: 50
-max_budget_usd: 2.0
 mcp_servers: [envelope, tracker, defect_memory]
 builtin_tools: [Read]
 policy:

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/conduit.yaml

@@ -8,7 +8,6 @@ prompt: CONDUIT.md
 model: claude-opus-5
 effort: high
 max_turns: 60
-max_budget_usd: 3.0
 mcp_servers: [envelope, contract_diff, env_control, defect_memory]
 builtin_tools: [Read, Grep, Glob]
 policy: {}

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/forge.yaml

@@ -8,7 +8,6 @@ prompt: FORGE.md
 model: claude-opus-5
 effort: high
 max_turns: 80
-max_budget_usd: 4.0
 mcp_servers: [envelope, test_runner, env_control, vcs]
 builtin_tools: [Read, Grep, Glob, Write, Edit, Bash]
 policy:

qaas_python-0.3.0/src/qaas/defaults/config/agents/gauge.yaml

@@ -0,0 +1,26 @@
+name: GAUGE
+layer: discovery
+role: >
+  Performance analyst. Finds N+1 query patterns, unbounded result sets, queries
+  filtering on unindexed columns on request paths, endpoint latency outliers,
+  bundle-size outliers, unbounded caches and leaked connections. Evidences them
+  from the code and from timed requests, because this deployment has no load
+  runner, no metrics backend and no profiler -- so it never claims behaviour
+  under load that it did not observe.
+prompt: GAUGE.md
+model: claude-opus-5
+effort: high
+max_turns: 60
+mcp_servers: [envelope, env_control, defect_memory]
+builtin_tools: [Read, Grep, Glob]
+policy: {}
+
+skills: [environment-pinning, repro-minimisation, root-cause-vs-symptom, severity-rubric]
+
+# No must_call: finding nothing is a valid outcome for a discovery agent, and
+# requiring an emission would manufacture findings to satisfy it -- which for a
+# performance agent means speculation about load it cannot apply.
+
+# Nightly and pre-release only (§4.10): too slow and too noisy per-PR. The
+# run_modes rosters in system.yaml decide that; this file only declares the
+# agent.

qaas_python-0.3.0/src/qaas/defaults/config/agents/keystone.yaml

@@ -0,0 +1,21 @@
+name: KEYSTONE
+layer: discovery
+role: >
+  Architecture analyst. Finds dependency cycles, layering violations, god modules
+  and fan-in outliers, domain logic duplicated across services, drift between the
+  architecture documents and the code, wrong service boundaries, and dead or
+  orphaned code. Pure static analysis -- it needs no running application, so it
+  is the one discovery agent that works against a target with no environment.
+prompt: KEYSTONE.md
+model: claude-opus-5
+effort: high
+max_turns: 60
+mcp_servers: [envelope, defect_memory]
+builtin_tools: [Read, Grep, Glob]
+policy: {}                  # read-only; it never touches the app it reads
+
+skills: [repo-cartography, api-surface-extraction, ownership-resolution, severity-rubric]
+
+# No must_call: see VAULT. Also, an architecture agent that must emit something
+# will emit taste, and "this could be cleaner" filed as a defect is the fastest
+# way for a team to stop reading structural findings at all.

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/mender.yaml

@@ -10,7 +10,6 @@ prompt: MENDER.md
 model: claude-opus-5
 effort: high
 max_turns: 80
-max_budget_usd: 5.0
 mcp_servers: [envelope, test_runner, env_control, vcs, tracker, contract_diff]
 builtin_tools: [Read, Grep, Glob, Write, Edit, Bash]
 skills: [test-first-fix, minimal-diff-discipline, root-cause-vs-symptom, rollback-plan-authoring]

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/proof.yaml

@@ -8,7 +8,6 @@ prompt: PROOF.md
 model: claude-opus-5
 effort: high
 max_turns: 60
-max_budget_usd: 4.0
 mcp_servers: [envelope, test_runner, env_control, tracker, vcs]
 builtin_tools: [Read, Grep, Glob, Bash]
 policy:

qaas_python-0.3.0/src/qaas/defaults/config/agents/pulse.yaml

@@ -0,0 +1,23 @@
+name: PULSE
+layer: discovery
+role: >
+  Realtime and WebSocket analyst. Finds auth bypass on the upgrade handshake,
+  reconnect without jittered backoff, message loss with no resume token,
+  order-dependent consumers with nothing carrying order, missing heartbeats,
+  absent backpressure, and channel authorization never re-checked after
+  subscribe. The WebSocket harness the design gives this role does not exist
+  here, so PULSE reads the connection code and reports at the confidence of a
+  source reading, not of a measurement.
+prompt: PULSE.md
+model: claude-opus-5
+effort: high
+max_turns: 60
+mcp_servers: [envelope, env_control, defect_memory]
+builtin_tools: [Read, Grep, Glob]
+policy: {}                  # read-only
+
+skills: [api-surface-extraction, authz-matrix-check, environment-pinning, severity-rubric]
+
+# No must_call: see VAULT. It matters more here than anywhere -- a target with no
+# realtime surface should produce zero envelopes, and a required emission would
+# turn "there are no websockets" into a manufactured finding about one.

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/surface.yaml

@@ -8,7 +8,6 @@ prompt: SURFACE.md
 model: claude-opus-5
 effort: high
 max_turns: 80
-max_budget_usd: 4.0
 mcp_servers: [envelope, env_control, playwright]
 builtin_tools: [Read, Grep, Glob]
 policy: {}

qaas_python-0.3.0/src/qaas/defaults/config/agents/usher.yaml

@@ -0,0 +1,23 @@
+name: USHER
+layer: discovery
+role: >
+  Product navigation and UX guide. Navigates the live product to answer "how do
+  I do X here?", and reports every place that navigation struggled: tasks
+  reachable only by typing a URL, dead ends, unlabelled paths, step counts out
+  of proportion to the task, and product vocabulary that does not match the
+  user's. SURFACE owns whether a feature works; USHER owns whether anyone can
+  find it.
+prompt: USHER.md
+model: claude-opus-5
+effort: high
+max_turns: 80
+mcp_servers: [envelope, env_control, playwright, defect_memory]
+builtin_tools: [Read, Grep, Glob]
+policy: {}
+
+skills: [product-task-graph, exploratory-ui-walk, environment-pinning, severity-rubric, repro-minimisation]
+
+# No must_call: finding nothing is a valid outcome for a discovery agent, and
+# requiring an emission would manufacture findings to satisfy it. That matters
+# more here than elsewhere -- a product that is easy to navigate produces no
+# friction envelopes, which is the result, not a failure of the run.

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/vault.yaml

@@ -10,7 +10,6 @@ prompt: VAULT.md
 model: claude-opus-5
 effort: high
 max_turns: 60
-max_budget_usd: 3.0
 mcp_servers: [envelope, env_control, defect_memory]
 builtin_tools: [Read, Grep, Glob]
 policy: {}

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/agents/warden.yaml

@@ -9,10 +9,6 @@ prompt: WARDEN.md
 model: claude-opus-5
 effort: high
 max_turns: 60
-# Measured: WARDEN exhausted $3.00 on its first real run against the demo app
-# and was killed mid-audit. Building the endpoint-by-role matrix and actually
-# impersonating each role costs more than reading a spec does.
-max_budget_usd: 5.0
 mcp_servers: [envelope, env_control, defect_memory]
 builtin_tools: [Read, Grep, Glob]
 policy: {}

{qaas_python-0.2.2 → qaas_python-0.3.0}/src/qaas/defaults/config/system.yaml

@@ -9,6 +9,11 @@ target:
 tracker: local      # local | jira   -- swap to file against real Jira
 vcs: local          # local | github
 
+# No spend cap by default. A dollar figure bakes one vendor's pricing into
+# the config, and this is meant to run against local models too. `max_turns`
+# is the model-agnostic bound. Set `max_budget_usd` here if you want a
+# ceiling; the governor enforces one whenever it is present.
+
 thresholds:
   min_confidence_to_file: 0.6      # §7 confidence gate
   max_findings_per_agent_run: 25   # §8.3 loop breaker: pause and escalate, don't file
@@ -20,31 +25,23 @@ thresholds:
 run_modes:
   pr-check:
     trigger: pull_request
-    agents: [CARTOGRAPHER, CONDUIT, SURFACE, FORGE, CLERK]
-    # Was 6.0, which this roster could not complete. Measured on a real run:
-    # CARTOGRAPHER $0.69 + CONDUIT $2.25 + SURFACE $3.16 = $6.09, so the governor
-    # stopped the run before FORGE or CLERK ever dispatched. The mode meant to
-    # run on every pull request could not file a ticket, and it failed silently:
-    # agents ran, findings landed in the ledger, nothing errored. `qaas validate`
-    # now refuses a mode whose agents cannot fit inside its cap.
-    max_budget_usd: 16.0
+    # KEYSTONE joins the PR sweep because it is pure static analysis and needs
+    # no running app. USHER, GAUGE and CHRONICLE do not: the design says GAUGE is
+    # "nightly and pre-release only -- too expensive and too noisy per-PR", and
+    # the same argument holds for a UX walk and a report about the week.
+    agents: [CARTOGRAPHER, KEYSTONE, CONDUIT, SURFACE, VAULT, WARDEN, FORGE, CLERK]
     max_wall_clock_s: 900
     max_concurrency: 2
 
   nightly:
     trigger: cron
-    agents: [CARTOGRAPHER, CONDUIT, SURFACE, VAULT, WARDEN, FORGE, CLERK]
-    # FORGE runs once per finding, so the deep sweep's budget scales with how
-    # much discovery found, not with the number of agents. Measured: discovery
-    # ~$6, then roughly $1-2 per finding reproduced.
-    max_budget_usd: 50.0
+    agents: [CARTOGRAPHER, KEYSTONE, CONDUIT, SURFACE, VAULT, WARDEN, PULSE, USHER, GAUGE, FORGE, CLERK, CHRONICLE]
     max_wall_clock_s: 7200
     max_concurrency: 3
 
   incident:
     trigger: alert
     agents: [CONDUIT]
-    max_budget_usd: 4.0
     max_wall_clock_s: 600
     max_concurrency: 2
     files_tickets: false          # §9: diagnostic only, read-only, no filing
@@ -55,7 +52,6 @@ run_modes:
   fix-cycle:
     trigger: agent_ready_ticket
     agents: [PROOF, MENDER, ARBITER]
-    max_budget_usd: 20.0
     max_wall_clock_s: 3600
     max_concurrency: 1
 
@@ -63,7 +59,6 @@ run_modes:
   # expensive mode in the system and the only one that closes the loop.
   full-loop:
     trigger: on_demand
-    agents: [CARTOGRAPHER, CONDUIT, SURFACE, VAULT, WARDEN, FORGE, CLERK, MENDER, ARBITER, PROOF]
-    max_budget_usd: 70.0
+    agents: [CARTOGRAPHER, KEYSTONE, CONDUIT, SURFACE, VAULT, WARDEN, PULSE, USHER, GAUGE, FORGE, CLERK, MENDER, ARBITER, PROOF, CHRONICLE]
     max_wall_clock_s: 10800
     max_concurrency: 3