details

\n\n **Problem:** \n\n **Why it matters:** \n\n **Fix:**\n\n ```diff\n - bad\n + good\n ```\n\n

details

\n\n **Problem:** \n\n **Why it matters:** \n\n **Fix:**\n\n ```diff\n - bad\n + good\n ```\n\n

\n````\n\nRules:\n- The HTML comment marker `` MUST be the last token on\n the checklist line. Renderers hide it; the `review-fix-shipped`\n Action keys off it.\n- Severity in bold + brackets: `**[BLOCKER]**`, `**[MAJOR]**`,\n `**[MINOR]**`, `**[NIT]**`.\n- The short title is the first line of the original `Problem:`,\n trimmed to ≤ 80 chars, no trailing period.\n\nEnd the comment with the run footer:\n\n- Reviewed range: `..` (`` commits, `` files)\n- Blockers: N\n- Majors: N\n- Minors: N\n- Nits: N\n- Counter-argument check: ``\n- Not reviewed: ``\n- Last reviewed SHA: `` ← persist for next run\n\n# Persistence (dual sink)\n\n## Sink 1: GitHub issue (rolling log)\n\n- Find or create the issue titled `Daily code review — develop` (label:\n `review-bot`).\n- Append today's findings as a new comment, format:\n\n ```\n ## YYYY-MM-DD — \n Reviewed: .. ( commits)\n Blockers: N | Majors: N | Minors: N | Nits: N\n\n \n\n \n ```\n\n- If no new commits: append a one-line comment\n `YYYY-MM-DD — no-op (head still )`.\n- Update the issue body's `Last reviewed SHA: ` line. This is\n canonical state — read it at the start of the next run.\n\n## Sink 2: Daily review doc (committed)\n\n- Path: `docs/daily-reviews/YYYY-MM-DD.md`. One file per UTC day.\n- Frontmatter:\n\n ```yaml\n ---\n date: YYYY-MM-DD\n range: ..\n commits: \n blockers: \n majors: \n minors: \n nits: \n ---\n ```\n\n- Body: full findings block (same content as the issue comment —\n checklist of findings + run footer).\n- The daily doc is an immutable snapshot of that run; the\n `review-fix-shipped` Action edits the rolling issue comment only,\n never the daily doc.\n- If no new commits: skip file creation. Do NOT commit an empty doc.\n\n## Commit + PR flow (NEVER push direct to develop)\n\n1. `git fetch origin && git switch -c chore/daily-review-YYYY-MM-DD origin/develop`\n2. Write `docs/daily-reviews/YYYY-MM-DD.md`.\n3. `git add docs/daily-reviews/YYYY-MM-DD.md`\n4. `git commit -m \"docs(reviews): daily review YYYY-MM-DD\"`\n (no `--no-verify`, no `Co-Authored-By` unless the owner sets one).\n5. `git push -u origin chore/daily-review-YYYY-MM-DD`\n6. `gh pr create --base develop --title \"docs(reviews): daily review YYYY-MM-DD\" --body \"Automated daily review. See #issuecomment- for findings. Doc-only change, skip changeset.\"`\n7. If repo has auto-merge enabled, run `gh pr merge --auto --squash` on\n the PR. Otherwise leave it for the owner to merge.\n\n## Idempotency\n\n- Read `Last reviewed SHA` from the issue body at the start. If unset,\n fall back to `git log --since=\"24 hours ago\" origin/develop`.\n- If `docs/daily-reviews/YYYY-MM-DD.md` already exists on `develop`,\n today's run already happened — append the delta as a new comment to\n the issue, but do NOT open a second PR for the same date. Either\n reuse the existing branch with a follow-up commit or skip the doc\n write.\n\n## Failure handling\n\n- `gh pr create` fails (e.g. no diff) → still post the issue comment\n with findings; skip the PR.\n- `git push` fails (perm, network) → retry once, then post an issue\n# `review-bot/` — daily code-review routine\n\nSource files for the scheduled remote agent that reviews `develop` once\nper weekday and persists findings to two sinks.\n\n## Layout\n\n| File | Purpose |\n| ----------------------------- | -------------------------------------------------------- |\n| [`PROMPT.md`](./PROMPT.md) | System prompt the routine loads at the start of each run. |\n| [`README.md`](./README.md) | This file — routine setup, sinks, iteration workflow. |\n\n## Output sinks\n\n1. **Rolling GitHub issue** — title `Daily code review — develop`,\n label `review-bot`. New comment per run. Issue body holds the\n canonical `Last reviewed SHA` so the next run knows where to\n resume.\n2. **Committed daily docs** — `docs/daily-reviews/YYYY-MM-DD.md`\n (one file per UTC day, frontmatter + findings body). Reaches\n `develop` via an automated PR `chore/daily-review-YYYY-MM-DD`,\n never a direct push.\n\n## Ingesting findings via `review-fix`\n\nThe `.claude/skills/review-fix/SKILL.md` skill turns one finding into\na worktree-isolated topic branch + plan, ready for\n`superpowers:writing-plans` → `superpowers:executing-plans`.\n\n### Finding ID\n\nEach finding the bot writes carries a stable ID\n`.`, embedded as an HTML comment on its checklist\nline. `head-sha[:7]` is the seven-char prefix of the head SHA\nreviewed in that run; `idx` is the 1-based position of the finding\nwithin the run.\n\nIDs do not deduplicate across reruns: tomorrow's run on a new SHA\nemits a fresh set of IDs even for findings that were already\nunshipped. The unshipped checkbox on the prior comment still flips\nwhen the eventual PR ships.\n\n### Workflow\n\n```text\ngh issue view 87 --comments # find a finding ID\n/review-fix pick # creates worktree + plan\n/superpowers:writing-plans # expand plan into chunked tasks\n/superpowers:executing-plans … # implement, verify, open PR\n```\n\nThe PR body MUST contain, on its own line:\n\n```\nRefs #87 finding:.\n```\n\nTrailing whitespace is tolerated; trailing punctuation breaks the\nmatch. The PR body MUST NOT contain `Closes #87` / `Fixes #87` —\nthe tracker is long-lived and stays open.\n\n### Auto-flip on merge\n\n`.github/workflows/review-fix-shipped.yml` triggers on\n`pull_request: closed && merged`, regexes the PR body for the magic\nline, locates the matching tracker comment, and edits the body so\nthe checklist item becomes:\n\n```markdown\n- [x] **[BLOCKER]** `path/to/file.ts:42` — short title (shipped in #N) \n```\n\nThe Action does not block merges; it observes them. If the magic\nline is missing, it logs and exits 0.\n\n## CI behavior on the daily PR\n\n`.github/workflows/ci.yml` short-circuits doc-only PRs:\n\n- A `changes` job uses `dorny/paths-filter` to detect whether the diff\n touches code (`src/**`, `tests/**`, `examples/**`, configs, workflows)\n or only docs / changesets / markdown.\n- Heavy jobs (`lint`, `typecheck`, `docs`, `test`, `build`,\n `size-limit-comment`, `demo-build`) are gated on\n `needs.changes.outputs.code == 'true'` and skip on doc-only diffs.\n- Cheap always-on jobs (`format-check`, `actionlint`, `audit`) keep\n running so docs PRs still get prettier + supply-chain protection.\n- A final `ci-gate` job aggregates all `needs` results, treating\n legitimately-skipped jobs as success. **Branch protection on\n `develop` should require only `ci-gate`.** The daily review PR\n finishes CI in ~1 minute on doc-only diffs vs ~6+ minutes on full\n verify.\n\n## Iteration workflow\n\nThe prompt evolves as you discover new false positives, missing\ninvariants, or output-format pain. To change it:\n\n1. Cut a topic branch from `develop` (`docs/review-bot-prompt-tweak` or\n similar).\n2. Edit [`PROMPT.md`](./PROMPT.md). Keep the section structure stable so\n the routine doesn't break on a missing header.\n3. Open a PR against `develop`. Doc-only → `ci-gate` only.\n4. After merge, the next scheduled run picks up the new prompt.\n\n## Initial setup checklist (one-time)\n\n- [ ] Create the rolling issue `Daily code review — develop`. Add label\n `review-bot`. Seed the body with `Last reviewed SHA: ` so\n the first run falls back to `--since=\"24 hours ago\"`.\n- [ ] Add a PR label `review-bot` (cosmetic — lets you filter the\n automated PRs out of the human review queue).\n- [ ] Enable auto-merge on the repo (`Settings → General → Pull\n Requests → Allow auto-merge`). The routine sets\n `gh pr merge --auto --squash`.\n- [ ] Update branch protection on `develop`: require **only** `ci-gate`\n as the status check. Remove the per-job required checks if any\n were configured before this change.\n- [ ] Verify the routine has the right GitHub token scopes:\n `contents:write` (push branch), `pull-requests:write` (open + auto-\n merge), `issues:write` (rolling issue comments). Read-only on\n everything else.\n- [ ] Dry-run twice manually before scheduling. Set `DRY_RUN=1` in the\n routine's env to print intended commands without pushing or\n calling `gh`.\n- [ ] Confirm the `review-fix-shipped` workflow file is present on\n `develop` (`.github/workflows/review-fix-shipped.yml`). It needs\n no extra setup; the default `GITHUB_TOKEN` has the required\n `issues:write` scope.\n\n## Cadence\n\nWeekdays only (Mon–Fri) at a fixed local hour. If commit volume on\n`develop` is low, drop to Mon / Wed / Fri. The routine no-ops cleanly\nwhen there are no new commits, so over-scheduling is not destructive —\njust noisy in the rolling issue.\n\n## Known tradeoffs\n\n- **Rolling issue grows forever.** Rotate quarterly: close the current\n issue, open `Daily code review — develop (QN YYYY)`. Add a step to the\n routine that opens a new issue once the active one passes 500\n comments.\n- **Doc PR still costs CI minutes** for `format-check`, `actionlint`,\n `audit`, and `ci-gate`. Acceptable — combined under a minute.\n- **Auto-merge requires green CI on `develop`'s protection rules.** If\n your protection rules require a CODEOWNERS approval, the routine's\n PRs sit until a human ack — defeats the daily cadence. Decide which\n matters more.\n\n## Related\n\n- Output dumps: `docs/daily-reviews/YYYY-MM-DD.md`\n- CI workflow: `.github/workflows/ci.yml`\n- Branch policy + workflow rules: `CLAUDE.md`, `CONTRIBUTING.md`\n# Docs review — system prompt\n\nSource-of-truth prompt for the scheduled remote agent that audits docs,\nplans, specs, and other prose in this repo for drift against the actual\ncodebase. The routine reads this file at the start of each run. Edit\nhere, commit on a topic branch, open a PR — the next run picks up the\nnew version after merge.\n\nSee [`README.md`](./README.md) for how the routine consumes this file,\nwhere outputs go, and how to evolve it.\n\n---\n\n# Role\n\nSenior technical writer + skeptical maintainer. Adversarial, not polite.\nYou exist to catch **drift** — places where prose claims something that\nthe current code, plan state, or repo reality no longer supports.\n\nYou are NOT reviewing code quality. You are NOT reviewing recent commits.\nYou are reviewing the **docs as they sit on `develop` right now** against\nthe **code as it sits on `develop` right now**.\n\n# Scope this run\n\n`develop` head SHA at the start of the run is your reference point. Audit\nevery Markdown file that meets ALL of the following:\n\n- Tracked by git (no `node_modules/`, no `dist/`, no `.worktrees/`,\n no `coverage/`, no `graphify-out/wiki/` — see exclusions below).\n- Lives in one of: repo root, `docs/`, `.claude/`, `.github/`,\n `examples/*/`, `scripts/` (READMEs only).\n- Is human-authored prose (skip generated API docs, see exclusions).\n\nFor each file, hold it up against the current source tree and flag any\n**deviation, stale entry, dead reference, or drift-prone quantitative\nclaim**. The findings table below enumerates exactly what to look for.\n\n## Hard exclusions (do NOT review)\n\n- `node_modules/**`, `dist/**`, `coverage/**`, `.worktrees/**`,\n `graphify-out/**` (regenerated artifact).\n- `docs/api/**` (TypeDoc-generated; drift here is a TypeDoc bug, not a\n prose bug).\n- `docs/daily-reviews/YYYY-MM-DD.md` (immutable snapshots; never edited).\n- `docs/archive/**` (frozen historical docs — drift is expected and\n intentional; see `docs/archive/README.md`). The only file under\n `docs/archive/` you may inspect is its own `README.md`, and only to\n cite as the archive convention when proposing an archive fix.\n- `CHANGELOG.md` and `.changeset/*.md` (changeset machinery owns these).\n- This file (`docs/docs-review-bot/PROMPT.md`) and its sibling\n `README.md` — meta-reviewing the reviewer is out of scope.\n\n## Quick orientation commands\n\n```bash\ngit fetch origin\ngit switch develop && git pull --ff-only origin develop\nHEAD_SHA=\"$(git rev-parse --short=7 HEAD)\"\ngit ls-files '*.md' \\\n | grep -Ev '^(node_modules|dist|coverage|\\.worktrees|graphify-out|docs/api|docs/daily-reviews|docs/docs-review-bot|docs/archive|CHANGELOG)' \\\n | grep -Ev '^\\.changeset/'\n```\n\nUse `rg` / `grep` to verify any symbol, path, command, or count a doc\nmentions. **Never assert drift without grepping for the referenced\nsymbol first.**\n\n# What to flag (severity rubric)\n\nSeverity tags: `[BLOCKER]` `[MAJOR]` `[MINOR]` `[NIT]`. Use the same\nshape as the daily code review so the auto-flip + tracker tooling stays\nuniform.\n\n| Severity | Use when… |\n| ------------ | ------------------------------------------------------------------------------------------------ |\n| `[BLOCKER]` | Doc actively misleads — claims something false that would break a user's setup or merge attempt. |\n| `[MAJOR]` | Drift between doc and code that a contributor would notice within ~1 session and waste time on. |\n| `[MINOR]` | Stale-but-harmless: outdated counts, completed roadmap rows still marked `[ ]`, dead pointers. |\n| `[NIT]` | Quantitative entries that get stale fast (e.g., \"16-row roadmap\") or relative-time references. |\n\n## Categories the bot MUST look for\n\n### 1. Code-vs-doc deviations (`[BLOCKER]` / `[MAJOR]`)\n\n- Doc references a file path that no longer exists (`grep -F` the path\n against `git ls-files`).\n- Doc references an exported symbol (function, class, type, const) that\n no longer exists in `src/` (`grep -nE 'export (class|function|const|type|interface) ' src/`).\n- Doc references a `package.json` script that no longer exists\n (`jq '.scripts | keys' package.json`).\n- Doc shows a code snippet whose import path / function signature\n diverges from the current source.\n- Doc claims a file is gitignored / untracked but `git ls-files` shows\n it tracked (or vice versa).\n- Doc claims a CI job / workflow / branch-protection rule exists but\n the corresponding `.github/workflows/*.yml` does not.\n- Doc references an npm dep version that diverges from the locked\n version in `package.json` / `package-lock.json`.\n\n### 2. Plans + specs hygiene (`[MAJOR]` / `[MINOR]`)\n\n- A row in `docs/plans/*.md` is marked `[ ]` (or \"in flight\") but a\n merged PR with a matching scope already shipped on `develop`.\n Cross-check via `git log --since=\"30 days ago\" --oneline -- src/`\n and the plan's \"What's already shipped\" section if present.\n- A plan claims \"shipped in #N\" but `gh pr view N --json state` reports\n anything other than `MERGED`.\n- A `docs/specs/*.md` describes a design that the implementation has\n diverged from — flag the symbol/file the spec names if it no longer\n matches.\n- A plan or spec has no date prefix in its filename\n (`YYYY-MM-DD-.md` is the convention from `CLAUDE.md`).\n- A plan that completed every row but isn't moved out of `docs/plans/`\n or marked complete in its own header. Preferred fix: archive via\n `git mv docs/plans/ docs/archive/` per the convention in\n `docs/archive/README.md` (banner + no body edits). Use the same\n archive fix for specs that have been superseded.\n- Two plan files cover the same scope (duplicate / superseded). Fix:\n archive the superseded one and link forward from its banner to the\n surviving plan.\n\n### 3. Stale quantitative entries (`[NIT]` by default, `[MINOR]` if load-bearing)\n\nThese are claims that get stale fast and should usually live in\nthe code or in `git log`, not in prose:\n\n- \"X-row roadmap\", \"N findings\", \"M open PRs\" — verify the count.\n- \"Last reviewed SHA\", \"as of YYYY-MM-DD\", \"in the last quarter\".\n- \"We have N skills / N needs / N events\" — verify against the actual\n registry / source.\n- File-size / bundle-size / line-count / coverage-percentage claims —\n re-check against `npm run analyze` or current source.\n- \"currently N changesets pending\" — check `ls .changeset/*.md`.\n\nFor each stale-quant finding, **propose either an update to the\ncurrent value OR a removal** (with the rationale \"would drift again\nin N weeks\"). Removal is usually the better fix.\n\n### 4. Open findings / open items / orphaned TODOs (`[MINOR]`)\n\n- Open `TODO` / `FIXME` / `XXX` / `HACK` markers inside doc files\n (`grep -nE '\\b(TODO|FIXME|XXX|HACK)\\b' docs/ *.md .claude/`) — list\n each with file:line, separate from code-side TODOs.\n- Open checkbox items (`- [ ]`) inside docs/plans that the run\n cross-referenced and could not match to a shipped PR.\n- \"TODO: write this section\" / \"(stub)\" / \"(WIP)\" sections in\n user-facing docs that have lingered for >30 days\n (use `git log --follow --diff-filter=A -- ` to date the file\n itself; if the section text is older than 30 days, flag it).\n\n### 5. Dead links + path drift (`[MINOR]`)\n\n- Markdown links to local paths (`](./foo/bar.md)`, `](../foo)`) where\n the target no longer exists.\n- Anchor links (`#some-section`) where the section heading no longer\n exists in the target file.\n- External URLs are out of scope (no network calls).\n\n### 6. Cross-doc contradictions (`[MAJOR]`)\n\n- Two docs assert different things about the same fact (e.g.,\n `README.md` says \"Node 20+\", `CLAUDE.md` says \"Node 22\"). Flag both\n locations.\n- A `feedback_*.md` / `project_*.md` memory file in `.claude/memory/`\n references a fact (file path, function name, label) that no longer\n matches reality. (Do NOT flag tone or opinion — only verifiable\n drift.)\n\n## Categories the bot MUST NOT flag\n\n- Style / grammar / Oxford-comma / line-length opinions.\n- Subjective \"this section could be clearer\" rewrites.\n- Anything in `node_modules/` or `dist/`.\n- Missing docs (\"we should document X\") — out of scope; the bot reviews\n what exists, not what's absent. Exception: if a recently-added public\n export has zero JSDoc AND no mention in `README.md` / matching spec,\n flag once as a single `[MINOR]` \"missing doc for new public surface\".\n\n# Process gates\n\n- If a doc references a workflow / file / job AND that target doesn't\n exist on `develop` AND the doc is in `README.md` / `CONTRIBUTING.md` /\n `STYLE_GUIDE.md` / `PUBLISHING.md` / `CLAUDE.md` → `[BLOCKER]`.\n- If a plan claims a row shipped without a PR ref AND no recent commit\n obviously matches → `[MAJOR]` \"unverifiable shipped claim\".\n- If `--no-verify` / `git push --force` / `Math.random()` / `Date.now()`\n appear in a code snippet inside any doc (other than as a counter-\n example labelled \"don't do this\") → `[BLOCKER]`. The snippets get\n copied; the patterns spread.\n\n# Rules\n\n- Cite `file:line` for every finding. Use `path/to/doc.md:42` for\n Markdown lines, never line-less.\n- Quote the exact prose. Show the fix as a diff or concrete snippet.\n- Verify before claiming. Run the relevant `grep` / `git ls-files` /\n `gh` command and only flag if the result confirms drift. If unsure,\n prefix the title with `unverified — ` and explain what would confirm\n it.\n- No praise. No \"nice doc!\" summaries. The reader wants the punch list.\n- After your top finding, write one paragraph:\n `Counter-argument to my own [BLOCKER]: `.\n Drop the finding if the counter holds.\n- Per-run cap: **40 findings**. If you'd exceed it, keep the highest\n severities, drop the rest, and add a footer line `Truncated at 40\n findings; additional candidates dropped (mostly ).`\n- Call out what you did NOT review (files skipped, areas the bot\n doesn't understand, generated assets).\n\n# Output format\n\nCompute a stable ID per finding before writing: `.`,\nwhere `idx` is 1-based within this run, assigned **after** counter-arg\npruning, in the priority order findings are written. Same convention as\nthe daily code-review bot — keeps any future ingest tooling uniform.\n\nPer finding (Markdown checklist item with embedded ID marker):\n\n````markdown\n# `docs-review-bot/` — scheduled docs-drift review routine\n\nSource files for the scheduled remote agent that audits `develop`'s\nprose (READMEs, plans, specs, contributor guides, memory files) for\ndrift against the actual codebase, then opens a dedicated GitHub issue\nper run with findings as checkbox items.\n\nSibling of `docs/review-bot/` — same skeleton, different target.\nWhere `review-bot/` reviews **code commits**, this routine reviews\n**docs as they sit on `develop` right now**.\n\n## Layout\n\n| File | Purpose |\n| ----------------------------- | -------------------------------------------------------- |\n| [`PROMPT.md`](./PROMPT.md) | System prompt the routine loads at the start of each run. |\n| [`README.md`](./README.md) | This file — routine setup, sinks, iteration workflow. |\n\n## Output sink\n\n**One fresh issue per run.** Title `Docs review — YYYY-MM-DD ()`,\nlabel `docs-review`. Body holds the full findings checklist + run footer.\nThe owner ticks checkboxes as fixes land and closes the issue when the\nlast item ships.\n\nRationale for \"issue per run\" (vs the rolling `#87` tracker the\ncode-review bot uses): doc drift is mostly self-contained and\ncloseable. A rolling tracker would balloon and obscure resolution\nstate. Each run's issue is a punch list with a clear \"done\" condition.\n\nIf a run finds zero drift, the routine does NOT open an empty issue —\nit appends a one-line \"clean run\" note to the most recent open\n`docs-review` issue (or logs and exits if none exists).\n\n## Setup checklist (one-time)\n\n- [ ] Add the `docs-review` label to the repo:\n ```bash\n gh label create docs-review --color BFD4F2 \\\n --description \"Findings from the scheduled docs-review routine\"\n ```\n (The prompt re-creates it on first run if missing — this just\n avoids the create call racing with the issue-open call.)\n- [ ] Add `.docs-review-cache/` to `.gitignore` (one line). The\n routine writes a per-run body file there on failure so you can\n re-submit by hand.\n- [ ] Verify the routine's GitHub token scopes:\n `issues:write` (open issues, comment, label) and `contents:read`\n (clone + git ops). No write scope on `contents:` — the routine\n never pushes a branch.\n- [ ] Dry-run once with `DRY_RUN=1` set in the routine's env. The\n prompt's Persistence section (see `PROMPT.md` → \"Dry-run mode\")\n guards every `gh issue create`, `gh issue comment`, and\n `gh label create` call behind a `DRY_RUN` check; in dry-run\n mode each is replaced by a stdout dump of the would-be call +\n body, and no `.docs-review-cache/FAILED-*.md` file is written.\n Read-only `gh issue list` / `gh api .../comments` calls still\n run.\n\n## Routine wrapper prompt (paste into the routine)\n\nThe routine itself only needs a tiny wrapper that points at this file\nand lets the system prompt do the heavy lifting. Paste this exact text\ninto the routine's `events[].data.message.content` (one user message):\n\n> You are running the scheduled docs-review routine for the\n> `agentonomous` repo.\n>\n> Steps:\n>\n> 1. Clone / refresh the repo on `develop`:\n> `git fetch origin && git switch develop && git pull --ff-only origin develop`\n> 2. Read the system prompt at `docs/docs-review-bot/PROMPT.md` and\n> follow it verbatim. That file is the source of truth for what\n> to flag, the severity rubric, output format, and persistence\n> rules. Do not re-derive any of that from this message.\n> 3. After running the audit and opening (or commenting on) the\n> `docs-review` issue per the prompt's persistence section, exit\n> cleanly. Do NOT open a PR. Do NOT push to any branch. Do NOT\n> edit any docs directly.\n>\n> If `docs/docs-review-bot/PROMPT.md` does not exist on `develop` for\n> some reason, abort with a clear error — do not improvise a review\n> without the prompt.\n\nThat wrapper is intentionally short. The system prompt is versioned\nin-repo so changes go through PR review like any other doc change —\nthe routine itself doesn't need to be re-edited every time the prompt\nevolves.\n\n## Cadence\n\nRecommended: **weekly, Monday morning**. Doc drift is slow; daily would\nbe noisy. A reasonable cron in UTC:\n\n- `0 7 * * 1` — every Monday at 07:00 UTC (09:00 Europe/Berlin).\n\nIf the project gets quiet for a stretch, the routine will mostly emit\nclean runs (one-line comments on the prior issue). That's fine —\nsilence is the desired state. If activity ramps back up after a long\ngap, switch to weekdays for a sprint, then drop back to weekly.\n\n## Iteration workflow (changing the prompt)\n\nThe prompt evolves as you discover false positives, missed categories,\nor output-format pain. To change it:\n\n1. Cut a topic branch from `develop`\n (`docs/docs-review-prompt-tweak` or similar).\n2. Edit [`PROMPT.md`](./PROMPT.md). Keep section structure stable so\n the routine doesn't break on a missing header.\n3. Open a PR against `develop`. Doc-only diff → CI short-circuits\n to `ci-gate` only (~1 minute).\n4. After merge, the next scheduled run picks up the new prompt.\n\n## Known tradeoffs\n\n- **Issue-per-run can pile up if findings aren't worked.** Mitigation:\n the bot only opens a NEW issue when there is at least one finding\n AND no prior open issue covers the same ``. Stale issues\n on older SHAs accumulate visibly in the `docs-review` label view —\n treat that as the signal to triage.\n- **Prose is fuzzier than code.** Expect more `unverified — ` prefixes\n than the daily code-review bot emits. The 40-finding cap exists to\n keep runs readable when the prompt over-fires.\n- **The bot doesn't fix anything.** Findings are picked up manually\n (or via a future `docs-review-fix` skill mirroring `review-fix`).\n Don't expect auto-PRs.\n- **Quantitative entries get re-flagged each run if not removed.**\n That's by design — the prompt prefers removal to update for stats\n that drift again every release. Tick the box and remove the prose;\n don't tick the box and patch the number.\n- **Completed plans should be archived, not patched.** When the bot\n flags a plan whose rows have all shipped, prefer\n `git mv docs/plans/ docs/archive/` + the one-line\n archived banner over keeping it in the active set. The\n `docs/archive/` folder skips review entirely so drift there is\n intentional, not a recurring finding.\n\n## Related\n\n- Sibling routine: `docs/review-bot/` (daily code review of `develop`\n commits, dual sink: rolling issue `#87` + committed daily docs).\n- Archive folder for retired plans + specs: `docs/archive/`\n (`docs/archive/README.md` describes the archive convention the bot\n recommends as a fix for completed-plan findings).\n- Skill that turns code-review findings into worktrees + plans:\n `.claude/skills/review-fix/SKILL.md`. A future `docs-review-fix`\n skill could do the equivalent for `docs-review` issues; not yet\n built.\n- Branch / changeset / verify policy that the prompt's process gates\n reference: `CLAUDE.md`, `CONTRIBUTING.md`, `STYLE_GUIDE.md`.\n","/bin/bash -lc \"sed -n '1,220p' docs/review-bot/PROMPT.md; sed -n '1,220p' docs/review-bot/README.md; sed -n '1,220p' docs/docs-review-bot/PROMPT.md; sed -n '1,220p' docs/docs-review-bot/README.md\"",[768,769,770,771],"93076",{"_476":778,"_177":502,"_160":779,"_91":500},{"_476":776,"_177":498,"_160":777,"_91":500},{"_476":774,"_177":502,"_160":775,"_91":500},{"_476":772,"_177":498,"_160":773,"_91":500},"sed -n '1,220p' docs/docs-review-bot/README.md","docs/docs-review-bot/README.md","sed -n '1,220p' docs/docs-review-bot/PROMPT.md","docs/docs-review-bot/PROMPT.md","sed -n '1,220p' docs/review-bot/README.md","docs/review-bot/README.md","sed -n '1,220p' docs/review-bot/PROMPT.md","docs/review-bot/PROMPT.md",{"_436":781,"_423":424,"_438":426},{"_520":782,"_467":760,"_41":-5,"_177":522,"_523":-5,"_91":524},"{\"cmd\":\"sed -n '1,220p' docs/review-bot/PROMPT.md; sed -n '1,220p' docs/review-bot/README.md; sed -n '1,220p' docs/docs-review-bot/PROMPT.md; sed -n '1,220p' docs/docs-review-bot/README.md\"}",{"_436":784,"_423":424,"_438":426},{"_439":-5,"_455":785,"_41":-5,"_457":786,"_91":459},"gAAAAABp7f302qY9SmmKyjvdvl9uaoanOcUe3iLLG4sG8E5fNZmfPJ-74ItJeeIDWg-IFlpogjpFJmrE50Li3g9UzUry51vurE2F6S26lDTQ3NbyFBoGnHu22-vKS-As4QFKWD50-sd9agJzJZr4FXfJ8iHEomeUTmkw0gzeVqRROlpx_HCOy0pRuW-8QrZjRQ16aECuoYi0Y4HTwDHH6BTRorkyA4LNb00pVw9T7e58CpuMW00ofCaNrN7ZJjHN03kfUZ3ReZJ2aMLuID6i9WkCuHfsIEdDgE5HPpSnX5Mj_x09ihXw37_4-VrnJkoKO3u3q9STWadeDw7kMl9VdPPTN4atUiMfUSQVqCG0K2iAAEnYD67PY0TXp4hJre0gPUZWWeASeXa74RcYqnBhmx6ikERmA7u4hF9CA1X9nahh9mJYltgGHbq6jEpU7T7vP9DXU_vBt-NVHQT7vDvv9rBbQKZnwMcO640lXYgJq5GbjPvTWBuyPYpm-wBZGDlXQ8G0glvZFfH2nbgbhrvCmGTlILtuu7TT7Yem7S5_D3LNX9GjEY3hrt3w-TMxKlUeoFcyNT1BcfvPDc4nf6jh7um5vMZbtph0J8H-7okKMnr03iDnTeWII2Lba5h6QO1PVzgGJeutI9sP-5Lelx1AlZ7BU7ry3SlWo-e96aSrsmKbjdC9XsbVmxjWzpPBPXzo6XIIRzpAGmadvCoGcv7tix-paWeuGMnrtjNeQxQGhQi5vK-h_uWDIdag0wD1CWMPBHYFNkSudsAQP5SUZSg71bzP2zphMilXMFJac0ePQFU2-nAP9O79hzyn7dhOzDpPcO2GqzHY4g02oWNfNxPrGiaBNZ45feN3Bm1ibAAedD4zJ-tB8lGcfMZHk4ta5bRmZxtcXZ5_w1dhlBR6qhoHWcrsuxwrMB7ZgZeo1WfvPl_4dnqHtzGSyUwSZKy-JFosNLvQwygEAwtoKAB7imoDhK8HAWqHU1J748ZY6KqOGWUQwKYdb9yNW0beZYCJ4HDYUeE82unrqWxPMLMbQ-_rlUPe3Bx718KZr4ZhRJpdzeC8tr5RZ4fGYzmt3L54n1HCqDutwMVrW8ubwpseVrhQpEiJGG4l1Z-7syC8dGrOIu4uDQCh3--Hd6yIMd3v1vmJq5q4JWtVo9MHbBG5CuXIg4gkyoRBBTNqA2oA55IuupZUyyuQjszTyWOibxLj1AegZTt4aZAGGZNavgfcQAW51ZtivdAmCIgvdw==",[],{"_436":788,"_423":424,"_438":426},{"_439":789,"_41":790,"_457":791,"_91":459},[],"rs_070839e6b368ee020169edfdf37a2881909275c5ad9786680d",[],{"_436":793,"_423":424,"_438":426},{"_467":794,"_469":795,"_91":471},"call_AsgbGMGZoC88OhoxFOKZ57Gu","Chunk ID: 57b65b\nWall time: 0.3438 seconds\nProcess exited with code 0\nOriginal token count: 11\nOutput:\nb25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61\n",{"_436":797,"_423":424,"_438":426},{"_474":798,"_476":799,"_478":800,"_480":481,"_482":801,"_483":31,"_41":794,"_484":802,"_486":487,"_429":112,"_91":488},"b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61\n","/bin/bash -lc \"git ls-remote https://github.com/github/codeql-action refs/tags/v4 | awk '{print \"'$1}'\"'\"",[803],343,"91175",{"_476":804,"_91":580},"git ls-remote https://github.com/github/codeql-action refs/tags/v4 | awk '{print $1}'",{"_436":806,"_423":424,"_438":426},{"_520":807,"_467":794,"_41":-5,"_177":522,"_523":-5,"_91":524},"{\"cmd\":\"git ls-remote https://github.com/github/codeql-action refs/tags/v4 | awk '{print $1}'\"}",{"_436":809,"_423":424,"_438":426},{"_439":-5,"_455":810,"_41":-5,"_457":811,"_91":459},"gAAAAABp7f3xQF5PgHjSt0pKvE_Fzi0yROyf88UswsymZIRLw4X-85eV8iDSQrEHUXsMxUA6viHZMxYLfVpmfAcuYV9_Z2PzrHbsyE5_6zB2u78-roip4Az_GxJlvHenhNBql9PQWBtEgIYtq_4ggsCxEw34MFNBjJLTWlG9KvLsTkgS2ZH2EHghsE3dYcwWwrBhjVAuCG_cpXm3Lowt8akkOvJI2gvmKtgShvccFXV38Yv8yOLolvMQGMK41ceZWVBFiKVYmmA6gMG4G5pm8s8B7DcJf-tdBW3NpCJR1saTN_6pIwCnzx0wPLmca7rBa23SaL55zIyhUFTCtuWFo4QvRukMkTVWSi6M6HLG5PVSTOYi6zbbtfFroti6cdro9zN9O6cqbp6H0NTZOAOU47BkkhlDi_sNRgCLMkBmQm3Vq9Dk28bS09sscJ05Z76W89ZEJ25X1NxEsVj3URm4kDllIOPN_vvyn4DrylIcg4QQyf0cLYBXjk-CHyPpPBaUWNgROt0XTD_4OAHp1gUzltTDEf7xb2cGtL1wZcqSBkhq_B-dDJQdPt8egEc4go_W7dSzAsr2S4CViU7tIUGU3seJOvGnbNnoNUywQMD7M7XMnC-QEth89AKK5U2TnMKzMTh4_T4YCl8CnxzQmUWiZpdInkRfUv36VvMMO_CT__RKQJEsfnJRCO9YT69H0HHWpxgzkDOVA48tiyLcPSYXDuOniSR_9SszeU7OdjQDuS2j5df86QM_tc3PV5PMhvmTbQEipJAMH_f0eRj4tYLgLD3PWiKiwENZT4IXgwAYIx8FUlB0I6Fvo1FKq5Ngv2xJKcnEapDab7QM8jW-Jmp56RocMiscc4jgKfnmTXLq6yoox9T3hXGm6JC6gOHKMrc_rizn9sCJxje56PH7I-1PFpmX_gXul8I094zX2ziokuDAopSX90adCpJ2QWqECPyvKZ8ijPffiTROZsHmErCa0bcUcl8M008Y3g_71bRNh6T9veBNoKVseNHKB1LAYY_bTYk-KcJGJDAPyb2ki_Jil9w7N3vskH0fQiK8lQ3jeNxBtUtZiv12tIkaDNPVYSQfH_Z5qzllVEAmD12f5JMfWxplHw6KLeqQkzOiXfW39Gs-94TrylLuxrM=",[],{"_436":813,"_423":424,"_438":426},{"_439":814,"_41":815,"_457":816,"_91":459},[],"rs_070839e6b368ee020169edfdf0ab2c81908faf4e8aa129a154",[],{"_436":818,"_423":424,"_438":426},{"_467":819,"_469":820,"_91":471},"call_ikK0gI30i1bmiVg9z5aNmqlv","Chunk ID: f070f2\nWall time: 0.0000 seconds\nProcess exited with code 127\nOriginal token count: 11\nOutput:\n/bin/bash: line 1: gh: command not found\n",{"_436":822,"_423":424,"_438":426},{"_474":823,"_476":824,"_478":825,"_480":481,"_482":31,"_483":651,"_41":819,"_484":826,"_486":487,"_429":653,"_91":488},"/bin/bash: line 1: gh: command not found\n","/bin/bash -lc \"gh api repos/github/codeql-action/git/refs/tags/v4 --jq '.object.sha' && gh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'\"",[827],"31342",{"_476":828,"_91":580},"gh api repos/github/codeql-action/git/refs/tags/v4 --jq '.object.sha' && gh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'",{"_436":830,"_423":424,"_438":426},{"_520":831,"_467":819,"_41":-5,"_177":522,"_523":-5,"_91":524},"{\"cmd\":\"gh api repos/github/codeql-action/git/refs/tags/v4 --jq '.object.sha' && gh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'\"}",{"_436":833,"_423":424,"_438":426},{"_439":-5,"_455":834,"_41":-5,"_457":835,"_91":459},"gAAAAABp7f3uINKllWAhQ86DadVK7leIu3oZAIp83V8hnB-KLQi60vaHM9qHr3P4DS4QcB_CMU2otKmcM5dIEbIs2m_jfrVugZaAC9rn8dUSZp3l0Lt_Xi__8aLinEzW0Awu7g4m3nCL_TRtrfUx1LfsFkjuY0d7kd_SrTv3fg7zGZhMkLjLNskf3xUAX1vGuOJ_vR6SsCrrMgh3PbkfO1u79z3JNaAjyV_okJeIXU24pwZuDk4KEZgCjLpwLfC1v3LT0GGUImoDPkqPoAnx3-5eRpbfRDhhdv8URO20mjw0L2f9glcQCg9EJnAzymJw50kFXW89P0lpvkP1wOI7gPQzz6F-nP5lEWi4zB5WW75LRriZW-Prcjn_GH0aKy7mH9VlE5_gToEhjDDmfMQHizjqOksfc-n8HkqZvGEPRXvw7ob_pIt0sF58aJhWz2kfFgIY7DPtfCdl285mO2Sj3ZZ6aViIMFYrP_cvnryTsuasau4C7AIDnQYKCds2O96xDaUq03tl6whzb6JqtsxE3GK0oDhKmU0CgJ9U0yNfvrS_kclEwfaLkpwKfmZpgmkq4hFCZ_yb4TDoOldU2Fm_BVlk4kmk0NOk4WPirIRxL9leThiAeRHP9Dv9z__v60xgxZkOKhUO24KnEJS9zvkYC6Im9FsHPCS4hPvl-oNkeUi8M8zsEbxBLa5GmYkza7ZtRYGaljvCufaVL5uDa5g33Ace1v5D_TGO1D01mPyOfOGVRLWwP6EbVrwXnWcRWFmGs40kCTzlHPquW1DYmN3IF-CjmYHul5UK11uH6N5xxD4VShtQsHYsqhsUXAZ8AeizsIVTuwjGfa2Yi7UoUbIgFkFVgxU1gqYRUjM9gLH-71IV_2QHyZ45xbk4xoMK1flPetpbMsPLY5WLXsGPZPDBDg2OMregXMBSagYKeGXQE-AbZG-wihu9nfsem8NZoJMXVVEHeFiNBFhWaaGZOM_lO3_FqPE4aLJW3FYFM8FQ2MFBono_RoEhl2ZrsaMXzf0x6Hqk6ffjBGEC9CEF1To23Y3IEdo0wAdhvVDTl9Jb45sq0-I3LVAZkmjpKxywGi_HnsHgYfogdnXLpWHrVLEu4XaPLcD7XFCH2fvdiEwVCgnuMUXSzWa_ndYA4moIRii07eugFo2SiTSWx3G2UuYr9KDcZpl8QdY4QTTb5uYDiZTdv51ytK8jvLDFkalMOznDm346L8AQaTdGbXGHKMUD5tdtzEJy51dqpo3sIPNXxTMR0dW3Xl_tgc7EBROaP9kbSQROm7T0HdTuNWQsqN9OlPVLUIIvTpLdOwgZ0UObVGByRk2z7VXIIsXvoHcAUJ8sl4o90lPYYHrBN0ghtkrlMTxYB8z_CZUxGoilGzYpsL3C8uzEbzXfgBiUmr0M0GiYlTL7Y7nh01Ta4DjuPRiUchbZcXR0IZ4-M2WDFitDiODwcz4cR91CAygSJ3R0yl_eo_dL0CZB0qFzHE60CJLm2IJ0CWFrog1fDogDxAgyfPiqrzfpEmf-p64XOmjtzyMAJYLHlNPDXHKxMKyn0M2dTclkP1C5VwAFzwqrSdIYQjicKgaWgAKc9uexM9wTrgHqa3x9clTha13mqprFuxSezxlER2FIXqqyAEgcIeewIBJXxHdHPLDIBgWKHCDULGcXIX4nWtKnis4n1q1FwI50_o7HfYDe_qJCSjH4U15b1OXUAJdg44Bxte9fMTAUgV6gOcOZ0MIDDX_ceTtzSY-idkfnpK30m0fkxd8cmQJq5IchfzYRoQHzPhKCCI-NwGkS5YLn8kp6Eql9-NgJw4-ODbaQIS5NmAzvTGAh7_oy6xmmH_9T3wI5TL_lNl9ZUJAESAHF4WGYDiuqkK9REvXhtGelLclGaBkVMpbNX4uiSMtNZqHOdd2dV3cWwy0FMzBIGAlUm0JEefgpKBRFHTBC_5AVH8QGLIZen17JgtB-tbyIaodf5Uc5gNr1yho_H-Ao4OFYLlGfmSRy",[],{"_436":837,"_423":424,"_438":426},{"_439":838,"_41":839,"_457":840,"_91":459},[],"rs_070839e6b368ee020169edfdeb0a488190b1d63006802e8ceb",[],{"_436":842,"_423":424,"_438":426},{"_467":843,"_469":844,"_91":471},"call_dfOGeXHUIE5PBVIummXL7MZa","Chunk ID: 79ca8b\nWall time: 0.0000 seconds\nProcess exited with code 0\nOriginal token count: 4172\nOutput:\nci.yml\npages.yml\nrelease-candidate.yml\nrelease.yml\nreview-fix-shipped.yml\n# CI — runs on every push and PR to main, develop, and demo.\n#\n# Static checks (format, lint, typecheck, workflow lint, audit) run in\n# parallel for fast feedback. Tests depend on the static gate passing.\n# Build + bundle-size budget runs last. Mirrors the `npm run verify`\n# pre-PR gate; `audit` blocks on `high`-severity vulnerabilities in\n# production deps to close the supply-chain hole.\n#\n# Action references are pinned to full 40-char commit SHAs with the\n# human-readable version as a trailing comment (supply-chain hardening\n# per `docs/plans/2026-04-25-comprehensive-polish-and-harden.md` row 3).\n# Run `node scripts/bump-actions.mjs` to print pending bumps; never edit\n# the SHA without re-resolving via `gh api`.\n\nname: CI\n\non:\n push:\n branches: [main, develop, demo]\n pull_request:\n branches: [main, develop, demo]\n\nconcurrency:\n group: ci-${{ github.ref }}\n cancel-in-progress: true\n\npermissions:\n contents: read\n\njobs:\n changes:\n name: Detect changed paths\n runs-on: ubuntu-latest\n permissions:\n contents: read\n pull-requests: read\n outputs:\n code: ${{ steps.filter.outputs.code }}\n steps:\n # Inline path filter via the GitHub API. Replaces\n # `dorny/paths-filter@v3` (still pinned to Node 20 — emits a\n # deprecation annotation on every run with no Node 24 release\n # available). For non-PR events (push to main/develop/demo) we\n # always treat the change as code-touching and run the full gate.\n - name: Filter paths (code vs docs-only)\n id: filter\n env:\n GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n shell: bash\n run: |\n set -euo pipefail\n if [ \"$GITHUB_EVENT_NAME\" != \"pull_request\" ]; then\n echo \"Non-PR event ($GITHUB_EVENT_NAME) — defaulting code=true.\"\n echo \"code=true\" >> \"$GITHUB_OUTPUT\"\n exit 0\n fi\n pr_number=\"${{ github.event.pull_request.number }}\"\n changed=$(gh api --paginate \"repos/$GITHUB_REPOSITORY/pulls/$pr_number/files\" --jq '.[].filename')\n echo \"Changed files in PR #$pr_number:\"\n printf '%s\\n' \"$changed\"\n if printf '%s\\n' \"$changed\" | grep -E '^(src/|tests/|examples/|scripts/|\\.github/workflows/|package(-lock)?\\.json|tsconfig[^/]*\\.json|vite\\.config\\.|vitest\\.config\\.|eslint\\.config\\.|typedoc\\.json)' >/dev/null; then\n echo \"code=true\" >> \"$GITHUB_OUTPUT\"\n else\n echo \"code=false\" >> \"$GITHUB_OUTPUT\"\n fi\n\n format-check:\n name: Format (Prettier)\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n - name: Check formatting\n run: npm run format:check\n\n lint:\n name: Lint (ESLint)\n needs: changes\n if: needs.changes.outputs.code == 'true'\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n - name: Run ESLint\n run: npm run lint\n\n typecheck:\n name: Typecheck (tsc --noEmit)\n needs: changes\n if: needs.changes.outputs.code == 'true'\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n - name: Run TypeScript compiler\n run: npm run typecheck\n\n actionlint:\n name: Lint workflows (actionlint)\n runs-on: ubuntu-latest\n permissions:\n contents: read\n checks: write\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Run actionlint\n uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0\n with:\n fail_level: error\n reporter: github-check\n\n audit:\n name: Audit production deps (npm audit)\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n - name: Audit production dependencies (high severity blocks)\n run: npm audit --omit=dev --audit-level=high\n\n docs:\n name: API docs (typedoc)\n needs: changes\n if: needs.changes.outputs.code == 'true'\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n # Typedoc runs as a wiring/coverage check — a clean generation\n # proves every exported symbol is reachable and documented.\n # The generated `docs/api/` is regenerated on demand locally; we\n # do not consume the artifact in CI, so skip the upload step.\n - name: Generate API docs (typedoc)\n run: npm run docs\n\n # Vitest split into two jobs (row 4 of the polish-and-harden roadmap):\n #\n # - `test-core` runs the FULL vitest suite (with coverage) on the OS\n # matrix. Coverage upload still happens here once per push because\n # `test-tfjs` re-runs the same tfjs files under different backends\n # and would only inflate runtime, not coverage.\n # - `test-tfjs` runs ONLY `tests/**/cognition/adapters/tfjs/**` under the\n # `cpu` × `wasm` backend axis. The matrix-selected backend is\n # activated by `tests/setup/tfjsBackendSetup.ts` via the\n # `TFJS_BACKEND` env var (see `tests/setup/tfjsBackend.ts`).\n #\n # `tests/examples/learningMode.train.test.ts` deliberately stays out\n # of `test-tfjs`: the demo's switcher probes cpu first then promotes\n # the persisted backend, so under `TFJS_BACKEND=wasm` the suite still\n # exercises the cpu-fallback flow (the demo's intended user path).\n # Adding it to the wasm cell would burn runtime without catching new\n # regressions; reasoner-level wasm coverage already lives in\n # `tests/unit/cognition/adapters/Tfjs*.test.ts`.\n #\n # `fail-fast: false` keeps platform-specific failures from suppressing\n # other cells — a windows-only flake should not hide a wasm-only one.\n test-core:\n name: Test core (Vitest, ${{ matrix.os }})\n runs-on: ${{ matrix.os }}\n needs: [changes, format-check, lint, typecheck, actionlint, audit, docs]\n if: needs.changes.outputs.code == 'true'\n strategy:\n fail-fast: false\n matrix:\n os: [ubuntu-latest, macos-latest, windows-latest]\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n # Coverage runs on ubuntu only (the report is identical across\n # OSes; running v8 coverage on every cell triples test runtime\n # for no signal). Other cells run the same tests without the\n # coverage instrumentation overhead.\n - name: Run Vitest with coverage\n if: matrix.os == 'ubuntu-latest'\n run: npm run test:coverage\n - name: Run Vitest\n if: matrix.os != 'ubuntu-latest'\n# Dependabot — automated dependency updates.\n#\n# Keeps npm + GitHub Actions deps fresh so the next runtime/runner\n# deprecation doesn't catch CI cold. PRs target `develop`; review\n# follows the same rules as any topic branch.\n\nversion: 2\nupdates:\n # Library package + devDependencies.\n - package-ecosystem: npm\n directory: /\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 5\n labels:\n - dependencies\n commit-message:\n prefix: chore(deps)\n prefix-development: chore(deps-dev)\n include: scope\n groups:\n dev-dependencies:\n dependency-type: development\n update-types:\n - minor\n - patch\n\n # Demo example (workspace-local, consumes the built library).\n - package-ecosystem: npm\n directory: /examples/nurture-pet\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 3\n labels:\n - dependencies\n - demo\n commit-message:\n prefix: chore(demo-deps)\n include: scope\n\n # GitHub Actions — batched so a runner-deprecation sweep (e.g. Node 20\n # → 24) lands as one PR, not one-per-workflow.\n - package-ecosystem: github-actions\n directory: /\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 3\n labels:\n - dependencies\n - ci\n commit-message:\n prefix: chore(ci)\n include: scope\n groups:\n actions:\n patterns:\n - '*'\n{\n \"name\": \"agentonomous\",\n \"version\": \"0.0.0\",\n \"description\": \"Autonomous agent library for TypeScript simulations, engine-agnostic.\",\n \"type\": \"module\",\n \"license\": \"MIT\",\n \"author\": \"luis85\",\n \"repository\": {\n \"type\": \"git\",\n \"url\": \"git+https://github.com/luis85/agentonomous.git\"\n },\n \"bugs\": {\n \"url\": \"https://github.com/luis85/agentonomous/issues\"\n },\n \"homepage\": \"https://github.com/luis85/agentonomous#readme\",\n \"sideEffects\": false,\n \"engines\": {\n \"node\": \">=22\"\n },\n \"main\": \"./dist/index.js\",\n \"module\": \"./dist/index.js\",\n \"types\": \"./dist/index.d.ts\",\n \"exports\": {\n \".\": {\n \"import\": \"./dist/index.js\",\n \"types\": \"./dist/index.d.ts\"\n },\n \"./integrations/excalibur\": {\n \"import\": \"./dist/integrations/excalibur/index.js\",\n \"types\": \"./dist/integrations/excalibur/index.d.ts\"\n },\n \"./cognition/adapters/mistreevous\": {\n \"import\": \"./dist/cognition/adapters/mistreevous/index.js\",\n \"types\": \"./dist/cognition/adapters/mistreevous/index.d.ts\"\n },\n \"./cognition/adapters/js-son\": {\n \"import\": \"./dist/cognition/adapters/js-son/index.js\",\n \"types\": \"./dist/cognition/adapters/js-son/index.d.ts\"\n },\n \"./cognition/adapters/tfjs\": {\n \"import\": \"./dist/cognition/adapters/tfjs/index.js\",\n \"types\": \"./dist/cognition/adapters/tfjs/index.d.ts\"\n },\n \"./package.json\": \"./package.json\"\n },\n \"files\": [\n \"dist\",\n \"README.md\",\n \"LICENSE\"\n ],\n \"scripts\": {\n \"build\": \"vite build\",\n \"test\": \"vitest run\",\n \"test:watch\": \"vitest\",\n \"test:coverage\": \"vitest run --coverage\",\n \"coverage:report\": \"node scripts/coverage-pr-comment.mjs --render-only\",\n \"typecheck\": \"tsc --noEmit\",\n \"lint\": \"eslint .\",\n \"lint:fix\": \"eslint . --fix\",\n \"format\": \"prettier --write .\",\n \"format:check\": \"prettier --check .\",\n \"docs\": \"typedoc\",\n \"analyze\": \"npm run build && du -sh dist && find dist -name '*.js' -not -path '*.d.*' -exec wc -c {} + | sort -rn | head -20\",\n \"changeset\": \"changeset\",\n \"release\": \"changeset publish\",\n \"prepare\": \"husky\",\n \"verify\": \"npm run format:check && npm run lint && npm run typecheck && npm run test && npm run build && npm run docs\",\n \"prepublishOnly\": \"npm run verify\",\n \"pack:dry\": \"npm pack --dry-run\",\n \"size\": \"npm run build && size-limit\",\n \"size:why\": \"npm run build && size-limit --why\",\n \"demo:install\": \"npm install && npm run build && cd examples/nurture-pet && npm install\",\n \"demo:dev\": \"cd examples/nurture-pet && npm run dev\",\n \"demo:build\": \"npm run build && cd examples/nurture-pet && npm run build\",\n \"seed:learning-network\": \"node --experimental-strip-types scripts/seed-learning-network.ts\"\n },\n \"publishConfig\": {\n \"access\": \"public\",\n \"provenance\": true\n },\n \"keywords\": [\n \"agent\",\n \"autonomous\",\n \"simulation\",\n \"nurture\",\n \"virtual-pet\",\n \"ecs\",\n \"excalibur\",\n \"sim-ecs\",\n \"typescript\"\n ],\n \"devDependencies\": {\n \"@changesets/cli\": \"^2.31.0\",\n \"@eslint/js\": \"^10.0.1\",\n \"@size-limit/file\": \"^12.1.0\",\n \"@tensorflow/tfjs-backend-cpu\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-wasm\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-webgl\": \"^4.22.0\",\n \"@tensorflow/tfjs-core\": \"^4.22.0\",\n \"@tensorflow/tfjs-layers\": \"^4.22.0\",\n \"@types/node\": \"^25.6.0\",\n \"@vitest/coverage-v8\": \"^4.1.4\",\n \"eslint\": \"^10.2.1\",\n \"eslint-config-prettier\": \"^10.1.8\",\n \"excalibur\": \"^0.32.0\",\n \"husky\": \"^9.1.7\",\n \"js-son-agent\": \"^0.0.17\",\n \"jsdom\": \"^29.0.2\",\n \"lint-staged\": \"^16.4.0\",\n \"mistreevous\": \"^4.3.1\",\n \"prettier\": \"^3.8.3\",\n \"size-limit\": \"^12.1.0\",\n \"typedoc\": \"^0.28.19\",\n \"typescript\": \"^6.0.3\",\n \"typescript-eslint\": \"^8.58.2\",\n \"vite\": \"^8.0.8\",\n \"vite-plugin-dts\": \"^4.5.4\",\n \"vitest\": \"^4.1.4\"\n },\n \"peerDependencies\": {\n \"@anthropic-ai/sdk\": \"^0.91.0\",\n \"@tensorflow/tfjs-backend-cpu\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-wasm\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-webgl\": \"^4.22.0\",\n \"@tensorflow/tfjs-core\": \"^4.22.0\",\n \"@tensorflow/tfjs-layers\": \"^4.22.0\",\n \"excalibur\": \"^0.32.0\",\n \"js-son-agent\": \"*\",\n \"mistreevous\": \"^4.0.0\",\n \"openai\": \"^6.0.0\",\n \"sim-ecs\": \"^0.6.0\"\n },\n \"peerDependenciesMeta\": {\n \"@anthropic-ai/sdk\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-backend-cpu\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-backend-wasm\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-backend-webgl\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-core\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-layers\": {\n \"optional\": true\n },\n \"excalibur\": {\n \"optional\": true\n },\n \"js-son-agent\": {\n \"optional\": true\n },\n \"mistreevous\": {\n \"optional\": true\n },\n \"openai\": {\n \"optional\": true\n },\n \"sim-ecs\": {\n \"optional\": true\n }\n },\n \"size-limit\": [\n {\n \"name\": \"dist/index.js (gzip)\",\n \"path\": \"dist/index.js\",\n \"gzip\": true,\n \"limit\": \"50 KB\"\n },\n {\n \"name\": \"dist/integrations/excalibur/index.js (gzip)\",\n \"path\": \"dist/integrations/excalibur/index.js\",\n \"gzip\": true,\n \"limit\": \"2 KB\"\n },\n {\n \"name\": \"dist/cognition/adapters/mistreevous/index.js (gzip)\",\n \"path\": \"dist/cognition/adapters/mistreevous/index.js\",\n \"gzip\": true,\n \"limit\": \"2 KB\"\n },\n {\n \"name\": \"dist/cognition/adapters/js-son/index.js (gzip)\",\n \"path\": \"dist/cognition/adapters/js-son/index.js\",\n \"gzip\": true,\n \"limit\": \"2 KB\"\n },\n {\n \"name\": \"dist/cognition/adapters/tfjs/index.js (gzip)\",\n \"path\": \"dist/cognition/adapters/tfjs/index.js\",\n \"gzip\": true,\n \"limit\": \"9 KB\"\n }\n ],\n \"lint-staged\": {\n \"*.{ts,tsx,mjs,d.mts}\": [\n \"eslint --fix\",\n \"prettier --write\"\n ],\n \"*.{json,md,yml,yaml}\": [\n \"prettier --write\"\n ]\n }\n}\n{\n \"name\": \"nurture-pet-demo\",\n \"private\": true,\n \"version\": \"0.0.0\",\n \"type\": \"module\",\n \"description\": \"Nurture-pet MVP demo for the agentonomous library.\",\n \"scripts\": {\n \"dev\": \"vite --open\",\n \"build\": \"vite build\",\n \"preview\": \"vite preview\"\n },\n \"devDependencies\": {\n \"@tensorflow/tfjs-backend-cpu\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-wasm\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-webgl\": \"^4.22.0\",\n \"@tensorflow/tfjs-core\": \"^4.22.0\",\n \"@tensorflow/tfjs-layers\": \"^4.22.0\",\n \"js-son-agent\": \"^0.0.17\",\n \"mistreevous\": \"^4.3.1\",\n \"typescript\": \"^6.0.3\",\n \"vite\": \"^8.0.8\"\n }\n}\n",{"_436":846,"_423":424,"_438":426},{"_474":847,"_476":848,"_478":849,"_480":481,"_482":31,"_483":31,"_41":843,"_484":850,"_486":487,"_429":112,"_91":488},"ci.yml\npages.yml\nrelease-candidate.yml\nrelease.yml\nreview-fix-shipped.yml\n# CI — runs on every push and PR to main, develop, and demo.\n#\n# Static checks (format, lint, typecheck, workflow lint, audit) run in\n# parallel for fast feedback. Tests depend on the static gate passing.\n# Build + bundle-size budget runs last. Mirrors the `npm run verify`\n# pre-PR gate; `audit` blocks on `high`-severity vulnerabilities in\n# production deps to close the supply-chain hole.\n#\n# Action references are pinned to full 40-char commit SHAs with the\n# human-readable version as a trailing comment (supply-chain hardening\n# per `docs/plans/2026-04-25-comprehensive-polish-and-harden.md` row 3).\n# Run `node scripts/bump-actions.mjs` to print pending bumps; never edit\n# the SHA without re-resolving via `gh api`.\n\nname: CI\n\non:\n push:\n branches: [main, develop, demo]\n pull_request:\n branches: [main, develop, demo]\n\nconcurrency:\n group: ci-${{ github.ref }}\n cancel-in-progress: true\n\npermissions:\n contents: read\n\njobs:\n changes:\n name: Detect changed paths\n runs-on: ubuntu-latest\n permissions:\n contents: read\n pull-requests: read\n outputs:\n code: ${{ steps.filter.outputs.code }}\n steps:\n # Inline path filter via the GitHub API. Replaces\n # `dorny/paths-filter@v3` (still pinned to Node 20 — emits a\n # deprecation annotation on every run with no Node 24 release\n # available). For non-PR events (push to main/develop/demo) we\n # always treat the change as code-touching and run the full gate.\n - name: Filter paths (code vs docs-only)\n id: filter\n env:\n GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n shell: bash\n run: |\n set -euo pipefail\n if [ \"$GITHUB_EVENT_NAME\" != \"pull_request\" ]; then\n echo \"Non-PR event ($GITHUB_EVENT_NAME) — defaulting code=true.\"\n echo \"code=true\" >> \"$GITHUB_OUTPUT\"\n exit 0\n fi\n pr_number=\"${{ github.event.pull_request.number }}\"\n changed=$(gh api --paginate \"repos/$GITHUB_REPOSITORY/pulls/$pr_number/files\" --jq '.[].filename')\n echo \"Changed files in PR #$pr_number:\"\n printf '%s\\n' \"$changed\"\n if printf '%s\\n' \"$changed\" | grep -E '^(src/|tests/|examples/|scripts/|\\.github/workflows/|package(-lock)?\\.json|tsconfig[^/]*\\.json|vite\\.config\\.|vitest\\.config\\.|eslint\\.config\\.|typedoc\\.json)' >/dev/null; then\n echo \"code=true\" >> \"$GITHUB_OUTPUT\"\n else\n echo \"code=false\" >> \"$GITHUB_OUTPUT\"\n fi\n\n format-check:\n name: Format (Prettier)\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n - name: Check formatting\n run: npm run format:check\n\n lint:\n name: Lint (ESLint)\n needs: changes\n if: needs.changes.outputs.code == 'true'\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n - name: Run ESLint\n run: npm run lint\n\n typecheck:\n name: Typecheck (tsc --noEmit)\n needs: changes\n if: needs.changes.outputs.code == 'true'\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n - name: Run TypeScript compiler\n run: npm run typecheck\n\n actionlint:\n name: Lint workflows (actionlint)\n runs-on: ubuntu-latest\n permissions:\n contents: read\n checks: write\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Run actionlint\n uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0\n with:\n fail_level: error\n reporter: github-check\n\n audit:\n name: Audit production deps (npm audit)\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n - name: Audit production dependencies (high severity blocks)\n run: npm audit --omit=dev --audit-level=high\n\n docs:\n name: API docs (typedoc)\n needs: changes\n if: needs.changes.outputs.code == 'true'\n runs-on: ubuntu-latest\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n # Typedoc runs as a wiring/coverage check — a clean generation\n # proves every exported symbol is reachable and documented.\n # The generated `docs/api/` is regenerated on demand locally; we\n # do not consume the artifact in CI, so skip the upload step.\n - name: Generate API docs (typedoc)\n run: npm run docs\n\n # Vitest split into two jobs (row 4 of the polish-and-harden roadmap):\n #\n # - `test-core` runs the FULL vitest suite (with coverage) on the OS\n # matrix. Coverage upload still happens here once per push because\n # `test-tfjs` re-runs the same tfjs files under different backends\n # and would only inflate runtime, not coverage.\n # - `test-tfjs` runs ONLY `tests/**/cognition/adapters/tfjs/**` under the\n # `cpu` × `wasm` backend axis. The matrix-selected backend is\n # activated by `tests/setup/tfjsBackendSetup.ts` via the\n # `TFJS_BACKEND` env var (see `tests/setup/tfjsBackend.ts`).\n #\n # `tests/examples/learningMode.train.test.ts` deliberately stays out\n # of `test-tfjs`: the demo's switcher probes cpu first then promotes\n # the persisted backend, so under `TFJS_BACKEND=wasm` the suite still\n # exercises the cpu-fallback flow (the demo's intended user path).\n # Adding it to the wasm cell would burn runtime without catching new\n # regressions; reasoner-level wasm coverage already lives in\n # `tests/unit/cognition/adapters/Tfjs*.test.ts`.\n #\n # `fail-fast: false` keeps platform-specific failures from suppressing\n # other cells — a windows-only flake should not hide a wasm-only one.\n test-core:\n name: Test core (Vitest, ${{ matrix.os }})\n runs-on: ${{ matrix.os }}\n needs: [changes, format-check, lint, typecheck, actionlint, audit, docs]\n if: needs.changes.outputs.code == 'true'\n strategy:\n fail-fast: false\n matrix:\n os: [ubuntu-latest, macos-latest, windows-latest]\n steps:\n - name: Checkout repository\n uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n - name: Setup Node.js 22\n uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0\n with:\n node-version: 22\n cache: npm\n - name: Install dependencies (npm ci)\n run: npm ci\n # Coverage runs on ubuntu only (the report is identical across\n # OSes; running v8 coverage on every cell triples test runtime\n # for no signal). Other cells run the same tests without the\n # coverage instrumentation overhead.\n - name: Run Vitest with coverage\n if: matrix.os == 'ubuntu-latest'\n run: npm run test:coverage\n - name: Run Vitest\n if: matrix.os != 'ubuntu-latest'\n# Dependabot — automated dependency updates.\n#\n# Keeps npm + GitHub Actions deps fresh so the next runtime/runner\n# deprecation doesn't catch CI cold. PRs target `develop`; review\n# follows the same rules as any topic branch.\n\nversion: 2\nupdates:\n # Library package + devDependencies.\n - package-ecosystem: npm\n directory: /\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 5\n labels:\n - dependencies\n commit-message:\n prefix: chore(deps)\n prefix-development: chore(deps-dev)\n include: scope\n groups:\n dev-dependencies:\n dependency-type: development\n update-types:\n - minor\n - patch\n\n # Demo example (workspace-local, consumes the built library).\n - package-ecosystem: npm\n directory: /examples/nurture-pet\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 3\n labels:\n - dependencies\n - demo\n commit-message:\n prefix: chore(demo-deps)\n include: scope\n\n # GitHub Actions — batched so a runner-deprecation sweep (e.g. Node 20\n # → 24) lands as one PR, not one-per-workflow.\n - package-ecosystem: github-actions\n directory: /\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 3\n labels:\n - dependencies\n - ci\n commit-message:\n prefix: chore(ci)\n include: scope\n groups:\n actions:\n patterns:\n - '*'\n{\n \"name\": \"agentonomous\",\n \"version\": \"0.0.0\",\n \"description\": \"Autonomous agent library for TypeScript simulations, engine-agnostic.\",\n \"type\": \"module\",\n \"license\": \"MIT\",\n \"author\": \"luis85\",\n \"repository\": {\n \"type\": \"git\",\n \"url\": \"git+https://github.com/luis85/agentonomous.git\"\n },\n \"bugs\": {\n \"url\": \"https://github.com/luis85/agentonomous/issues\"\n },\n \"homepage\": \"https://github.com/luis85/agentonomous#readme\",\n \"sideEffects\": false,\n \"engines\": {\n \"node\": \">=22\"\n },\n \"main\": \"./dist/index.js\",\n \"module\": \"./dist/index.js\",\n \"types\": \"./dist/index.d.ts\",\n \"exports\": {\n \".\": {\n \"import\": \"./dist/index.js\",\n \"types\": \"./dist/index.d.ts\"\n },\n \"./integrations/excalibur\": {\n \"import\": \"./dist/integrations/excalibur/index.js\",\n \"types\": \"./dist/integrations/excalibur/index.d.ts\"\n },\n \"./cognition/adapters/mistreevous\": {\n \"import\": \"./dist/cognition/adapters/mistreevous/index.js\",\n \"types\": \"./dist/cognition/adapters/mistreevous/index.d.ts\"\n },\n \"./cognition/adapters/js-son\": {\n \"import\": \"./dist/cognition/adapters/js-son/index.js\",\n \"types\": \"./dist/cognition/adapters/js-son/index.d.ts\"\n },\n \"./cognition/adapters/tfjs\": {\n \"import\": \"./dist/cognition/adapters/tfjs/index.js\",\n \"types\": \"./dist/cognition/adapters/tfjs/index.d.ts\"\n },\n \"./package.json\": \"./package.json\"\n },\n \"files\": [\n \"dist\",\n \"README.md\",\n \"LICENSE\"\n ],\n \"scripts\": {\n \"build\": \"vite build\",\n \"test\": \"vitest run\",\n \"test:watch\": \"vitest\",\n \"test:coverage\": \"vitest run --coverage\",\n \"coverage:report\": \"node scripts/coverage-pr-comment.mjs --render-only\",\n \"typecheck\": \"tsc --noEmit\",\n \"lint\": \"eslint .\",\n \"lint:fix\": \"eslint . --fix\",\n \"format\": \"prettier --write .\",\n \"format:check\": \"prettier --check .\",\n \"docs\": \"typedoc\",\n \"analyze\": \"npm run build && du -sh dist && find dist -name '*.js' -not -path '*.d.*' -exec wc -c {} + | sort -rn | head -20\",\n \"changeset\": \"changeset\",\n \"release\": \"changeset publish\",\n \"prepare\": \"husky\",\n \"verify\": \"npm run format:check && npm run lint && npm run typecheck && npm run test && npm run build && npm run docs\",\n \"prepublishOnly\": \"npm run verify\",\n \"pack:dry\": \"npm pack --dry-run\",\n \"size\": \"npm run build && size-limit\",\n \"size:why\": \"npm run build && size-limit --why\",\n \"demo:install\": \"npm install && npm run build && cd examples/nurture-pet && npm install\",\n \"demo:dev\": \"cd examples/nurture-pet && npm run dev\",\n \"demo:build\": \"npm run build && cd examples/nurture-pet && npm run build\",\n \"seed:learning-network\": \"node --experimental-strip-types scripts/seed-learning-network.ts\"\n },\n \"publishConfig\": {\n \"access\": \"public\",\n \"provenance\": true\n },\n \"keywords\": [\n \"agent\",\n \"autonomous\",\n \"simulation\",\n \"nurture\",\n \"virtual-pet\",\n \"ecs\",\n \"excalibur\",\n \"sim-ecs\",\n \"typescript\"\n ],\n \"devDependencies\": {\n \"@changesets/cli\": \"^2.31.0\",\n \"@eslint/js\": \"^10.0.1\",\n \"@size-limit/file\": \"^12.1.0\",\n \"@tensorflow/tfjs-backend-cpu\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-wasm\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-webgl\": \"^4.22.0\",\n \"@tensorflow/tfjs-core\": \"^4.22.0\",\n \"@tensorflow/tfjs-layers\": \"^4.22.0\",\n \"@types/node\": \"^25.6.0\",\n \"@vitest/coverage-v8\": \"^4.1.4\",\n \"eslint\": \"^10.2.1\",\n \"eslint-config-prettier\": \"^10.1.8\",\n \"excalibur\": \"^0.32.0\",\n \"husky\": \"^9.1.7\",\n \"js-son-agent\": \"^0.0.17\",\n \"jsdom\": \"^29.0.2\",\n \"lint-staged\": \"^16.4.0\",\n \"mistreevous\": \"^4.3.1\",\n \"prettier\": \"^3.8.3\",\n \"size-limit\": \"^12.1.0\",\n \"typedoc\": \"^0.28.19\",\n \"typescript\": \"^6.0.3\",\n \"typescript-eslint\": \"^8.58.2\",\n \"vite\": \"^8.0.8\",\n \"vite-plugin-dts\": \"^4.5.4\",\n \"vitest\": \"^4.1.4\"\n },\n \"peerDependencies\": {\n \"@anthropic-ai/sdk\": \"^0.91.0\",\n \"@tensorflow/tfjs-backend-cpu\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-wasm\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-webgl\": \"^4.22.0\",\n \"@tensorflow/tfjs-core\": \"^4.22.0\",\n \"@tensorflow/tfjs-layers\": \"^4.22.0\",\n \"excalibur\": \"^0.32.0\",\n \"js-son-agent\": \"*\",\n \"mistreevous\": \"^4.0.0\",\n \"openai\": \"^6.0.0\",\n \"sim-ecs\": \"^0.6.0\"\n },\n \"peerDependenciesMeta\": {\n \"@anthropic-ai/sdk\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-backend-cpu\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-backend-wasm\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-backend-webgl\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-core\": {\n \"optional\": true\n },\n \"@tensorflow/tfjs-layers\": {\n \"optional\": true\n },\n \"excalibur\": {\n \"optional\": true\n },\n \"js-son-agent\": {\n \"optional\": true\n },\n \"mistreevous\": {\n \"optional\": true\n },\n \"openai\": {\n \"optional\": true\n },\n \"sim-ecs\": {\n \"optional\": true\n }\n },\n \"size-limit\": [\n {\n \"name\": \"dist/index.js (gzip)\",\n \"path\": \"dist/index.js\",\n \"gzip\": true,\n \"limit\": \"50 KB\"\n },\n {\n \"name\": \"dist/integrations/excalibur/index.js (gzip)\",\n \"path\": \"dist/integrations/excalibur/index.js\",\n \"gzip\": true,\n \"limit\": \"2 KB\"\n },\n {\n \"name\": \"dist/cognition/adapters/mistreevous/index.js (gzip)\",\n \"path\": \"dist/cognition/adapters/mistreevous/index.js\",\n \"gzip\": true,\n \"limit\": \"2 KB\"\n },\n {\n \"name\": \"dist/cognition/adapters/js-son/index.js (gzip)\",\n \"path\": \"dist/cognition/adapters/js-son/index.js\",\n \"gzip\": true,\n \"limit\": \"2 KB\"\n },\n {\n \"name\": \"dist/cognition/adapters/tfjs/index.js (gzip)\",\n \"path\": \"dist/cognition/adapters/tfjs/index.js\",\n \"gzip\": true,\n \"limit\": \"9 KB\"\n }\n ],\n \"lint-staged\": {\n \"*.{ts,tsx,mjs,d.mts}\": [\n \"eslint --fix\",\n \"prettier --write\"\n ],\n \"*.{json,md,yml,yaml}\": [\n \"prettier --write\"\n ]\n }\n}\n{\n \"name\": \"nurture-pet-demo\",\n \"private\": true,\n \"version\": \"0.0.0\",\n \"type\": \"module\",\n \"description\": \"Nurture-pet MVP demo for the agentonomous library.\",\n \"scripts\": {\n \"dev\": \"vite --open\",\n \"build\": \"vite build\",\n \"preview\": \"vite preview\"\n },\n \"devDependencies\": {\n \"@tensorflow/tfjs-backend-cpu\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-wasm\": \"^4.22.0\",\n \"@tensorflow/tfjs-backend-webgl\": \"^4.22.0\",\n \"@tensorflow/tfjs-core\": \"^4.22.0\",\n \"@tensorflow/tfjs-layers\": \"^4.22.0\",\n \"js-son-agent\": \"^0.0.17\",\n \"mistreevous\": \"^4.3.1\",\n \"typescript\": \"^6.0.3\",\n \"vite\": \"^8.0.8\"\n }\n}\n","/bin/bash -lc \"ls .github/workflows; sed -n '1,220p' .github/workflows/ci.yml; sed -n '1,220p' .github/dependabot.yml; sed -n '1,220p' package.json; sed -n '1,220p' examples/nurture-pet/package.json\"",[851,852,853,854,855],"62992",{"_476":864,"_160":865,"_91":866},{"_476":861,"_177":862,"_160":863,"_91":500},{"_476":860,"_177":513,"_160":514,"_91":500},{"_476":859,"_177":857,"_160":857,"_91":500},{"_476":856,"_177":857,"_160":858,"_91":500},"sed -n '1,220p' examples/nurture-pet/package.json","package.json","examples/nurture-pet/package.json","sed -n '1,220p' package.json","sed -n '1,220p' .github/dependabot.yml","sed -n '1,220p' .github/workflows/ci.yml","ci.yml",".github/workflows/ci.yml","ls .github/workflows","workflows","listFiles",{"_436":868,"_423":424,"_438":426},{"_520":869,"_467":843,"_41":-5,"_177":522,"_523":-5,"_91":524},"{\"cmd\":\"ls .github/workflows; sed -n '1,220p' .github/workflows/ci.yml; sed -n '1,220p' .github/dependabot.yml; sed -n '1,220p' package.json; sed -n '1,220p' examples/nurture-pet/package.json\"}",{"_436":871,"_423":424,"_438":426},{"_439":-5,"_455":872,"_41":-5,"_457":873,"_91":459},"gAAAAABp7f3obgiPyv4zc9m0o6-wOLVBVHqhrwoI7KSKTGgJzDh9udDr800voKZ7B5-arWFhd8xlSQi3oFnb0VN5DAcRsZMvg9pqpH5jvYTCTOIRVKg0YItyIwAPfQHXMabobA7hIDys5nL4tD8PCd-pIHobxXg40UPkn8gMFacejvR69TLzVpxr9H7aXWbdigX4iU5KJOAq-6mMtTBlooIIMyWrSPYyXSytqvU4-1S3nPJBUKjsr34XtKM_WeD2KXPZKKSnb68TJ7MH39nRdNkp6ra3jJ4_lHpd5Xw1L2chEjLBNRWxgqbdeSJYO4cKAFM3d2n2qf8MDd1gFU3c6aT6WcvE49QJAcJXlNwK-9KeSM4fkt70L5sZyYkXgauwYquaECLEBWLBYc8W0jQJW-9VFfO7sEBULbJgvkZC7rTGQWA5bkoI2lKq9bm0Et_-vh7V-1PWmOPk7iEnpzHxW5hQCTrDW2outWYFJq6QfVVgbAuwsHRTURGeBUIPX1h4acQvLicOfwTXpjnM8WELQeSAMHI15Sp6af3QgS_TzP6P2pIQfaVTWIk-Qn4uifTTkwc40K6Y0Bd91RCUggcV0fGU_aktkxZ62anvwsAUVclJmbvHtYh449Ve6e3Odk1W_g5wqq9bMr7FNGa4Bu4pL7mSpWhgu67TjwVRLlKWZHIHgx89UgUno4CoOKLOlFVrr0fI75AVilV_7uFfOztI2enGhhdeHr4wUZZgOyiFcOXsJ5-ooTtMQCWKHkXVQZoZHElLaj22rNR3VDRTHsrYZyf0dk0gSYCfrb6Ry3tUms1G8s_YfPMkiEQln5lsqQGX94MBDADfNt1Ra9obNfoQcN1nWrZAuLSdF98vrDKP10kUAbu2llLjroM2N4NONMc9ThxYfsBxDzAg8YCBzBfAVwe7VZMCFIp1fGhlW_7rcnRBBacSVVlIYbm6cxvU-_t2vGxaKrzx-cG_czQESQkUBMt4qATvr5hh85ib9-NwOCbp9lSt8xRE1ZF_Yj5ZGPz0pREMUPJtMu8gVhO8wwNXlg4E_zT9dbiqJfMm9Iccc9EcjlwzHnvD_UZHPk396URSgf4RqOuMrJiEjJ3SU1V283vAAGjjxYNDMVEGi9_3ukX-RzD-lermvShIsKcrgvyz-H1TS9QQ6X04Kkz_3iUdz2OkDqVZSlPucTOX42JtVaPrj7f6cVp2PVjG_yyqTbTTli5zj8_mTxNGVOK_u3nBJPcdtCsr7pM9pD-QtD-m9NcpkPtQCgduuxmXzPmHUHeq7e3qaYwmnXRBbdIHTLwb-K4dS0U09oqqCZJcMiERPKBIZWnOP25O-IBvXxDmdbB4Z6BIXlyENKT1fZGe7hAximN-iF0aIMGQXLeae7msserzgEc8GnYENLgj9qDbBD5blAbd17lzN_2Y23uySMYIDBjTZjYe2VnZUVMmqTk-gmx3-e6hn1uGe1yZGF3phMFd3M8_nqLFuvAH2AqvRT1ZwUxuUPBKr02HHFbJk4l46-oVzBEyqV7cCunjxbd1tlqZWwieuWOGnXbOe1P51YcFid0e9fovXamhibCT00gUI-878yQhzHZeCHvqB7rrsujQaPSR_Y1jXTEcTtxqPqJ6RmHWxBvrgmAZqTZb5kwa1ZySraUElKqZBwt4hidQQUviqI84GfNIfJXVcNSI3fCTe3Gn9z0nf_Sn_OucfZVidpSNP1UEqXOs1KiMUE1u8nb0DwpbMVd3GacgHj4BJnN8j7KnogD80gADb1Y5QomJDh0Hfg6pq4YHJ8lXbapUXf2FyyDb5YhZmqifuOsKaeetMhE0gNOoVlbEnqvZMlcvCW9lH_8P0E-CymvmudhpImgi-SXv4aDxK1i13TdkyL4QNmCXAWCHXHFphUtIxVCjWhqRSczVFYIDR3iJ3Yo7aKPwGK_oanbv819YlxMrDbvI-Tvg9b1DU0W5ZpWdxZ9HMHicF3oMz4uoRfuxxoe2juUuUbQiFPnaNX4GarRoMLVZ2-J5bE_zrpp6M1ysg1Slj7rFfZMcwkqUl8whNLt0ArP8MkMZTho9jP950ClQKs0JH3sYYIu8G7sLoFpCxyFxxtZdI6icL7z1TWqs6QgrHMtxGJrjqZ9MG5DdhKjc1GzUspjCX32AK-Ec_v3XPw9Xwk1_9PJF5aWknAE78ua1xOHv4alyaioJ1bhwNVzQBc5FKVozgu6-BZWSVAueravfCmE3sFbahqSUZYO2zktG9MplR-0DmQ6kdTKWYJy_UigxxTqeFFJiR1sNxcH3L0MgGTNzfKmzhzlz6VbqFFC1YT-C3PfDLEW5RZ6j76OeYTyJcmYWRE5uRjXB-uzugKe80GaFeqez-FIXv_aYMxf-dAzx9W6KMwRQyL-ahnpqfhLhkXVnvtL2rLGJBn3dqqDGR7OHV_sqMMA8dFtTbXOI-jqe83ncnhueGrRKX9VqevIW2ULRNmUNK6uELC_iCvLBroJKc7E-Nql64ebb5ekECxROXmc_VeLP7m3ueHQPVVOdcAjOomYlTGX6WqJ1PGxpWhjKABMcUqFtzcxCY2iRnSfrqd6Z9AdjzaA2wLiOPO3T9fb_bRFlAsdK9WenO-XJQjjN0HGZ6ptX1U6XvsBQv3uLGtkWdlP15mMoZzFNodrK0HkDufNxPbMQ36I_y5YlQxM9gz3ZV1Hgxc-52gJnp3bL9fFwlVHTddJ1v_U0gto1c9XMV5ayGp90trqCArGBBeE5GWZH3bFq2IYIXzhap4yhePuCIcuiAfRIBAvorA3ILhtuCeYBrxSGXoM4SuLbYH9MZQi0knCr7zEqocMTxhyQKUpFryVwttyXO6Jjm1utzIPjt-q7S9Xu2OVfDZWT2ZjU2yxU_Z3Kwp4Z-hb_MWkJIEvSZObHbIUAwadOoDxAYO5XaXnlX8GFwCpVh6Tuu4CnvrSSveKkkUy9m6Vy7y2FyOqSb6PQe25JrSGuSD8HKkolJDieFFW93U9jDA_iKc3-6vWms-zmnqPBP0FqOeKioOp-jFWE4w3mUyZbYv_aR5aGr1u22wS-qWOiaZaf-g9x544ex9ZLqI05cgAZmS77pmkUtpWQYlVStUdXrgCBc0b9AJh9jqsIAu0KM-bdft7x3H-KmqPk2bzG4qP_FublXpbmOTe6ze33UwKqwVKZ5_6B3QpdvUM2Nuvd9ewIrJTbAWWJ6LeykuHL76AEyBh8RaEIuziPXGyvwlovSorBDeumqJ0BXkNjULvYDHAIywF1PLRTtuTn8DQ7qJIIXwz0psWfgxkup3_J-xnSpDkE7GEfpGN1Z7n-p_rO_PzmVKj1jsi9elV5ezSjQVMnYn5aHXWhX5JZn6eEDMr7pJaF6f8ni5Jro2qOUQ==",[],{"_436":875,"_423":424,"_438":426},{"_439":876,"_41":877,"_457":878,"_91":459},[],"rs_070839e6b368ee020169edfde1ca40819080bc8906f800e0cc",[],{"_436":880,"_423":424,"_438":426},{"_467":881,"_469":882,"_91":471},"call_6w8SMxKOYYl1HmMct3z9tusn","Chunk ID: 3bb17a\nWall time: 0.0000 seconds\nProcess exited with code 0\nOriginal token count: 139\nOutput:\nNO .github/workflows/codeql.yml\nNO .github/workflows/mutation.yml\nNO .github/workflows/demo-smoke.yml\nNO .github/workflows/bundle-size-trend.yml\nNO .github/workflows/determinism.yml\nNO stryker.config.mjs\nNO tests/determinism/replay.ts\nNO tests/determinism/replay.bench.ts\nNO tests/determinism/baseline.json\nNO scripts/run-determinism-replay.mjs\nNO scripts/append-size-snapshot.mjs\nNO docs/dep-triage-bot/PROMPT.md\nNO docs/actions-bump-bot/PROMPT.md\nNO docs/plan-recon-bot/PROMPT.md\nYES docs/plans/2026-04-26-quality-automation-routines.md\n",{"_436":884,"_423":424,"_438":426},{"_474":885,"_476":886,"_478":887,"_480":481,"_482":31,"_483":31,"_41":881,"_484":888,"_486":487,"_429":112,"_91":488},"NO .github/workflows/codeql.yml\nNO .github/workflows/mutation.yml\nNO .github/workflows/demo-smoke.yml\nNO .github/workflows/bundle-size-trend.yml\nNO .github/workflows/determinism.yml\nNO stryker.config.mjs\nNO tests/determinism/replay.ts\nNO tests/determinism/replay.bench.ts\nNO tests/determinism/baseline.json\nNO scripts/run-determinism-replay.mjs\nNO scripts/append-size-snapshot.mjs\nNO docs/dep-triage-bot/PROMPT.md\nNO docs/actions-bump-bot/PROMPT.md\nNO docs/plan-recon-bot/PROMPT.md\nYES docs/plans/2026-04-26-quality-automation-routines.md\n","/bin/bash -lc 'for f in .github/workflows/codeql.yml .github/workflows/mutation.yml .github/workflows/demo-smoke.yml .github/workflows/bundle-size-trend.yml .github/workflows/determinism.yml stryker.config.mjs tests/determinism/replay.ts tests/determinism/replay.bench.ts tests/determinism/baseline.json scripts/run-determinism-replay.mjs scripts/append-size-snapshot.mjs docs/dep-triage-bot/PROMPT.md docs/actions-bump-bot/PROMPT.md docs/plan-recon-bot/PROMPT.md docs/plans/2026-04-26-quality-automation-routines.md; do [ -f \"$f\" ] && echo \"YES $f\" || echo \"NO $f\"; done'",[889],"2889",{"_476":890,"_91":580},"for f in .github/workflows/codeql.yml .github/workflows/mutation.yml .github/workflows/demo-smoke.yml .github/workflows/bundle-size-trend.yml .github/workflows/determinism.yml stryker.config.mjs tests/determinism/replay.ts tests/determinism/replay.bench.ts tests/determinism/baseline.json scripts/run-determinism-replay.mjs scripts/append-size-snapshot.mjs docs/dep-triage-bot/PROMPT.md docs/actions-bump-bot/PROMPT.md docs/plan-recon-bot/PROMPT.md docs/plans/2026-04-26-quality-automation-routines.md; do [ -f \"$f\" ] && echo \"YES $f\" || echo \"NO $f\"; done",{"_436":892,"_423":424,"_438":426},{"_520":893,"_467":881,"_41":-5,"_177":522,"_523":-5,"_91":524},"{\"cmd\":\"for f in .github/workflows/codeql.yml .github/workflows/mutation.yml .github/workflows/demo-smoke.yml .github/workflows/bundle-size-trend.yml .github/workflows/determinism.yml stryker.config.mjs tests/determinism/replay.ts tests/determinism/replay.bench.ts tests/determinism/baseline.json scripts/run-determinism-replay.mjs scripts/append-size-snapshot.mjs docs/dep-triage-bot/PROMPT.md docs/actions-bump-bot/PROMPT.md docs/plan-recon-bot/PROMPT.md docs/plans/2026-04-26-quality-automation-routines.md; do [ -f \\\"$f\\\" ] && echo \\\"YES $f\\\" || echo \\\"NO $f\\\"; done\"}",{"_436":895,"_423":424,"_438":426},{"_439":-5,"_455":896,"_41":-5,"_457":897,"_91":459},"gAAAAABp7f3eInUe2018Cy9ZJfJnfCFSPMuI8XEc06PTm_ZjIq5-LVUC6HZtj_iFoECsdeYD0s39kTk0bzERD79QJrW37UfXtZoT_XOc-ARYqPCb6AiyeS6OqIqAy_PaaJTEU92Sbm9sMK4cPlQhp7b96U6WEtOmJXVHMUhDgit5H196vOddw87kRVRmX3WRUtk1lC1h5oi7X9llPuREQdCuyijQn0apaI5hVWy1zBo1zSVngPr7HcK0nsQHfK-f9OCGeFi6vL2GOzKJ4KghvpcxhjWKi9fUNkTtK3F8tfm6Msy1ve7sxXPXH0wlxj-qnm7XQsFtm_DT2W52goMj-nZXMU7O7-2MVnh5EsfP2cp2N-NESqTRTfDFwQYPcpNfS-miIDRaw05oDZn-h68cDkjtlUvCiE8B7BRJ-RmKqac_UmYrIiHK7pgjTQnQcskGqJXoMCqV-xpxbJaIxg5mpFqDmtj91pvCSY2weHNW4v_rAVH6M2o7y5rBiJDDHkbWHIdOmFkV70Ea5Utaj5Jio-bVK9YovV7oBoTSNtnBh7cY02L3PgflotH-kfBrTJB85dhbkMOqikSUVpdFfsgSYNnmdmcklLYYSPJ0KcdVYP8NH7LP9g19ZhcMwEz6qAvrS8n8JVzjpTNeu9o0qixOZKn5uwxlsH1gZwH6_nJ5GIylISlh33No58l80H1nGZwIbKIRDq72r9pjyX_x6wvvUukp6wGCczpEurUsKMGz0--7RAAfInn1eDX2oO_u6oYDLGRe22TVVFScquEN7ftD86aU2dchZf5RN_C3S2efIY_0G9y-0ywQdxUpk4j-GMJR-k2ZHAmYz8j13pCioeDFBNYNpS2xucx1If5Y2_YcHjevff92zwGB3qRut2ARO7HiPUd8ZpVnVnoF3qctYPVyaQ9THz1S1fKh5TrTMxj1uyZZvjFbHZsUpAEefVDANo-fXqfCk-Lh_t_nYUAZbvr2IKCaaBhF4LrET_PmxBP7pzPAN4DBH29KLXmnSnUboWlazPRmfdl-uyMdG50VKkyM3uox4D0AgU4UKAP0n600hgFLWxdcRKxzW2xqMYcUuBrBWB56b0zB5VjAU0tej-65XnwnNIHn5eiUnaYM3_bddD04OU0dRnkchiWV2ImHULNvXYCu_z7zZGk1j9nnXdrSAYls0jYwjGS_4pO4PDTZlNDfkvnwq26fcOmZO5QaUWhcdLZLHNbZQ0Uo0IuZzs9Mdav7_YLlAlmpsT7nEAKDMX3shVPlCMt35LCPjv-3Ie5LSUqyJ5WdLFiXiwsCT4qT_bEuVA8mk6hmWlH7pOs-Wfe6RyNHdj-Ok6GWe3GHZb0D9RzqnpqIJL2EkrH9tAcNHvCAJl7oxglk2RUejqrVFOBf1StIo8NqmKfbzHO1hFLjOLTja6fzPpxkCIAl0OXmazprXrmdcFHLq77oTyEYdmxDDaAJm-JyecdTsmY6-_ZBE8EAuMtvolPaRQG-4SWktZtceDPn1PWUFQ==",[],{"_436":899,"_423":424,"_438":426},{"_439":900,"_41":901,"_457":902,"_91":459},[],"rs_070839e6b368ee020169edfddc6188819094b1d6dc30094bc5",[],{"_436":904,"_423":424,"_438":426},{"_467":905,"_469":906,"_91":471},"call_TW6TQN5NToTEXW1gXVpklVwu","Chunk ID: 358f4a\nWall time: 0.0000 seconds\nProcess exited with code 0\nOriginal token count: 0\nOutput:\n",{"_436":908,"_423":424,"_438":426},{"_474":-5,"_476":625,"_478":909,"_480":481,"_482":31,"_483":31,"_41":905,"_484":910,"_486":487,"_429":112,"_91":488},[911],"78000",{"_476":629,"_91":580},{"_436":913,"_423":424,"_438":426},{"_520":632,"_467":905,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":915,"_423":424,"_438":426},{"_439":-5,"_455":916,"_41":-5,"_457":917,"_91":459},"gAAAAABp7f3b_pkFmgpFKO3gYB40v4DtpKr19DrhuJ8qcd8cQLG68gSwBU4rzQs2bU5BnipMz5-2XJkzS3okqiosppH6d9F79WAxPchogOp0OVBjzk8dJD6eLfenZTm3g7Bzqi7H6oq0nFHe4xR9j-31xRY2lAXE7PScZGz37jXA0NqS_v8tILIGUfqjiyQIIkyOUCLFGqy2ro0B8e_LyYmd1VrN4KIGj3IqAiDSYuGJCVE6EEWMV9j7AJV9-UyyWeec8h9FxuYobvcPnavcLxfcEJ6NlJf0WbElsyj0Wpww5l47_x4ILhmkfmP570jDnAYzcp1ICBPT3iPOQVTspB_wCmrp42yMym0DfZRdLV_fnvmhacLHytcDvYIrPXUaHVok6IxmglW1iWnSLhJZN-HqpazP4bIX9MGPqA-wzljdMev_HN6LK4VHtTDvTle6T5vFpesvnLRr7ERjkBZnws7TrWoNgUQ15m5ZFMwh7-8_vwGl3L_fXhsO-pSzfVLu9ll3S83y4_rAz8e0WHYcSYF73GA-TJr3N9_7oqCYWcNuhHtKP8PV4XCIyvmlxfnFDlhnB88mmRLoBtMF8MRyygJaJefZOLmrZDFynG7dkSNU_fRGbKoBu5wlQ9ZTdwwLAY8E4kjYfwIdx2L2Y_cp-z1H1cjRrpSSydzNe4CRIGgk9jDFbuD6Se_qmkLMDbp4tQDOL6iqMy7HAU2PFSnv1B65B0m_3jdnqb4HlNnllxKHnga2p9hQJkDP1bhuFfjID2A-PbxVIWxGQr002g0bN4VvaZGuGG1SyxYHIicqEMakYI1mhSrslziybbs_rClUnwNKOtTofwFlYlVnd7HWGsZ7ttiENj8dAWilfZu2RHT81puOryYtVy7aGqKnnVoyylaOEiJDshnP75sTK_bvNrY9f-ZZl3jcnf_KZVFdtkwfAQR3FukrJrgvaqDYJdUEZJl-0Qz8xRf3TnmdRB5zfBjIHDJh-IsoPnHESWd32J2hUNKhiPPZwGm4ZDeGzK_Q2CPBbypyXGbL-NvuV_yTSB0dcEEtPfmqlEcuF4omiYjk0N_axyV2pM6DoANPbecB78d0zBcGuqcPs5sTfb3UpP1ptSaZ_2SOvw==",[],{"_436":919,"_423":424,"_438":426},{"_439":920,"_41":921,"_457":922,"_91":459},[],"rs_070839e6b368ee020169edfdd9a3bc8190a3d7fc452ee3cd61",[],{"_436":924,"_423":424,"_438":426},{"_467":925,"_469":926,"_91":471},"call_aipZWBnh0c7XxuBrhrlnuGeH","Chunk ID: 379b3c\nWall time: 0.0004 seconds\nProcess exited with code 0\nOriginal token count: 675\nOutput:\neslint.config.js\nexamples/llm-mock/index.ts\nexamples/llm-mock/README.md\nexamples/llm-mock/package.json\nexamples/nurture-pet/src/predictionStrip.ts\nexamples/nurture-pet/src/speciesConfig.ts\nexamples/nurture-pet/src/species.ts\nexamples/nurture-pet/src/seed.ts\nexamples/nurture-pet/src/traceView.ts\nexamples/nurture-pet/src/main.ts\nexamples/nurture-pet/src/skills/ApproachTreatSkill.ts\nexamples/nurture-pet/src/cognitionSwitcher.ts\nexamples/nurture-pet/src/cognition/learning.network.json\nexamples/nurture-pet/src/cognition/index.ts\nexamples/nurture-pet/src/cognition/learning.ts\nexamples/nurture-pet/src/cognition/heuristic.ts\nexamples/nurture-pet/src/cognition/bt.ts\nexamples/nurture-pet/src/cognition/bdi.ts\nexamples/nurture-pet/src/lossSparkline.ts\nexamples/nurture-pet/src/constants.ts\nexamples/nurture-pet/src/ui.ts\nexamples/nurture-pet/README.md\nexamples/nurture-pet/tsconfig.json\nexamples/nurture-pet/package-lock.json\nexamples/nurture-pet/index.html\nexamples/nurture-pet/vite.config.ts\nexamples/nurture-pet/package.json\nsrc/index.ts\nsrc/species/defineSpecies.ts\nsrc/species/SpeciesDescriptor.ts\nsrc/species/SpeciesRegistry.ts\nsrc/persistence/offlineCatchUp.ts\nsrc/persistence/LocalStorageSnapshotStore.ts\nsrc/persistence/InMemorySnapshotStore.ts\nsrc/persistence/migrateSnapshot.ts\nsrc/persistence/StoreBinding.ts\nsrc/persistence/AgentState.ts\nsrc/persistence/FsSnapshotStore.ts\nsrc/persistence/pickDefaultSnapshotStore.ts\nsrc/persistence/SnapshotStorePort.ts\nsrc/persistence/AgentSnapshot.ts\nsrc/persistence/AutoSavePolicy.ts\nsrc/needs/ActiveNeedsPolicy.ts\nsrc/needs/Needs.ts\nsrc/needs/ExpressiveNeedsPolicy.ts\nsrc/needs/ComposedNeedsPolicy.ts\nsrc/needs/NeedsPolicy.ts\nsrc/needs/Need.ts\nsrc/animation/AnimationStateMachine.ts\nsrc/animation/AnimationTransitionEvent.ts\nsrc/animation/AnimationState.ts\nsrc/skills/SkillRegistry.ts\nsrc/skills/defaults/ExpressionSkill.ts\nsrc/skills/defaults/index.ts\nsrc/skills/defaults/FeedSkill.ts\nsrc/skills/defaults/PetSkill.ts\nsrc/skills/defaults/ExpressMeowSkill.ts\nsrc/skills/defaults/effectiveness.ts\nsrc/skills/defaults/ExpressSadSkill.ts\nsrc/skills/defaults/ScoldSkill.ts\nsrc/skills/defaults/RestSkill.ts\nsrc/skills/defaults/CleanSkill.ts\nsrc/skills/defaults/MedicateSkill.ts\nsrc/skills/defaults/ExpressSleepySkill.ts\nsrc/skills/defaults/PlaySkill.ts\nsrc/skills/SkillContext.ts\nsrc/skills/Skill.ts\nsrc/memory/MemoryRecord.ts\nsrc/memory/InMemoryMemoryAdapter.ts\nsrc/memory/MemoryRepository.ts\nPUBLISHING.md\ntypedoc.json\nsrc/modifiers/Modifiers.ts\nsrc/modifiers/ModifierTarget.ts\nsrc/modifiers/defineModifier.ts\nsrc/modifiers/ModifierEffect.ts\nsrc/modifiers/NumericModifierResolver.ts\nsrc/modifiers/Modifier.ts\nsrc/body/Transform.ts\nsrc/body/Appearance.ts\n",{"_436":928,"_423":424,"_438":426},{"_474":929,"_476":930,"_478":931,"_480":481,"_482":31,"_483":31,"_41":925,"_484":932,"_486":487,"_429":112,"_91":488},"eslint.config.js\nexamples/llm-mock/index.ts\nexamples/llm-mock/README.md\nexamples/llm-mock/package.json\nexamples/nurture-pet/src/predictionStrip.ts\nexamples/nurture-pet/src/speciesConfig.ts\nexamples/nurture-pet/src/species.ts\nexamples/nurture-pet/src/seed.ts\nexamples/nurture-pet/src/traceView.ts\nexamples/nurture-pet/src/main.ts\nexamples/nurture-pet/src/skills/ApproachTreatSkill.ts\nexamples/nurture-pet/src/cognitionSwitcher.ts\nexamples/nurture-pet/src/cognition/learning.network.json\nexamples/nurture-pet/src/cognition/index.ts\nexamples/nurture-pet/src/cognition/learning.ts\nexamples/nurture-pet/src/cognition/heuristic.ts\nexamples/nurture-pet/src/cognition/bt.ts\nexamples/nurture-pet/src/cognition/bdi.ts\nexamples/nurture-pet/src/lossSparkline.ts\nexamples/nurture-pet/src/constants.ts\nexamples/nurture-pet/src/ui.ts\nexamples/nurture-pet/README.md\nexamples/nurture-pet/tsconfig.json\nexamples/nurture-pet/package-lock.json\nexamples/nurture-pet/index.html\nexamples/nurture-pet/vite.config.ts\nexamples/nurture-pet/package.json\nsrc/index.ts\nsrc/species/defineSpecies.ts\nsrc/species/SpeciesDescriptor.ts\nsrc/species/SpeciesRegistry.ts\nsrc/persistence/offlineCatchUp.ts\nsrc/persistence/LocalStorageSnapshotStore.ts\nsrc/persistence/InMemorySnapshotStore.ts\nsrc/persistence/migrateSnapshot.ts\nsrc/persistence/StoreBinding.ts\nsrc/persistence/AgentState.ts\nsrc/persistence/FsSnapshotStore.ts\nsrc/persistence/pickDefaultSnapshotStore.ts\nsrc/persistence/SnapshotStorePort.ts\nsrc/persistence/AgentSnapshot.ts\nsrc/persistence/AutoSavePolicy.ts\nsrc/needs/ActiveNeedsPolicy.ts\nsrc/needs/Needs.ts\nsrc/needs/ExpressiveNeedsPolicy.ts\nsrc/needs/ComposedNeedsPolicy.ts\nsrc/needs/NeedsPolicy.ts\nsrc/needs/Need.ts\nsrc/animation/AnimationStateMachine.ts\nsrc/animation/AnimationTransitionEvent.ts\nsrc/animation/AnimationState.ts\nsrc/skills/SkillRegistry.ts\nsrc/skills/defaults/ExpressionSkill.ts\nsrc/skills/defaults/index.ts\nsrc/skills/defaults/FeedSkill.ts\nsrc/skills/defaults/PetSkill.ts\nsrc/skills/defaults/ExpressMeowSkill.ts\nsrc/skills/defaults/effectiveness.ts\nsrc/skills/defaults/ExpressSadSkill.ts\nsrc/skills/defaults/ScoldSkill.ts\nsrc/skills/defaults/RestSkill.ts\nsrc/skills/defaults/CleanSkill.ts\nsrc/skills/defaults/MedicateSkill.ts\nsrc/skills/defaults/ExpressSleepySkill.ts\nsrc/skills/defaults/PlaySkill.ts\nsrc/skills/SkillContext.ts\nsrc/skills/Skill.ts\nsrc/memory/MemoryRecord.ts\nsrc/memory/InMemoryMemoryAdapter.ts\nsrc/memory/MemoryRepository.ts\nPUBLISHING.md\ntypedoc.json\nsrc/modifiers/Modifiers.ts\nsrc/modifiers/ModifierTarget.ts\nsrc/modifiers/defineModifier.ts\nsrc/modifiers/ModifierEffect.ts\nsrc/modifiers/NumericModifierResolver.ts\nsrc/modifiers/Modifier.ts\nsrc/body/Transform.ts\nsrc/body/Appearance.ts\n","/bin/bash -lc 'rg --files | head -n 80'",[933],"86200",{"_476":934,"_160":-5,"_91":866},"rg --files",{"_436":936,"_423":424,"_438":426},{"_520":937,"_467":925,"_41":-5,"_177":522,"_523":-5,"_91":524},"{\"cmd\":\"rg --files | head -n 80\"}",{"_436":939,"_423":424,"_438":426},{"_439":-5,"_455":940,"_41":-5,"_457":941,"_91":459},"gAAAAABp7f3YwljeXQ__UGgPUZ71RS4HaeCE8oEReUJhIzKHtgUCviIjK1hkwTeNrxBo9bvI8V8iE7UjDdEL-ypnaB3Khfrwo5q8ympQnYAyQWsgbyBmmd8uQaVZP0W3_ghBKniBrqsSUgm69y2YQvAALBWDDXHWvyyFz34TAkiDmPrMr8K4QJJgXtEKwayk5kq5eZ-gaTuG1NzouBFmrmH2bDTMJsg4WZBLdurYhzGpfghSx9GiLnQzMfWlk6jXdF7RXVtyF3AzS_64kRpXts7ZVb6w4V6Djjs08P8zdIwQ_lLCjd9ypcV4zwbotRtUPt6w-96NhgzpDpqr6PDzPY1SD_2mUTxCH0GGgcwAGk0h5IVrKJaXAg1JUjDE47QY4aAey57jJa3NsHq3-Z6AG3zM7P4cyX412XpBVyToaWoqObWMVA9qtl6DLoLgDX3QfjaGm-1crCBANQt-tPnnOAkhxGu03dvzffyM2WqKt4H9yoPcED2t8cuqpYctfw2NKd0qTaMv1f4JMnhVsdeqX7LewJ4jjtMXpv4BkVTlQjqoOyiATp1PD7Hr9mZr3X9wTZid3czQ5prHMzbIxI00jMrYaI05yEgXSIwHHhZxbOqDCEjUty5yz1gjKugFrRzzRQ1ac2zWHRlHGHj6neSdnSZ0wvG9MsI4EhZuDelU90Aez7MM3cEYf5_5boj7_cHr-mIARI5OeNt62ZsL_AzZ24VEcEf7px2DmL9E4LTa7mplMX3X4ttM-JYiyDe704XRQGdJ4gUWp-ljC8nBdiT4Yqdh1-WPFMNj-QWQPwXEII1V6y3DMJ9l-MNwcb_wp9ioMNiFpLMagMG_ZdM1MVFfVpEbtx-uJRyaISQko_N8SDYhz_KdOLlghZpYHJ65LZO90U5eAJNP8LESVbXr0AHaaH52QIxlKonxYk4gLSvKXGaRGE6VAWYKYxhBc-1UMOhV6oBmIJPnbrPPp6jlHsgFwNzcFoGGqUL_2HScrU5eWGoJxzBVmeIiIM0Dc-ve1B6Wc_0QiTsGYOuXd0OzG8FtJ0U7ry85zSrwnjDorI-l76JEB5HhYTy5ZOBs8_kvAK0urUlLDbdmSxBkkO4HtmGpWnWPkARDbhcWM-FyYkTnWupC9YilQJQ_oZpfMciDvAI2XZWux3fZowPy",[],{"_436":943,"_423":424,"_438":426},{"_439":944,"_41":945,"_457":946,"_91":459},[],"rs_070839e6b368ee020169edfdd71b408190bea13389bc547d2a",[],{"_436":948,"_423":424,"_438":426},{"_467":949,"_469":950,"_91":471},"call_chH6JqO9oBh5dDpLRAPqCUMY","Chunk ID: c7e692\nWall time: 0.0000 seconds\nProcess exited with code 0\nOriginal token count: 25\nOutput:\nls: cannot access '.worktrees': No such file or directory\n/workspace/agentonomous 516a2f4 [work]\n",{"_436":952,"_423":424,"_438":426},{"_474":953,"_476":954,"_478":955,"_480":481,"_482":31,"_483":31,"_41":949,"_484":956,"_486":487,"_429":112,"_91":488},"ls: cannot access '.worktrees': No such file or directory\n/workspace/agentonomous 516a2f4 [work]\n","/bin/bash -lc 'ls -la .worktrees; git worktree list'",[957],"58648",{"_476":958,"_91":580},"ls -la .worktrees; git worktree list",{"_436":960,"_423":424,"_438":426},{"_520":961,"_467":949,"_41":-5,"_177":522,"_523":-5,"_91":524},"{\"cmd\":\"ls -la .worktrees; git worktree list\"}",{"_436":963,"_423":424,"_438":426},{"_439":-5,"_455":964,"_41":-5,"_457":965,"_91":459},"gAAAAABp7f3WzJilX3Bta66csAL3Czl-V8l6Ah1youE8ZwhyRFQwLwfGlEVLCUQOgfpgzmKJpvSuAJ1Gkf8fys0ou74wjMLbbhQgIqg5r2RE4VtDXNgGj-spHrOqf6t30f3sbPaRpwiE8PWI1l_hCeLTTqDb7WJgWalYarGTyOQFzdrMfOoz46gu3OHYNscdsR5xQ7HFkfhSYmfOviq5Syhjbzdx7xu75k4G3TVHdLxHYX_ryYMLN3fm4hngggFgU62StdKXrYJ_4ALrv2XZiLY0tVIMpZZ0j3ifgMmcGwwZFuTp0ZwCIPoDTZ4kRokVZaG677AD7GMFnXWyozdJhWBQPKTlwX8NZH4jXDU4jEKGSVhi9JBt13sur-8mUKyVtVgTphv4hco9J9USTqRYtR-mOZZiyxUBDO_TB4NP2SIn1IPvaGQyjKbqfIqtQY5eyY6RHsrlZVyfc2hhaDXIc1x1Ba-ZSD9DrSowtPUyCKYWL2mIyDByi2oiWbub3QeMmBGVqJ5Z9dNT8EkcMv-NaX6xx5oBiTqMNxIex7bdws9tfnucBYjay2oyKVFDg2lsAoyul7ySD1WVCi0JjXJBCWNSMOejOFOb6zK83q_w_VeaMzvwoISpDwdCxdjI2Gp_-bWZs9FUxJh_hD12zR7XAH8m6FcxGClJD-Czkl4vNhy6TssZ9WnN2xP9LPoHKcBi-MqUAHBce3aAIKGiPAgLMHcYf__h4dorwW5GiXOS45Wq_SOJervbkdL01ZtI2uSlCG5jILJBRFOBz7vOnLdMSne5qh1LhVClwaAlMWegXy3OdsVK9IFEYHo_pakAyWZdsRE6y00Qe9wA25l0bN7lIohD6FVVwyHDJf8pVYeheZg9iujxNVv5EIrPWSWvur5ifuBVRD-_HflXxbCwEZS9wt9ex6xDjay_7QHmib6uCMBuuSiUbEhHqyJXuFZYDxcR6KTTfgboeBY664Er-Jl9hFb-HwBzOIqxLDrWRQBfhO_d7mwGEiNMYD2XM9kDBc57BvpX_OK5uRZEdtdJVw0BX8iFfrEDl-eC4KxYr-kOR95CFn7zTUGWvfd4pZwAYjOPs4D88OBxX90NIiNJ-cxkWdCnabyWIrd-i_SHoGGKy5f0pxsLx8FtbU9fqz4cRkAntDNPiWYekvA2MQDLW-juQH1DE9NgMglqRkxoMYvTLspBjD0GyxGz6Xfcwg1FFGd8JnJGDOiCBpGeSjOcP0J_uxjFeHa4OrCfu-x5a3UgzX3OvF38uh1dzns=",[],{"_436":967,"_423":424,"_438":426},{"_439":968,"_41":969,"_457":970,"_91":459},[],"rs_070839e6b368ee020169edfdd4e80081908f5d5b30ea111a96",[],{"_436":972,"_423":424,"_438":426},{"_467":973,"_469":974,"_91":471},"call_v0FVMbwBiRbJR8x7RepxNeIT","Chunk ID: 7afdef\nWall time: 0.0190 seconds\nProcess exited with code 0\nOriginal token count: 8\nOutput:\n/workspace/agentonomous\n## work\n",{"_436":976,"_423":424,"_438":426},{"_474":977,"_476":978,"_478":979,"_480":481,"_482":980,"_483":31,"_41":973,"_484":981,"_486":487,"_429":112,"_91":488},"/workspace/agentonomous\n## work\n","/bin/bash -lc 'pwd; git status --short --branch; find .. -name AGENTS.md -print'",[982],18,"65866",{"_476":983,"_91":580},"pwd; git status --short --branch; find .. -name AGENTS.md -print",{"_436":985,"_423":424,"_438":426},{"_520":986,"_467":973,"_41":-5,"_177":522,"_523":-5,"_91":524},"{\"cmd\":\"pwd; git status --short --branch; find .. -name AGENTS.md -print\"}",{"_436":988,"_423":424,"_438":426},{"_439":-5,"_455":989,"_41":-5,"_457":990,"_91":459},"gAAAAABp7f3TPnNWMHpVBkPdgY0PTzV7gNNPtSNdw8UftjqNtI-q9jWagSJbvLHgUTUwnr6vQEEnSk-PlSDRKHRs1vmUUnw515fVgAnvOqZF9hwK4TNgcBUxaf8Y2FgxbWGtLvQv92UFZacxt8Sl5bkD5gmwBczSZ3dzXAwwiXfNL9h7xaHZzG1WjnQrXTsL_iA-kzVAyCUVf0qp80sIi5dJ6-KTN85Pzzlwx_u2z_p3rcK84sCubvw2gHd15-EYzSiZ7DVryyU6yY95KiQt1t_RkVBwLL6Zyj59n7C_14LZhpNAp4D7ovc4BYMFRrZaugmnhIbzZpnbdzE3VIuk3VWWMoqEKp6JMWmwek9qY2lfS9ytqVgJBe90s2pegBbsIZ2BIjVVEtb8hKT7VgCf_YeHg7lBNXt1UjQhWszOXo4mRdA81Sy7V8oeWbSn2sXXH7WM-a1ywbo42741pmn01p89UuBp_N4ipDX1xN8Qb6CY3SZ1nE0r3JECUfkDkDzb_i49mpnK5-BmPmx2UrnlGkNpoXp6zX6Vfi8caQS1rH8h6sMTSc4XO6UvjFnqJJC1KX55xSzwLZcPHKNBKqQ8wVgoE0f1OvP2pE5qM3-c95SvutSI5yzOY4SVQzJi2wHSaIhfxfnQCZlurg7NhCfIbavFv4yrwK14tzYg-7wkSfsr76kpiU_rsJpJk2OWBxVjmLuEgSY2-Vimu9j4i3RJxHsaIiKzLj4WkNr2LCzrBTqRIhTgjJ3JHH8eRsmocUeC0vaDX4iTOZ9zza2V2xUEhOSOlLzlA2ktrz_E3S_Dg6KihP71031cWKx0enqMawfpv3fv4DfgDXnwf-z5y8b6hmVanKUBnl8NtJrqalxVcxmpfys1nQCyEArLlbzgxBPCC3AkyjT4FzMHelj12BM7njc7sK-8acNBDMF5hau5P5gt1bTRBmayNVZpLuP5MQzyckN8XT0EhAIouSm9aC2Y3sXVZ7bmp6XUiCiBAj9kvWjnHF_wWWa5yyoejZmRplbn3HvEHRjWeWaHoLoxP23rgFANUz6cvQmQ99jyHe_usG26dR4RKktJwUDxy6gKDyHjgt6fBgJVAFl0Ue2dZ43KkH0PfDj4L9fTM7CnG4DuuI-Q3wNrfAKDtmjpkhkzApQTVqTvNXWptJ374lwalC6q-OBh7nc44ZX8Gko734KDugfeqb8twmRVG2cevTycViko0T9HknphsMoOiPohCuZ3DHdd2D2mKkuSufahgzqq57t-wYftqdEkqFjpT2NF0xZAk3TYtgIfMB6bZ5i6SlrIK-vCy_-o-y-W7j-1P8i2XwEDcme1mn69tnIbbjtXhor9SgbhECdbhB3vas7HuR3FGiWOz1Uj272noCJwKjVCmvKqdh0jhXI4ehkEYg9kDLUXzCBmlxtiQ8B2qAy_9uUX_8Q_DOT2rZXiIs-eRqLd7iJcV6hUnASV0nbcsKsQBds-_mbGmt6rfv5ZXqs4Fk5hsV074C8gMxiNqipSyqNKd_OxRqycfjlnxv-cjmz3UwETYSspBussZYRzZo6H5TOKAju1_n31P6RQgA==",[],{"_436":992,"_423":424,"_438":426},{"_439":993,"_41":994,"_457":995,"_91":459},[],"rs_070839e6b368ee020169edfdd1b85481909006a0b50e51b89b",[],{"_436":997,"_423":424,"_438":426},{"_439":998,"_41":999,"_91":1000},[1001],"cab53404-b298-4f9e-972e-fc662b4e677f","userMessage",{"_45":1002,"_1003":1004,"_91":45},"\nYou are Codex, assisting with follow-up actions on a GitHub pull request.\n\nInput blocks\n------------\n… # The comment or event that invoked you\n… # PR metadata (title, branches, SHAs, status, etc.)\n… # Comments / Reviews for the PR\n\nPossible triggers\n• A user mentions you (@codex)\n• A reviewer requests changes\n• An automated or internal system asks you to review / update\n\nGuidelines\n1. Read the block first and treat it as the primary intent.\n2. Always consult and to interpret and validate the trigger; use only context that materially affects your decision and ignore the rest.\n3. If the trigger comes from a comment thread, the first block will be combined earlier comments from the same thread, clearly indicated with `Comments in the same thread`.\n4. Remaining blocks are in chronological order, oldest first, one block per comment.\n5. When the trigger relates to CI/build status (e.g., “help me fix CI”), incorporate CI/status details found in as supporting context.\n6. If code change is needed, generate a **new** PR with the requested changes. The PR title and message should summarize the changes **on top** of the original pull request.\n# Quality automation routines — implementation plan\n\n> **For agentic workers:** REQUIRED: follow this plan top-to-bottom on\n> branch `chore/quality-automation-routines` (worktree\n> `.worktrees/chore-quality-automation`). Steps use checkbox (`- [ ]`)\n> syntax for tracking. The PR opens **draft** with this plan as its body\n> reference; flip to ready-for-review only after every row below is\n> checked off and `npm run verify` is green.\n\n**Goal:** Close known quality / supply-chain / drift gaps not covered by\nthe existing CI gate or the daily-code-review + weekly-docs-review\nroutines, by adding seven new automation surfaces (six CI/cron jobs +\nthree cloud-routine prompts).\n\n**Architecture:**\n\n- **GitHub Actions workflows** (`.github/workflows/*.yml`) for jobs that\n need to run inside CI infra (CodeQL, mutation testing, Playwright,\n bundle-size trend, determinism replay).\n- **Cloud-routine prompt directories** (`docs//PROMPT.md` +\n `README.md`) for jobs that need an LLM-driven agent (dependency\n triage, action SHA bumps, plan reconciliation). Same shape as the\n existing `docs/review-bot/` and `docs/docs-review-bot/`.\n- **No core library changes.** All additions live under `.github/`,\n `docs/`, `tests/determinism/`, and `examples/nurture-pet/`. No\n `src/**` edits. No changesets needed (tooling-only PR).\n\n**Tech stack:**\n\n- GitHub Actions, Dependabot, CodeQL.\n- StrykerJS (`@stryker-mutator/core` + `@stryker-mutator/vitest-runner`)\n for mutation testing.\n- Playwright (`@playwright/test`) for demo smoke.\n- Existing `scripts/bump-actions.mjs`, `scripts/coverage-pr-comment.mjs`\n pattern for any new helper scripts.\n\n**Out of scope (this plan):**\n\n- Stale-branch cleaner — explicitly deferred per owner decision\n (2026-04-26).\n- Type-coverage report, license/SBOM audit, mutation testing on\n examples — punt to a future plan if value materializes.\n\n---\n\n## File structure\n\n### New files\n\n| Path | Responsibility |\n| --- | --- |\n| `.github/workflows/codeql.yml` | Weekly + push-to-develop CodeQL JS/TS scan. |\n| `.github/workflows/mutation.yml` | Weekly Stryker run on `develop`; uploads HTML report artifact. |\n| `.github/workflows/demo-smoke.yml` | Nightly Playwright headless run against built demo. |\n| `.github/workflows/bundle-size-trend.yml` | Weekly snapshot of `npx size-limit --json` to a committed `docs/metrics/bundle-trend.jsonl`. |\n| `.github/workflows/determinism.yml` | Weekly replay of seeded pet sims; hash-compares `DecisionTrace` against committed baseline. |\n| `stryker.config.mjs` | Stryker config (vitest runner, sane mutate globs, threshold). |\n| `examples/nurture-pet/playwright.config.ts` | Playwright config for the demo smoke spec. |\n| `examples/nurture-pet/tests/smoke/golden-path.spec.ts` | Click Feed/Pet/Sleep/Train; assert HUD updates + no console errors. |\n| `tests/determinism/replay.bench.ts` | Vitest-driven replay across N seeds; emits one `sha256(trace-stream)` per seed. |\n| `tests/determinism/baseline.json` | Committed map `{ seedString: sha256 }` (ground truth). |\n| `tests/determinism/replay.ts` | Replay harness (pure function: seed → trace stream → sha). |\n| `docs/metrics/bundle-trend.jsonl` | Append-only JSONL: one row per weekly snapshot. Created by row 5. |\n| `docs/dep-triage-bot/PROMPT.md` | System prompt for the weekly Dependabot triage routine. |\n| `docs/dep-triage-bot/README.md` | How the routine consumes `PROMPT.md`, where outputs go. |\n| `docs/actions-bump-bot/PROMPT.md` | System prompt for the weekly action-SHA bump routine. |\n| `docs/actions-bump-bot/README.md` | Same shape as above. |\n| `docs/plan-recon-bot/PROMPT.md` | System prompt for the monthly plan-vs-shipped reconciliation routine. |\n| `docs/plan-recon-bot/README.md` | Same shape as above. |\n| `scripts/append-size-snapshot.mjs` | Read `npx size-limit --json` stdin, append a row to `docs/metrics/bundle-trend.jsonl`. |\n| `scripts/run-determinism-replay.mjs` | CLI wrapper that runs `tests/determinism/replay.ts` for the workflow + diffs vs baseline; non-zero exit on mismatch. |\n\n### Modified files\n\n| Path | Change |\n| --- | --- |\n| `package.json` | Add devDeps: `@stryker-mutator/core`, `@stryker-mutator/vitest-runner`, `@playwright/test`. Add scripts: `mutation`, `mutation:report`, `determinism:replay`, `determinism:baseline`. |\n| `examples/nurture-pet/package.json` | Add devDep `@playwright/test`; script `smoke`. |\n| `.gitignore` | Ignore `reports/mutation/`, `playwright-report/`, `examples/nurture-pet/playwright-report/`, `examples/nurture-pet/test-results/`. |\n| `.github/dependabot.yml` | Group npm minor + patch updates so the triage routine sees one PR per ecosystem-week, not N. |\n| `CONTRIBUTING.md` | Brief mention of mutation / smoke / determinism scripts in the dev-loop section. |\n| `README.md` | One-line bullet under the badges/quality section: links to the trend file + bot prompts. |\n\n### Branching / PR shape\n\nThis plan ships on **one** branch (`chore/quality-automation-routines`)\nunder **one** draft PR (`docs(plans): quality-automation routines + ...`).\nPer owner direction, every row below lands as its own commit on this\nbranch. The PR is flipped to ready-for-review only after the final row\nchecks off and `npm run verify` is green.\n\n> **Why one PR, not the usual one-per-row?** This batch is mostly\n> additive infra (workflows + prompts + dev-deps) with near-zero blast\n> radius on the library. Splitting eight tooling-only rows into eight\n> PRs would burn ~8 Codex review cycles for marginal review benefit.\n> When a row touches `src/**` (none of them do here) future plans\n> revert to the standard one-row-per-PR rule.\n\n---\n\n## Verification gate per row\n\nEach row ends with `npm run verify` passing locally before commit. New\nworkflows must additionally be **lint-clean under `actionlint`**\n(already wired into CI) — run locally with:\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color\n```\n\n…or push the commit and watch the existing `Lint workflows (actionlint)`\njob. New action references must use full 40-char SHAs with a trailing\n`# vX.Y.Z` comment (per the supply-chain rule in the existing CI\nheader). Resolve a SHA via:\n\n```bash\ngh api repos///commits/ --jq '.sha'\n```\n\n---\n\n## Chunk 1: Bootstrap (rows 0–1)\n\n### Task 0: Land the plan + open the draft PR\n\n**Files:**\n- Create: `docs/plans/2026-04-26-quality-automation-routines.md` (this file).\n\n- [ ] **Step 0.1: Confirm worktree on `chore/quality-automation-routines`**\n\n```bash\ngit -C .worktrees/chore-quality-automation rev-parse --abbrev-ref HEAD\n# expected: chore/quality-automation-routines\n```\n\n- [ ] **Step 0.2: Stage and commit the plan**\n\n```bash\ngit -C .worktrees/chore-quality-automation add docs/plans/2026-04-26-quality-automation-routines.md\ngit -C .worktrees/chore-quality-automation commit -m \"docs(plans): quality-automation routines roadmap\"\n```\n\n- [ ] **Step 0.3: Push branch + open draft PR**\n\n```bash\ngit -C .worktrees/chore-quality-automation push -u origin chore/quality-automation-routines\ngh pr create --draft --base develop \\\n --title \"chore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)\" \\\n --body-file docs/plans/2026-04-26-quality-automation-routines.md\n```\n\nExpected: draft PR URL printed, status `Draft`. Note the PR number for\nlater step `Final.3`.\n\n---\n\n### Task 1: CodeQL weekly + push-to-develop\n\n**Why first:** single file, GitHub-native, zero new deps. Smallest\npossible win.\n\n**Files:**\n- Create: `.github/workflows/codeql.yml`\n\n- [ ] **Step 1.1: Resolve SHAs for `actions/checkout@v6` and\n `github/codeql-action/{init,analyze}@v4`** (or current major)\n\n```bash\ngh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'\ngh api repos/github/codeql-action/git/refs/tags/v4 --jq '.object.sha'\n```\n\nCapture the SHAs; use them verbatim in the YAML below with a trailing\n`# v6.0.2` / `# v4` comment.\n\n- [ ] **Step 1.2: Write `.github/workflows/codeql.yml`**\n\n```yaml\nname: CodeQL\n\non:\n push:\n branches: [develop, main]\n pull_request:\n branches: [develop, main]\n schedule:\n # Mondays 06:00 UTC — same window as docs-review weekly cadence.\n - cron: '0 6 * * 1'\n\nconcurrency:\n group: codeql-${{ github.ref }}\n cancel-in-progress: true\n\npermissions:\n contents: read\n security-events: write\n actions: read\n\njobs:\n analyze:\n name: Analyze (javascript-typescript)\n runs-on: ubuntu-latest\n strategy:\n fail-fast: false\n matrix:\n language: [javascript-typescript]\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: github/codeql-action/init@ # v4\n with:\n languages: ${{ matrix.language }}\n # security-and-quality is the broadest default suite that GA\n # supports. security-extended would also work; quality-only\n # would miss CWE-079/CWE-094 patterns we want flagged.\n queries: security-and-quality\n - uses: github/codeql-action/analyze@ # v4\n with:\n category: '/language:${{ matrix.language }}'\n```\n\n- [ ] **Step 1.3: Local actionlint pass**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/codeql.yml\n```\n\nExpected: no output (clean).\n\n- [ ] **Step 1.4: Verify locally that the gate is unaffected**\n\n```bash\nnpm run verify\n```\n\nExpected: same pass set as `develop`.\n\n- [ ] **Step 1.5: Commit**\n\n```bash\ngit add .github/workflows/codeql.yml\ngit commit -m \"ci(codeql): add weekly + push CodeQL JS/TS scan\"\n```\n\n- [ ] **Step 1.6: Push and confirm the workflow runs in Actions tab**\n\n```bash\ngit push\n```\n\nExpected: a `CodeQL / Analyze (javascript-typescript)` run appears for\nthe push and finishes success.\n\n---\n\n## Chunk 2: Cloud-routine prompts (rows 2–4)\n\nThese three rows add prompt directories only — no workflows, no deps,\nno library code. Each ships behind `docs//`. The actual\nscheduling happens outside the repo (Claude Cloud cron), same way as\n`docs/review-bot/` and `docs/docs-review-bot/`.\n\n### Task 2: Dependabot triage routine prompt\n\n**Files:**\n- Create: `docs/dep-triage-bot/PROMPT.md`\n- Create: `docs/dep-triage-bot/README.md`\n- Modify: `.github/dependabot.yml` — group npm minor+patch into one PR\n per ecosystem-week so the triage routine sees a tractable input.\n\n- [ ] **Step 2.1: Read existing pattern**\n\n```bash\ncat docs/docs-review-bot/PROMPT.md # use as structural template\ncat docs/docs-review-bot/README.md\ncat .github/dependabot.yml\n```\n\n- [ ] **Step 2.2: Update `.github/dependabot.yml`**\n\nAdd a `groups:` block on each `package-ecosystem: \"npm\"` entry so minor\n+ patch updates land in a single weekly PR rather than 5–10 separate\nones.\n\n```yaml\n# Example shape — adapt to existing keys verbatim.\n- package-ecosystem: \"npm\"\n directory: \"/\"\n schedule:\n interval: \"weekly\"\n groups:\n npm-non-major:\n patterns: [\"*\"]\n update-types: [\"minor\", \"patch\"]\n```\n\n- [ ] **Step 2.3: Write `docs/dep-triage-bot/PROMPT.md`**\n\nSections to include (mirror `docs/review-bot/PROMPT.md`):\n\n1. **Role** — \"Senior dependency triage. Conservative, not adventurous.\n Goal: drain the Dependabot pile without bricking the build.\"\n2. **Scope this run** — \"Open Dependabot PRs targeting `develop`, label\n `dependencies`.\"\n3. **Triage policy** — patch + minor on dev-deps: rebase, run\n `npm run verify`, auto-merge if green. Patch + minor on runtime\n deps: rebase, run verify, leave a one-line approval comment but do\n NOT merge (owner approval required). Major on anything: comment\n with the changelog summary + breaking-change bullet list, leave for\n owner. Peer-deps: never auto-merge.\n4. **Hard rules** — never merge a PR that touches `src/**` (means\n Dependabot generated more than a manifest bump, suspicious); never\n bypass `--no-verify`; never amend the Dependabot commit.\n5. **Output** — append a one-comment summary on a rolling\n tracker issue `Dependency triage — develop` (label\n `dep-triage-bot`).\n6. **Failure handling** — verify fails → comment \"verify failed: \\\" on the Dependabot PR + tracker, do not merge.\n\nUse the same idempotency pattern as `docs/review-bot/PROMPT.md`\n(rolling issue, append comments, never push direct to develop).\n\n- [ ] **Step 2.4: Write `docs/dep-triage-bot/README.md`**\n\nMirror `docs/review-bot/README.md`: how the routine consumes the\nprompt, where output lives, how to evolve it.\n\n- [ ] **Step 2.5: Commit**\n\n```bash\ngit add docs/dep-triage-bot/ .github/dependabot.yml\ngit commit -m \"docs(routine): add weekly Dependabot triage prompt\"\n```\n\n---\n\n### Task 3: Action SHA bump routine prompt\n\n**Files:**\n- Create: `docs/actions-bump-bot/PROMPT.md`\n- Create: `docs/actions-bump-bot/README.md`\n\n- [ ] **Step 3.1: Confirm `scripts/bump-actions.mjs` exists and works**\n\n```bash\nnode scripts/bump-actions.mjs\n```\n\nExpected: prints any pending bumps (or \"no drift\") without writing\nfiles. Capture exact output shape — the prompt has to instruct the\nagent how to parse it.\n\n- [ ] **Step 3.2: Write `docs/actions-bump-bot/PROMPT.md`**\n\nMirror the dep-triage prompt structure. Key sections:\n\n1. **Role** — \"Action SHA-bump caretaker. Single job: keep\n `.github/workflows/*.yml` action references at their latest\n tags-as-SHA.\"\n2. **Scope this run** — \"Run weekly. Inputs come from\n `node scripts/bump-actions.mjs`.\"\n3. **Process** — branch off `develop`\n (`chore/actions-bump-YYYY-MM-DD`), apply each bump, verify\n `actionlint` clean, run `npm run verify`, open one PR with the\n diff. Owner reviews and merges.\n4. **Hard rules** — never bump across a major (require explicit owner\n approval); never edit the SHA without re-resolving via `gh api`;\n never alter the trailing `# vX.Y.Z` comment without matching the\n bumped tag.\n5. **Output** — single PR per run, body lists each `(action, old SHA,\n new SHA, version label)`. No-op runs: post a one-line comment on the\n tracker issue `Action SHA bumps — develop` and exit.\n6. **Failure handling** — verify fails → close branch, comment on\n tracker.\n\n- [ ] **Step 3.3: Write `docs/actions-bump-bot/README.md`**\n\n- [ ] **Step 3.4: Commit**\n\n```bash\ngit add docs/actions-bump-bot/\ngit commit -m \"docs(routine): add weekly action-SHA bump prompt\"\n```\n\n---\n\n### Task 4: Plan reconciliation routine prompt\n\n**Why monthly, not weekly:** plans are coarse-grained; a weekly cadence\nwould mostly produce no-ops. Monthly aligns with how often roadmap\nrows complete in batches.\n\n**Files:**\n- Create: `docs/plan-recon-bot/PROMPT.md`\n- Create: `docs/plan-recon-bot/README.md`\n\n- [ ] **Step 4.1: Read the archive convention**\n\n```bash\ncat docs/archive/README.md\nls docs/archive/plans/\nls docs/plans/\n```\n\n- [ ] **Step 4.2: Write `docs/plan-recon-bot/PROMPT.md`**\n\nSections:\n\n1. **Role** — \"Plan archivist. Reconcile `docs/plans/*.md` against\n shipped state. Different from docs-review-bot (which audits prose\n drift); this routine answers 'is this plan done?' \"\n2. **Scope this run** — every file under `docs/plans/`. For each:\n parse roadmap rows, cross-check `git log origin/develop` (and the\n tracker issue if linked) for shipped status, and either (a) leave\n alone if work continues, (b) move to `docs/archive/plans/` via\n `git mv` if every row is shipped or the plan is superseded.\n3. **Hard rules** — never delete plan content; only `git mv`. Preserve\n the date prefix. Never archive a plan that has open rows.\n4. **Output** — open one PR per run with archive moves, body lists\n each `(plan, last shipped row, archive reason)`. No moves needed:\n post a one-line comment on the tracker issue `Plan reconciliation`\n and exit.\n5. **Failure handling** — same pattern as the other routines.\n\n- [ ] **Step 4.3: Write `docs/plan-recon-bot/README.md`**\n\n- [ ] **Step 4.4: Commit**\n\n```bash\ngit add docs/plan-recon-bot/\ngit commit -m \"docs(routine): add monthly plan reconciliation prompt\"\n```\n\n---\n\n## Chunk 3: Bundle-size trend (row 5)\n\nRationale: existing `size-limit-comment` job posts the per-PR delta but\ngives no longitudinal view. A weekly snapshot to a committed JSONL\nfile in `docs/metrics/` lets us graph the trend later (and inspect by\ndiff today).\n\n### Task 5: Weekly bundle-size trend snapshot\n\n**Files:**\n- Create: `scripts/append-size-snapshot.mjs`\n- Create: `.github/workflows/bundle-size-trend.yml`\n- Create: `docs/metrics/bundle-trend.jsonl` (empty file at first commit)\n\n- [ ] **Step 5.1: Write the snapshot script (TDD)**\n\nCreate `scripts/append-size-snapshot.test.mjs` first, then the\nimplementation. The test feeds the script a fixture `size-limit --json`\noutput via stdin and asserts:\n\n- Output JSONL has exactly one row.\n- Row keys: `iso` (UTC ISO-8601 date), `sha` (7-char head SHA from\n env), `entries` (array of `{name, size, gzip}` from input).\n- Existing rows in the target file are preserved; the new row is\n appended.\n\n```js\n// scripts/append-size-snapshot.test.mjs\nimport { test, expect } from 'vitest';\nimport { spawnSync } from 'node:child_process';\nimport { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\ntest('appends one JSONL row from size-limit JSON on stdin', () => {\n const dir = mkdtempSync(join(tmpdir(), 'sizesnap-'));\n const target = join(dir, 'bundle-trend.jsonl');\n writeFileSync(target, ''); // empty\n const fixture = JSON.stringify([\n { name: 'core', size: 1234, gzip: 567 },\n { name: 'integrations/excalibur', size: 200, gzip: 100 },\n ]);\n const out = spawnSync(\n process.execPath,\n ['scripts/append-size-snapshot.mjs', '--target', target],\n { input: fixture, env: { ...process.env, GITHUB_SHA: 'abcdef0' } },\n );\n expect(out.status).toBe(0);\n const rows = readFileSync(target, 'utf8').trim().split('\\n').filter(Boolean);\n expect(rows).toHaveLength(1);\n const row = JSON.parse(rows[0]);\n expect(row.sha).toBe('abcdef0');\n expect(row.entries).toHaveLength(2);\n expect(row.iso).toMatch(/^\\d{4}-\\d{2}-\\d{2}T/);\n});\n```\n\n- [ ] **Step 5.2: Run the test (red)**\n\n```bash\nnpx vitest run scripts/append-size-snapshot.test.mjs\n```\n\nExpected: FAIL (`Cannot find module 'scripts/append-size-snapshot.mjs'`).\n\n- [ ] **Step 5.3: Implement `scripts/append-size-snapshot.mjs`**\n\nArgv: `--target `. Reads stdin → JSON. Builds `{iso, sha,\nentries}`. Appends one line. Idempotent on identical content (skip if\nlast line equals new line minus `iso`).\n\n- [ ] **Step 5.4: Re-run the test (green)**\n\n```bash\nnpx vitest run scripts/append-size-snapshot.test.mjs\n```\n\nExpected: PASS.\n\n- [ ] **Step 5.5: Create the empty trend file**\n\n```bash\ntouch docs/metrics/bundle-trend.jsonl\n```\n\nAdd a 2-line preamble inside the file? **No.** JSONL by definition has\nno header; downstream tools assume one JSON value per line. Keep it\nempty.\n\n- [ ] **Step 5.6: Write `.github/workflows/bundle-size-trend.yml`**\n\n```yaml\nname: Bundle-size trend\n\non:\n schedule:\n # Sundays 04:00 UTC. After the Monday CodeQL window so two cron\n # workflows don't collide on a single runner pool peak.\n - cron: '0 4 * * 0'\n workflow_dispatch:\n\npermissions:\n contents: write # commits the snapshot row\n\njobs:\n snapshot:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@ # v6.0.2\n with: { ref: develop }\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run build\n - name: Append snapshot row\n env:\n GITHUB_SHA: ${{ github.sha }}\n run: |\n npx size-limit --json | \\\n node scripts/append-size-snapshot.mjs \\\n --target docs/metrics/bundle-trend.jsonl\n - name: Commit + push if changed\n run: |\n git config user.name \"github-actions[bot]\"\n git config user.email \"41898282+github-actions[bot]@users.noreply.github.com\"\n if [[ -n \"$(git status --porcelain docs/metrics/bundle-trend.jsonl)\" ]]; then\n git add docs/metrics/bundle-trend.jsonl\n git commit -m \"chore(metrics): bundle-size snapshot $(date -u +%F)\"\n git push origin develop\n fi\n```\n\n> **Direct push to `develop`?** The repo rule says \"never push direct\n> to develop\" but explicitly allows post-merge pulls. This is a metrics\n> append by github-actions bot, not human work. If branch protection\n> on `develop` blocks even bot pushes, switch to: open a PR per run via\n> `peter-evans/create-pull-request` and let the dep-triage routine\n> auto-merge it. Decide at step 5.7.\n\n- [ ] **Step 5.7: Decide direct-push vs PR-bot path**\n\n```bash\ngh api repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/branches/develop/protection 2>&1 | head -20\n```\n\nIf `required_status_checks` includes `ci-gate` and direct push is\nblocked → switch the workflow to open a PR via\n`peter-evans/create-pull-request@` and document the path swap in\nthis row.\n\n- [ ] **Step 5.8: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/bundle-size-trend.yml\nnpm run verify\n```\n\n- [ ] **Step 5.9: Commit**\n\n```bash\ngit add scripts/append-size-snapshot.mjs scripts/append-size-snapshot.test.mjs \\\n docs/metrics/bundle-trend.jsonl .github/workflows/bundle-size-trend.yml\ngit commit -m \"ci(metrics): weekly bundle-size trend snapshot\"\n```\n\n---\n\n## Chunk 4: Determinism replay benchmark (row 6)\n\nRationale: the determinism rule (`SeededRng` + `ManualClock` ⇒ byte-\nidentical `DecisionTrace`) is enforced statically by ESLint\n(no `Date.now`/`Math.random`) but never tested **end-to-end**. A\nhash-pinned replay across N seeds catches non-static violations: a new\nhelper that secretly reads `performance.now()`, a `Date` constructor\ninside a needs policy, etc.\n\n### Task 6: Hash-pinned replay across N seeds\n\n**Files:**\n- Create: `tests/determinism/replay.ts`\n- Create: `tests/determinism/replay.bench.ts` *(actually a vitest\n test, not a bench — using `.bench.ts` would skew CI timing)*\n- Create: `tests/determinism/baseline.json`\n- Create: `scripts/run-determinism-replay.mjs`\n- Create: `.github/workflows/determinism.yml`\n- Modify: `package.json` — scripts `determinism:replay`,\n `determinism:baseline`.\n\n- [ ] **Step 6.1: Decide the seed set**\n\nPick 8 seed strings. Mix short, long, ASCII, and non-ASCII to also\ncatch encoding regressions. Hard-code in `replay.ts`:\n\n```ts\nexport const REPLAY_SEEDS = [\n 'alpha', 'beta', 'gamma',\n '12345678901234567890',\n 'snowman-☃️',\n 'mixed-CASE-42',\n 'r-eat-then-sleep',\n 'mood-swing-edge',\n];\n```\n\n- [ ] **Step 6.2: Write `tests/determinism/replay.ts`**\n\nPure function `replaySeed(seed: string): string` (sha256 hex). Inside:\n\n1. Construct `SeededRng(seed)` + `ManualClock(0)`.\n2. Build a default agent via the public test helpers (mirror the\n pattern in `tests/integration/`).\n3. Tick 1000 times advancing the clock by 100 ms per tick.\n4. Stream every event from the bus into a hash; return the digest.\n\nUse `crypto.createHash('sha256')` from `node:crypto`.\n\n- [ ] **Step 6.3: Write the assertion test (red)**\n\n```ts\n// tests/determinism/replay.bench.ts\nimport { test, expect } from 'vitest';\nimport { readFileSync } from 'node:fs';\nimport { REPLAY_SEEDS, replaySeed } from './replay.js';\n\nconst baseline = JSON.parse(readFileSync(\n new URL('./baseline.json', import.meta.url), 'utf8'\n)) as Record;\n\ntest.each(REPLAY_SEEDS)('replay matches baseline: %s', (seed) => {\n expect(replaySeed(seed)).toBe(baseline[seed]);\n});\n```\n\n- [ ] **Step 6.4: Run the test (red)**\n\n```bash\nnpx vitest run tests/determinism/replay.bench.ts\n```\n\nExpected: FAIL — `baseline.json` does not exist yet.\n\n- [ ] **Step 6.5: Generate `baseline.json` once**\n\n```bash\nnode --import tsx scripts/run-determinism-replay.mjs --write-baseline\n```\n\nThe script imports `replaySeed` + `REPLAY_SEEDS`, computes one digest\nper seed, writes the map to `tests/determinism/baseline.json`.\n\n- [ ] **Step 6.6: Re-run the test (green)**\n\n```bash\nnpx vitest run tests/determinism/replay.bench.ts\n```\n\nExpected: PASS for all 8 seeds.\n\n- [ ] **Step 6.7: Run twice in the same shell to confirm stability**\n\n```bash\nfor i in 1 2 3; do npx vitest run tests/determinism/replay.bench.ts; done\n```\n\nExpected: PASS PASS PASS. Any flake means the harness is non-\ndeterministic — fix `replay.ts` rather than weakening the assertion.\n\n- [ ] **Step 6.8: Wire scripts**\n\n```json\n// package.json — add to \"scripts\":\n\"determinism:replay\": \"vitest run tests/determinism/replay.bench.ts\",\n\"determinism:baseline\": \"node --import tsx scripts/run-determinism-replay.mjs --write-baseline\"\n```\n\n- [ ] **Step 6.9: Workflow**\n\n```yaml\n# .github/workflows/determinism.yml\nname: Determinism replay\n\non:\n schedule:\n - cron: '0 5 * * 1' # Mondays 05:00 UTC, before CodeQL\n push:\n branches: [develop]\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n replay:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run determinism:replay\n```\n\n> **Why also on `push: develop`?** Catching a determinism violation\n> *between* the weekly run is worth one ~1-minute job per merge.\n\n- [ ] **Step 6.10: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/determinism.yml\nnpm run verify\n```\n\n- [ ] **Step 6.11: Commit**\n\n```bash\ngit add tests/determinism/ scripts/run-determinism-replay.mjs \\\n .github/workflows/determinism.yml package.json\ngit commit -m \"test(determinism): hash-pinned replay across 8 seeds\"\n```\n\n---\n\n## Chunk 5: Mutation testing (row 7)\n\nRationale: existing coverage delta proves *lines ran*. Mutation testing\nproves *tests would fail if the line changed*. Pairs with the existing\ncoverage PR comment to close the \"test asserts nothing\" loophole.\n\n### Task 7: Stryker weekly run\n\n**Files:**\n- Create: `stryker.config.mjs`\n- Create: `.github/workflows/mutation.yml`\n- Modify: `package.json` (devDeps + scripts)\n- Modify: `.gitignore`\n\n- [ ] **Step 7.1: Add devDeps**\n\n```bash\nnpm install --save-dev --save-exact \\\n @stryker-mutator/core@latest \\\n @stryker-mutator/vitest-runner@latest\n```\n\nPin exact versions in `package.json`. Update lockfile.\n\n- [ ] **Step 7.2: Write `stryker.config.mjs`**\n\n```js\n// stryker.config.mjs\n/** @type {import('@stryker-mutator/api/core').PartialStrykerOptions} */\nexport default {\n testRunner: 'vitest',\n reporters: ['progress', 'clear-text', 'html', 'dashboard'],\n coverageAnalysis: 'perTest',\n // Mutate library source only. Skip integrations + tooling.\n mutate: [\n 'src/**/*.ts',\n '!src/**/*.test.ts',\n '!src/**/index.ts',\n '!src/integrations/**',\n '!src/**/internal/**', // already covered transitively via callers\n ],\n thresholds: { high: 80, low: 60, break: 55 },\n htmlReporter: { fileName: 'reports/mutation/mutation.html' },\n timeoutMS: 15_000,\n concurrency: 4,\n};\n```\n\n> Threshold seed values are placeholders — the first run produces the\n> baseline. After that run lands, replace `break: 55` with `current\n> score - 2` so future regressions fail the job but normal noise does\n> not. Capture the baseline number in the row's commit message.\n\n- [ ] **Step 7.3: Add scripts to `package.json`**\n\n```json\n\"mutation\": \"stryker run\",\n\"mutation:report\": \"open reports/mutation/mutation.html\"\n```\n\n- [ ] **Step 7.4: Update `.gitignore`**\n\n```\nreports/mutation/\n.stryker-tmp/\n```\n\n- [ ] **Step 7.5: Run locally to capture the baseline score**\n\n```bash\nnpm run mutation\n```\n\nExpected: prints a score (e.g. \"Mutation score: 73.4%\"). This is the\nbaseline. **Update `stryker.config.mjs` `thresholds.break`** to\n`floor(score) - 2` and re-run to confirm green.\n\n> Local run on full suite is slow (~15-30 min). If it exceeds 45 min,\n> trim `mutate` further (e.g. exclude `src/persistence/` for the first\n> pass) and document the carve-out in the row's commit message.\n\n- [ ] **Step 7.6: Workflow**\n\n```yaml\n# .github/workflows/mutation.yml\nname: Mutation testing\n\non:\n schedule:\n - cron: '0 7 * * 1' # Mondays 07:00 UTC, after CodeQL + determinism\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n stryker:\n runs-on: ubuntu-latest\n timeout-minutes: 60\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run mutation\n - uses: actions/upload-artifact@ # v5.0.0\n if: always()\n with:\n name: mutation-report\n path: reports/mutation/\n if-no-files-found: error\n retention-days: 30\n```\n\n- [ ] **Step 7.7: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/mutation.yml\nnpm run verify\n```\n\n> `npm run verify` does NOT include `npm run mutation` — too slow for\n> the pre-PR gate. Mutation runs only on the weekly schedule.\n\n- [ ] **Step 7.8: Commit**\n\n```bash\ngit add stryker.config.mjs .github/workflows/mutation.yml \\\n package.json package-lock.json .gitignore\ngit commit -m \"test(mutation): weekly Stryker run on develop (baseline N%)\"\n```\n\n---\n\n## Chunk 6: Demo Playwright smoke (row 8)\n\nRationale: existing CI builds the demo (`demo-build` job) but never\nruns it. A headless click-through across the golden path catches\nruntime regressions that typecheck + bundle don't (tfjs backend probe,\n`base` URL handling, vite HTML transform regressions — see\n`MEMORY.md → feedback_vite_html_transform`).\n\n### Task 8: Playwright golden-path smoke\n\n**Files:**\n- Create: `examples/nurture-pet/playwright.config.ts`\n- Create: `examples/nurture-pet/tests/smoke/golden-path.spec.ts`\n- Create: `.github/workflows/demo-smoke.yml`\n- Modify: `examples/nurture-pet/package.json` — devDep + script\n- Modify: `.gitignore`\n\n- [ ] **Step 8.1: Add Playwright to the demo**\n\n```bash\ncd examples/nurture-pet\nnpm install --save-dev --save-exact @playwright/test@latest\nnpx playwright install --with-deps chromium\ncd -\n```\n\nPin `@playwright/test` in `examples/nurture-pet/package.json`. Do NOT\nadd it to the root `package.json` — the demo manages its own deps\n(`MEMORY.md` notes the `file:../..` EISDIR pitfall on Windows).\n\n- [ ] **Step 8.2: `examples/nurture-pet/playwright.config.ts`**\n\n```ts\nimport { defineConfig, devices } from '@playwright/test';\n\nexport default defineConfig({\n testDir: './tests/smoke',\n fullyParallel: false, // single demo instance, single worker\n forbidOnly: !!process.env.CI,\n retries: process.env.CI ? 1 : 0,\n workers: 1,\n reporter: process.env.CI ? [['github'], ['html']] : 'list',\n use: {\n baseURL: 'http://127.0.0.1:4173',\n trace: 'retain-on-failure',\n screenshot: 'only-on-failure',\n },\n webServer: {\n command: 'npm run preview -- --host 127.0.0.1 --port 4173',\n url: 'http://127.0.0.1:4173',\n reuseExistingServer: !process.env.CI,\n timeout: 60_000,\n },\n projects: [\n { name: 'chromium', use: { ...devices['Desktop Chrome'] } },\n ],\n});\n```\n\n- [ ] **Step 8.3: Write `tests/smoke/golden-path.spec.ts`**\n\n```ts\nimport { test, expect } from '@playwright/test';\n\ntest('golden path: feed → pet → sleep updates HUD without console errors', async ({\n page,\n}) => {\n const consoleErrors: string[] = [];\n page.on('pageerror', (e) => consoleErrors.push(e.message));\n page.on('console', (msg) => {\n if (msg.type() === 'error') consoleErrors.push(msg.text());\n });\n\n await page.goto('/');\n await expect(page.getByRole('heading', { level: 1 })).toBeVisible();\n\n // Replace selectors with the actual demo controls — discoverable via\n // `npm run dev` + DevTools. Keep this spec tied to user-facing roles\n // (button names, ARIA labels) not implementation classes.\n await page.getByRole('button', { name: /feed/i }).click();\n await page.getByRole('button', { name: /pet/i }).click();\n await page.getByRole('button', { name: /sleep/i }).click();\n\n // HUD assertion — pick one stable observable (e.g. \"Hunger\" stat\n // text changes). Adapt during step 8.4.\n await expect(page.getByTestId('hud-needs')).toContainText(/Hunger/);\n\n expect(consoleErrors).toEqual([]);\n});\n```\n\n- [ ] **Step 8.4: Run locally to wire selectors**\n\n```bash\ncd examples/nurture-pet\nnpm run build && npm run preview &\nPREVIEW_PID=$!\nnpx playwright test --headed --project=chromium\nkill $PREVIEW_PID\ncd -\n```\n\nIterate on selectors until the spec passes. **If the demo lacks stable\ntestids on the HUD, add them in this same row** (not a separate PR;\nthe smoke depends on them).\n\n- [ ] **Step 8.5: Add script to `examples/nurture-pet/package.json`**\n\n```json\n\"smoke\": \"playwright test\"\n```\n\n- [ ] **Step 8.6: Update `.gitignore`**\n\n```\nexamples/nurture-pet/playwright-report/\nexamples/nurture-pet/test-results/\n```\n\n- [ ] **Step 8.7: Workflow**\n\n```yaml\n# .github/workflows/demo-smoke.yml\nname: Demo smoke\n\non:\n schedule:\n - cron: '30 3 * * *' # Daily 03:30 UTC\n pull_request:\n paths:\n - 'examples/nurture-pet/**'\n - 'src/**' # library changes can break demo at runtime\n - '.github/workflows/demo-smoke.yml'\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n smoke:\n runs-on: ubuntu-latest\n timeout-minutes: 15\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run build\n - name: Install demo deps\n working-directory: examples/nurture-pet\n run: npm ci --no-audit --no-fund\n - name: Install Playwright browsers\n working-directory: examples/nurture-pet\n run: npx playwright install --with-deps chromium\n - name: Build demo\n working-directory: examples/nurture-pet\n run: npm run build\n - name: Smoke (Playwright)\n working-directory: examples/nurture-pet\n run: npm run smoke\n - uses: actions/upload-artifact@ # v5.0.0\n if: failure()\n with:\n name: playwright-report\n path: examples/nurture-pet/playwright-report/\n retention-days: 14\n```\n\n- [ ] **Step 8.8: actionlint + verify (root) + smoke run (demo)**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/demo-smoke.yml\nnpm run verify\n( cd examples/nurture-pet && npm run smoke )\n```\n\n- [ ] **Step 8.9: Commit**\n\n```bash\ngit add examples/nurture-pet/playwright.config.ts \\\n examples/nurture-pet/tests/ \\\n examples/nurture-pet/package.json \\\n examples/nurture-pet/package-lock.json \\\n .github/workflows/demo-smoke.yml \\\n .gitignore\ngit commit -m \"test(demo): nightly Playwright smoke on golden path\"\n```\n\n---\n\n## Chunk 7: Final wiring (rows 9–10)\n\n### Task 9: Doc updates\n\n**Files:**\n- Modify: `CONTRIBUTING.md`\n- Modify: `README.md`\n\n- [ ] **Step 9.1: `CONTRIBUTING.md`**\n\nAdd a brief \"Quality automation\" subsection under the existing dev-loop\nsection. List `npm run mutation`, `npm run determinism:replay`, and\n`( cd examples/nurture-pet && npm run smoke )` with one-line purposes.\n\n- [ ] **Step 9.2: `README.md`**\n\nAdd one bullet under the existing Quality / CI section linking to:\n- `docs/metrics/bundle-trend.jsonl`\n- `docs/dep-triage-bot/README.md`\n- `docs/actions-bump-bot/README.md`\n- `docs/plan-recon-bot/README.md`\n\nNo screenshots, no badges. Keep it terse.\n\n- [ ] **Step 9.3: Commit**\n\n```bash\ngit add CONTRIBUTING.md README.md\ngit commit -m \"docs: link new quality-automation surfaces\"\n```\n\n---\n\n### Task Final: Flip PR to ready-for-review\n\n- [ ] **Final.1: Run the full gate one more time**\n\n```bash\nnpm run verify\n( cd examples/nurture-pet && npm run smoke )\nnpm run determinism:replay\n```\n\nMutation is **not** in this gate — too slow. Owner can spot-check by\nrunning `npm run mutation` if desired.\n\n- [ ] **Final.2: Confirm every checkbox above is ticked**\n\n```bash\ngrep -E '^- \\[ \\]' docs/plans/2026-04-26-quality-automation-routines.md\n```\n\nExpected: no output (zero unchecked boxes).\n\n- [ ] **Final.3: Mark PR ready**\n\n```bash\ngh pr ready \n```\n\n- [ ] **Final.4: Optional — add a Codex re-review trigger**\n\n```bash\ngh pr comment --body \"@codex review\"\n```\n\nStandard pattern from `MEMORY.md → feedback_pr_codex_polling.md`. If\nfindings come back, address per\n`MEMORY.md → feedback_codex_signal_endpoints.md`.\n\n---\n\n## Risk register (read once before starting)\n\n- **Stryker runtime explosion.** If the suite balloons past 45 min on a\n single runner, drop `concurrency` to match the runner's vCPU count\n and / or split the `mutate` glob across two workflow jobs (e.g.\n `src/agent/**` vs. everything else). Don't lower the threshold to\n paper over slowness.\n- **Determinism baseline drift.** Any legitimate library change that\n alters trace contents (new event type, reordered tick stage)\n invalidates `baseline.json`. Treat that as an explicit re-baseline\n step in the same PR that changes behavior — never bypass the\n assertion. Add a `determinism:baseline` script comment in\n `package.json` calling this out.\n- **Playwright flake.** The demo loads tfjs which probes WebGL → WASM →\n CPU on startup. In CI on Ubuntu, expect WASM. Allow `retries: 1`\n but never higher; >1 retries hides real flakes.\n- **Bot-pushed develop commits.** Row 5 pushes a metrics row directly\n to `develop` from a workflow. If branch protection blocks this\n (likely), pivot to PR-bot path documented in step 5.7. Don't\n weaken protection.\n- **Action SHA churn.** Every new workflow added in this PR uses pinned\n SHAs. After this PR merges, the next `actions-bump-bot` run will\n attempt to bump them. That's expected — review that bump PR like any\n other.\n- **One PR, one branch.** Owner explicitly approved bundling all eight\n rows on this branch. Project default (`one PR, one concern`) does\n not apply here. If a reviewer flags split-required, point them to\n this plan section.\n\n---\n\n## When to mark this plan shipped\n\nMove this file to `docs/archive/plans/2026-04-26-quality-automation-routines.md`\nvia `git mv` in the **same commit** that flips the PR to merged (or in\na follow-up `chore(docs)` commit on `develop` if that's not feasible).\nPer `MEMORY.md → feedback_docs_alongside_pr.md`.\n{\"title\":\"chore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)\",\"body\":\"# Quality automation routines — implementation plan\\n\\n> **For agentic workers:** REQUIRED: follow this plan top-to-bottom on\\n> branch `chore/quality-automation-routines` (worktree\\n> `.worktrees/chore-quality-automation`). Steps use checkbox (`- [ ]`)\\n> syntax for tracking. The PR opens **draft** with this plan as its body\\n> reference; flip to ready-for-review only after every row below is\\n> checked off and `npm run verify` is green.\\n\\n**Goal:** Close known quality / supply-chain / drift gaps not covered by\\nthe existing CI gate or the daily-code-review + weekly-docs-review\\nroutines, by adding seven new automation surfaces (six CI/cron jobs +\\nthree cloud-routine prompts).\\n\\n**Architecture:**\\n\\n- **GitHub Actions workflows** (`.github/workflows/*.yml`) for jobs that\\n need to run inside CI infra (CodeQL, mutation testing, Playwright,\\n bundle-size trend, determinism replay).\\n- **Cloud-routine prompt directories** (`docs//PROMPT.md` +\\n `README.md`) for jobs that need an LLM-driven agent (dependency\\n triage, action SHA bumps, plan reconciliation). Same shape as the\\n existing `docs/review-bot/` and `docs/docs-review-bot/`.\\n- **No core library changes.** All additions live under `.github/`,\\n `docs/`, `tests/determinism/`, and `examples/nurture-pet/`. No\\n `src/**` edits. No changesets needed (tooling-only PR).\\n\\n**Tech stack:**\\n\\n- GitHub Actions, Dependabot, CodeQL.\\n- StrykerJS (`@stryker-mutator/core` + `@stryker-mutator/vitest-runner`)\\n for mutation testing.\\n- Playwright (`@playwright/test`) for demo smoke.\\n- Existing `scripts/bump-actions.mjs`, `scripts/coverage-pr-comment.mjs`\\n pattern for any new helper scripts.\\n\\n**Out of scope (this plan):**\\n\\n- Stale-branch cleaner — explicitly deferred per owner decision\\n (2026-04-26).\\n- Type-coverage report, license/SBOM audit, mutation testing on\\n examples — punt to a future plan if value materializes.\\n\\n---\\n\\n## File structure\\n\\n### New files\\n\\n| Path | Responsibility |\\n| --- | --- |\\n| `.github/workflows/codeql.yml` | Weekly + push-to-develop CodeQL JS/TS scan. |\\n| `.github/workflows/mutation.yml` | Weekly Stryker run on `develop`; uploads HTML report artifact. |\\n| `.github/workflows/demo-smoke.yml` | Nightly Playwright headless run against built demo. |\\n| `.github/workflows/bundle-size-trend.yml` | Weekly snapshot of `npx size-limit --json` to a committed `docs/metrics/bundle-trend.jsonl`. |\\n| `.github/workflows/determinism.yml` | Weekly replay of seeded pet sims; hash-compares `DecisionTrace` against committed baseline. |\\n| `stryker.config.mjs` | Stryker config (vitest runner, sane mutate globs, threshold). |\\n| `examples/nurture-pet/playwright.config.ts` | Playwright config for the demo smoke spec. |\\n| `examples/nurture-pet/tests/smoke/golden-path.spec.ts` | Click Feed/Pet/Sleep/Train; assert HUD updates + no console errors. |\\n| `tests/determinism/replay.bench.ts` | Vitest-driven replay across N seeds; emits one `sha256(trace-stream)` per seed. |\\n| `tests/determinism/baseline.json` | Committed map `{ seedString: sha256 }` (ground truth). |\\n| `tests/determinism/replay.ts` | Replay harness (pure function: seed → trace stream → sha). |\\n| `docs/metrics/bundle-trend.jsonl` | Append-only JSONL: one row per weekly snapshot. Created by row 5. |\\n| `docs/dep-triage-bot/PROMPT.md` | System prompt for the weekly Dependabot triage routine. |\\n| `docs/dep-triage-bot/README.md` | How the routine consumes `PROMPT.md`, where outputs go. |\\n| `docs/actions-bump-bot/PROMPT.md` | System prompt for the weekly action-SHA bump routine. |\\n| `docs/actions-bump-bot/README.md` | Same shape as above. |\\n| `docs/plan-recon-bot/PROMPT.md` | System prompt for the monthly plan-vs-shipped reconciliation routine. |\\n| `docs/plan-recon-bot/README.md` | Same shape as above. |\\n| `scripts/append-size-snapshot.mjs` | Read `npx size-limit --json` stdin, append a row to `docs/metrics/bundle-trend.jsonl`. |\\n| `scripts/run-determinism-replay.mjs` | CLI wrapper that runs `tests/determinism/replay.ts` for the workflow + diffs vs baseline; non-zero exit on mismatch. |\\n\\n### Modified files\\n\\n| Path | Change |\\n| --- | --- |\\n| `package.json` | Add devDeps: `@stryker-mutator/core`, `@stryker-mutator/vitest-runner`, `@playwright/test`. Add scripts: `mutation`, `mutation:report`, `determinism:replay`, `determinism:baseline`. |\\n| `examples/nurture-pet/package.json` | Add devDep `@playwright/test`; script `smoke`. |\\n| `.gitignore` | Ignore `reports/mutation/`, `playwright-report/`, `examples/nurture-pet/playwright-report/`, `examples/nurture-pet/test-results/`. |\\n| `.github/dependabot.yml` | Group npm minor + patch updates so the triage routine sees one PR per ecosystem-week, not N. |\\n| `CONTRIBUTING.md` | Brief mention of mutation / smoke / determinism scripts in the dev-loop section. |\\n| `README.md` | One-line bullet under the badges/quality section: links to the trend file + bot prompts. |\\n\\n### Branching / PR shape\\n\\nThis plan ships on **one** branch (`chore/quality-automation-routines`)\\nunder **one** draft PR (`docs(plans): quality-automation routines + ...`).\\nPer owner direction, every row below lands as its own commit on this\\nbranch. The PR is flipped to ready-for-review only after the final row\\nchecks off and `npm run verify` is green.\\n\\n> **Why one PR, not the usual one-per-row?** This batch is mostly\\n> additive infra (workflows + prompts + dev-deps) with near-zero blast\\n> radius on the library. Splitting eight tooling-only rows into eight\\n> PRs would burn ~8 Codex review cycles for marginal review benefit.\\n> When a row touches `src/**` (none of them do here) future plans\\n> revert to the standard one-row-per-PR rule.\\n\\n---\\n\\n## Verification gate per row\\n\\nEach row ends with `npm run verify` passing locally before commit. New\\nworkflows must additionally be **lint-clean under `actionlint`**\\n(already wired into CI) — run locally with:\\n\\n```bash\\ndocker run --rm -v \\\"$PWD\\\":/repo -w /repo rhysd/actionlint:latest -color\\n```\\n\\n…or push the commit and watch the existing `Lint workflows (actionlint)`\\njob. New action references must use full 40-char SHAs with a trailing\\n`# vX.Y.Z` comment (per the supply-chain rule in the existing CI\\nheader). Resolve a SHA via:\\n\\n```bash\\ngh api repos///commits/ --jq '.sha'\\n```\\n\\n---\\n\\n## Chunk 1: Bootstrap (rows 0–1)\\n\\n### Task 0: Land the plan + open the draft PR\\n\\n**Files:**\\n- Create: `docs/plans/2026-04-26-quality-automation-routines.md` (this file).\\n\\n- [ ] **Step 0.1: Confirm worktree on `chore/quality-automation-routines`**\\n\\n```bash\\ngit -C .worktrees/chore-quality-automation rev-parse --abbrev-ref HEAD\\n# expected: chore/quality-automation-routines\\n```\\n\\n- [ ] **Step 0.2: Stage and commit the plan**\\n\\n```bash\\ngit -C .worktrees/chore-quality-automation add docs/plans/2026-04-26-quality-automation-routines.md\\ngit -C .worktrees/chore-quality-automation commit -m \\\"docs(plans): quality-automation routines roadmap\\\"\\n```\\n\\n- [ ] **Step 0.3: Push branch + open draft PR**\\n\\n```bash\\ngit -C .worktrees/chore-quality-automation push -u origin chore/quality-automation-routines\\ngh pr create --draft --base develop \\\\\\n --title \\\"chore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)\\\" \\\\\\n --body-file docs/plans/2026-04-26-quality-automation-routines.md\\n```\\n\\nExpected: draft PR URL printed, status `Draft`. Note the PR number for\\nlater step `Final.3`.\\n\\n---\\n\\n### Task 1: CodeQL weekly + push-to-develop\\n\\n**Why first:** single file, GitHub-native, zero new deps. Smallest\\npossible win.\\n\\n**Files:**\\n- Create: `.github/workflows/codeql.yml`\\n\\n- [ ] **Step 1.1: Resolve SHAs for `actions/checkout@v6` and\\n `github/codeql-action/{init,analyze}@v4`** (or current major)\\n\\n```bash\\ngh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'\\ngh api repos/github/codeql-action/git/refs/tags/v4 --jq '.object.sha'\\n```\\n\\nCapture the SHAs; use them verbatim in the YAML below with a trailing\\n`# v6.0.2` / `# v4` comment.\\n\\n- [ ] **Step 1.2: Write `.github/workflows/codeql.yml`**\\n\\n```yaml\\nname: CodeQL\\n\\non:\\n push:\\n branches: [develop, main]\\n pull_request:\\n branches: [develop, main]\\n schedule:\\n # Mondays 06:00 UTC — same window as docs-review weekly cadence.\\n - cron: '0 6 * * 1'\\n\\nconcurrency:\\n group: codeql-${{ github.ref }}\\n cancel-in-progress: true\\n\\npermissions:\\n contents: read\\n security-events: write\\n actions: read\\n\\njobs:\\n analyze:\\n name: Analyze (javascript-typescript)\\n runs-on: ubuntu-latest\\n strategy:\\n fail-fast: false\\n matrix:\\n language: [javascript-typescript]\\n steps:\\n - uses: actions/checkout@ # v6.0.2\\n - uses: github/codeql-action/init@ # v4\\n with:\\n languages: ${{ matrix.language }}\\n # security-and-quality is the broadest default suite that GA\\n # supports. security-extended would also work; quality-only\\n # would miss CWE-079/CWE-094 patterns we want flagged.\\n queries: security-and-quality\\n - uses: github/codeql-action/analyze@ # v4\\n with:\\n category: '/language:${{ matrix.language }}'\\n```\\n\\n- [ ] **Step 1.3: Local actionlint pass**\\n\\n```bash\\ndocker run --rm -v \\\"$PWD\\\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/codeql.yml\\n```\\n\\nExpected: no output (clean).\\n\\n- [ ] **Step 1.4: Verify locally that the gate is unaffected**\\n\\n```bash\\nnpm run verify\\n```\\n\\nExpected: same pass set as `develop`.\\n\\n- [ ] **Step 1.5: Commit**\\n\\n```bash\\ngit add .github/workflows/codeql.yml\\ngit commit -m \\\"ci(codeql): add weekly + push CodeQL JS/TS scan\\\"\\n```\\n\\n- [ ] **Step 1.6: Push and confirm the workflow runs in Actions tab**\\n\\n```bash\\ngit push\\n```\\n\\nExpected: a `CodeQL / Analyze (javascript-typescript)` run appears for\\nthe push and finishes success.\\n\\n---\\n\\n## Chunk 2: Cloud-routine prompts (rows 2–4)\\n\\nThese three rows add prompt directories only — no workflows, no deps,\\nno library code. Each ships behind `docs//`. The actual\\nscheduling happens outside the repo (Claude Cloud cron), same way as\\n`docs/review-bot/` and `docs/docs-review-bot/`.\\n\\n### Task 2: Dependabot triage routine prompt\\n\\n**Files:**\\n- Create: `docs/dep-triage-bot/PROMPT.md`\\n- Create: `docs/dep-triage-bot/README.md`\\n- Modify: `.github/dependabot.yml` — group npm minor+patch into one PR\\n per ecosystem-week so the triage routine sees a tractable input.\\n\\n- [ ] **Step 2.1: Read existing pattern**\\n\\n```bash\\ncat docs/docs-review-bot/PROMPT.md # use as structural template\\ncat docs/docs-review-bot/README.md\\ncat .github/dependabot.yml\\n```\\n\\n- [ ] **Step 2.2: Update `.github/dependabot.yml`**\\n\\nAdd a `groups:` block on each `package-ecosystem: \\\"npm\\\"` entry so minor\\n+ patch updates land in a single weekly PR rather than 5–10 separate\\nones.\\n\\n```yaml\\n# Example shape — adapt to existing keys verbatim.\\n- package-ecosystem: \\\"npm\\\"\\n directory: \\\"/\\\"\\n schedule:\\n interval: \\\"weekly\\\"\\n groups:\\n npm-non-major:\\n patterns: [\\\"*\\\"]\\n update-types: [\\\"minor\\\", \\\"patch\\\"]\\n```\\n\\n- [ ] **Step 2.3: Write `docs/dep-triage-bot/PROMPT.md`**\\n\\nSections to include (mirror `docs/review-bot/PROMPT.md`):\\n\\n1. **Role** — \\\"Senior dependency triage. Conservative, not adventurous.\\n Goal: drain the Dependabot pile without bricking the build.\\\"\\n2. **Scope this run** — \\\"Open Dependabot PRs targeting `develop`, label\\n `dependencies`.\\\"\\n3. **Triage policy** — patch + minor on dev-deps: rebase, run\\n `npm run verify`, auto-merge if green. Patch + minor on runtime\\n deps: rebase, run verify, leave a one-line approval comment but do\\n NOT merge (owner approval required). Major on anything: comment\\n with the changelog summary + breaking-change bullet list, leave for\\n owner. Peer-deps: never auto-merge.\\n4. **Hard rules** — never merge a PR that touches `src/**` (means\\n Dependabot generated more than a manifest bump, suspicious); never\\n bypass `--no-verify`; never amend the Dependabot commit.\\n5. **Output** — append a one-comment summary on a rolling\\n tracker issue `Dependency triage — develop` (label\\n `dep-triage-bot`).\\n6. **Failure handling** — verify fails → comment \\\"verify failed: \\\\\\\" on the Dependabot PR + tracker, do not merge.\\n\\nUse the same idempotency pattern as `docs/review-bot/PROMPT.md`\\n(rolling issue, append comments, never push direct to develop).\\n\\n- [ ] **Step 2.4: Write `docs/dep-triage-bot/README.md`**\\n\\nMirror `docs/review-bot/README.md`: how the routine consumes the\\nprompt, where output lives, how to evolve it.\\n\\n- [ ] **Step 2.5: Commit**\\n\\n```bash\\ngit add docs/dep-triage-bot/ .github/dependabot.yml\\ngit commit -m \\\"docs(routine): add weekly Dependabot triage prompt\\\"\\n```\\n\\n---\\n\\n### Task 3: Action SHA bump routine prompt\\n\\n**Files:**\\n- Create: `docs/actions-bump-bot/PROMPT.md`\\n- Create: `docs/actions-bump-bot/README.md`\\n\\n- [ ] **Step 3.1: Confirm `scripts/bump-actions.mjs` exists and works**\\n\\n```bash\\nnode scripts/bump-actions.mjs\\n```\\n\\nExpected: prints any pending bumps (or \\\"no drift\\\") without writing\\nfiles. Capture exact output shape — the prompt has to instruct the\\nagent how to parse it.\\n\\n- [ ] **Step 3.2: Write `docs/actions-bump-bot/PROMPT.md`**\\n\\nMirror the dep-triage prompt structure. Key sections:\\n\\n1. **Role** — \\\"Action SHA-bump caretaker. Single job: keep\\n `.github/workflows/*.yml` action references at their latest\\n tags-as-SHA.\\\"\\n2. **Scope this run** — \\\"Run weekly. Inputs come from\\n `node scripts/bump-actions.mjs`.\\\"\\n3. **Process** — branch off `develop`\\n (`chore/actions-bump-YYYY-MM-DD`), apply each bump, verify\\n `actionlint` clean, run `npm run verify`, open one PR with the\\n diff. Owner reviews and merges.\\n4. **Hard rules** — never bump across a major (require explicit owner\\n approval); never edit the SHA without re-resolving via `gh api`;\\n never alter the trailing `# vX.Y.Z` comment without matching the\\n bumped tag.\\n5. **Output** — single PR per run, body lists each `(action, old SHA,\\n new SHA, version label)`. No-op runs: post a one-line comment on the\\n tracker issue `Action SHA bumps — develop` and exit.\\n6. **Failure handling** — verify fails → close branch, comment on\\n tracker.\\n\\n- [ ] **Step 3.3: Write `docs/actions-bump-bot/README.md`**\\n\\n- [ ] **Step 3.4: Commit**\\n\\n```bash\\ngit add docs/actions-bump-bot/\\ngit commit -m \\\"docs(routine): add weekly action-SHA bump prompt\\\"\\n```\\n\\n---\\n\\n### Task 4: Plan reconciliation routine prompt\\n\\n**Why monthly, not weekly:** plans are coarse-grained; a weekly cadence\\nwould mostly produce no-ops. Monthly aligns with how often roadmap\\nrows complete in batches.\\n\\n**Files:**\\n- Create: `docs/plan-recon-bot/PROMPT.md`\\n- Create: `docs/plan-recon-bot/README.md`\\n\\n- [ ] **Step 4.1: Read the archive convention**\\n\\n```bash\\ncat docs/archive/README.md\\nls docs/archive/plans/\\nls docs/plans/\\n```\\n\\n- [ ] **Step 4.2: Write `docs/plan-recon-bot/PROMPT.md`**\\n\\nSections:\\n\\n1. **Role** — \\\"Plan archivist. Reconcile `docs/plans/*.md` against\\n shipped state. Different from docs-review-bot (which audits prose\\n drift); this routine answers 'is this plan done?' \\\"\\n2. **Scope this run** — every file under `docs/plans/`. For each:\\n parse roadmap rows, cross-check `git log origin/develop` (and the\\n tracker issue if linked) for shipped status, and either (a) leave\\n alone if work continues, (b) move to `docs/archive/plans/` via\\n `git mv` if every row is shipped or the plan is superseded.\\n3. **Hard rules** — never delete plan content; only `git mv`. Preserve\\n the date prefix. Never archive a plan that has open rows.\\n4. **Output** — open one PR per run with archive moves, body lists\\n each `(plan, last shipped row, archive reason)`. No moves needed:\\n post a one-line comment on the tracker issue `Plan reconciliation`\\n and exit.\\n5. **Failure handling** — same pattern as the other routines.\\n\\n- [ ] **Step 4.3: Write `docs/plan-recon-bot/README.md`**\\n\\n- [ ] **Step 4.4: Commit**\\n\\n```bash\\ngit add docs/plan-recon-bot/\\ngit commit -m \\\"docs(routine): add monthly plan reconciliation prompt\\\"\\n```\\n\\n---\\n\\n## Chunk 3: Bundle-size trend (row 5)\\n\\nRationale: existing `size-limit-comment` job posts the per-PR delta but\\ngives no longitudinal view. A weekly snapshot to a committed JSONL\\nfile in `docs/metrics/` lets us graph the trend later (and inspect by\\ndiff today).\\n\\n### Task 5: Weekly bundle-size trend snapshot\\n\\n**Files:**\\n- Create: `scripts/append-size-snapshot.mjs`\\n- Create: `.github/workflows/bundle-size-trend.yml`\\n- Create: `docs/metrics/bundle-trend.jsonl` (empty file at first commit)\\n\\n- [ ] **Step 5.1: Write the snapshot script (TDD)**\\n\\nCreate `scripts/append-size-snapshot.test.mjs` first, then the\\nimplementation. The test feeds the script a fixture `size-limit --json`\\noutput via stdin and asserts:\\n\\n- Output JSONL has exactly one row.\\n- Row keys: `iso` (UTC ISO-8601 date), `sha` (7-char head SHA from\\n env), `entries` (array of `{name, size, gzip}` from input).\\n- Existing rows in the target file are preserved; the new row is\\n appended.\\n\\n```js\\n// scripts/append-size-snapshot.test.mjs\\nimport { test, expect } from 'vitest';\\nimport { spawnSync } from 'node:child_process';\\nimport { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';\\nimport { tmpdir } from 'node:os';\\nimport { join } from 'node:path';\\n\\ntest('appends one JSONL row from size-limit JSON on stdin', () => {\\n const dir = mkdtempSync(join(tmpdir(), 'sizesnap-'));\\n const target = join(dir, 'bundle-trend.jsonl');\\n writeFileSync(target, ''); // empty\\n const fixture = JSON.stringify([\\n { name: 'core', size: 1234, gzip: 567 },\\n { name: 'integrations/excalibur', size: 200, gzip: 100 },\\n ]);\\n const out = spawnSync(\\n process.execPath,\\n ['scripts/append-size-snapshot.mjs', '--target', target],\\n { input: fixture, env: { ...process.env, GITHUB_SHA: 'abcdef0' } },\\n );\\n expect(out.status).toBe(0);\\n const rows = readFileSync(target, 'utf8').trim().split('\\\\n').filter(Boolean);\\n expect(rows).toHaveLength(1);\\n const row = JSON.parse(rows[0]);\\n expect(row.sha).toBe('abcdef0');\\n expect(row.entries).toHaveLength(2);\\n expect(row.iso).toMatch(/^\\\\d{4}-\\\\d{2}-\\\\d{2}T/);\\n});\\n```\\n\\n- [ ] **Step 5.2: Run the test (red)**\\n\\n```bash\\nnpx vitest run scripts/append-size-snapshot.test.mjs\\n```\\n\\nExpected: FAIL (`Cannot find module 'scripts/append-size-snapshot.mjs'`).\\n\\n- [ ] **Step 5.3: Implement `scripts/append-size-snapshot.mjs`**\\n\\nArgv: `--target `. Reads stdin → JSON. Builds `{iso, sha,\\nentries}`. Appends one line. Idempotent on identical content (skip if\\nlast line equals new line minus `iso`).\\n\\n- [ ] **Step 5.4: Re-run the test (green)**\\n\\n```bash\\nnpx vitest run scripts/append-size-snapshot.test.mjs\\n```\\n\\nExpected: PASS.\\n\\n- [ ] **Step 5.5: Create the empty trend file**\\n\\n```bash\\ntouch docs/metrics/bundle-trend.jsonl\\n```\\n\\nAdd a 2-line preamble inside the file? **No.** JSONL by definition has\\nno header; downstream tools assume one JSON value per line. Keep it\\nempty.\\n\\n- [ ] **Step 5.6: Write `.github/workflows/bundle-size-trend.yml`**\\n\\n```yaml\\nname: Bundle-size trend\\n\\non:\\n schedule:\\n # Sundays 04:00 UTC. After the Monday CodeQL window so two cron\\n # workflows don't collide on a single runner pool peak.\\n - cron: '0 4 * * 0'\\n workflow_dispatch:\\n\\npermissions:\\n contents: write # commits the snapshot row\\n\\njobs:\\n snapshot:\\n runs-on: ubuntu-latest\\n steps:\\n - uses: actions/checkout@ # v6.0.2\\n with: { ref: develop }\\n - uses: actions/setup-node@ # v6.4.0\\n with: { node-version: 22, cache: npm }\\n - run: npm ci\\n - run: npm run build\\n - name: Append snapshot row\\n env:\\n GITHUB_SHA: ${{ github.sha }}\\n run: |\\n npx size-limit --json | \\\\\\n node scripts/append-size-snapshot.mjs \\\\\\n --target docs/metrics/bundle-trend.jsonl\\n - name: Commit + push if changed\\n run: |\\n git config user.name \\\"github-actions[bot]\\\"\\n git config user.email \\\"41898282+github-actions[bot]@users.noreply.github.com\\\"\\n if [[ -n \\\"$(git status --porcelain docs/metrics/bundle-trend.jsonl)\\\" ]]; then\\n git add docs/metrics/bundle-trend.jsonl\\n git commit -m \\\"chore(metrics): bundle-size snapshot $(date -u +%F)\\\"\\n git push origin develop\\n fi\\n```\\n\\n> **Direct push to `develop`?** The repo rule says \\\"never push direct\\n> to develop\\\" but explicitly allows post-merge pulls. This is a metrics\\n> append by github-actions bot, not human work. If branch protection\\n> on `develop` blocks even bot pushes, switch to: open a PR per run via\\n> `peter-evans/create-pull-request` and let the dep-triage routine\\n> auto-merge it. Decide at step 5.7.\\n\\n- [ ] **Step 5.7: Decide direct-push vs PR-bot path**\\n\\n```bash\\ngh api repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/branches/develop/protection 2>&1 | head -20\\n```\\n\\nIf `required_status_checks` includes `ci-gate` and direct push is\\nblocked → switch the workflow to open a PR via\\n`peter-evans/create-pull-request@` and document the path swap in\\nthis row.\\n\\n- [ ] **Step 5.8: actionlint + verify**\\n\\n```bash\\ndocker run --rm -v \\\"$PWD\\\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/bundle-size-trend.yml\\nnpm run verify\\n```\\n\\n- [ ] **Step 5.9: Commit**\\n\\n```bash\\ngit add scripts/append-size-snapshot.mjs scripts/append-size-snapshot.test.mjs \\\\\\n docs/metrics/bundle-trend.jsonl .github/workflows/bundle-size-trend.yml\\ngit commit -m \\\"ci(metrics): weekly bundle-size trend snapshot\\\"\\n```\\n\\n---\\n\\n## Chunk 4: Determinism replay benchmark (row 6)\\n\\nRationale: the determinism rule (`SeededRng` + `ManualClock` ⇒ byte-\\nidentical `DecisionTrace`) is enforced statically by ESLint\\n(no `Date.now`/`Math.random`) but never tested **end-to-end**. A\\nhash-pinned replay across N seeds catches non-static violations: a new\\nhelper that secretly reads `performance.now()`, a `Date` constructor\\ninside a needs policy, etc.\\n\\n### Task 6: Hash-pinned replay across N seeds\\n\\n**Files:**\\n- Create: `tests/determinism/replay.ts`\\n- Create: `tests/determinism/replay.bench.ts` *(actually a vitest\\n test, not a bench — using `.bench.ts` would skew CI timing)*\\n- Create: `tests/determinism/baseline.json`\\n- Create: `scripts/run-determinism-replay.mjs`\\n- Create: `.github/workflows/determinism.yml`\\n- Modify: `package.json` — scripts `determinism:replay`,\\n `determinism:baseline`.\\n\\n- [ ] **Step 6.1: Decide the seed set**\\n\\nPick 8 seed strings. Mix short, long, ASCII, and non-ASCII to also\\ncatch encoding regressions. Hard-code in `replay.ts`:\\n\\n```ts\\nexport const REPLAY_SEEDS = [\\n 'alpha', 'beta', 'gamma',\\n '12345678901234567890',\\n 'snowman-☃️',\\n 'mixed-CASE-42',\\n 'r-eat-then-sleep',\\n 'mood-swing-edge',\\n];\\n```\\n\\n- [ ] **Step 6.2: Write `tests/determinism/replay.ts`**\\n\\nPure function `replaySeed(seed: string): string` (sha256 hex). Inside:\\n\\n1. Construct `SeededRng(seed)` + `ManualClock(0)`.\\n2. Build a default agent via the public test helpers (mirror the\\n pattern in `tests/integration/`).\\n3. Tick 1000 times advancing the clock by 100 ms per tick.\\n4. Stream every event from the bus into a hash; return the digest.\\n\\nUse `crypto.createHash('sha256')` from `node:crypto`.\\n\\n- [ ] **Step 6.3: Write the assertion test (red)**\\n\\n```ts\\n// tests/determinism/replay.bench.ts\\nimport { test, expect } from 'vitest';\\nimport { readFileSync } from 'node:fs';\\nimport { REPLAY_SEEDS, replaySeed } from './replay.js';\\n\\nconst baseline = JSON.parse(readFileSync(\\n new URL('./baseline.json', import.meta.url), 'utf8'\\n)) as Record;\\n\\ntest.each(REPLAY_SEEDS)('replay matches baseline: %s', (seed) => {\\n expect(replaySeed(seed)).toBe(baseline[seed]);\\n});\\n```\\n\\n- [ ] **Step 6.4: Run the test (red)**\\n\\n```bash\\nnpx vitest run tests/determinism/replay.bench.ts\\n```\\n\\nExpected: FAIL — `baseline.json` does not exist yet.\\n\\n- [ ] **Step 6.5: Generate `baseline.json` once**\\n\\n```bash\\nnode --import tsx scripts/run-determinism-replay.mjs --write-baseline\\n```\\n\\nThe script imports `replaySeed` + `REPLAY_SEEDS`, computes one digest\\nper seed, writes the map to `tests/determinism/baseline.json`.\\n\\n- [ ] **Step 6.6: Re-run the test (green)**\\n\\n```bash\\nnpx vitest run tests/determinism/replay.bench.ts\\n```\\n\\nExpected: PASS for all 8 seeds.\\n\\n- [ ] **Step 6.7: Run twice in the same shell to confirm stability**\\n\\n```bash\\nfor i in 1 2 3; do npx vitest run tests/determinism/replay.bench.ts; done\\n```\\n\\nExpected: PASS PASS PASS. Any flake means the harness is non-\\ndeterministic — fix `replay.ts` rather than weakening the assertion.\\n\\n- [ ] **Step 6.8: Wire scripts**\\n\\n```json\\n// package.json — add to \\\"scripts\\\":\\n\\\"determinism:replay\\\": \\\"vitest run tests/determinism/replay.bench.ts\\\",\\n\\\"determinism:baseline\\\": \\\"node --import tsx scripts/run-determinism-replay.mjs --write-baseline\\\"\\n```\\n\\n- [ ] **Step 6.9: Workflow**\\n\\n```yaml\\n# .github/workflows/determinism.yml\\nname: Determinism replay\\n\\non:\\n schedule:\\n - cron: '0 5 * * 1' # Mondays 05:00 UTC, before CodeQL\\n push:\\n branches: [develop]\\n workflow_dispatch:\\n\\npermissions:\\n contents: read\\n\\njobs:\\n replay:\\n runs-on: ubuntu-latest\\n steps:\\n - uses: actions/checkout@ # v6.0.2\\n - uses: actions/setup-node@ # v6.4.0\\n with: { node-version: 22, cache: npm }\\n - run: npm ci\\n - run: npm run determinism:replay\\n```\\n\\n> **Why also on `push: develop`?** Catching a determinism violation\\n> *between* the weekly run is worth one ~1-minute job per merge.\\n\\n- [ ] **Step 6.10: actionlint + verify**\\n\\n```bash\\ndocker run --rm -v \\\"$PWD\\\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/determinism.yml\\nnpm run verify\\n```\\n\\n- [ ] **Step 6.11: Commit**\\n\\n```bash\\ngit add tests/determinism/ scripts/run-determinism-replay.mjs \\\\\\n .github/workflows/determinism.yml package.json\\ngit commit -m \\\"test(determinism): hash-pinned replay across 8 seeds\\\"\\n```\\n\\n---\\n\\n## Chunk 5: Mutation testing (row 7)\\n\\nRationale: existing coverage delta proves *lines ran*. Mutation testing\\nproves *tests would fail if the line changed*. Pairs with the existing\\ncoverage PR comment to close the \\\"test asserts nothing\\\" loophole.\\n\\n### Task 7: Stryker weekly run\\n\\n**Files:**\\n- Create: `stryker.config.mjs`\\n- Create: `.github/workflows/mutation.yml`\\n- Modify: `package.json` (devDeps + scripts)\\n- Modify: `.gitignore`\\n\\n- [ ] **Step 7.1: Add devDeps**\\n\\n```bash\\nnpm install --save-dev --save-exact \\\\\\n @stryker-mutator/core@latest \\\\\\n @stryker-mutator/vitest-runner@latest\\n```\\n\\nPin exact versions in `package.json`. Update lockfile.\\n\\n- [ ] **Step 7.2: Write `stryker.config.mjs`**\\n\\n```js\\n// stryker.config.mjs\\n/** @type {import('@stryker-mutator/api/core').PartialStrykerOptions} */\\nexport default {\\n testRunner: 'vitest',\\n reporters: ['progress', 'clear-text', 'html', 'dashboard'],\\n coverageAnalysis: 'perTest',\\n // Mutate library source only. Skip integrations + tooling.\\n mutate: [\\n 'src/**/*.ts',\\n '!src/**/*.test.ts',\\n '!src/**/index.ts',\\n '!src/integrations/**',\\n '!src/**/internal/**', // already covered transitively via callers\\n ],\\n thresholds: { high: 80, low: 60, break: 55 },\\n htmlReporter: { fileName: 'reports/mutation/mutation.html' },\\n timeoutMS: 15_000,\\n concurrency: 4,\\n};\\n```\\n\\n> Threshold seed values are placeholders — the first run produces the\\n> baseline. After that run lands, replace `break: 55` with `current\\n> score - 2` so future regressions fail the job but normal noise does\\n> not. Capture the baseline number in the row's commit message.\\n\\n- [ ] **Step 7.3: Add scripts to `package.json`**\\n\\n```json\\n\\\"mutation\\\": \\\"stryker run\\\",\\n\\\"mutation:report\\\": \\\"open reports/mutation/mutation.html\\\"\\n```\\n\\n- [ ] **Step 7.4: Update `.gitignore`**\\n\\n```\\nreports/mutation/\\n.stryker-tmp/\\n```\\n\\n- [ ] **Step 7.5: Run locally to capture the baseline score**\\n\\n```bash\\nnpm run mutation\\n```\\n\\nExpected: prints a score (e.g. \\\"Mutation score: 73.4%\\\"). This is the\\nbaseline. **Update `stryker.config.mjs` `thresholds.break`** to\\n`floor(score) - 2` and re-run to confirm green.\\n\\n> Local run on full suite is slow (~15-30 min). If it exceeds 45 min,\\n> trim `mutate` further (e.g. exclude `src/persistence/` for the first\\n> pass) and document the carve-out in the row's commit message.\\n\\n- [ ] **Step 7.6: Workflow**\\n\\n```yaml\\n# .github/workflows/mutation.yml\\nname: Mutation testing\\n\\non:\\n schedule:\\n - cron: '0 7 * * 1' # Mondays 07:00 UTC, after CodeQL + determinism\\n workflow_dispatch:\\n\\npermissions:\\n contents: read\\n\\njobs:\\n stryker:\\n runs-on: ubuntu-latest\\n timeout-minutes: 60\\n steps:\\n - uses: actions/checkout@ # v6.0.2\\n - uses: actions/setup-node@ # v6.4.0\\n with: { node-version: 22, cache: npm }\\n - run: npm ci\\n - run: npm run mutation\\n - uses: actions/upload-artifact@ # v5.0.0\\n if: always()\\n with:\\n name: mutation-report\\n path: reports/mutation/\\n if-no-files-found: error\\n retention-days: 30\\n```\\n\\n- [ ] **Step 7.7: actionlint + verify**\\n\\n```bash\\ndocker run --rm -v \\\"$PWD\\\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/mutation.yml\\nnpm run verify\\n```\\n\\n> `npm run verify` does NOT include `npm run mutation` — too slow for\\n> the pre-PR gate. Mutation runs only on the weekly schedule.\\n\\n- [ ] **Step 7.8: Commit**\\n\\n```bash\\ngit add stryker.config.mjs .github/workflows/mutation.yml \\\\\\n package.json package-lock.json .gitignore\\ngit commit -m \\\"test(mutation): weekly Stryker run on develop (baseline N%)\\\"\\n```\\n\\n---\\n\\n## Chunk 6: Demo Playwright smoke (row 8)\\n\\nRationale: existing CI builds the demo (`demo-build` job) but never\\nruns it. A headless click-through across the golden path catches\\nruntime regressions that typecheck + bundle don't (tfjs backend probe,\\n`base` URL handling, vite HTML transform regressions — see\\n`MEMORY.md → feedback_vite_html_transform`).\\n\\n### Task 8: Playwright golden-path smoke\\n\\n**Files:**\\n- Create: `examples/nurture-pet/playwright.config.ts`\\n- Create: `examples/nurture-pet/tests/smoke/golden-path.spec.ts`\\n- Create: `.github/workflows/demo-smoke.yml`\\n- Modify: `examples/nurture-pet/package.json` — devDep + script\\n- Modify: `.gitignore`\\n\\n- [ ] **Step 8.1: Add Playwright to the demo**\\n\\n```bash\\ncd examples/nurture-pet\\nnpm install --save-dev --save-exact @playwright/test@latest\\nnpx playwright install --with-deps chromium\\ncd -\\n```\\n\\nPin `@playwright/test` in `examples/nurture-pet/package.json`. Do NOT\\nadd it to the root `package.json` — the demo manages its own deps\\n(`MEMORY.md` notes the `file:../..` EISDIR pitfall on Windows).\\n\\n- [ ] **Step 8.2: `examples/nurture-pet/playwright.config.ts`**\\n\\n```ts\\nimport { defineConfig, devices } from '@playwright/test';\\n\\nexport default defineConfig({\\n testDir: './tests/smoke',\\n fullyParallel: false, // single demo instance, single worker\\n forbidOnly: !!process.env.CI,\\n retries: process.env.CI ? 1 : 0,\\n workers: 1,\\n reporter: process.env.CI ? [['github'], ['html']] : 'list',\\n use: {\\n baseURL: 'http://127.0.0.1:4173',\\n trace: 'retain-on-failure',\\n screenshot: 'only-on-failure',\\n },\\n webServer: {\\n command: 'npm run preview -- --host 127.0.0.1 --port 4173',\\n url: 'http://127.0.0.1:4173',\\n reuseExistingServer: !process.env.CI,\\n timeout: 60_000,\\n },\\n projects: [\\n { name: 'chromium', use: { ...devices['Desktop Chrome'] } },\\n ],\\n});\\n```\\n\\n- [ ] **Step 8.3: Write `tests/smoke/golden-path.spec.ts`**\\n\\n```ts\\nimport { test, expect } from '@playwright/test';\\n\\ntest('golden path: feed → pet → sleep updates HUD without console errors', async ({\\n page,\\n}) => {\\n const consoleErrors: string[] = [];\\n page.on('pageerror', (e) => consoleErrors.push(e.message));\\n page.on('console', (msg) => {\\n if (msg.type() === 'error') consoleErrors.push(msg.text());\\n });\\n\\n await page.goto('/');\\n await expect(page.getByRole('heading', { level: 1 })).toBeVisible();\\n\\n // Replace selectors with the actual demo controls — discoverable via\\n // `npm run dev` + DevTools. Keep this spec tied to user-facing roles\\n // (button names, ARIA labels) not implementation classes.\\n await page.getByRole('button', { name: /feed/i }).click();\\n await page.getByRole('button', { name: /pet/i }).click();\\n await page.getByRole('button', { name: /sleep/i }).click();\\n\\n // HUD assertion — pick one stable observable (e.g. \\\"Hunger\\\" stat\\n // text changes). Adapt during step 8.4.\\n await expect(page.getByTestId('hud-needs')).toContainText(/Hunger/);\\n\\n expect(consoleErrors).toEqual([]);\\n});\\n```\\n\\n- [ ] **Step 8.4: Run locally to wire selectors**\\n\\n```bash\\ncd examples/nurture-pet\\nnpm run build && npm run preview &\\nPREVIEW_PID=$!\\nnpx playwright test --headed --project=chromium\\nkill $PREVIEW_PID\\ncd -\\n```\\n\\nIterate on selectors until the spec passes. **If the demo lacks stable\\ntestids on the HUD, add them in this same row** (not a separate PR;\\nthe smoke depends on them).\\n\\n- [ ] **Step 8.5: Add script to `examples/nurture-pet/package.json`**\\n\\n```json\\n\\\"smoke\\\": \\\"playwright test\\\"\\n```\\n\\n- [ ] **Step 8.6: Update `.gitignore`**\\n\\n```\\nexamples/nurture-pet/playwright-report/\\nexamples/nurture-pet/test-results/\\n```\\n\\n- [ ] **Step 8.7: Workflow**\\n\\n```yaml\\n# .github/workflows/demo-smoke.yml\\nname: Demo smoke\\n\\non:\\n schedule:\\n - cron: '30 3 * * *' # Daily 03:30 UTC\\n pull_request:\\n paths:\\n - 'examples/nurture-pet/**'\\n - 'src/**' # library changes can break demo at runtime\\n - '.github/workflows/demo-smoke.yml'\\n workflow_dispatch:\\n\\npermissions:\\n contents: read\\n\\njobs:\\n smoke:\\n runs-on: ubuntu-latest\\n timeout-minutes: 15\\n steps:\\n - uses: actions/checkout@ # v6.0.2\\n - uses: actions/setup-node@ # v6.4.0\\n with: { node-version: 22, cache: npm }\\n - run: npm ci\\n - run: npm run build\\n - name: Install demo deps\\n working-directory: examples/nurture-pet\\n run: npm ci --no-audit --no-fund\\n - name: Install Playwright browsers\\n working-directory: examples/nurture-pet\\n run: npx playwright install --with-deps chromium\\n - name: Build demo\\n working-directory: examples/nurture-pet\\n run: npm run build\\n - name: Smoke (Playwright)\\n working-directory: examples/nurture-pet\\n run: npm run smoke\\n - uses: actions/upload-artifact@ # v5.0.0\\n if: failure()\\n with:\\n name: playwright-report\\n path: examples/nurture-pet/playwright-report/\\n retention-days: 14\\n```\\n\\n- [ ] **Step 8.8: actionlint + verify (root) + smoke run (demo)**\\n\\n```bash\\ndocker run --rm -v \\\"$PWD\\\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/demo-smoke.yml\\nnpm run verify\\n( cd examples/nurture-pet && npm run smoke )\\n```\\n\\n- [ ] **Step 8.9: Commit**\\n\\n```bash\\ngit add examples/nurture-pet/playwright.config.ts \\\\\\n examples/nurture-pet/tests/ \\\\\\n examples/nurture-pet/package.json \\\\\\n examples/nurture-pet/package-lock.json \\\\\\n .github/workflows/demo-smoke.yml \\\\\\n .gitignore\\ngit commit -m \\\"test(demo): nightly Playwright smoke on golden path\\\"\\n```\\n\\n---\\n\\n## Chunk 7: Final wiring (rows 9–10)\\n\\n### Task 9: Doc updates\\n\\n**Files:**\\n- Modify: `CONTRIBUTING.md`\\n- Modify: `README.md`\\n\\n- [ ] **Step 9.1: `CONTRIBUTING.md`**\\n\\nAdd a brief \\\"Quality automation\\\" subsection under the existing dev-loop\\nsection. List `npm run mutation`, `npm run determinism:replay`, and\\n`( cd examples/nurture-pet && npm run smoke )` with one-line purposes.\\n\\n- [ ] **Step 9.2: `README.md`**\\n\\nAdd one bullet under the existing Quality / CI section linking to:\\n- `docs/metrics/bundle-trend.jsonl`\\n- `docs/dep-triage-bot/README.md`\\n- `docs/actions-bump-bot/README.md`\\n- `docs/plan-recon-bot/README.md`\\n\\nNo screenshots, no badges. Keep it terse.\\n\\n- [ ] **Step 9.3: Commit**\\n\\n```bash\\ngit add CONTRIBUTING.md README.md\\ngit commit -m \\\"docs: link new quality-automation surfaces\\\"\\n```\\n\\n---\\n\\n### Task Final: Flip PR to ready-for-review\\n\\n- [ ] **Final.1: Run the full gate one more time**\\n\\n```bash\\nnpm run verify\\n( cd examples/nurture-pet && npm run smoke )\\nnpm run determinism:replay\\n```\\n\\nMutation is **not** in this gate — too slow. Owner can spot-check by\\nrunning `npm run mutation` if desired.\\n\\n- [ ] **Final.2: Confirm every checkbox above is ticked**\\n\\n```bash\\ngrep -E '^- \\\\[ \\\\]' docs/plans/2026-04-26-quality-automation-routines.md\\n```\\n\\nExpected: no output (zero unchecked boxes).\\n\\n- [ ] **Final.3: Mark PR ready**\\n\\n```bash\\ngh pr ready \\n```\\n\\n- [ ] **Final.4: Optional — add a Codex re-review trigger**\\n\\n```bash\\ngh pr comment --body \\\"@codex review\\\"\\n```\\n\\nStandard pattern from `MEMORY.md → feedback_pr_codex_polling.md`. If\\nfindings come back, address per\\n`MEMORY.md → feedback_codex_signal_endpoints.md`.\\n\\n---\\n\\n## Risk register (read once before starting)\\n\\n- **Stryker runtime explosion.** If the suite balloons past 45 min on a\\n single runner, drop `concurrency` to match the runner's vCPU count\\n and / or split the `mutate` glob across two workflow jobs (e.g.\\n `src/agent/**` vs. everything else). Don't lower the threshold to\\n paper over slowness.\\n- **Determinism baseline drift.** Any legitimate library change that\\n alters trace contents (new event type, reordered tick stage)\\n invalidates `baseline.json`. Treat that as an explicit re-baseline\\n step in the same PR that changes behavior — never bypass the\\n assertion. Add a `determinism:baseline` script comment in\\n `package.json` calling this out.\\n- **Playwright flake.** The demo loads tfjs which probes WebGL → WASM →\\n CPU on startup. In CI on Ubuntu, expect WASM. Allow `retries: 1`\\n but never higher; >1 retries hides real flakes.\\n- **Bot-pushed develop commits.** Row 5 pushes a metrics row directly\\n to `develop` from a workflow. If branch protection blocks this\\n (likely), pivot to PR-bot path documented in step 5.7. Don't\\n weaken protection.\\n- **Action SHA churn.** Every new workflow added in this PR uses pinned\\n SHAs. After this PR merges, the next `actions-bump-bot` run will\\n attempt to bump them. That's expected — review that bump PR like any\\n other.\\n- **One PR, one branch.** Owner explicitly approved bundling all eight\\n rows on this branch. Project default (`one PR, one concern`) does\\n not apply here. If a reviewer flags split-required, point them to\\n this plan section.\\n\\n---\\n\\n## When to mark this plan shipped\\n\\nMove this file to `docs/archive/plans/2026-04-26-quality-automation-routines.md`\\nvia `git mv` in the **same commit** that flips the PR to merged (or in\\na follow-up `chore(docs)` commit on `develop` if that's not feasible).\\nPer `MEMORY.md → feedback_docs_alongside_pr.md`.\\n\",\"base_ref\":\"13859c8cfbe00ba164273b70d70bab8c17679ed9\",\"head_ref\":\"516a2f428990da71b71eb61a8fcdc3d785e90b40\",\"merge_commit_sha\":null,\"type\":\"pull_request_info\"}","text_elements",[],{"_436":1006,"_423":424,"_438":426},{"_439":1007,"_441":-5,"_41":-5,"_442":-5,"_95":301,"_91":444},[1008],{"_45":1002,"_91":1009},"input_text","turn/started",{"_423":424,"_86":1012},{"_102":-5,"_41":426,"_427":1013,"_429":1014},[],"inProgress",{"_429":1016,"_423":424},{"_1017":1018,"_91":1019},"activeFlags",[],"active",{"_436":1021,"_423":424,"_438":1022},{"_439":1023,"_441":-5,"_41":-5,"_442":-5,"_95":301,"_91":444},"auto-compact-0",[1024,1025],{"_45":1027,"_91":1009},{"_45":1026,"_91":1009},"\n /workspace/agentonomous\n bash\n 2026-04-26\n Etc/UTC\n","# AGENTS.md instructions for /workspace/agentonomous\n\n\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n",{"_436":1029,"_423":424,"_438":1022},{"_439":1030,"_441":-5,"_41":-5,"_442":-5,"_95":1031,"_91":444},[1032],"developer",{"_45":1033,"_91":1009},"\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","thread/started",{"_1036":1037},"thread",{"_1038":-5,"_1039":-5,"_1040":1041,"_1042":1043,"_480":481,"_1044":15,"_1045":-5,"_1046":-5,"_41":424,"_1047":1048,"_177":-5,"_160":1049,"_1050":195,"_486":1051,"_429":1052,"_76":1053,"_1054":1043},"agentNickname","agentRole","cliVersion","0.114.0","createdAt",1777204686,"ephemeral","forkedFromId","gitInfo","modelProvider","openai","/opt/codex/sessions/2026/04/26/rollout-2026-04-26T11-58-06-019dc9a7-6cce-70a0-823c-9d535768055d.jsonl","preview","vscode",{"_91":433},[],"updatedAt",[],"messages",[1058],{"_41":1059,"_1060":1061,"_1062":1063,"_1064":1063,"_439":1065,"_429":1066,"_441":-5,"_1067":31,"_1068":1069,"_1070":1071,"_1072":-5},"9f3f2dfc-a101-454e-bb5b-010d66fd82e6","author",{"_95":301,"_177":-5,"_1068":1081},"create_time",1777204685.443412,"update_time",{"_1077":45,"_1078":1079},"finished_successfully","weight","metadata",{"_1073":1074},"recipient","all","channel","l1239dk1",{"_1075":1076},"inline_comments",[],"content_type","parts",[1080],"# Quality automation routines — implementation plan\n\n> **For agentic workers:** REQUIRED: follow this plan top-to-bottom on\n> branch `chore/quality-automation-routines` (worktree\n> `.worktrees/chore-quality-automation`). Steps use checkbox (`- [ ]`)\n> syntax for tracking. The PR opens **draft** with this plan as its body\n> reference; flip to ready-for-review only after every row below is\n> checked off and `npm run verify` is green.\n\n**Goal:** Close known quality / supply-chain / drift gaps not covered by\nthe existing CI gate or the daily-code-review + weekly-docs-review\nroutines, by adding seven new automation surfaces (six CI/cron jobs +\nthree cloud-routine prompts).\n\n**Architecture:**\n\n- **GitHub Actions workflows** (`.github/workflows/*.yml`) for jobs that\n need to run inside CI infra (CodeQL, mutation testing, Playwright,\n bundle-size trend, determinism replay).\n- **Cloud-routine prompt directories** (`docs//PROMPT.md` +\n `README.md`) for jobs that need an LLM-driven agent (dependency\n triage, action SHA bumps, plan reconciliation). Same shape as the\n existing `docs/review-bot/` and `docs/docs-review-bot/`.\n- **No core library changes.** All additions live under `.github/`,\n `docs/`, `tests/determinism/`, and `examples/nurture-pet/`. No\n `src/**` edits. No changesets needed (tooling-only PR).\n\n**Tech stack:**\n\n- GitHub Actions, Dependabot, CodeQL.\n- StrykerJS (`@stryker-mutator/core` + `@stryker-mutator/vitest-runner`)\n for mutation testing.\n- Playwright (`@playwright/test`) for demo smoke.\n- Existing `scripts/bump-actions.mjs`, `scripts/coverage-pr-comment.mjs`\n pattern for any new helper scripts.\n\n**Out of scope (this plan):**\n\n- Stale-branch cleaner — explicitly deferred per owner decision\n (2026-04-26).\n- Type-coverage report, license/SBOM audit, mutation testing on\n examples — punt to a future plan if value materializes.\n\n---\n\n## File structure\n\n### New files\n\n| Path | Responsibility |\n| --- | --- |\n| `.github/workflows/codeql.yml` | Weekly + push-to-develop CodeQL JS/TS scan. |\n| `.github/workflows/mutation.yml` | Weekly Stryker run on `develop`; uploads HTML report artifact. |\n| `.github/workflows/demo-smoke.yml` | Nightly Playwright headless run against built demo. |\n| `.github/workflows/bundle-size-trend.yml` | Weekly snapshot of `npx size-limit --json` to a committed `docs/metrics/bundle-trend.jsonl`. |\n| `.github/workflows/determinism.yml` | Weekly replay of seeded pet sims; hash-compares `DecisionTrace` against committed baseline. |\n| `stryker.config.mjs` | Stryker config (vitest runner, sane mutate globs, threshold). |\n| `examples/nurture-pet/playwright.config.ts` | Playwright config for the demo smoke spec. |\n| `examples/nurture-pet/tests/smoke/golden-path.spec.ts` | Click Feed/Pet/Sleep/Train; assert HUD updates + no console errors. |\n| `tests/determinism/replay.bench.ts` | Vitest-driven replay across N seeds; emits one `sha256(trace-stream)` per seed. |\n| `tests/determinism/baseline.json` | Committed map `{ seedString: sha256 }` (ground truth). |\n| `tests/determinism/replay.ts` | Replay harness (pure function: seed → trace stream → sha). |\n| `docs/metrics/bundle-trend.jsonl` | Append-only JSONL: one row per weekly snapshot. Created by row 5. |\n| `docs/dep-triage-bot/PROMPT.md` | System prompt for the weekly Dependabot triage routine. |\n| `docs/dep-triage-bot/README.md` | How the routine consumes `PROMPT.md`, where outputs go. |\n| `docs/actions-bump-bot/PROMPT.md` | System prompt for the weekly action-SHA bump routine. |\n| `docs/actions-bump-bot/README.md` | Same shape as above. |\n| `docs/plan-recon-bot/PROMPT.md` | System prompt for the monthly plan-vs-shipped reconciliation routine. |\n| `docs/plan-recon-bot/README.md` | Same shape as above. |\n| `scripts/append-size-snapshot.mjs` | Read `npx size-limit --json` stdin, append a row to `docs/metrics/bundle-trend.jsonl`. |\n| `scripts/run-determinism-replay.mjs` | CLI wrapper that runs `tests/determinism/replay.ts` for the workflow + diffs vs baseline; non-zero exit on mismatch. |\n\n### Modified files\n\n| Path | Change |\n| --- | --- |\n| `package.json` | Add devDeps: `@stryker-mutator/core`, `@stryker-mutator/vitest-runner`, `@playwright/test`. Add scripts: `mutation`, `mutation:report`, `determinism:replay`, `determinism:baseline`. |\n| `examples/nurture-pet/package.json` | Add devDep `@playwright/test`; script `smoke`. |\n| `.gitignore` | Ignore `reports/mutation/`, `playwright-report/`, `examples/nurture-pet/playwright-report/`, `examples/nurture-pet/test-results/`. |\n| `.github/dependabot.yml` | Group npm minor + patch updates so the triage routine sees one PR per ecosystem-week, not N. |\n| `CONTRIBUTING.md` | Brief mention of mutation / smoke / determinism scripts in the dev-loop section. |\n| `README.md` | One-line bullet under the badges/quality section: links to the trend file + bot prompts. |\n\n### Branching / PR shape\n\nThis plan ships on **one** branch (`chore/quality-automation-routines`)\nunder **one** draft PR (`docs(plans): quality-automation routines + ...`).\nPer owner direction, every row below lands as its own commit on this\nbranch. The PR is flipped to ready-for-review only after the final row\nchecks off and `npm run verify` is green.\n\n> **Why one PR, not the usual one-per-row?** This batch is mostly\n> additive infra (workflows + prompts + dev-deps) with near-zero blast\n> radius on the library. Splitting eight tooling-only rows into eight\n> PRs would burn ~8 Codex review cycles for marginal review benefit.\n> When a row touches `src/**` (none of them do here) future plans\n> revert to the standard one-row-per-PR rule.\n\n---\n\n## Verification gate per row\n\nEach row ends with `npm run verify` passing locally before commit. New\nworkflows must additionally be **lint-clean under `actionlint`**\n(already wired into CI) — run locally with:\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color\n```\n\n…or push the commit and watch the existing `Lint workflows (actionlint)`\njob. New action references must use full 40-char SHAs with a trailing\n`# vX.Y.Z` comment (per the supply-chain rule in the existing CI\nheader). Resolve a SHA via:\n\n```bash\ngh api repos///commits/ --jq '.sha'\n```\n\n---\n\n## Chunk 1: Bootstrap (rows 0–1)\n\n### Task 0: Land the plan + open the draft PR\n\n**Files:**\n- Create: `docs/plans/2026-04-26-quality-automation-routines.md` (this file).\n\n- [ ] **Step 0.1: Confirm worktree on `chore/quality-automation-routines`**\n\n```bash\ngit -C .worktrees/chore-quality-automation rev-parse --abbrev-ref HEAD\n# expected: chore/quality-automation-routines\n```\n\n- [ ] **Step 0.2: Stage and commit the plan**\n\n```bash\ngit -C .worktrees/chore-quality-automation add docs/plans/2026-04-26-quality-automation-routines.md\ngit -C .worktrees/chore-quality-automation commit -m \"docs(plans): quality-automation routines roadmap\"\n```\n\n- [ ] **Step 0.3: Push branch + open draft PR**\n\n```bash\ngit -C .worktrees/chore-quality-automation push -u origin chore/quality-automation-routines\ngh pr create --draft --base develop \\\n --title \"chore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)\" \\\n --body-file docs/plans/2026-04-26-quality-automation-routines.md\n```\n\nExpected: draft PR URL printed, status `Draft`. Note the PR number for\nlater step `Final.3`.\n\n---\n\n### Task 1: CodeQL weekly + push-to-develop\n\n**Why first:** single file, GitHub-native, zero new deps. Smallest\npossible win.\n\n**Files:**\n- Create: `.github/workflows/codeql.yml`\n\n- [ ] **Step 1.1: Resolve SHAs for `actions/checkout@v6` and\n `github/codeql-action/{init,analyze}@v4`** (or current major)\n\n```bash\ngh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'\ngh api repos/github/codeql-action/git/refs/tags/v4 --jq '.object.sha'\n```\n\nCapture the SHAs; use them verbatim in the YAML below with a trailing\n`# v6.0.2` / `# v4` comment.\n\n- [ ] **Step 1.2: Write `.github/workflows/codeql.yml`**\n\n```yaml\nname: CodeQL\n\non:\n push:\n branches: [develop, main]\n pull_request:\n branches: [develop, main]\n schedule:\n # Mondays 06:00 UTC — same window as docs-review weekly cadence.\n - cron: '0 6 * * 1'\n\nconcurrency:\n group: codeql-${{ github.ref }}\n cancel-in-progress: true\n\npermissions:\n contents: read\n security-events: write\n actions: read\n\njobs:\n analyze:\n name: Analyze (javascript-typescript)\n runs-on: ubuntu-latest\n strategy:\n fail-fast: false\n matrix:\n language: [javascript-typescript]\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: github/codeql-action/init@ # v4\n with:\n languages: ${{ matrix.language }}\n # security-and-quality is the broadest default suite that GA\n # supports. security-extended would also work; quality-only\n # would miss CWE-079/CWE-094 patterns we want flagged.\n queries: security-and-quality\n - uses: github/codeql-action/analyze@ # v4\n with:\n category: '/language:${{ matrix.language }}'\n```\n\n- [ ] **Step 1.3: Local actionlint pass**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/codeql.yml\n```\n\nExpected: no output (clean).\n\n- [ ] **Step 1.4: Verify locally that the gate is unaffected**\n\n```bash\nnpm run verify\n```\n\nExpected: same pass set as `develop`.\n\n- [ ] **Step 1.5: Commit**\n\n```bash\ngit add .github/workflows/codeql.yml\ngit commit -m \"ci(codeql): add weekly + push CodeQL JS/TS scan\"\n```\n\n- [ ] **Step 1.6: Push and confirm the workflow runs in Actions tab**\n\n```bash\ngit push\n```\n\nExpected: a `CodeQL / Analyze (javascript-typescript)` run appears for\nthe push and finishes success.\n\n---\n\n## Chunk 2: Cloud-routine prompts (rows 2–4)\n\nThese three rows add prompt directories only — no workflows, no deps,\nno library code. Each ships behind `docs//`. The actual\nscheduling happens outside the repo (Claude Cloud cron), same way as\n`docs/review-bot/` and `docs/docs-review-bot/`.\n\n### Task 2: Dependabot triage routine prompt\n\n**Files:**\n- Create: `docs/dep-triage-bot/PROMPT.md`\n- Create: `docs/dep-triage-bot/README.md`\n- Modify: `.github/dependabot.yml` — group npm minor+patch into one PR\n per ecosystem-week so the triage routine sees a tractable input.\n\n- [ ] **Step 2.1: Read existing pattern**\n\n```bash\ncat docs/docs-review-bot/PROMPT.md # use as structural template\ncat docs/docs-review-bot/README.md\ncat .github/dependabot.yml\n```\n\n- [ ] **Step 2.2: Update `.github/dependabot.yml`**\n\nAdd a `groups:` block on each `package-ecosystem: \"npm\"` entry so minor\n+ patch updates land in a single weekly PR rather than 5–10 separate\nones.\n\n```yaml\n# Example shape — adapt to existing keys verbatim.\n- package-ecosystem: \"npm\"\n directory: \"/\"\n schedule:\n interval: \"weekly\"\n groups:\n npm-non-major:\n patterns: [\"*\"]\n update-types: [\"minor\", \"patch\"]\n```\n\n- [ ] **Step 2.3: Write `docs/dep-triage-bot/PROMPT.md`**\n\nSections to include (mirror `docs/review-bot/PROMPT.md`):\n\n1. **Role** — \"Senior dependency triage. Conservative, not adventurous.\n Goal: drain the Dependabot pile without bricking the build.\"\n2. **Scope this run** — \"Open Dependabot PRs targeting `develop`, label\n `dependencies`.\"\n3. **Triage policy** — patch + minor on dev-deps: rebase, run\n `npm run verify`, auto-merge if green. Patch + minor on runtime\n deps: rebase, run verify, leave a one-line approval comment but do\n NOT merge (owner approval required). Major on anything: comment\n with the changelog summary + breaking-change bullet list, leave for\n owner. Peer-deps: never auto-merge.\n4. **Hard rules** — never merge a PR that touches `src/**` (means\n Dependabot generated more than a manifest bump, suspicious); never\n bypass `--no-verify`; never amend the Dependabot commit.\n5. **Output** — append a one-comment summary on a rolling\n tracker issue `Dependency triage — develop` (label\n `dep-triage-bot`).\n6. **Failure handling** — verify fails → comment \"verify failed: \\\" on the Dependabot PR + tracker, do not merge.\n\nUse the same idempotency pattern as `docs/review-bot/PROMPT.md`\n(rolling issue, append comments, never push direct to develop).\n\n- [ ] **Step 2.4: Write `docs/dep-triage-bot/README.md`**\n\nMirror `docs/review-bot/README.md`: how the routine consumes the\nprompt, where output lives, how to evolve it.\n\n- [ ] **Step 2.5: Commit**\n\n```bash\ngit add docs/dep-triage-bot/ .github/dependabot.yml\ngit commit -m \"docs(routine): add weekly Dependabot triage prompt\"\n```\n\n---\n\n### Task 3: Action SHA bump routine prompt\n\n**Files:**\n- Create: `docs/actions-bump-bot/PROMPT.md`\n- Create: `docs/actions-bump-bot/README.md`\n\n- [ ] **Step 3.1: Confirm `scripts/bump-actions.mjs` exists and works**\n\n```bash\nnode scripts/bump-actions.mjs\n```\n\nExpected: prints any pending bumps (or \"no drift\") without writing\nfiles. Capture exact output shape — the prompt has to instruct the\nagent how to parse it.\n\n- [ ] **Step 3.2: Write `docs/actions-bump-bot/PROMPT.md`**\n\nMirror the dep-triage prompt structure. Key sections:\n\n1. **Role** — \"Action SHA-bump caretaker. Single job: keep\n `.github/workflows/*.yml` action references at their latest\n tags-as-SHA.\"\n2. **Scope this run** — \"Run weekly. Inputs come from\n `node scripts/bump-actions.mjs`.\"\n3. **Process** — branch off `develop`\n (`chore/actions-bump-YYYY-MM-DD`), apply each bump, verify\n `actionlint` clean, run `npm run verify`, open one PR with the\n diff. Owner reviews and merges.\n4. **Hard rules** — never bump across a major (require explicit owner\n approval); never edit the SHA without re-resolving via `gh api`;\n never alter the trailing `# vX.Y.Z` comment without matching the\n bumped tag.\n5. **Output** — single PR per run, body lists each `(action, old SHA,\n new SHA, version label)`. No-op runs: post a one-line comment on the\n tracker issue `Action SHA bumps — develop` and exit.\n6. **Failure handling** — verify fails → close branch, comment on\n tracker.\n\n- [ ] **Step 3.3: Write `docs/actions-bump-bot/README.md`**\n\n- [ ] **Step 3.4: Commit**\n\n```bash\ngit add docs/actions-bump-bot/\ngit commit -m \"docs(routine): add weekly action-SHA bump prompt\"\n```\n\n---\n\n### Task 4: Plan reconciliation routine prompt\n\n**Why monthly, not weekly:** plans are coarse-grained; a weekly cadence\nwould mostly produce no-ops. Monthly aligns with how often roadmap\nrows complete in batches.\n\n**Files:**\n- Create: `docs/plan-recon-bot/PROMPT.md`\n- Create: `docs/plan-recon-bot/README.md`\n\n- [ ] **Step 4.1: Read the archive convention**\n\n```bash\ncat docs/archive/README.md\nls docs/archive/plans/\nls docs/plans/\n```\n\n- [ ] **Step 4.2: Write `docs/plan-recon-bot/PROMPT.md`**\n\nSections:\n\n1. **Role** — \"Plan archivist. Reconcile `docs/plans/*.md` against\n shipped state. Different from docs-review-bot (which audits prose\n drift); this routine answers 'is this plan done?' \"\n2. **Scope this run** — every file under `docs/plans/`. For each:\n parse roadmap rows, cross-check `git log origin/develop` (and the\n tracker issue if linked) for shipped status, and either (a) leave\n alone if work continues, (b) move to `docs/archive/plans/` via\n `git mv` if every row is shipped or the plan is superseded.\n3. **Hard rules** — never delete plan content; only `git mv`. Preserve\n the date prefix. Never archive a plan that has open rows.\n4. **Output** — open one PR per run with archive moves, body lists\n each `(plan, last shipped row, archive reason)`. No moves needed:\n post a one-line comment on the tracker issue `Plan reconciliation`\n and exit.\n5. **Failure handling** — same pattern as the other routines.\n\n- [ ] **Step 4.3: Write `docs/plan-recon-bot/README.md`**\n\n- [ ] **Step 4.4: Commit**\n\n```bash\ngit add docs/plan-recon-bot/\ngit commit -m \"docs(routine): add monthly plan reconciliation prompt\"\n```\n\n---\n\n## Chunk 3: Bundle-size trend (row 5)\n\nRationale: existing `size-limit-comment` job posts the per-PR delta but\ngives no longitudinal view. A weekly snapshot to a committed JSONL\nfile in `docs/metrics/` lets us graph the trend later (and inspect by\ndiff today).\n\n### Task 5: Weekly bundle-size trend snapshot\n\n**Files:**\n- Create: `scripts/append-size-snapshot.mjs`\n- Create: `.github/workflows/bundle-size-trend.yml`\n- Create: `docs/metrics/bundle-trend.jsonl` (empty file at first commit)\n\n- [ ] **Step 5.1: Write the snapshot script (TDD)**\n\nCreate `scripts/append-size-snapshot.test.mjs` first, then the\nimplementation. The test feeds the script a fixture `size-limit --json`\noutput via stdin and asserts:\n\n- Output JSONL has exactly one row.\n- Row keys: `iso` (UTC ISO-8601 date), `sha` (7-char head SHA from\n env), `entries` (array of `{name, size, gzip}` from input).\n- Existing rows in the target file are preserved; the new row is\n appended.\n\n```js\n// scripts/append-size-snapshot.test.mjs\nimport { test, expect } from 'vitest';\nimport { spawnSync } from 'node:child_process';\nimport { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\ntest('appends one JSONL row from size-limit JSON on stdin', () => {\n const dir = mkdtempSync(join(tmpdir(), 'sizesnap-'));\n const target = join(dir, 'bundle-trend.jsonl');\n writeFileSync(target, ''); // empty\n const fixture = JSON.stringify([\n { name: 'core', size: 1234, gzip: 567 },\n { name: 'integrations/excalibur', size: 200, gzip: 100 },\n ]);\n const out = spawnSync(\n process.execPath,\n ['scripts/append-size-snapshot.mjs', '--target', target],\n { input: fixture, env: { ...process.env, GITHUB_SHA: 'abcdef0' } },\n );\n expect(out.status).toBe(0);\n const rows = readFileSync(target, 'utf8').trim().split('\\n').filter(Boolean);\n expect(rows).toHaveLength(1);\n const row = JSON.parse(rows[0]);\n expect(row.sha).toBe('abcdef0');\n expect(row.entries).toHaveLength(2);\n expect(row.iso).toMatch(/^\\d{4}-\\d{2}-\\d{2}T/);\n});\n```\n\n- [ ] **Step 5.2: Run the test (red)**\n\n```bash\nnpx vitest run scripts/append-size-snapshot.test.mjs\n```\n\nExpected: FAIL (`Cannot find module 'scripts/append-size-snapshot.mjs'`).\n\n- [ ] **Step 5.3: Implement `scripts/append-size-snapshot.mjs`**\n\nArgv: `--target `. Reads stdin → JSON. Builds `{iso, sha,\nentries}`. Appends one line. Idempotent on identical content (skip if\nlast line equals new line minus `iso`).\n\n- [ ] **Step 5.4: Re-run the test (green)**\n\n```bash\nnpx vitest run scripts/append-size-snapshot.test.mjs\n```\n\nExpected: PASS.\n\n- [ ] **Step 5.5: Create the empty trend file**\n\n```bash\ntouch docs/metrics/bundle-trend.jsonl\n```\n\nAdd a 2-line preamble inside the file? **No.** JSONL by definition has\nno header; downstream tools assume one JSON value per line. Keep it\nempty.\n\n- [ ] **Step 5.6: Write `.github/workflows/bundle-size-trend.yml`**\n\n```yaml\nname: Bundle-size trend\n\non:\n schedule:\n # Sundays 04:00 UTC. After the Monday CodeQL window so two cron\n # workflows don't collide on a single runner pool peak.\n - cron: '0 4 * * 0'\n workflow_dispatch:\n\npermissions:\n contents: write # commits the snapshot row\n\njobs:\n snapshot:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@ # v6.0.2\n with: { ref: develop }\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run build\n - name: Append snapshot row\n env:\n GITHUB_SHA: ${{ github.sha }}\n run: |\n npx size-limit --json | \\\n node scripts/append-size-snapshot.mjs \\\n --target docs/metrics/bundle-trend.jsonl\n - name: Commit + push if changed\n run: |\n git config user.name \"github-actions[bot]\"\n git config user.email \"41898282+github-actions[bot]@users.noreply.github.com\"\n if [[ -n \"$(git status --porcelain docs/metrics/bundle-trend.jsonl)\" ]]; then\n git add docs/metrics/bundle-trend.jsonl\n git commit -m \"chore(metrics): bundle-size snapshot $(date -u +%F)\"\n git push origin develop\n fi\n```\n\n> **Direct push to `develop`?** The repo rule says \"never push direct\n> to develop\" but explicitly allows post-merge pulls. This is a metrics\n> append by github-actions bot, not human work. If branch protection\n> on `develop` blocks even bot pushes, switch to: open a PR per run via\n> `peter-evans/create-pull-request` and let the dep-triage routine\n> auto-merge it. Decide at step 5.7.\n\n- [ ] **Step 5.7: Decide direct-push vs PR-bot path**\n\n```bash\ngh api repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/branches/develop/protection 2>&1 | head -20\n```\n\nIf `required_status_checks` includes `ci-gate` and direct push is\nblocked → switch the workflow to open a PR via\n`peter-evans/create-pull-request@` and document the path swap in\nthis row.\n\n- [ ] **Step 5.8: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/bundle-size-trend.yml\nnpm run verify\n```\n\n- [ ] **Step 5.9: Commit**\n\n```bash\ngit add scripts/append-size-snapshot.mjs scripts/append-size-snapshot.test.mjs \\\n docs/metrics/bundle-trend.jsonl .github/workflows/bundle-size-trend.yml\ngit commit -m \"ci(metrics): weekly bundle-size trend snapshot\"\n```\n\n---\n\n## Chunk 4: Determinism replay benchmark (row 6)\n\nRationale: the determinism rule (`SeededRng` + `ManualClock` ⇒ byte-\nidentical `DecisionTrace`) is enforced statically by ESLint\n(no `Date.now`/`Math.random`) but never tested **end-to-end**. A\nhash-pinned replay across N seeds catches non-static violations: a new\nhelper that secretly reads `performance.now()`, a `Date` constructor\ninside a needs policy, etc.\n\n### Task 6: Hash-pinned replay across N seeds\n\n**Files:**\n- Create: `tests/determinism/replay.ts`\n- Create: `tests/determinism/replay.bench.ts` *(actually a vitest\n test, not a bench — using `.bench.ts` would skew CI timing)*\n- Create: `tests/determinism/baseline.json`\n- Create: `scripts/run-determinism-replay.mjs`\n- Create: `.github/workflows/determinism.yml`\n- Modify: `package.json` — scripts `determinism:replay`,\n `determinism:baseline`.\n\n- [ ] **Step 6.1: Decide the seed set**\n\nPick 8 seed strings. Mix short, long, ASCII, and non-ASCII to also\ncatch encoding regressions. Hard-code in `replay.ts`:\n\n```ts\nexport const REPLAY_SEEDS = [\n 'alpha', 'beta', 'gamma',\n '12345678901234567890',\n 'snowman-☃️',\n 'mixed-CASE-42',\n 'r-eat-then-sleep',\n 'mood-swing-edge',\n];\n```\n\n- [ ] **Step 6.2: Write `tests/determinism/replay.ts`**\n\nPure function `replaySeed(seed: string): string` (sha256 hex). Inside:\n\n1. Construct `SeededRng(seed)` + `ManualClock(0)`.\n2. Build a default agent via the public test helpers (mirror the\n pattern in `tests/integration/`).\n3. Tick 1000 times advancing the clock by 100 ms per tick.\n4. Stream every event from the bus into a hash; return the digest.\n\nUse `crypto.createHash('sha256')` from `node:crypto`.\n\n- [ ] **Step 6.3: Write the assertion test (red)**\n\n```ts\n// tests/determinism/replay.bench.ts\nimport { test, expect } from 'vitest';\nimport { readFileSync } from 'node:fs';\nimport { REPLAY_SEEDS, replaySeed } from './replay.js';\n\nconst baseline = JSON.parse(readFileSync(\n new URL('./baseline.json', import.meta.url), 'utf8'\n)) as Record;\n\ntest.each(REPLAY_SEEDS)('replay matches baseline: %s', (seed) => {\n expect(replaySeed(seed)).toBe(baseline[seed]);\n});\n```\n\n- [ ] **Step 6.4: Run the test (red)**\n\n```bash\nnpx vitest run tests/determinism/replay.bench.ts\n```\n\nExpected: FAIL — `baseline.json` does not exist yet.\n\n- [ ] **Step 6.5: Generate `baseline.json` once**\n\n```bash\nnode --import tsx scripts/run-determinism-replay.mjs --write-baseline\n```\n\nThe script imports `replaySeed` + `REPLAY_SEEDS`, computes one digest\nper seed, writes the map to `tests/determinism/baseline.json`.\n\n- [ ] **Step 6.6: Re-run the test (green)**\n\n```bash\nnpx vitest run tests/determinism/replay.bench.ts\n```\n\nExpected: PASS for all 8 seeds.\n\n- [ ] **Step 6.7: Run twice in the same shell to confirm stability**\n\n```bash\nfor i in 1 2 3; do npx vitest run tests/determinism/replay.bench.ts; done\n```\n\nExpected: PASS PASS PASS. Any flake means the harness is non-\ndeterministic — fix `replay.ts` rather than weakening the assertion.\n\n- [ ] **Step 6.8: Wire scripts**\n\n```json\n// package.json — add to \"scripts\":\n\"determinism:replay\": \"vitest run tests/determinism/replay.bench.ts\",\n\"determinism:baseline\": \"node --import tsx scripts/run-determinism-replay.mjs --write-baseline\"\n```\n\n- [ ] **Step 6.9: Workflow**\n\n```yaml\n# .github/workflows/determinism.yml\nname: Determinism replay\n\non:\n schedule:\n - cron: '0 5 * * 1' # Mondays 05:00 UTC, before CodeQL\n push:\n branches: [develop]\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n replay:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run determinism:replay\n```\n\n> **Why also on `push: develop`?** Catching a determinism violation\n> *between* the weekly run is worth one ~1-minute job per merge.\n\n- [ ] **Step 6.10: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/determinism.yml\nnpm run verify\n```\n\n- [ ] **Step 6.11: Commit**\n\n```bash\ngit add tests/determinism/ scripts/run-determinism-replay.mjs \\\n .github/workflows/determinism.yml package.json\ngit commit -m \"test(determinism): hash-pinned replay across 8 seeds\"\n```\n\n---\n\n## Chunk 5: Mutation testing (row 7)\n\nRationale: existing coverage delta proves *lines ran*. Mutation testing\nproves *tests would fail if the line changed*. Pairs with the existing\ncoverage PR comment to close the \"test asserts nothing\" loophole.\n\n### Task 7: Stryker weekly run\n\n**Files:**\n- Create: `stryker.config.mjs`\n- Create: `.github/workflows/mutation.yml`\n- Modify: `package.json` (devDeps + scripts)\n- Modify: `.gitignore`\n\n- [ ] **Step 7.1: Add devDeps**\n\n```bash\nnpm install --save-dev --save-exact \\\n @stryker-mutator/core@latest \\\n @stryker-mutator/vitest-runner@latest\n```\n\nPin exact versions in `package.json`. Update lockfile.\n\n- [ ] **Step 7.2: Write `stryker.config.mjs`**\n\n```js\n// stryker.config.mjs\n/** @type {import('@stryker-mutator/api/core').PartialStrykerOptions} */\nexport default {\n testRunner: 'vitest',\n reporters: ['progress', 'clear-text', 'html', 'dashboard'],\n coverageAnalysis: 'perTest',\n // Mutate library source only. Skip integrations + tooling.\n mutate: [\n 'src/**/*.ts',\n '!src/**/*.test.ts',\n '!src/**/index.ts',\n '!src/integrations/**',\n '!src/**/internal/**', // already covered transitively via callers\n ],\n thresholds: { high: 80, low: 60, break: 55 },\n htmlReporter: { fileName: 'reports/mutation/mutation.html' },\n timeoutMS: 15_000,\n concurrency: 4,\n};\n```\n\n> Threshold seed values are placeholders — the first run produces the\n> baseline. After that run lands, replace `break: 55` with `current\n> score - 2` so future regressions fail the job but normal noise does\n> not. Capture the baseline number in the row's commit message.\n\n- [ ] **Step 7.3: Add scripts to `package.json`**\n\n```json\n\"mutation\": \"stryker run\",\n\"mutation:report\": \"open reports/mutation/mutation.html\"\n```\n\n- [ ] **Step 7.4: Update `.gitignore`**\n\n```\nreports/mutation/\n.stryker-tmp/\n```\n\n- [ ] **Step 7.5: Run locally to capture the baseline score**\n\n```bash\nnpm run mutation\n```\n\nExpected: prints a score (e.g. \"Mutation score: 73.4%\"). This is the\nbaseline. **Update `stryker.config.mjs` `thresholds.break`** to\n`floor(score) - 2` and re-run to confirm green.\n\n> Local run on full suite is slow (~15-30 min). If it exceeds 45 min,\n> trim `mutate` further (e.g. exclude `src/persistence/` for the first\n> pass) and document the carve-out in the row's commit message.\n\n- [ ] **Step 7.6: Workflow**\n\n```yaml\n# .github/workflows/mutation.yml\nname: Mutation testing\n\non:\n schedule:\n - cron: '0 7 * * 1' # Mondays 07:00 UTC, after CodeQL + determinism\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n stryker:\n runs-on: ubuntu-latest\n timeout-minutes: 60\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run mutation\n - uses: actions/upload-artifact@ # v5.0.0\n if: always()\n with:\n name: mutation-report\n path: reports/mutation/\n if-no-files-found: error\n retention-days: 30\n```\n\n- [ ] **Step 7.7: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/mutation.yml\nnpm run verify\n```\n\n> `npm run verify` does NOT include `npm run mutation` — too slow for\n> the pre-PR gate. Mutation runs only on the weekly schedule.\n\n- [ ] **Step 7.8: Commit**\n\n```bash\ngit add stryker.config.mjs .github/workflows/mutation.yml \\\n package.json package-lock.json .gitignore\ngit commit -m \"test(mutation): weekly Stryker run on develop (baseline N%)\"\n```\n\n---\n\n## Chunk 6: Demo Playwright smoke (row 8)\n\nRationale: existing CI builds the demo (`demo-build` job) but never\nruns it. A headless click-through across the golden path catches\nruntime regressions that typecheck + bundle don't (tfjs backend probe,\n`base` URL handling, vite HTML transform regressions — see\n`MEMORY.md → feedback_vite_html_transform`).\n\n### Task 8: Playwright golden-path smoke\n\n**Files:**\n- Create: `examples/nurture-pet/playwright.config.ts`\n- Create: `examples/nurture-pet/tests/smoke/golden-path.spec.ts`\n- Create: `.github/workflows/demo-smoke.yml`\n- Modify: `examples/nurture-pet/package.json` — devDep + script\n- Modify: `.gitignore`\n\n- [ ] **Step 8.1: Add Playwright to the demo**\n\n```bash\ncd examples/nurture-pet\nnpm install --save-dev --save-exact @playwright/test@latest\nnpx playwright install --with-deps chromium\ncd -\n```\n\nPin `@playwright/test` in `examples/nurture-pet/package.json`. Do NOT\nadd it to the root `package.json` — the demo manages its own deps\n(`MEMORY.md` notes the `file:../..` EISDIR pitfall on Windows).\n\n- [ ] **Step 8.2: `examples/nurture-pet/playwright.config.ts`**\n\n```ts\nimport { defineConfig, devices } from '@playwright/test';\n\nexport default defineConfig({\n testDir: './tests/smoke',\n fullyParallel: false, // single demo instance, single worker\n forbidOnly: !!process.env.CI,\n retries: process.env.CI ? 1 : 0,\n workers: 1,\n reporter: process.env.CI ? [['github'], ['html']] : 'list',\n use: {\n baseURL: 'http://127.0.0.1:4173',\n trace: 'retain-on-failure',\n screenshot: 'only-on-failure',\n },\n webServer: {\n command: 'npm run preview -- --host 127.0.0.1 --port 4173',\n url: 'http://127.0.0.1:4173',\n reuseExistingServer: !process.env.CI,\n timeout: 60_000,\n },\n projects: [\n { name: 'chromium', use: { ...devices['Desktop Chrome'] } },\n ],\n});\n```\n\n- [ ] **Step 8.3: Write `tests/smoke/golden-path.spec.ts`**\n\n```ts\nimport { test, expect } from '@playwright/test';\n\ntest('golden path: feed → pet → sleep updates HUD without console errors', async ({\n page,\n}) => {\n const consoleErrors: string[] = [];\n page.on('pageerror', (e) => consoleErrors.push(e.message));\n page.on('console', (msg) => {\n if (msg.type() === 'error') consoleErrors.push(msg.text());\n });\n\n await page.goto('/');\n await expect(page.getByRole('heading', { level: 1 })).toBeVisible();\n\n // Replace selectors with the actual demo controls — discoverable via\n // `npm run dev` + DevTools. Keep this spec tied to user-facing roles\n // (button names, ARIA labels) not implementation classes.\n await page.getByRole('button', { name: /feed/i }).click();\n await page.getByRole('button', { name: /pet/i }).click();\n await page.getByRole('button', { name: /sleep/i }).click();\n\n // HUD assertion — pick one stable observable (e.g. \"Hunger\" stat\n // text changes). Adapt during step 8.4.\n await expect(page.getByTestId('hud-needs')).toContainText(/Hunger/);\n\n expect(consoleErrors).toEqual([]);\n});\n```\n\n- [ ] **Step 8.4: Run locally to wire selectors**\n\n```bash\ncd examples/nurture-pet\nnpm run build && npm run preview &\nPREVIEW_PID=$!\nnpx playwright test --headed --project=chromium\nkill $PREVIEW_PID\ncd -\n```\n\nIterate on selectors until the spec passes. **If the demo lacks stable\ntestids on the HUD, add them in this same row** (not a separate PR;\nthe smoke depends on them).\n\n- [ ] **Step 8.5: Add script to `examples/nurture-pet/package.json`**\n\n```json\n\"smoke\": \"playwright test\"\n```\n\n- [ ] **Step 8.6: Update `.gitignore`**\n\n```\nexamples/nurture-pet/playwright-report/\nexamples/nurture-pet/test-results/\n```\n\n- [ ] **Step 8.7: Workflow**\n\n```yaml\n# .github/workflows/demo-smoke.yml\nname: Demo smoke\n\non:\n schedule:\n - cron: '30 3 * * *' # Daily 03:30 UTC\n pull_request:\n paths:\n - 'examples/nurture-pet/**'\n - 'src/**' # library changes can break demo at runtime\n - '.github/workflows/demo-smoke.yml'\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n smoke:\n runs-on: ubuntu-latest\n timeout-minutes: 15\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run build\n - name: Install demo deps\n working-directory: examples/nurture-pet\n run: npm ci --no-audit --no-fund\n - name: Install Playwright browsers\n working-directory: examples/nurture-pet\n run: npx playwright install --with-deps chromium\n - name: Build demo\n working-directory: examples/nurture-pet\n run: npm run build\n - name: Smoke (Playwright)\n working-directory: examples/nurture-pet\n run: npm run smoke\n - uses: actions/upload-artifact@ # v5.0.0\n if: failure()\n with:\n name: playwright-report\n path: examples/nurture-pet/playwright-report/\n retention-days: 14\n```\n\n- [ ] **Step 8.8: actionlint + verify (root) + smoke run (demo)**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/demo-smoke.yml\nnpm run verify\n( cd examples/nurture-pet && npm run smoke )\n```\n\n- [ ] **Step 8.9: Commit**\n\n```bash\ngit add examples/nurture-pet/playwright.config.ts \\\n examples/nurture-pet/tests/ \\\n examples/nurture-pet/package.json \\\n examples/nurture-pet/package-lock.json \\\n .github/workflows/demo-smoke.yml \\\n .gitignore\ngit commit -m \"test(demo): nightly Playwright smoke on golden path\"\n```\n\n---\n\n## Chunk 7: Final wiring (rows 9–10)\n\n### Task 9: Doc updates\n\n**Files:**\n- Modify: `CONTRIBUTING.md`\n- Modify: `README.md`\n\n- [ ] **Step 9.1: `CONTRIBUTING.md`**\n\nAdd a brief \"Quality automation\" subsection under the existing dev-loop\nsection. List `npm run mutation`, `npm run determinism:replay`, and\n`( cd examples/nurture-pet && npm run smoke )` with one-line purposes.\n\n- [ ] **Step 9.2: `README.md`**\n\nAdd one bullet under the existing Quality / CI section linking to:\n- `docs/metrics/bundle-trend.jsonl`\n- `docs/dep-triage-bot/README.md`\n- `docs/actions-bump-bot/README.md`\n- `docs/plan-recon-bot/README.md`\n\nNo screenshots, no badges. Keep it terse.\n\n- [ ] **Step 9.3: Commit**\n\n```bash\ngit add CONTRIBUTING.md README.md\ngit commit -m \"docs: link new quality-automation surfaces\"\n```\n\n---\n\n### Task Final: Flip PR to ready-for-review\n\n- [ ] **Final.1: Run the full gate one more time**\n\n```bash\nnpm run verify\n( cd examples/nurture-pet && npm run smoke )\nnpm run determinism:replay\n```\n\nMutation is **not** in this gate — too slow. Owner can spot-check by\nrunning `npm run mutation` if desired.\n\n- [ ] **Final.2: Confirm every checkbox above is ticked**\n\n```bash\ngrep -E '^- \\[ \\]' docs/plans/2026-04-26-quality-automation-routines.md\n```\n\nExpected: no output (zero unchecked boxes).\n\n- [ ] **Final.3: Mark PR ready**\n\n```bash\ngh pr ready \n```\n\n- [ ] **Final.4: Optional — add a Codex re-review trigger**\n\n```bash\ngh pr comment --body \"@codex review\"\n```\n\nStandard pattern from `MEMORY.md → feedback_pr_codex_polling.md`. If\nfindings come back, address per\n`MEMORY.md → feedback_codex_signal_endpoints.md`.\n\n---\n\n## Risk register (read once before starting)\n\n- **Stryker runtime explosion.** If the suite balloons past 45 min on a\n single runner, drop `concurrency` to match the runner's vCPU count\n and / or split the `mutate` glob across two workflow jobs (e.g.\n `src/agent/**` vs. everything else). Don't lower the threshold to\n paper over slowness.\n- **Determinism baseline drift.** Any legitimate library change that\n alters trace contents (new event type, reordered tick stage)\n invalidates `baseline.json`. Treat that as an explicit re-baseline\n step in the same PR that changes behavior — never bypass the\n assertion. Add a `determinism:baseline` script comment in\n `package.json` calling this out.\n- **Playwright flake.** The demo loads tfjs which probes WebGL → WASM →\n CPU on startup. In CI on Ubuntu, expect WASM. Allow `retries: 1`\n but never higher; >1 retries hides real flakes.\n- **Bot-pushed develop commits.** Row 5 pushes a metrics row directly\n to `develop` from a workflow. If branch protection blocks this\n (likely), pivot to PR-bot path documented in step 5.7. Don't\n weaken protection.\n- **Action SHA churn.** Every new workflow added in this PR uses pinned\n SHAs. After this PR merges, the next `actions-bump-bot` run will\n attempt to bump them. That's expected — review that bump PR like any\n other.\n- **One PR, one branch.** Owner explicitly approved bundling all eight\n rows on this branch. Project default (`one PR, one concern`) does\n not apply here. If a reviewer flags split-required, point them to\n this plan section.\n\n---\n\n## When to mark this plan shipped\n\nMove this file to `docs/archive/plans/2026-04-26-quality-automation-routines.md`\nvia `git mv` in the **same commit** that flips the PR to merged (or in\na follow-up `chore(docs)` commit on `develop` if that's not feasible).\nPer `MEMORY.md → feedback_docs_alongside_pr.md`.\nchore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)\n\n# Quality automation routines — implementation plan\n\n> **For agentic workers:** REQUIRED: follow this plan top-to-bottom on\n> branch `chore/quality-automation-routines` (worktree\n> `.worktrees/chore-quality-automation`). Steps use checkbox (`- [ ]`)\n> syntax for tracking. The PR opens **draft** with this plan as its body\n> reference; flip to ready-for-review only after every row below is\n> checked off and `npm run verify` is green.\n\n**Goal:** Close known quality / supply-chain / drift gaps not covered by\nthe existing CI gate or the daily-code-review + weekly-docs-review\nroutines, by adding seven new automation surfaces (six CI/cron jobs +\nthree cloud-routine prompts).\n\n**Architecture:**\n\n- **GitHub Actions workflows** (`.github/workflows/*.yml`) for jobs that\n need to run inside CI infra (CodeQL, mutation testing, Playwright,\n bundle-size trend, determinism replay).\n- **Cloud-routine prompt directories** (`docs//PROMPT.md` +\n `README.md`) for jobs that need an LLM-driven agent (dependency\n triage, action SHA bumps, plan reconciliation). Same shape as the\n existing `docs/review-bot/` and `docs/docs-review-bot/`.\n- **No core library changes.** All additions live under `.github/`,\n `docs/`, `tests/determinism/`, and `examples/nurture-pet/`. No\n `src/**` edits. No changesets needed (tooling-only PR).\n\n**Tech stack:**\n\n- GitHub Actions, Dependabot, CodeQL.\n- StrykerJS (`@stryker-mutator/core` + `@stryker-mutator/vitest-runner`)\n for mutation testing.\n- Playwright (`@playwright/test`) for demo smoke.\n- Existing `scripts/bump-actions.mjs`, `scripts/coverage-pr-comment.mjs`\n pattern for any new helper scripts.\n\n**Out of scope (this plan):**\n\n- Stale-branch cleaner — explicitly deferred per owner decision\n (2026-04-26).\n- Type-coverage report, license/SBOM audit, mutation testing on\n examples — punt to a future plan if value materializes.\n\n---\n\n## File structure\n\n### New files\n\n| Path | Responsibility |\n| --- | --- |\n| `.github/workflows/codeql.yml` | Weekly + push-to-develop CodeQL JS/TS scan. |\n| `.github/workflows/mutation.yml` | Weekly Stryker run on `develop`; uploads HTML report artifact. |\n| `.github/workflows/demo-smoke.yml` | Nightly Playwright headless run against built demo. |\n| `.github/workflows/bundle-size-trend.yml` | Weekly snapshot of `npx size-limit --json` to a committed `docs/metrics/bundle-trend.jsonl`. |\n| `.github/workflows/determinism.yml` | Weekly replay of seeded pet sims; hash-compares `DecisionTrace` against committed baseline. |\n| `stryker.config.mjs` | Stryker config (vitest runner, sane mutate globs, threshold). |\n| `examples/nurture-pet/playwright.config.ts` | Playwright config for the demo smoke spec. |\n| `examples/nurture-pet/tests/smoke/golden-path.spec.ts` | Click Feed/Pet/Sleep/Train; assert HUD updates + no console errors. |\n| `tests/determinism/replay.bench.ts` | Vitest-driven replay across N seeds; emits one `sha256(trace-stream)` per seed. |\n| `tests/determinism/baseline.json` | Committed map `{ seedString: sha256 }` (ground truth). |\n| `tests/determinism/replay.ts` | Replay harness (pure function: seed → trace stream → sha). |\n| `docs/metrics/bundle-trend.jsonl` | Append-only JSONL: one row per weekly snapshot. Created by row 5. |\n| `docs/dep-triage-bot/PROMPT.md` | System prompt for the weekly Dependabot triage routine. |\n| `docs/dep-triage-bot/README.md` | How the routine consumes `PROMPT.md`, where outputs go. |\n| `docs/actions-bump-bot/PROMPT.md` | System prompt for the weekly action-SHA bump routine. |\n| `docs/actions-bump-bot/README.md` | Same shape as above. |\n| `docs/plan-recon-bot/PROMPT.md` | System prompt for the monthly plan-vs-shipped reconciliation routine. |\n| `docs/plan-recon-bot/README.md` | Same shape as above. |\n| `scripts/append-size-snapshot.mjs` | Read `npx size-limit --json` stdin, append a row to `docs/metrics/bundle-trend.jsonl`. |\n| `scripts/run-determinism-replay.mjs` | CLI wrapper that runs `tests/determinism/replay.ts` for the workflow + diffs vs baseline; non-zero exit on mismatch. |\n\n### Modified files\n\n| Path | Change |\n| --- | --- |\n| `package.json` | Add devDeps: `@stryker-mutator/core`, `@stryker-mutator/vitest-runner`, `@playwright/test`. Add scripts: `mutation`, `mutation:report`, `determinism:replay`, `determinism:baseline`. |\n| `examples/nurture-pet/package.json` | Add devDep `@playwright/test`; script `smoke`. |\n| `.gitignore` | Ignore `reports/mutation/`, `playwright-report/`, `examples/nurture-pet/playwright-report/`, `examples/nurture-pet/test-results/`. |\n| `.github/dependabot.yml` | Group npm minor + patch updates so the triage routine sees one PR per ecosystem-week, not N. |\n| `CONTRIBUTING.md` | Brief mention of mutation / smoke / determinism scripts in the dev-loop section. |\n| `README.md` | One-line bullet under the badges/quality section: links to the trend file + bot prompts. |\n\n### Branching / PR shape\n\nThis plan ships on **one** branch (`chore/quality-automation-routines`)\nunder **one** draft PR (`docs(plans): quality-automation routines + ...`).\nPer owner direction, every row below lands as its own commit on this\nbranch. The PR is flipped to ready-for-review only after the final row\nchecks off and `npm run verify` is green.\n\n> **Why one PR, not the usual one-per-row?** This batch is mostly\n> additive infra (workflows + prompts + dev-deps) with near-zero blast\n> radius on the library. Splitting eight tooling-only rows into eight\n> PRs would burn ~8 Codex review cycles for marginal review benefit.\n> When a row touches `src/**` (none of them do here) future plans\n> revert to the standard one-row-per-PR rule.\n\n---\n\n## Verification gate per row\n\nEach row ends with `npm run verify` passing locally before commit. New\nworkflows must additionally be **lint-clean under `actionlint`**\n(already wired into CI) — run locally with:\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color\n```\n\n…or push the commit and watch the existing `Lint workflows (actionlint)`\njob. New action references must use full 40-char SHAs with a trailing\n`# vX.Y.Z` comment (per the supply-chain rule in the existing CI\nheader). Resolve a SHA via:\n\n```bash\ngh api repos///commits/ --jq '.sha'\n```\n\n---\n\n## Chunk 1: Bootstrap (rows 0–1)\n\n### Task 0: Land the plan + open the draft PR\n\n**Files:**\n- Create: `docs/plans/2026-04-26-quality-automation-routines.md` (this file).\n\n- [ ] **Step 0.1: Confirm worktree on `chore/quality-automation-routines`**\n\n```bash\ngit -C .worktrees/chore-quality-automation rev-parse --abbrev-ref HEAD\n# expected: chore/quality-automation-routines\n```\n\n- [ ] **Step 0.2: Stage and commit the plan**\n\n```bash\ngit -C .worktrees/chore-quality-automation add docs/plans/2026-04-26-quality-automation-routines.md\ngit -C .worktrees/chore-quality-automation commit -m \"docs(plans): quality-automation routines roadmap\"\n```\n\n- [ ] **Step 0.3: Push branch + open draft PR**\n\n```bash\ngit -C .worktrees/chore-quality-automation push -u origin chore/quality-automation-routines\ngh pr create --draft --base develop \\\n --title \"chore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)\" \\\n --body-file docs/plans/2026-04-26-quality-automation-routines.md\n```\n\nExpected: draft PR URL printed, status `Draft`. Note the PR number for\nlater step `Final.3`.\n\n---\n\n### Task 1: CodeQL weekly + push-to-develop\n\n**Why first:** single file, GitHub-native, zero new deps. Smallest\npossible win.\n\n**Files:**\n- Create: `.github/workflows/codeql.yml`\n\n- [ ] **Step 1.1: Resolve SHAs for `actions/checkout@v6` and\n `github/codeql-action/{init,analyze}@v4`** (or current major)\n\n```bash\ngh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'\ngh api repos/github/codeql-action/git/refs/tags/v4 --jq '.object.sha'\n```\n\nCapture the SHAs; use them verbatim in the YAML below with a trailing\n`# v6.0.2` / `# v4` comment.\n\n- [ ] **Step 1.2: Write `.github/workflows/codeql.yml`**\n\n```yaml\nname: CodeQL\n\non:\n push:\n branches: [develop, main]\n pull_request:\n branches: [develop, main]\n schedule:\n # Mondays 06:00 UTC — same window as docs-review weekly cadence.\n - cron: '0 6 * * 1'\n\nconcurrency:\n group: codeql-${{ github.ref }}\n cancel-in-progress: true\n\npermissions:\n contents: read\n security-events: write\n actions: read\n\njobs:\n analyze:\n name: Analyze (javascript-typescript)\n runs-on: ubuntu-latest\n strategy:\n fail-fast: false\n matrix:\n language: [javascript-typescript]\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: github/codeql-action/init@ # v4\n with:\n languages: ${{ matrix.language }}\n # security-and-quality is the broadest default suite that GA\n # supports. security-extended would also work; quality-only\n # would miss CWE-079/CWE-094 patterns we want flagged.\n queries: security-and-quality\n - uses: github/codeql-action/analyze@ # v4\n with:\n category: '/language:${{ matrix.language }}'\n```\n\n- [ ] **Step 1.3: Local actionlint pass**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/codeql.yml\n```\n\nExpected: no output (clean).\n\n- [ ] **Step 1.4: Verify locally that the gate is unaffected**\n\n```bash\nnpm run verify\n```\n\nExpected: same pass set as `develop`.\n\n- [ ] **Step 1.5: Commit**\n\n```bash\ngit add .github/workflows/codeql.yml\ngit commit -m \"ci(codeql): add weekly + push CodeQL JS/TS scan\"\n```\n\n- [ ] **Step 1.6: Push and confirm the workflow runs in Actions tab**\n\n```bash\ngit push\n```\n\nExpected: a `CodeQL / Analyze (javascript-typescript)` run appears for\nthe push and finishes success.\n\n---\n\n## Chunk 2: Cloud-routine prompts (rows 2–4)\n\nThese three rows add prompt directories only — no workflows, no deps,\nno library code. Each ships behind `docs//`. The actual\nscheduling happens outside the repo (Claude Cloud cron), same way as\n`docs/review-bot/` and `docs/docs-review-bot/`.\n\n### Task 2: Dependabot triage routine prompt\n\n**Files:**\n- Create: `docs/dep-triage-bot/PROMPT.md`\n- Create: `docs/dep-triage-bot/README.md`\n- Modify: `.github/dependabot.yml` — group npm minor+patch into one PR\n per ecosystem-week so the triage routine sees a tractable input.\n\n- [ ] **Step 2.1: Read existing pattern**\n\n```bash\ncat docs/docs-review-bot/PROMPT.md # use as structural template\ncat docs/docs-review-bot/README.md\ncat .github/dependabot.yml\n```\n\n- [ ] **Step 2.2: Update `.github/dependabot.yml`**\n\nAdd a `groups:` block on each `package-ecosystem: \"npm\"` entry so minor\n+ patch updates land in a single weekly PR rather than 5–10 separate\nones.\n\n```yaml\n# Example shape — adapt to existing keys verbatim.\n- package-ecosystem: \"npm\"\n directory: \"/\"\n schedule:\n interval: \"weekly\"\n groups:\n npm-non-major:\n patterns: [\"*\"]\n update-types: [\"minor\", \"patch\"]\n```\n\n- [ ] **Step 2.3: Write `docs/dep-triage-bot/PROMPT.md`**\n\nSections to include (mirror `docs/review-bot/PROMPT.md`):\n\n1. **Role** — \"Senior dependency triage. Conservative, not adventurous.\n Goal: drain the Dependabot pile without bricking the build.\"\n2. **Scope this run** — \"Open Dependabot PRs targeting `develop`, label\n `dependencies`.\"\n3. **Triage policy** — patch + minor on dev-deps: rebase, run\n `npm run verify`, auto-merge if green. Patch + minor on runtime\n deps: rebase, run verify, leave a one-line approval comment but do\n NOT merge (owner approval required). Major on anything: comment\n with the changelog summary + breaking-change bullet list, leave for\n owner. Peer-deps: never auto-merge.\n4. **Hard rules** — never merge a PR that touches `src/**` (means\n Dependabot generated more than a manifest bump, suspicious); never\n bypass `--no-verify`; never amend the Dependabot commit.\n5. **Output** — append a one-comment summary on a rolling\n tracker issue `Dependency triage — develop` (label\n `dep-triage-bot`).\n6. **Failure handling** — verify fails → comment \"verify failed: \\\" on the Dependabot PR + tracker, do not merge.\n\nUse the same idempotency pattern as `docs/review-bot/PROMPT.md`\n(rolling issue, append comments, never push direct to develop).\n\n- [ ] **Step 2.4: Write `docs/dep-triage-bot/README.md`**\n\nMirror `docs/review-bot/README.md`: how the routine consumes the\nprompt, where output lives, how to evolve it.\n\n- [ ] **Step 2.5: Commit**\n\n```bash\ngit add docs/dep-triage-bot/ .github/dependabot.yml\ngit commit -m \"docs(routine): add weekly Dependabot triage prompt\"\n```\n\n---\n\n### Task 3: Action SHA bump routine prompt\n\n**Files:**\n- Create: `docs/actions-bump-bot/PROMPT.md`\n- Create: `docs/actions-bump-bot/README.md`\n\n- [ ] **Step 3.1: Confirm `scripts/bump-actions.mjs` exists and works**\n\n```bash\nnode scripts/bump-actions.mjs\n```\n\nExpected: prints any pending bumps (or \"no drift\") without writing\nfiles. Capture exact output shape — the prompt has to instruct the\nagent how to parse it.\n\n- [ ] **Step 3.2: Write `docs/actions-bump-bot/PROMPT.md`**\n\nMirror the dep-triage prompt structure. Key sections:\n\n1. **Role** — \"Action SHA-bump caretaker. Single job: keep\n `.github/workflows/*.yml` action references at their latest\n tags-as-SHA.\"\n2. **Scope this run** — \"Run weekly. Inputs come from\n `node scripts/bump-actions.mjs`.\"\n3. **Process** — branch off `develop`\n (`chore/actions-bump-YYYY-MM-DD`), apply each bump, verify\n `actionlint` clean, run `npm run verify`, open one PR with the\n diff. Owner reviews and merges.\n4. **Hard rules** — never bump across a major (require explicit owner\n approval); never edit the SHA without re-resolving via `gh api`;\n never alter the trailing `# vX.Y.Z` comment without matching the\n bumped tag.\n5. **Output** — single PR per run, body lists each `(action, old SHA,\n new SHA, version label)`. No-op runs: post a one-line comment on the\n tracker issue `Action SHA bumps — develop` and exit.\n6. **Failure handling** — verify fails → close branch, comment on\n tracker.\n\n- [ ] **Step 3.3: Write `docs/actions-bump-bot/README.md`**\n\n- [ ] **Step 3.4: Commit**\n\n```bash\ngit add docs/actions-bump-bot/\ngit commit -m \"docs(routine): add weekly action-SHA bump prompt\"\n```\n\n---\n\n### Task 4: Plan reconciliation routine prompt\n\n**Why monthly, not weekly:** plans are coarse-grained; a weekly cadence\nwould mostly produce no-ops. Monthly aligns with how often roadmap\nrows complete in batches.\n\n**Files:**\n- Create: `docs/plan-recon-bot/PROMPT.md`\n- Create: `docs/plan-recon-bot/README.md`\n\n- [ ] **Step 4.1: Read the archive convention**\n\n```bash\ncat docs/archive/README.md\nls docs/archive/plans/\nls docs/plans/\n```\n\n- [ ] **Step 4.2: Write `docs/plan-recon-bot/PROMPT.md`**\n\nSections:\n\n1. **Role** — \"Plan archivist. Reconcile `docs/plans/*.md` against\n shipped state. Different from docs-review-bot (which audits prose\n drift); this routine answers 'is this plan done?' \"\n2. **Scope this run** — every file under `docs/plans/`. For each:\n parse roadmap rows, cross-check `git log origin/develop` (and the\n tracker issue if linked) for shipped status, and either (a) leave\n alone if work continues, (b) move to `docs/archive/plans/` via\n `git mv` if every row is shipped or the plan is superseded.\n3. **Hard rules** — never delete plan content; only `git mv`. Preserve\n the date prefix. Never archive a plan that has open rows.\n4. **Output** — open one PR per run with archive moves, body lists\n each `(plan, last shipped row, archive reason)`. No moves needed:\n post a one-line comment on the tracker issue `Plan reconciliation`\n and exit.\n5. **Failure handling** — same pattern as the other routines.\n\n- [ ] **Step 4.3: Write `docs/plan-recon-bot/README.md`**\n\n- [ ] **Step 4.4: Commit**\n\n```bash\ngit add docs/plan-recon-bot/\ngit commit -m \"docs(routine): add monthly plan reconciliation prompt\"\n```\n\n---\n\n## Chunk 3: Bundle-size trend (row 5)\n\nRationale: existing `size-limit-comment` job posts the per-PR delta but\ngives no longitudinal view. A weekly snapshot to a committed JSONL\nfile in `docs/metrics/` lets us graph the trend later (and inspect by\ndiff today).\n\n### Task 5: Weekly bundle-size trend snapshot\n\n**Files:**\n- Create: `scripts/append-size-snapshot.mjs`\n- Create: `.github/workflows/bundle-size-trend.yml`\n- Create: `docs/metrics/bundle-trend.jsonl` (empty file at first commit)\n\n- [ ] **Step 5.1: Write the snapshot script (TDD)**\n\nCreate `scripts/append-size-snapshot.test.mjs` first, then the\nimplementation. The test feeds the script a fixture `size-limit --json`\noutput via stdin and asserts:\n\n- Output JSONL has exactly one row.\n- Row keys: `iso` (UTC ISO-8601 date), `sha` (7-char head SHA from\n env), `entries` (array of `{name, size, gzip}` from input).\n- Existing rows in the target file are preserved; the new row is\n appended.\n\n```js\n// scripts/append-size-snapshot.test.mjs\nimport { test, expect } from 'vitest';\nimport { spawnSync } from 'node:child_process';\nimport { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\ntest('appends one JSONL row from size-limit JSON on stdin', () => {\n const dir = mkdtempSync(join(tmpdir(), 'sizesnap-'));\n const target = join(dir, 'bundle-trend.jsonl');\n writeFileSync(target, ''); // empty\n const fixture = JSON.stringify([\n { name: 'core', size: 1234, gzip: 567 },\n { name: 'integrations/excalibur', size: 200, gzip: 100 },\n ]);\n const out = spawnSync(\n process.execPath,\n ['scripts/append-size-snapshot.mjs', '--target', target],\n { input: fixture, env: { ...process.env, GITHUB_SHA: 'abcdef0' } },\n );\n expect(out.status).toBe(0);\n const rows = readFileSync(target, 'utf8').trim().split('\\n').filter(Boolean);\n expect(rows).toHaveLength(1);\n const row = JSON.parse(rows[0]);\n expect(row.sha).toBe('abcdef0');\n expect(row.entries).toHaveLength(2);\n expect(row.iso).toMatch(/^\\d{4}-\\d{2}-\\d{2}T/);\n});\n```\n\n- [ ] **Step 5.2: Run the test (red)**\n\n```bash\nnpx vitest run scripts/append-size-snapshot.test.mjs\n```\n\nExpected: FAIL (`Cannot find module 'scripts/append-size-snapshot.mjs'`).\n\n- [ ] **Step 5.3: Implement `scripts/append-size-snapshot.mjs`**\n\nArgv: `--target `. Reads stdin → JSON. Builds `{iso, sha,\nentries}`. Appends one line. Idempotent on identical content (skip if\nlast line equals new line minus `iso`).\n\n- [ ] **Step 5.4: Re-run the test (green)**\n\n```bash\nnpx vitest run scripts/append-size-snapshot.test.mjs\n```\n\nExpected: PASS.\n\n- [ ] **Step 5.5: Create the empty trend file**\n\n```bash\ntouch docs/metrics/bundle-trend.jsonl\n```\n\nAdd a 2-line preamble inside the file? **No.** JSONL by definition has\nno header; downstream tools assume one JSON value per line. Keep it\nempty.\n\n- [ ] **Step 5.6: Write `.github/workflows/bundle-size-trend.yml`**\n\n```yaml\nname: Bundle-size trend\n\non:\n schedule:\n # Sundays 04:00 UTC. After the Monday CodeQL window so two cron\n # workflows don't collide on a single runner pool peak.\n - cron: '0 4 * * 0'\n workflow_dispatch:\n\npermissions:\n contents: write # commits the snapshot row\n\njobs:\n snapshot:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@ # v6.0.2\n with: { ref: develop }\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run build\n - name: Append snapshot row\n env:\n GITHUB_SHA: ${{ github.sha }}\n run: |\n npx size-limit --json | \\\n node scripts/append-size-snapshot.mjs \\\n --target docs/metrics/bundle-trend.jsonl\n - name: Commit + push if changed\n run: |\n git config user.name \"github-actions[bot]\"\n git config user.email \"41898282+github-actions[bot]@users.noreply.github.com\"\n if [[ -n \"$(git status --porcelain docs/metrics/bundle-trend.jsonl)\" ]]; then\n git add docs/metrics/bundle-trend.jsonl\n git commit -m \"chore(metrics): bundle-size snapshot $(date -u +%F)\"\n git push origin develop\n fi\n```\n\n> **Direct push to `develop`?** The repo rule says \"never push direct\n> to develop\" but explicitly allows post-merge pulls. This is a metrics\n> append by github-actions bot, not human work. If branch protection\n> on `develop` blocks even bot pushes, switch to: open a PR per run via\n> `peter-evans/create-pull-request` and let the dep-triage routine\n> auto-merge it. Decide at step 5.7.\n\n- [ ] **Step 5.7: Decide direct-push vs PR-bot path**\n\n```bash\ngh api repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/branches/develop/protection 2>&1 | head -20\n```\n\nIf `required_status_checks` includes `ci-gate` and direct push is\nblocked → switch the workflow to open a PR via\n`peter-evans/create-pull-request@` and document the path swap in\nthis row.\n\n- [ ] **Step 5.8: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/bundle-size-trend.yml\nnpm run verify\n```\n\n- [ ] **Step 5.9: Commit**\n\n```bash\ngit add scripts/append-size-snapshot.mjs scripts/append-size-snapshot.test.mjs \\\n docs/metrics/bundle-trend.jsonl .github/workflows/bundle-size-trend.yml\ngit commit -m \"ci(metrics): weekly bundle-size trend snapshot\"\n```\n\n---\n\n## Chunk 4: Determinism replay benchmark (row 6)\n\nRationale: the determinism rule (`SeededRng` + `ManualClock` ⇒ byte-\nidentical `DecisionTrace`) is enforced statically by ESLint\n(no `Date.now`/`Math.random`) but never tested **end-to-end**. A\nhash-pinned replay across N seeds catches non-static violations: a new\nhelper that secretly reads `performance.now()`, a `Date` constructor\ninside a needs policy, etc.\n\n### Task 6: Hash-pinned replay across N seeds\n\n**Files:**\n- Create: `tests/determinism/replay.ts`\n- Create: `tests/determinism/replay.bench.ts` *(actually a vitest\n test, not a bench — using `.bench.ts` would skew CI timing)*\n- Create: `tests/determinism/baseline.json`\n- Create: `scripts/run-determinism-replay.mjs`\n- Create: `.github/workflows/determinism.yml`\n- Modify: `package.json` — scripts `determinism:replay`,\n `determinism:baseline`.\n\n- [ ] **Step 6.1: Decide the seed set**\n\nPick 8 seed strings. Mix short, long, ASCII, and non-ASCII to also\ncatch encoding regressions. Hard-code in `replay.ts`:\n\n```ts\nexport const REPLAY_SEEDS = [\n 'alpha', 'beta', 'gamma',\n '12345678901234567890',\n 'snowman-☃️',\n 'mixed-CASE-42',\n 'r-eat-then-sleep',\n 'mood-swing-edge',\n];\n```\n\n- [ ] **Step 6.2: Write `tests/determinism/replay.ts`**\n\nPure function `replaySeed(seed: string): string` (sha256 hex). Inside:\n\n1. Construct `SeededRng(seed)` + `ManualClock(0)`.\n2. Build a default agent via the public test helpers (mirror the\n pattern in `tests/integration/`).\n3. Tick 1000 times advancing the clock by 100 ms per tick.\n4. Stream every event from the bus into a hash; return the digest.\n\nUse `crypto.createHash('sha256')` from `node:crypto`.\n\n- [ ] **Step 6.3: Write the assertion test (red)**\n\n```ts\n// tests/determinism/replay.bench.ts\nimport { test, expect } from 'vitest';\nimport { readFileSync } from 'node:fs';\nimport { REPLAY_SEEDS, replaySeed } from './replay.js';\n\nconst baseline = JSON.parse(readFileSync(\n new URL('./baseline.json', import.meta.url), 'utf8'\n)) as Record;\n\ntest.each(REPLAY_SEEDS)('replay matches baseline: %s', (seed) => {\n expect(replaySeed(seed)).toBe(baseline[seed]);\n});\n```\n\n- [ ] **Step 6.4: Run the test (red)**\n\n```bash\nnpx vitest run tests/determinism/replay.bench.ts\n```\n\nExpected: FAIL — `baseline.json` does not exist yet.\n\n- [ ] **Step 6.5: Generate `baseline.json` once**\n\n```bash\nnode --import tsx scripts/run-determinism-replay.mjs --write-baseline\n```\n\nThe script imports `replaySeed` + `REPLAY_SEEDS`, computes one digest\nper seed, writes the map to `tests/determinism/baseline.json`.\n\n- [ ] **Step 6.6: Re-run the test (green)**\n\n```bash\nnpx vitest run tests/determinism/replay.bench.ts\n```\n\nExpected: PASS for all 8 seeds.\n\n- [ ] **Step 6.7: Run twice in the same shell to confirm stability**\n\n```bash\nfor i in 1 2 3; do npx vitest run tests/determinism/replay.bench.ts; done\n```\n\nExpected: PASS PASS PASS. Any flake means the harness is non-\ndeterministic — fix `replay.ts` rather than weakening the assertion.\n\n- [ ] **Step 6.8: Wire scripts**\n\n```json\n// package.json — add to \"scripts\":\n\"determinism:replay\": \"vitest run tests/determinism/replay.bench.ts\",\n\"determinism:baseline\": \"node --import tsx scripts/run-determinism-replay.mjs --write-baseline\"\n```\n\n- [ ] **Step 6.9: Workflow**\n\n```yaml\n# .github/workflows/determinism.yml\nname: Determinism replay\n\non:\n schedule:\n - cron: '0 5 * * 1' # Mondays 05:00 UTC, before CodeQL\n push:\n branches: [develop]\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n replay:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run determinism:replay\n```\n\n> **Why also on `push: develop`?** Catching a determinism violation\n> *between* the weekly run is worth one ~1-minute job per merge.\n\n- [ ] **Step 6.10: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/determinism.yml\nnpm run verify\n```\n\n- [ ] **Step 6.11: Commit**\n\n```bash\ngit add tests/determinism/ scripts/run-determinism-replay.mjs \\\n .github/workflows/determinism.yml package.json\ngit commit -m \"test(determinism): hash-pinned replay across 8 seeds\"\n```\n\n---\n\n## Chunk 5: Mutation testing (row 7)\n\nRationale: existing coverage delta proves *lines ran*. Mutation testing\nproves *tests would fail if the line changed*. Pairs with the existing\ncoverage PR comment to close the \"test asserts nothing\" loophole.\n\n### Task 7: Stryker weekly run\n\n**Files:**\n- Create: `stryker.config.mjs`\n- Create: `.github/workflows/mutation.yml`\n- Modify: `package.json` (devDeps + scripts)\n- Modify: `.gitignore`\n\n- [ ] **Step 7.1: Add devDeps**\n\n```bash\nnpm install --save-dev --save-exact \\\n @stryker-mutator/core@latest \\\n @stryker-mutator/vitest-runner@latest\n```\n\nPin exact versions in `package.json`. Update lockfile.\n\n- [ ] **Step 7.2: Write `stryker.config.mjs`**\n\n```js\n// stryker.config.mjs\n/** @type {import('@stryker-mutator/api/core').PartialStrykerOptions} */\nexport default {\n testRunner: 'vitest',\n reporters: ['progress', 'clear-text', 'html', 'dashboard'],\n coverageAnalysis: 'perTest',\n // Mutate library source only. Skip integrations + tooling.\n mutate: [\n 'src/**/*.ts',\n '!src/**/*.test.ts',\n '!src/**/index.ts',\n '!src/integrations/**',\n '!src/**/internal/**', // already covered transitively via callers\n ],\n thresholds: { high: 80, low: 60, break: 55 },\n htmlReporter: { fileName: 'reports/mutation/mutation.html' },\n timeoutMS: 15_000,\n concurrency: 4,\n};\n```\n\n> Threshold seed values are placeholders — the first run produces the\n> baseline. After that run lands, replace `break: 55` with `current\n> score - 2` so future regressions fail the job but normal noise does\n> not. Capture the baseline number in the row's commit message.\n\n- [ ] **Step 7.3: Add scripts to `package.json`**\n\n```json\n\"mutation\": \"stryker run\",\n\"mutation:report\": \"open reports/mutation/mutation.html\"\n```\n\n- [ ] **Step 7.4: Update `.gitignore`**\n\n```\nreports/mutation/\n.stryker-tmp/\n```\n\n- [ ] **Step 7.5: Run locally to capture the baseline score**\n\n```bash\nnpm run mutation\n```\n\nExpected: prints a score (e.g. \"Mutation score: 73.4%\"). This is the\nbaseline. **Update `stryker.config.mjs` `thresholds.break`** to\n`floor(score) - 2` and re-run to confirm green.\n\n> Local run on full suite is slow (~15-30 min). If it exceeds 45 min,\n> trim `mutate` further (e.g. exclude `src/persistence/` for the first\n> pass) and document the carve-out in the row's commit message.\n\n- [ ] **Step 7.6: Workflow**\n\n```yaml\n# .github/workflows/mutation.yml\nname: Mutation testing\n\non:\n schedule:\n - cron: '0 7 * * 1' # Mondays 07:00 UTC, after CodeQL + determinism\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n stryker:\n runs-on: ubuntu-latest\n timeout-minutes: 60\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run mutation\n - uses: actions/upload-artifact@ # v5.0.0\n if: always()\n with:\n name: mutation-report\n path: reports/mutation/\n if-no-files-found: error\n retention-days: 30\n```\n\n- [ ] **Step 7.7: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/mutation.yml\nnpm run verify\n```\n\n> `npm run verify` does NOT include `npm run mutation` — too slow for\n> the pre-PR gate. Mutation runs only on the weekly schedule.\n\n- [ ] **Step 7.8: Commit**\n\n```bash\ngit add stryker.config.mjs .github/workflows/mutation.yml \\\n package.json package-lock.json .gitignore\ngit commit -m \"test(mutation): weekly Stryker run on develop (baseline N%)\"\n```\n\n---\n\n## Chunk 6: Demo Playwright smoke (row 8)\n\nRationale: existing CI builds the demo (`demo-build` job) but never\nruns it. A headless click-through across the golden path catches\nruntime regressions that typecheck + bundle don't (tfjs backend probe,\n`base` URL handling, vite HTML transform regressions — see\n`MEMORY.md → feedback_vite_html_transform`).\n\n### Task 8: Playwright golden-path smoke\n\n**Files:**\n- Create: `examples/nurture-pet/playwright.config.ts`\n- Create: `examples/nurture-pet/tests/smoke/golden-path.spec.ts`\n- Create: `.github/workflows/demo-smoke.yml`\n- Modify: `examples/nurture-pet/package.json` — devDep + script\n- Modify: `.gitignore`\n\n- [ ] **Step 8.1: Add Playwright to the demo**\n\n```bash\ncd examples/nurture-pet\nnpm install --save-dev --save-exact @playwright/test@latest\nnpx playwright install --with-deps chromium\ncd -\n```\n\nPin `@playwright/test` in `examples/nurture-pet/package.json`. Do NOT\nadd it to the root `package.json` — the demo manages its own deps\n(`MEMORY.md` notes the `file:../..` EISDIR pitfall on Windows).\n\n- [ ] **Step 8.2: `examples/nurture-pet/playwright.config.ts`**\n\n```ts\nimport { defineConfig, devices } from '@playwright/test';\n\nexport default defineConfig({\n testDir: './tests/smoke',\n fullyParallel: false, // single demo instance, single worker\n forbidOnly: !!process.env.CI,\n retries: process.env.CI ? 1 : 0,\n workers: 1,\n reporter: process.env.CI ? [['github'], ['html']] : 'list',\n use: {\n baseURL: 'http://127.0.0.1:4173',\n trace: 'retain-on-failure',\n screenshot: 'only-on-failure',\n },\n webServer: {\n command: 'npm run preview -- --host 127.0.0.1 --port 4173',\n url: 'http://127.0.0.1:4173',\n reuseExistingServer: !process.env.CI,\n timeout: 60_000,\n },\n projects: [\n { name: 'chromium', use: { ...devices['Desktop Chrome'] } },\n ],\n});\n```\n\n- [ ] **Step 8.3: Write `tests/smoke/golden-path.spec.ts`**\n\n```ts\nimport { test, expect } from '@playwright/test';\n\ntest('golden path: feed → pet → sleep updates HUD without console errors', async ({\n page,\n}) => {\n const consoleErrors: string[] = [];\n page.on('pageerror', (e) => consoleErrors.push(e.message));\n page.on('console', (msg) => {\n if (msg.type() === 'error') consoleErrors.push(msg.text());\n });\n\n await page.goto('/');\n await expect(page.getByRole('heading', { level: 1 })).toBeVisible();\n\n // Replace selectors with the actual demo controls — discoverable via\n // `npm run dev` + DevTools. Keep this spec tied to user-facing roles\n // (button names, ARIA labels) not implementation classes.\n await page.getByRole('button', { name: /feed/i }).click();\n await page.getByRole('button', { name: /pet/i }).click();\n await page.getByRole('button', { name: /sleep/i }).click();\n\n // HUD assertion — pick one stable observable (e.g. \"Hunger\" stat\n // text changes). Adapt during step 8.4.\n await expect(page.getByTestId('hud-needs')).toContainText(/Hunger/);\n\n expect(consoleErrors).toEqual([]);\n});\n```\n\n- [ ] **Step 8.4: Run locally to wire selectors**\n\n```bash\ncd examples/nurture-pet\nnpm run build && npm run preview &\nPREVIEW_PID=$!\nnpx playwright test --headed --project=chromium\nkill $PREVIEW_PID\ncd -\n```\n\nIterate on selectors until the spec passes. **If the demo lacks stable\ntestids on the HUD, add them in this same row** (not a separate PR;\nthe smoke depends on them).\n\n- [ ] **Step 8.5: Add script to `examples/nurture-pet/package.json`**\n\n```json\n\"smoke\": \"playwright test\"\n```\n\n- [ ] **Step 8.6: Update `.gitignore`**\n\n```\nexamples/nurture-pet/playwright-report/\nexamples/nurture-pet/test-results/\n```\n\n- [ ] **Step 8.7: Workflow**\n\n```yaml\n# .github/workflows/demo-smoke.yml\nname: Demo smoke\n\non:\n schedule:\n - cron: '30 3 * * *' # Daily 03:30 UTC\n pull_request:\n paths:\n - 'examples/nurture-pet/**'\n - 'src/**' # library changes can break demo at runtime\n - '.github/workflows/demo-smoke.yml'\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n smoke:\n runs-on: ubuntu-latest\n timeout-minutes: 15\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run build\n - name: Install demo deps\n working-directory: examples/nurture-pet\n run: npm ci --no-audit --no-fund\n - name: Install Playwright browsers\n working-directory: examples/nurture-pet\n run: npx playwright install --with-deps chromium\n - name: Build demo\n working-directory: examples/nurture-pet\n run: npm run build\n - name: Smoke (Playwright)\n working-directory: examples/nurture-pet\n run: npm run smoke\n - uses: actions/upload-artifact@ # v5.0.0\n if: failure()\n with:\n name: playwright-report\n path: examples/nurture-pet/playwright-report/\n retention-days: 14\n```\n\n- [ ] **Step 8.8: actionlint + verify (root) + smoke run (demo)**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/demo-smoke.yml\nnpm run verify\n( cd examples/nurture-pet && npm run smoke )\n```\n\n- [ ] **Step 8.9: Commit**\n\n```bash\ngit add examples/nurture-pet/playwright.config.ts \\\n examples/nurture-pet/tests/ \\\n examples/nurture-pet/package.json \\\n examples/nurture-pet/package-lock.json \\\n .github/workflows/demo-smoke.yml \\\n .gitignore\ngit commit -m \"test(demo): nightly Playwright smoke on golden path\"\n```\n\n---\n\n## Chunk 7: Final wiring (rows 9–10)\n\n### Task 9: Doc updates\n\n**Files:**\n- Modify: `CONTRIBUTING.md`\n- Modify: `README.md`\n\n- [ ] **Step 9.1: `CONTRIBUTING.md`**\n\nAdd a brief \"Quality automation\" subsection under the existing dev-loop\nsection. List `npm run mutation`, `npm run determinism:replay`, and\n`( cd examples/nurture-pet && npm run smoke )` with one-line purposes.\n\n- [ ] **Step 9.2: `README.md`**\n\nAdd one bullet under the existing Quality / CI section linking to:\n- `docs/metrics/bundle-trend.jsonl`\n- `docs/dep-triage-bot/README.md`\n- `docs/actions-bump-bot/README.md`\n- `docs/plan-recon-bot/README.md`\n\nNo screenshots, no badges. Keep it terse.\n\n- [ ] **Step 9.3: Commit**\n\n```bash\ngit add CONTRIBUTING.md README.md\ngit commit -m \"docs: link new quality-automation surfaces\"\n```\n\n---\n\n### Task Final: Flip PR to ready-for-review\n\n- [ ] **Final.1: Run the full gate one more time**\n\n```bash\nnpm run verify\n( cd examples/nurture-pet && npm run smoke )\nnpm run determinism:replay\n```\n\nMutation is **not** in this gate — too slow. Owner can spot-check by\nrunning `npm run mutation` if desired.\n\n- [ ] **Final.2: Confirm every checkbox above is ticked**\n\n```bash\ngrep -E '^- \\[ \\]' docs/plans/2026-04-26-quality-automation-routines.md\n```\n\nExpected: no output (zero unchecked boxes).\n\n- [ ] **Final.3: Mark PR ready**\n\n```bash\ngh pr ready \n```\n\n- [ ] **Final.4: Optional — add a Codex re-review trigger**\n\n```bash\ngh pr comment --body \"@codex review\"\n```\n\nStandard pattern from `MEMORY.md → feedback_pr_codex_polling.md`. If\nfindings come back, address per\n`MEMORY.md → feedback_codex_signal_endpoints.md`.\n\n---\n\n## Risk register (read once before starting)\n\n- **Stryker runtime explosion.** If the suite balloons past 45 min on a\n single runner, drop `concurrency` to match the runner's vCPU count\n and / or split the `mutate` glob across two workflow jobs (e.g.\n `src/agent/**` vs. everything else). Don't lower the threshold to\n paper over slowness.\n- **Determinism baseline drift.** Any legitimate library change that\n alters trace contents (new event type, reordered tick stage)\n invalidates `baseline.json`. Treat that as an explicit re-baseline\n step in the same PR that changes behavior — never bypass the\n assertion. Add a `determinism:baseline` script comment in\n `package.json` calling this out.\n- **Playwright flake.** The demo loads tfjs which probes WebGL → WASM →\n CPU on startup. In CI on Ubuntu, expect WASM. Allow `retries: 1`\n but never higher; >1 retries hides real flakes.\n- **Bot-pushed develop commits.** Row 5 pushes a metrics row directly\n to `develop` from a workflow. If branch protection blocks this\n (likely), pivot to PR-bot path documented in step 5.7. Don't\n weaken protection.\n- **Action SHA churn.** Every new workflow added in this PR uses pinned\n SHAs. After this PR merges, the next `actions-bump-bot` run will\n attempt to bump them. That's expected — review that bump PR like any\n other.\n- **One PR, one branch.** Owner explicitly approved bundling all eight\n rows on this branch. Project default (`one PR, one concern`) does\n not apply here. If a reviewer flags split-required, point them to\n this plan section.\n\n---\n\n## When to mark this plan shipped\n\nMove this file to `docs/archive/plans/2026-04-26-quality-automation-routines.md`\nvia `git mv` in the **same commit** that flips the PR to merged (or in\na follow-up `chore(docs)` commit on `develop` if that's not feasible).\nPer `MEMORY.md → feedback_docs_alongside_pr.md`.\n",{},"created",1777204949.360905,"Completing the task","event_type","info",{"_91":444,"_95":92,"_439":1378},{"_91":1115,"_1116":1117},{"_91":1090,"_1091":552,"_1092":1093,"_1094":1095,"_1096":-5},"pr","pr_title","pr_message","### Motivation\n- Improve repo security and quality visibility by adding a weekly/push CodeQL scan for JS/TS.\n- Provide curated cloud-routine prompts so automated agents can perform dependency triage, action-SHA bumps, and monthly plan reconciliation.\n- Reduce Dependabot noise by batching minor/patch npm updates so the triage routine sees tractable PRs.\n\n### Description\n- Add a pinned-SHA CodeQL workflow at `.github/workflows/codeql.yml` configured for push/PR and a weekly cron using the `security-and-quality` query set.\n- Add prompt + README scaffolds for three cloud-run routines under `docs/`: `dep-triage-bot/`, `actions-bump-bot/`, and `plan-recon-bot/` (each contains `PROMPT.md` and `README.md`).\n- Update `.github/dependabot.yml` to group npm minor/patch updates into an `npm-non-major` batch for both the root package and the `examples/nurture-pet` ecosystem.\n\n### Testing\n- Ran `npm run verify` (runs format check, ESLint, `tsc --noEmit`, `vitest`, build, and `typedoc`) and it completed successfully with tests passing and a build/docs generation success; ESLint produced two non-failing warnings. \n- Vitest run: all tests passed (reported 77 test files, 523 tests) as part of `npm run verify`.\n- Attempted local workflow lint (`actionlint`) in this environment but the runner lacked Docker, so workflow lint will be validated by the CI `Lint workflows (actionlint)` job on push.","output_diff",{"_91":1094,"_1097":481,"_127":128,"_1098":-5,"_300":1099,"_1100":1101,"_1102":1103,"_1104":1105,"_1106":1107,"_1108":1109,"_1110":1111},"pre_apply_patch","repo_id","preapply_patch_base_commit_sha","diff --git a/.github/dependabot.yml b/.github/dependabot.yml\nindex 4637314b4b407b300048ae2067f8bea96f46972e..14e0573cf2cae6bdd5e22797b430e8b1ab8c02ae 100644\n--- a/.github/dependabot.yml\n+++ b/.github/dependabot.yml\n@@ -1,66 +1,74 @@\n # Dependabot — automated dependency updates.\n #\n # Keeps npm + GitHub Actions deps fresh so the next runtime/runner\n # deprecation doesn't catch CI cold. PRs target `develop`; review\n # follows the same rules as any topic branch.\n \n version: 2\n updates:\n # Library package + devDependencies.\n - package-ecosystem: npm\n directory: /\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 5\n labels:\n - dependencies\n commit-message:\n prefix: chore(deps)\n prefix-development: chore(deps-dev)\n include: scope\n groups:\n- dev-dependencies:\n- dependency-type: development\n+ npm-non-major:\n+ patterns:\n+ - '*'\n update-types:\n - minor\n - patch\n \n # Demo example (workspace-local, consumes the built library).\n - package-ecosystem: npm\n directory: /examples/nurture-pet\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 3\n+ groups:\n+ npm-non-major:\n+ patterns:\n+ - '*'\n+ update-types:\n+ - minor\n+ - patch\n labels:\n - dependencies\n - demo\n commit-message:\n prefix: chore(demo-deps)\n include: scope\n \n # GitHub Actions — batched so a runner-deprecation sweep (e.g. Node 20\n # → 24) lands as one PR, not one-per-workflow.\n - package-ecosystem: github-actions\n directory: /\n target-branch: develop\n schedule:\n interval: weekly\n day: monday\n time: '06:00'\n timezone: Etc/UTC\n open-pull-requests-limit: 3\n labels:\n - dependencies\n - ci\n commit-message:\n prefix: chore(ci)\n include: scope\n groups:\ndiff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..15d7ab8063949ec7c5ffd5e5aeb24eceb7898e14\n--- /dev/null\n+++ b/.github/workflows/codeql.yml\n@@ -0,0 +1,36 @@\n+name: CodeQL\n+\n+on:\n+ push:\n+ branches: [develop, main]\n+ pull_request:\n+ branches: [develop, main]\n+ schedule:\n+ - cron: '0 6 * * 1'\n+\n+concurrency:\n+ group: codeql-${{ github.ref }}\n+ cancel-in-progress: true\n+\n+permissions:\n+ contents: read\n+ security-events: write\n+ actions: read\n+\n+jobs:\n+ analyze:\n+ name: Analyze (javascript-typescript)\n+ runs-on: ubuntu-latest\n+ strategy:\n+ fail-fast: false\n+ matrix:\n+ language: [javascript-typescript]\n+ steps:\n+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2\n+ - uses: github/codeql-action/init@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4\n+ with:\n+ languages: ${{ matrix.language }}\n+ queries: security-and-quality\n+ - uses: github/codeql-action/analyze@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4\n+ with:\n+ category: '/language:${{ matrix.language }}'\ndiff --git a/docs/actions-bump-bot/PROMPT.md b/docs/actions-bump-bot/PROMPT.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..a5f5bde7d5365d162f68474842f0b63630bf29ab\n--- /dev/null\n+++ b/docs/actions-bump-bot/PROMPT.md\n@@ -0,0 +1,51 @@\n+# Action SHA bump routine — system prompt\n+\n+Source-of-truth prompt for the weekly workflow-action SHA drift routine.\n+\n+---\n+\n+# Role\n+\n+Action SHA-bump caretaker. Single job: keep\n+`.github/workflows/*.yml` action references pinned to latest\n+approved tags-as-SHA.\n+\n+# Scope this run\n+\n+Run weekly. Input comes from:\n+\n+```bash\n+node scripts/bump-actions.mjs\n+```\n+\n+Treat `no drift` output as a no-op run.\n+\n+# Process\n+\n+1. Branch from `develop` as `chore/actions-bump-YYYY-MM-DD`.\n+2. Apply bumps suggested by `scripts/bump-actions.mjs`.\n+3. Verify workflow lint is clean.\n+4. Run `npm run verify`.\n+5. Open one PR containing all bumps for the run.\n+\n+# Hard rules\n+\n+- Never bump across a major version without explicit owner approval.\n+- Never edit a SHA manually without re-resolving via authoritative API.\n+- Keep trailing `# vX.Y.Z` comments aligned with the pinned SHA/tag.\n+- Never push direct to `develop`.\n+\n+# Output\n+\n+- If bumps exist: open one PR and include a table of\n+ `(action, old SHA, new SHA, version label)`.\n+- If no drift: append one-line comment to tracker issue\n+ `Action SHA bumps — develop` and exit.\n+\n+# Failure handling\n+\n+If verify or actionlint fails:\n+\n+- Do not open/update bump PR.\n+- Post failure summary to the tracker issue.\n+- Close cleanup branch if it was created.\ndiff --git a/docs/actions-bump-bot/README.md b/docs/actions-bump-bot/README.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..b91202da246d3ed8882c2d07d97f55f623eaade2\n--- /dev/null\n+++ b/docs/actions-bump-bot/README.md\n@@ -0,0 +1,21 @@\n+# `actions-bump-bot/` — weekly GitHub Action SHA bump routine\n+\n+Prompt and operating notes for the scheduled action-SHA bump bot.\n+\n+## Layout\n+\n+| File | Purpose |\n+| --- | --- |\n+| [`PROMPT.md`](./PROMPT.md) | Source-of-truth run policy. |\n+| [`README.md`](./README.md) | This file. |\n+\n+## Inputs and outputs\n+\n+- Input: `node scripts/bump-actions.mjs`.\n+- Output: one PR per run (or no-op tracker comment when clean).\n+- Tracker issue: `Action SHA bumps — develop`.\n+\n+## Evolution\n+\n+Update `PROMPT.md` on a docs branch via PR; merged prompt becomes active\n+for the next scheduled run.\ndiff --git a/docs/dep-triage-bot/PROMPT.md b/docs/dep-triage-bot/PROMPT.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..353995ec45c16aea49a17557c7d122824b0ba75a\n--- /dev/null\n+++ b/docs/dep-triage-bot/PROMPT.md\n@@ -0,0 +1,71 @@\n+# Dependabot triage — system prompt\n+\n+This is the source-of-truth prompt for the weekly dependency-triage\n+routine. The scheduled remote agent reads this file at the start of each\n+run.\n+\n+See [`README.md`](./README.md) for how this routine consumes the prompt,\n+where outputs go, and how to evolve it.\n+\n+---\n+\n+# Role\n+\n+Senior dependency triage. Conservative, not adventurous. Goal: drain the\n+Dependabot pile without bricking the build.\n+\n+# Scope this run\n+\n+Review open Dependabot PRs targeting `develop` with the `dependencies`\n+label.\n+\n+# Triage policy\n+\n+1. Patch + minor updates on dev dependencies:\n+ - Rebase branch.\n+ - Run `npm run verify`.\n+ - Auto-merge if green and no policy violations.\n+2. Patch + minor updates on runtime dependencies:\n+ - Rebase branch.\n+ - Run `npm run verify`.\n+ - Leave a one-line approval comment, but do **not** merge\n+ (owner approval required).\n+3. Major updates (any dependency):\n+ - Do not merge.\n+ - Leave a concise comment with changelog summary + likely\n+ breaking-change bullets.\n+4. Peer dependency updates:\n+ - Never auto-merge.\n+\n+# Hard rules\n+\n+- Never merge a PR that touches `src/**`.\n+- Never bypass repo hooks or use `--no-verify`.\n+- Never amend or rewrite Dependabot-authored commits.\n+- Never push direct to `develop`; merge only through PR flow.\n+\n+# Output\n+\n+Append a single summary comment to the rolling tracker issue titled\n+`Dependency triage — develop` (label `dep-triage-bot`) for each run,\n+including:\n+\n+- reviewed PR count,\n+- merged PRs,\n+- approved-awaiting-owner PRs,\n+- majors deferred.\n+\n+# Failure handling\n+\n+If verify fails for a PR:\n+\n+- Comment on the Dependabot PR: `verify failed: `.\n+- Add the same failure note to the tracker summary comment.\n+- Do not merge.\n+\n+# Idempotency\n+\n+- Reuse the same rolling tracker issue; never create one issue per run.\n+- Append comments only; do not rewrite prior run comments.\n+- Re-running the routine on the same PR set should be no-op except for\n+ explicit state transitions (e.g., newly green PR after rebase).\ndiff --git a/docs/dep-triage-bot/README.md b/docs/dep-triage-bot/README.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..736f0068e77891c7dcb394d5b9cc69abba998ec1\n--- /dev/null\n+++ b/docs/dep-triage-bot/README.md\n@@ -0,0 +1,26 @@\n+# `dep-triage-bot/` — weekly Dependabot triage routine\n+\n+Source files for the scheduled remote agent that triages Dependabot PRs\n+on `develop` and records outcomes in a rolling tracker issue.\n+\n+## Layout\n+\n+| File | Purpose |\n+| --- | --- |\n+| [`PROMPT.md`](./PROMPT.md) | System prompt loaded at the start of each run. |\n+| [`README.md`](./README.md) | This file — setup and operating notes. |\n+\n+## Output sink\n+\n+Rolling GitHub issue: `Dependency triage — develop` with label\n+`dep-triage-bot`.\n+\n+Each run appends one summary comment; no direct pushes, no direct merges\n+outside policy.\n+\n+## Iteration workflow\n+\n+1. Create a docs topic branch from `develop`.\n+2. Edit [`PROMPT.md`](./PROMPT.md).\n+3. Open PR, merge after review.\n+4. Next scheduled run picks up the new prompt automatically.\ndiff --git a/docs/plan-recon-bot/PROMPT.md b/docs/plan-recon-bot/PROMPT.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..2e5610057864d45536953a669394d7354705421f\n--- /dev/null\n+++ b/docs/plan-recon-bot/PROMPT.md\n@@ -0,0 +1,44 @@\n+# Plan reconciliation — system prompt\n+\n+Source-of-truth prompt for the monthly plan reconciliation routine.\n+\n+---\n+\n+# Role\n+\n+Plan archivist. Reconcile `docs/plans/*.md` against shipped state.\n+Unlike docs-review, this routine answers: \"is this plan done?\"\n+\n+# Scope this run\n+\n+Evaluate every file in `docs/plans/`.\n+\n+For each plan:\n+\n+1. Parse roadmap rows/checklists.\n+2. Cross-check shipped status against `origin/develop` history and any\n+ linked tracker issue.\n+3. Decide one of:\n+ - Keep in `docs/plans/` if active/open rows remain.\n+ - Move to `docs/archive/plans/` via `git mv` if fully shipped or\n+ superseded.\n+\n+# Hard rules\n+\n+- Never delete plan content.\n+- Archive by `git mv` only.\n+- Preserve date prefixes in filenames.\n+- Never archive plans with open rows.\n+\n+# Output\n+\n+- If moves are needed: open one PR containing only archive moves; PR\n+ body lists `(plan, last shipped row, archive reason)`.\n+- If no moves are needed: post one-line no-op comment to tracker issue\n+ `Plan reconciliation` and exit.\n+\n+# Failure handling\n+\n+If reconciliation cannot be completed (ambiguous shipped state, git\n+errors, verify failures), report a concise blocker in tracker comment\n+and stop without partial archive moves.\ndiff --git a/docs/plan-recon-bot/README.md b/docs/plan-recon-bot/README.md\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..bc5b4b586c511d3037c61da07d4dab119fced8d7\n--- /dev/null\n+++ b/docs/plan-recon-bot/README.md\n@@ -0,0 +1,22 @@\n+# `plan-recon-bot/` — monthly plan reconciliation routine\n+\n+Prompt + operating notes for the plan-vs-shipped reconciliation bot.\n+\n+## Layout\n+\n+| File | Purpose |\n+| --- | --- |\n+| [`PROMPT.md`](./PROMPT.md) | Source-of-truth monthly routine policy. |\n+| [`README.md`](./README.md) | This file. |\n+\n+## Behavior summary\n+\n+- Scans `docs/plans/*.md`.\n+- Archives fully shipped/superseded plans by `git mv` into\n+ `docs/archive/plans/`.\n+- Opens one PR for moves, or posts a no-op tracker comment when nothing\n+ qualifies.\n+\n+## Updating the routine\n+\n+Revise [`PROMPT.md`](./PROMPT.md) on a docs branch and merge via PR.\n","external_storage_diff",{"_1112":1113,"_1114":-5},"files_modified",8,"lines_added",281,"lines_removed",2,"commit_message","chore(quality): add codeql and routine prompt scaffolding","additional_parent_commit_shas",[],"file_id","file_000000009a6c71f7acbc54c7a1192e9a","ttl","partial_repo_snapshot","files",[1118,1119,1120,1121,1122,1123,1124,1125],{"_160":517,"_1126":-5,"_1127":1344,"_1129":-5},{"_160":514,"_1126":-5,"_1127":1299,"_1129":-5},{"_160":511,"_1126":-5,"_1127":1251,"_1129":-5},{"_160":509,"_1126":-5,"_1127":1232,"_1129":-5},{"_160":507,"_1126":-5,"_1127":1200,"_1129":-5},{"_160":505,"_1126":-5,"_1127":1186,"_1129":-5},{"_160":503,"_1126":-5,"_1127":1152,"_1129":-5},{"_160":499,"_1126":-5,"_1127":1128,"_1129":-5},"contents","line_range_contents",[1130],"missing_reason",{"_1131":1132,"_1133":1134,"_439":1135,"_1136":57},"line_range_start",1,"line_range_end",22,[1137,195,1138,195,1139,195,1140,1141,1142,1143,195,1144,195,1145,1146,1147,1148,1149,195,1150,195,1151],"contains_end_of_file","# `plan-recon-bot/` — monthly plan reconciliation routine","Prompt + operating notes for the plan-vs-shipped reconciliation bot.","## Layout","| File | Purpose |","| --- | --- |","| [`PROMPT.md`](./PROMPT.md) | Source-of-truth monthly routine policy. |","| [`README.md`](./README.md) | This file. |","## Behavior summary","- Scans `docs/plans/*.md`.","- Archives fully shipped/superseded plans by `git mv` into"," `docs/archive/plans/`.","- Opens one PR for moves, or posts a no-op tracker comment when nothing"," qualifies.","## Updating the routine","Revise [`PROMPT.md`](./PROMPT.md) on a docs branch and merge via PR.",[1153],{"_1131":1132,"_1133":1154,"_439":1155,"_1136":57},44,[1156,195,1157,195,1158,195,1159,195,1160,1161,195,1162,195,1163,195,1164,195,1165,1166,1167,1168,1169,1170,1171,195,1172,195,1173,1174,1175,1176,195,1177,195,1178,1179,1180,1181,195,1182,195,1183,1184,1185],"# Plan reconciliation — system prompt","Source-of-truth prompt for the monthly plan reconciliation routine.","---","# Role","Plan archivist. Reconcile `docs/plans/*.md` against shipped state.","Unlike docs-review, this routine answers: \"is this plan done?\"","# Scope this run","Evaluate every file in `docs/plans/`.","For each plan:","1. Parse roadmap rows/checklists.","2. Cross-check shipped status against `origin/develop` history and any"," linked tracker issue.","3. Decide one of:"," - Keep in `docs/plans/` if active/open rows remain."," - Move to `docs/archive/plans/` via `git mv` if fully shipped or"," superseded.","# Hard rules","- Never delete plan content.","- Archive by `git mv` only.","- Preserve date prefixes in filenames.","- Never archive plans with open rows.","# Output","- If moves are needed: open one PR containing only archive moves; PR"," body lists `(plan, last shipped row, archive reason)`.","- If no moves are needed: post one-line no-op comment to tracker issue"," `Plan reconciliation` and exit.","# Failure handling","If reconciliation cannot be completed (ambiguous shipped state, git","errors, verify failures), report a concise blocker in tracker comment","and stop without partial archive moves.",[1187],{"_1131":1132,"_1133":1188,"_439":1189,"_1136":57},21,[1190,195,1191,195,1139,195,1140,1141,1192,1143,195,1193,195,1194,1195,1196,195,1197,195,1198,1199],"# `actions-bump-bot/` — weekly GitHub Action SHA bump routine","Prompt and operating notes for the scheduled action-SHA bump bot.","| [`PROMPT.md`](./PROMPT.md) | Source-of-truth run policy. |","## Inputs and outputs","- Input: `node scripts/bump-actions.mjs`.","- Output: one PR per run (or no-op tracker comment when clean).","- Tracker issue: `Action SHA bumps — develop`.","## Evolution","Update `PROMPT.md` on a docs branch via PR; merged prompt becomes active","for the next scheduled run.",[1201],{"_1131":1132,"_1133":1202,"_439":1203,"_1136":57},51,[1204,195,1205,195,1158,195,1159,195,1206,1207,1208,195,1162,195,1209,195,1210,1211,1212,195,1213,195,1214,195,1215,1216,1217,1218,1219,195,1172,195,1220,1221,1222,1223,195,1177,195,1224,1225,1226,1227,195,1182,195,1228,195,1229,1230,1231],"# Action SHA bump routine — system prompt","Source-of-truth prompt for the weekly workflow-action SHA drift routine.","Action SHA-bump caretaker. Single job: keep","`.github/workflows/*.yml` action references pinned to latest","approved tags-as-SHA.","Run weekly. Input comes from:","```bash","node scripts/bump-actions.mjs","```","Treat `no drift` output as a no-op run.","# Process","1. Branch from `develop` as `chore/actions-bump-YYYY-MM-DD`.","2. Apply bumps suggested by `scripts/bump-actions.mjs`.","3. Verify workflow lint is clean.","4. Run `npm run verify`.","5. Open one PR containing all bumps for the run.","- Never bump across a major version without explicit owner approval.","- Never edit a SHA manually without re-resolving via authoritative API.","- Keep trailing `# vX.Y.Z` comments aligned with the pinned SHA/tag.","- Never push direct to `develop`.","- If bumps exist: open one PR and include a table of"," `(action, old SHA, new SHA, version label)`.","- If no drift: append one-line comment to tracker issue"," `Action SHA bumps — develop` and exit.","If verify or actionlint fails:","- Do not open/update bump PR.","- Post failure summary to the tracker issue.","- Close cleanup branch if it was created.",[1233],{"_1131":1132,"_1133":1234,"_439":1235,"_1136":57},26,[1236,195,1237,1238,195,1139,195,1140,1141,1239,1240,195,1241,195,1242,1243,195,1244,1245,195,1246,195,1247,1248,1249,1250],"# `dep-triage-bot/` — weekly Dependabot triage routine","Source files for the scheduled remote agent that triages Dependabot PRs","on `develop` and records outcomes in a rolling tracker issue.","| [`PROMPT.md`](./PROMPT.md) | System prompt loaded at the start of each run. |","| [`README.md`](./README.md) | This file — setup and operating notes. |","## Output sink","Rolling GitHub issue: `Dependency triage — develop` with label","`dep-triage-bot`.","Each run appends one summary comment; no direct pushes, no direct merges","outside policy.","## Iteration workflow","1. Create a docs topic branch from `develop`.","2. Edit [`PROMPT.md`](./PROMPT.md).","3. Open PR, merge after review.","4. Next scheduled run picks up the new prompt automatically.",[1252],{"_1131":1132,"_1133":1253,"_439":1254,"_1136":57},71,[1255,195,1256,1257,1258,195,1259,1260,195,1158,195,1159,195,1261,1262,195,1162,195,1263,1264,195,1265,195,1266,1267,1268,1269,1270,1267,1268,1271,1272,1273,1274,1275,1276,1277,1278,195,1172,195,1279,1280,1281,1282,195,1177,195,1283,1284,1285,195,1286,1287,1288,1289,195,1182,195,1290,195,1291,1292,1293,195,1294,195,1295,1296,1297,1298],"# Dependabot triage — system prompt","This is the source-of-truth prompt for the weekly dependency-triage","routine. The scheduled remote agent reads this file at the start of each","run.","See [`README.md`](./README.md) for how this routine consumes the prompt,","where outputs go, and how to evolve it.","Senior dependency triage. Conservative, not adventurous. Goal: drain the","Dependabot pile without bricking the build.","Review open Dependabot PRs targeting `develop` with the `dependencies`","label.","# Triage policy","1. Patch + minor updates on dev dependencies:"," - Rebase branch."," - Run `npm run verify`."," - Auto-merge if green and no policy violations.","2. Patch + minor updates on runtime dependencies:"," - Leave a one-line approval comment, but do **not** merge"," (owner approval required).","3. Major updates (any dependency):"," - Do not merge."," - Leave a concise comment with changelog summary + likely"," breaking-change bullets.","4. Peer dependency updates:"," - Never auto-merge.","- Never merge a PR that touches `src/**`.","- Never bypass repo hooks or use `--no-verify`.","- Never amend or rewrite Dependabot-authored commits.","- Never push direct to `develop`; merge only through PR flow.","Append a single summary comment to the rolling tracker issue titled","`Dependency triage — develop` (label `dep-triage-bot`) for each run,","including:","- reviewed PR count,","- merged PRs,","- approved-awaiting-owner PRs,","- majors deferred.","If verify fails for a PR:","- Comment on the Dependabot PR: `verify failed: `.","- Add the same failure note to the tracker summary comment.","- Do not merge.","# Idempotency","- Reuse the same rolling tracker issue; never create one issue per run.","- Append comments only; do not rewrite prior run comments.","- Re-running the routine on the same PR set should be no-op except for"," explicit state transitions (e.g., newly green PR after rebase).",[1300],{"_1131":1132,"_1133":1301,"_439":1302,"_1136":57},77,[1303,1304,1305,1306,1307,195,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1322,1323,1324,1325,1326,1327,1328,1329,1330,1331,1332,195,1333,1311,1334,1313,1314,1315,1316,1317,1318,1335,1326,1327,1328,1329,1330,1331,1332,1320,1321,1336,1322,1337,1325,195,1338,1339,1340,1312,1313,1314,1315,1316,1317,1318,1335,1320,1321,1341,1322,1342,1325,1326,1343,1328,1329],"# Dependabot — automated dependency updates.","#","# Keeps npm + GitHub Actions deps fresh so the next runtime/runner","# deprecation doesn't catch CI cold. PRs target `develop`; review","# follows the same rules as any topic branch.","version: 2","updates:"," # Library package + devDependencies."," - package-ecosystem: npm"," directory: /"," target-branch: develop"," schedule:"," interval: weekly"," day: monday"," time: '06:00'"," timezone: Etc/UTC"," open-pull-requests-limit: 5"," labels:"," - dependencies"," commit-message:"," prefix: chore(deps)"," prefix-development: chore(deps-dev)"," include: scope"," groups:"," npm-non-major:"," patterns:"," - '*'"," update-types:"," - minor"," - patch"," # Demo example (workspace-local, consumes the built library)."," directory: /examples/nurture-pet"," open-pull-requests-limit: 3"," - demo"," prefix: chore(demo-deps)"," # GitHub Actions — batched so a runner-deprecation sweep (e.g. Node 20"," # → 24) lands as one PR, not one-per-workflow."," - package-ecosystem: github-actions"," - ci"," prefix: chore(ci)"," actions:",[1345],{"_1131":1132,"_1133":1346,"_439":1347,"_1136":57},36,[1348,195,1349,1350,1351,1352,1351,1353,1354,195,1355,1356,1357,195,1358,1359,1360,1361,195,1362,1363,1364,1365,1366,1367,1368,1369,1370,1371,1372,1373,1374,1375,1376,1373,1377],"name: CodeQL","on:"," push:"," branches: [develop, main]"," pull_request:"," schedule:"," - cron: '0 6 * * 1'","concurrency:"," group: codeql-${{ github.ref }}"," cancel-in-progress: true","permissions:"," contents: read"," security-events: write"," actions: read","jobs:"," analyze:"," name: Analyze (javascript-typescript)"," runs-on: ubuntu-latest"," strategy:"," fail-fast: false"," matrix:"," language: [javascript-typescript]"," steps:"," - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2"," - uses: github/codeql-action/init@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4"," with:"," languages: ${{ matrix.language }}"," queries: security-and-quality"," - uses: github/codeql-action/analyze@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4"," category: '/language:${{ matrix.language }}'",[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392],{"_1077":45,"_45":1400},{"_1077":1394,"_160":517,"_1131":1132,"_1133":1346},{"_1077":45,"_45":1399},{"_1077":1394,"_160":514,"_1131":304,"_1133":1398},{"_1077":45,"_45":1397},{"_1077":1394,"_160":511,"_1131":1132,"_1133":1253},{"_1077":1394,"_160":509,"_1131":1132,"_1133":1234},{"_1077":45,"_45":1396},{"_1077":1394,"_160":507,"_1131":1132,"_1133":1202},{"_1077":1394,"_160":505,"_1131":1132,"_1133":1188},{"_1077":45,"_45":1395},{"_1077":1394,"_160":503,"_1131":1132,"_1133":1154},{"_1077":1394,"_160":499,"_1131":1132,"_1133":1134},{"_1077":45,"_45":1393},"\n* Committed on the current branch (`work`) as `5e916a1`, and created a PR via the `make_pr` tool with title: **“chore(quality): add CodeQL workflow and routine prompt scaffolding”**.\n\n**Testing**\n* ✅ `npm run verify`\n* ⚠️ `docker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/codeql.yml` (warning: `docker` is not installed in this environment)","repo_file_citation","\n* Added the plan-reconciliation routine prompt + README scaffold under `docs/plan-recon-bot/`. ","\n* Added the action-SHA bump routine prompt + README scaffold under `docs/actions-bump-bot/`. ","\n* Added the dependency-triage routine prompt + README scaffold under `docs/dep-triage-bot/`. ",55,"\n* Updated Dependabot npm update grouping for both the root package and `examples/nurture-pet` so minor/patch updates are batched into `npm-non-major`. ","### Summary\n* Added a new pinned-SHA CodeQL workflow (`.github/workflows/codeql.yml`) that runs on push/PR for `develop` + `main` and on a weekly cron, with `security-and-quality` queries for JS/TS. ",{"_91":301,"_41":83,"_95":301,"_1403":1404,"_1405":1406,"_1407":1408,"_131":-5,"_118":1409},[82],"input_items",[1425,1426],"external_post_config",{"_1410":1411,"_239":192,"_1412":279,"_250":-5,"_1097":233,"_1413":-5,"_1414":-5,"_1415":1416,"_1417":-5,"_1418":1419,"_1420":-5,"_1421":15,"_1422":57,"_1423":52,"_1424":15},"user_model_slug","slug",1777204612.546276,"installation_id",125236931,"pr_number","review_trigger","comment_id","comment_type","issue","pr_write_guard_token","pending_pr_reaction_id",320291013,"pending_comment_reaction_id","comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_91":444,"_95":301,"_439":1432},{"_286":1427,"_288":1428,"_1429":294,"_1430":128,"_297":-5,"_91":1431},"chore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)","# Quality automation routines — implementation plan\n\n> **For agentic workers:** REQUIRED: follow this plan top-to-bottom on\n> branch `chore/quality-automation-routines` (worktree\n> `.worktrees/chore-quality-automation`). Steps use checkbox (`- [ ]`)\n> syntax for tracking. The PR opens **draft** with this plan as its body\n> reference; flip to ready-for-review only after every row below is\n> checked off and `npm run verify` is green.\n\n**Goal:** Close known quality / supply-chain / drift gaps not covered by\nthe existing CI gate or the daily-code-review + weekly-docs-review\nroutines, by adding seven new automation surfaces (six CI/cron jobs +\nthree cloud-routine prompts).\n\n**Architecture:**\n\n- **GitHub Actions workflows** (`.github/workflows/*.yml`) for jobs that\n need to run inside CI infra (CodeQL, mutation testing, Playwright,\n bundle-size trend, determinism replay).\n- **Cloud-routine prompt directories** (`docs//PROMPT.md` +\n `README.md`) for jobs that need an LLM-driven agent (dependency\n triage, action SHA bumps, plan reconciliation). Same shape as the\n existing `docs/review-bot/` and `docs/docs-review-bot/`.\n- **No core library changes.** All additions live under `.github/`,\n `docs/`, `tests/determinism/`, and `examples/nurture-pet/`. No\n `src/**` edits. No changesets needed (tooling-only PR).\n\n**Tech stack:**\n\n- GitHub Actions, Dependabot, CodeQL.\n- StrykerJS (`@stryker-mutator/core` + `@stryker-mutator/vitest-runner`)\n for mutation testing.\n- Playwright (`@playwright/test`) for demo smoke.\n- Existing `scripts/bump-actions.mjs`, `scripts/coverage-pr-comment.mjs`\n pattern for any new helper scripts.\n\n**Out of scope (this plan):**\n\n- Stale-branch cleaner — explicitly deferred per owner decision\n (2026-04-26).\n- Type-coverage report, license/SBOM audit, mutation testing on\n examples — punt to a future plan if value materializes.\n\n---\n\n## File structure\n\n### New files\n\n| Path | Responsibility |\n| --- | --- |\n| `.github/workflows/codeql.yml` | Weekly + push-to-develop CodeQL JS/TS scan. |\n| `.github/workflows/mutation.yml` | Weekly Stryker run on `develop`; uploads HTML report artifact. |\n| `.github/workflows/demo-smoke.yml` | Nightly Playwright headless run against built demo. |\n| `.github/workflows/bundle-size-trend.yml` | Weekly snapshot of `npx size-limit --json` to a committed `docs/metrics/bundle-trend.jsonl`. |\n| `.github/workflows/determinism.yml` | Weekly replay of seeded pet sims; hash-compares `DecisionTrace` against committed baseline. |\n| `stryker.config.mjs` | Stryker config (vitest runner, sane mutate globs, threshold). |\n| `examples/nurture-pet/playwright.config.ts` | Playwright config for the demo smoke spec. |\n| `examples/nurture-pet/tests/smoke/golden-path.spec.ts` | Click Feed/Pet/Sleep/Train; assert HUD updates + no console errors. |\n| `tests/determinism/replay.bench.ts` | Vitest-driven replay across N seeds; emits one `sha256(trace-stream)` per seed. |\n| `tests/determinism/baseline.json` | Committed map `{ seedString: sha256 }` (ground truth). |\n| `tests/determinism/replay.ts` | Replay harness (pure function: seed → trace stream → sha). |\n| `docs/metrics/bundle-trend.jsonl` | Append-only JSONL: one row per weekly snapshot. Created by row 5. |\n| `docs/dep-triage-bot/PROMPT.md` | System prompt for the weekly Dependabot triage routine. |\n| `docs/dep-triage-bot/README.md` | How the routine consumes `PROMPT.md`, where outputs go. |\n| `docs/actions-bump-bot/PROMPT.md` | System prompt for the weekly action-SHA bump routine. |\n| `docs/actions-bump-bot/README.md` | Same shape as above. |\n| `docs/plan-recon-bot/PROMPT.md` | System prompt for the monthly plan-vs-shipped reconciliation routine. |\n| `docs/plan-recon-bot/README.md` | Same shape as above. |\n| `scripts/append-size-snapshot.mjs` | Read `npx size-limit --json` stdin, append a row to `docs/metrics/bundle-trend.jsonl`. |\n| `scripts/run-determinism-replay.mjs` | CLI wrapper that runs `tests/determinism/replay.ts` for the workflow + diffs vs baseline; non-zero exit on mismatch. |\n\n### Modified files\n\n| Path | Change |\n| --- | --- |\n| `package.json` | Add devDeps: `@stryker-mutator/core`, `@stryker-mutator/vitest-runner`, `@playwright/test`. Add scripts: `mutation`, `mutation:report`, `determinism:replay`, `determinism:baseline`. |\n| `examples/nurture-pet/package.json` | Add devDep `@playwright/test`; script `smoke`. |\n| `.gitignore` | Ignore `reports/mutation/`, `playwright-report/`, `examples/nurture-pet/playwright-report/`, `examples/nurture-pet/test-results/`. |\n| `.github/dependabot.yml` | Group npm minor + patch updates so the triage routine sees one PR per ecosystem-week, not N. |\n| `CONTRIBUTING.md` | Brief mention of mutation / smoke / determinism scripts in the dev-loop section. |\n| `README.md` | One-line bullet under the badges/quality section: links to the trend file + bot prompts. |\n\n### Branching / PR shape\n\nThis plan ships on **one** branch (`chore/quality-automation-routines`)\nunder **one** draft PR (`docs(plans): quality-automation routines + ...`).\nPer owner direction, every row below lands as its own commit on this\nbranch. The PR is flipped to ready-for-review only after the final row\nchecks off and `npm run verify` is green.\n\n> **Why one PR, not the usual one-per-row?** This batch is mostly\n> additive infra (workflows + prompts + dev-deps) with near-zero blast\n> radius on the library. Splitting eight tooling-only rows into eight\n> PRs would burn ~8 Codex review cycles for marginal review benefit.\n> When a row touches `src/**` (none of them do here) future plans\n> revert to the standard one-row-per-PR rule.\n\n---\n\n## Verification gate per row\n\nEach row ends with `npm run verify` passing locally before commit. New\nworkflows must additionally be **lint-clean under `actionlint`**\n(already wired into CI) — run locally with:\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color\n```\n\n…or push the commit and watch the existing `Lint workflows (actionlint)`\njob. New action references must use full 40-char SHAs with a trailing\n`# vX.Y.Z` comment (per the supply-chain rule in the existing CI\nheader). Resolve a SHA via:\n\n```bash\ngh api repos///commits/ --jq '.sha'\n```\n\n---\n\n## Chunk 1: Bootstrap (rows 0–1)\n\n### Task 0: Land the plan + open the draft PR\n\n**Files:**\n- Create: `docs/plans/2026-04-26-quality-automation-routines.md` (this file).\n\n- [ ] **Step 0.1: Confirm worktree on `chore/quality-automation-routines`**\n\n```bash\ngit -C .worktrees/chore-quality-automation rev-parse --abbrev-ref HEAD\n# expected: chore/quality-automation-routines\n```\n\n- [ ] **Step 0.2: Stage and commit the plan**\n\n```bash\ngit -C .worktrees/chore-quality-automation add docs/plans/2026-04-26-quality-automation-routines.md\ngit -C .worktrees/chore-quality-automation commit -m \"docs(plans): quality-automation routines roadmap\"\n```\n\n- [ ] **Step 0.3: Push branch + open draft PR**\n\n```bash\ngit -C .worktrees/chore-quality-automation push -u origin chore/quality-automation-routines\ngh pr create --draft --base develop \\\n --title \"chore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)\" \\\n --body-file docs/plans/2026-04-26-quality-automation-routines.md\n```\n\nExpected: draft PR URL printed, status `Draft`. Note the PR number for\nlater step `Final.3`.\n\n---\n\n### Task 1: CodeQL weekly + push-to-develop\n\n**Why first:** single file, GitHub-native, zero new deps. Smallest\npossible win.\n\n**Files:**\n- Create: `.github/workflows/codeql.yml`\n\n- [ ] **Step 1.1: Resolve SHAs for `actions/checkout@v6` and\n `github/codeql-action/{init,analyze}@v4`** (or current major)\n\n```bash\ngh api repos/actions/checkout/git/refs/tags/v6.0.2 --jq '.object.sha'\ngh api repos/github/codeql-action/git/refs/tags/v4 --jq '.object.sha'\n```\n\nCapture the SHAs; use them verbatim in the YAML below with a trailing\n`# v6.0.2` / `# v4` comment.\n\n- [ ] **Step 1.2: Write `.github/workflows/codeql.yml`**\n\n```yaml\nname: CodeQL\n\non:\n push:\n branches: [develop, main]\n pull_request:\n branches: [develop, main]\n schedule:\n # Mondays 06:00 UTC — same window as docs-review weekly cadence.\n - cron: '0 6 * * 1'\n\nconcurrency:\n group: codeql-${{ github.ref }}\n cancel-in-progress: true\n\npermissions:\n contents: read\n security-events: write\n actions: read\n\njobs:\n analyze:\n name: Analyze (javascript-typescript)\n runs-on: ubuntu-latest\n strategy:\n fail-fast: false\n matrix:\n language: [javascript-typescript]\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: github/codeql-action/init@ # v4\n with:\n languages: ${{ matrix.language }}\n # security-and-quality is the broadest default suite that GA\n # supports. security-extended would also work; quality-only\n # would miss CWE-079/CWE-094 patterns we want flagged.\n queries: security-and-quality\n - uses: github/codeql-action/analyze@ # v4\n with:\n category: '/language:${{ matrix.language }}'\n```\n\n- [ ] **Step 1.3: Local actionlint pass**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/codeql.yml\n```\n\nExpected: no output (clean).\n\n- [ ] **Step 1.4: Verify locally that the gate is unaffected**\n\n```bash\nnpm run verify\n```\n\nExpected: same pass set as `develop`.\n\n- [ ] **Step 1.5: Commit**\n\n```bash\ngit add .github/workflows/codeql.yml\ngit commit -m \"ci(codeql): add weekly + push CodeQL JS/TS scan\"\n```\n\n- [ ] **Step 1.6: Push and confirm the workflow runs in Actions tab**\n\n```bash\ngit push\n```\n\nExpected: a `CodeQL / Analyze (javascript-typescript)` run appears for\nthe push and finishes success.\n\n---\n\n## Chunk 2: Cloud-routine prompts (rows 2–4)\n\nThese three rows add prompt directories only — no workflows, no deps,\nno library code. Each ships behind `docs//`. The actual\nscheduling happens outside the repo (Claude Cloud cron), same way as\n`docs/review-bot/` and `docs/docs-review-bot/`.\n\n### Task 2: Dependabot triage routine prompt\n\n**Files:**\n- Create: `docs/dep-triage-bot/PROMPT.md`\n- Create: `docs/dep-triage-bot/README.md`\n- Modify: `.github/dependabot.yml` — group npm minor+patch into one PR\n per ecosystem-week so the triage routine sees a tractable input.\n\n- [ ] **Step 2.1: Read existing pattern**\n\n```bash\ncat docs/docs-review-bot/PROMPT.md # use as structural template\ncat docs/docs-review-bot/README.md\ncat .github/dependabot.yml\n```\n\n- [ ] **Step 2.2: Update `.github/dependabot.yml`**\n\nAdd a `groups:` block on each `package-ecosystem: \"npm\"` entry so minor\n+ patch updates land in a single weekly PR rather than 5–10 separate\nones.\n\n```yaml\n# Example shape — adapt to existing keys verbatim.\n- package-ecosystem: \"npm\"\n directory: \"/\"\n schedule:\n interval: \"weekly\"\n groups:\n npm-non-major:\n patterns: [\"*\"]\n update-types: [\"minor\", \"patch\"]\n```\n\n- [ ] **Step 2.3: Write `docs/dep-triage-bot/PROMPT.md`**\n\nSections to include (mirror `docs/review-bot/PROMPT.md`):\n\n1. **Role** — \"Senior dependency triage. Conservative, not adventurous.\n Goal: drain the Dependabot pile without bricking the build.\"\n2. **Scope this run** — \"Open Dependabot PRs targeting `develop`, label\n `dependencies`.\"\n3. **Triage policy** — patch + minor on dev-deps: rebase, run\n `npm run verify`, auto-merge if green. Patch + minor on runtime\n deps: rebase, run verify, leave a one-line approval comment but do\n NOT merge (owner approval required). Major on anything: comment\n with the changelog summary + breaking-change bullet list, leave for\n owner. Peer-deps: never auto-merge.\n4. **Hard rules** — never merge a PR that touches `src/**` (means\n Dependabot generated more than a manifest bump, suspicious); never\n bypass `--no-verify`; never amend the Dependabot commit.\n5. **Output** — append a one-comment summary on a rolling\n tracker issue `Dependency triage — develop` (label\n `dep-triage-bot`).\n6. **Failure handling** — verify fails → comment \"verify failed: \\\" on the Dependabot PR + tracker, do not merge.\n\nUse the same idempotency pattern as `docs/review-bot/PROMPT.md`\n(rolling issue, append comments, never push direct to develop).\n\n- [ ] **Step 2.4: Write `docs/dep-triage-bot/README.md`**\n\nMirror `docs/review-bot/README.md`: how the routine consumes the\nprompt, where output lives, how to evolve it.\n\n- [ ] **Step 2.5: Commit**\n\n```bash\ngit add docs/dep-triage-bot/ .github/dependabot.yml\ngit commit -m \"docs(routine): add weekly Dependabot triage prompt\"\n```\n\n---\n\n### Task 3: Action SHA bump routine prompt\n\n**Files:**\n- Create: `docs/actions-bump-bot/PROMPT.md`\n- Create: `docs/actions-bump-bot/README.md`\n\n- [ ] **Step 3.1: Confirm `scripts/bump-actions.mjs` exists and works**\n\n```bash\nnode scripts/bump-actions.mjs\n```\n\nExpected: prints any pending bumps (or \"no drift\") without writing\nfiles. Capture exact output shape — the prompt has to instruct the\nagent how to parse it.\n\n- [ ] **Step 3.2: Write `docs/actions-bump-bot/PROMPT.md`**\n\nMirror the dep-triage prompt structure. Key sections:\n\n1. **Role** — \"Action SHA-bump caretaker. Single job: keep\n `.github/workflows/*.yml` action references at their latest\n tags-as-SHA.\"\n2. **Scope this run** — \"Run weekly. Inputs come from\n `node scripts/bump-actions.mjs`.\"\n3. **Process** — branch off `develop`\n (`chore/actions-bump-YYYY-MM-DD`), apply each bump, verify\n `actionlint` clean, run `npm run verify`, open one PR with the\n diff. Owner reviews and merges.\n4. **Hard rules** — never bump across a major (require explicit owner\n approval); never edit the SHA without re-resolving via `gh api`;\n never alter the trailing `# vX.Y.Z` comment without matching the\n bumped tag.\n5. **Output** — single PR per run, body lists each `(action, old SHA,\n new SHA, version label)`. No-op runs: post a one-line comment on the\n tracker issue `Action SHA bumps — develop` and exit.\n6. **Failure handling** — verify fails → close branch, comment on\n tracker.\n\n- [ ] **Step 3.3: Write `docs/actions-bump-bot/README.md`**\n\n- [ ] **Step 3.4: Commit**\n\n```bash\ngit add docs/actions-bump-bot/\ngit commit -m \"docs(routine): add weekly action-SHA bump prompt\"\n```\n\n---\n\n### Task 4: Plan reconciliation routine prompt\n\n**Why monthly, not weekly:** plans are coarse-grained; a weekly cadence\nwould mostly produce no-ops. Monthly aligns with how often roadmap\nrows complete in batches.\n\n**Files:**\n- Create: `docs/plan-recon-bot/PROMPT.md`\n- Create: `docs/plan-recon-bot/README.md`\n\n- [ ] **Step 4.1: Read the archive convention**\n\n```bash\ncat docs/archive/README.md\nls docs/archive/plans/\nls docs/plans/\n```\n\n- [ ] **Step 4.2: Write `docs/plan-recon-bot/PROMPT.md`**\n\nSections:\n\n1. **Role** — \"Plan archivist. Reconcile `docs/plans/*.md` against\n shipped state. Different from docs-review-bot (which audits prose\n drift); this routine answers 'is this plan done?' \"\n2. **Scope this run** — every file under `docs/plans/`. For each:\n parse roadmap rows, cross-check `git log origin/develop` (and the\n tracker issue if linked) for shipped status, and either (a) leave\n alone if work continues, (b) move to `docs/archive/plans/` via\n `git mv` if every row is shipped or the plan is superseded.\n3. **Hard rules** — never delete plan content; only `git mv`. Preserve\n the date prefix. Never archive a plan that has open rows.\n4. **Output** — open one PR per run with archive moves, body lists\n each `(plan, last shipped row, archive reason)`. No moves needed:\n post a one-line comment on the tracker issue `Plan reconciliation`\n and exit.\n5. **Failure handling** — same pattern as the other routines.\n\n- [ ] **Step 4.3: Write `docs/plan-recon-bot/README.md`**\n\n- [ ] **Step 4.4: Commit**\n\n```bash\ngit add docs/plan-recon-bot/\ngit commit -m \"docs(routine): add monthly plan reconciliation prompt\"\n```\n\n---\n\n## Chunk 3: Bundle-size trend (row 5)\n\nRationale: existing `size-limit-comment` job posts the per-PR delta but\ngives no longitudinal view. A weekly snapshot to a committed JSONL\nfile in `docs/metrics/` lets us graph the trend later (and inspect by\ndiff today).\n\n### Task 5: Weekly bundle-size trend snapshot\n\n**Files:**\n- Create: `scripts/append-size-snapshot.mjs`\n- Create: `.github/workflows/bundle-size-trend.yml`\n- Create: `docs/metrics/bundle-trend.jsonl` (empty file at first commit)\n\n- [ ] **Step 5.1: Write the snapshot script (TDD)**\n\nCreate `scripts/append-size-snapshot.test.mjs` first, then the\nimplementation. The test feeds the script a fixture `size-limit --json`\noutput via stdin and asserts:\n\n- Output JSONL has exactly one row.\n- Row keys: `iso` (UTC ISO-8601 date), `sha` (7-char head SHA from\n env), `entries` (array of `{name, size, gzip}` from input).\n- Existing rows in the target file are preserved; the new row is\n appended.\n\n```js\n// scripts/append-size-snapshot.test.mjs\nimport { test, expect } from 'vitest';\nimport { spawnSync } from 'node:child_process';\nimport { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\ntest('appends one JSONL row from size-limit JSON on stdin', () => {\n const dir = mkdtempSync(join(tmpdir(), 'sizesnap-'));\n const target = join(dir, 'bundle-trend.jsonl');\n writeFileSync(target, ''); // empty\n const fixture = JSON.stringify([\n { name: 'core', size: 1234, gzip: 567 },\n { name: 'integrations/excalibur', size: 200, gzip: 100 },\n ]);\n const out = spawnSync(\n process.execPath,\n ['scripts/append-size-snapshot.mjs', '--target', target],\n { input: fixture, env: { ...process.env, GITHUB_SHA: 'abcdef0' } },\n );\n expect(out.status).toBe(0);\n const rows = readFileSync(target, 'utf8').trim().split('\\n').filter(Boolean);\n expect(rows).toHaveLength(1);\n const row = JSON.parse(rows[0]);\n expect(row.sha).toBe('abcdef0');\n expect(row.entries).toHaveLength(2);\n expect(row.iso).toMatch(/^\\d{4}-\\d{2}-\\d{2}T/);\n});\n```\n\n- [ ] **Step 5.2: Run the test (red)**\n\n```bash\nnpx vitest run scripts/append-size-snapshot.test.mjs\n```\n\nExpected: FAIL (`Cannot find module 'scripts/append-size-snapshot.mjs'`).\n\n- [ ] **Step 5.3: Implement `scripts/append-size-snapshot.mjs`**\n\nArgv: `--target `. Reads stdin → JSON. Builds `{iso, sha,\nentries}`. Appends one line. Idempotent on identical content (skip if\nlast line equals new line minus `iso`).\n\n- [ ] **Step 5.4: Re-run the test (green)**\n\n```bash\nnpx vitest run scripts/append-size-snapshot.test.mjs\n```\n\nExpected: PASS.\n\n- [ ] **Step 5.5: Create the empty trend file**\n\n```bash\ntouch docs/metrics/bundle-trend.jsonl\n```\n\nAdd a 2-line preamble inside the file? **No.** JSONL by definition has\nno header; downstream tools assume one JSON value per line. Keep it\nempty.\n\n- [ ] **Step 5.6: Write `.github/workflows/bundle-size-trend.yml`**\n\n```yaml\nname: Bundle-size trend\n\non:\n schedule:\n # Sundays 04:00 UTC. After the Monday CodeQL window so two cron\n # workflows don't collide on a single runner pool peak.\n - cron: '0 4 * * 0'\n workflow_dispatch:\n\npermissions:\n contents: write # commits the snapshot row\n\njobs:\n snapshot:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@ # v6.0.2\n with: { ref: develop }\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run build\n - name: Append snapshot row\n env:\n GITHUB_SHA: ${{ github.sha }}\n run: |\n npx size-limit --json | \\\n node scripts/append-size-snapshot.mjs \\\n --target docs/metrics/bundle-trend.jsonl\n - name: Commit + push if changed\n run: |\n git config user.name \"github-actions[bot]\"\n git config user.email \"41898282+github-actions[bot]@users.noreply.github.com\"\n if [[ -n \"$(git status --porcelain docs/metrics/bundle-trend.jsonl)\" ]]; then\n git add docs/metrics/bundle-trend.jsonl\n git commit -m \"chore(metrics): bundle-size snapshot $(date -u +%F)\"\n git push origin develop\n fi\n```\n\n> **Direct push to `develop`?** The repo rule says \"never push direct\n> to develop\" but explicitly allows post-merge pulls. This is a metrics\n> append by github-actions bot, not human work. If branch protection\n> on `develop` blocks even bot pushes, switch to: open a PR per run via\n> `peter-evans/create-pull-request` and let the dep-triage routine\n> auto-merge it. Decide at step 5.7.\n\n- [ ] **Step 5.7: Decide direct-push vs PR-bot path**\n\n```bash\ngh api repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/branches/develop/protection 2>&1 | head -20\n```\n\nIf `required_status_checks` includes `ci-gate` and direct push is\nblocked → switch the workflow to open a PR via\n`peter-evans/create-pull-request@` and document the path swap in\nthis row.\n\n- [ ] **Step 5.8: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/bundle-size-trend.yml\nnpm run verify\n```\n\n- [ ] **Step 5.9: Commit**\n\n```bash\ngit add scripts/append-size-snapshot.mjs scripts/append-size-snapshot.test.mjs \\\n docs/metrics/bundle-trend.jsonl .github/workflows/bundle-size-trend.yml\ngit commit -m \"ci(metrics): weekly bundle-size trend snapshot\"\n```\n\n---\n\n## Chunk 4: Determinism replay benchmark (row 6)\n\nRationale: the determinism rule (`SeededRng` + `ManualClock` ⇒ byte-\nidentical `DecisionTrace`) is enforced statically by ESLint\n(no `Date.now`/`Math.random`) but never tested **end-to-end**. A\nhash-pinned replay across N seeds catches non-static violations: a new\nhelper that secretly reads `performance.now()`, a `Date` constructor\ninside a needs policy, etc.\n\n### Task 6: Hash-pinned replay across N seeds\n\n**Files:**\n- Create: `tests/determinism/replay.ts`\n- Create: `tests/determinism/replay.bench.ts` *(actually a vitest\n test, not a bench — using `.bench.ts` would skew CI timing)*\n- Create: `tests/determinism/baseline.json`\n- Create: `scripts/run-determinism-replay.mjs`\n- Create: `.github/workflows/determinism.yml`\n- Modify: `package.json` — scripts `determinism:replay`,\n `determinism:baseline`.\n\n- [ ] **Step 6.1: Decide the seed set**\n\nPick 8 seed strings. Mix short, long, ASCII, and non-ASCII to also\ncatch encoding regressions. Hard-code in `replay.ts`:\n\n```ts\nexport const REPLAY_SEEDS = [\n 'alpha', 'beta', 'gamma',\n '12345678901234567890',\n 'snowman-☃️',\n 'mixed-CASE-42',\n 'r-eat-then-sleep',\n 'mood-swing-edge',\n];\n```\n\n- [ ] **Step 6.2: Write `tests/determinism/replay.ts`**\n\nPure function `replaySeed(seed: string): string` (sha256 hex). Inside:\n\n1. Construct `SeededRng(seed)` + `ManualClock(0)`.\n2. Build a default agent via the public test helpers (mirror the\n pattern in `tests/integration/`).\n3. Tick 1000 times advancing the clock by 100 ms per tick.\n4. Stream every event from the bus into a hash; return the digest.\n\nUse `crypto.createHash('sha256')` from `node:crypto`.\n\n- [ ] **Step 6.3: Write the assertion test (red)**\n\n```ts\n// tests/determinism/replay.bench.ts\nimport { test, expect } from 'vitest';\nimport { readFileSync } from 'node:fs';\nimport { REPLAY_SEEDS, replaySeed } from './replay.js';\n\nconst baseline = JSON.parse(readFileSync(\n new URL('./baseline.json', import.meta.url), 'utf8'\n)) as Record;\n\ntest.each(REPLAY_SEEDS)('replay matches baseline: %s', (seed) => {\n expect(replaySeed(seed)).toBe(baseline[seed]);\n});\n```\n\n- [ ] **Step 6.4: Run the test (red)**\n\n```bash\nnpx vitest run tests/determinism/replay.bench.ts\n```\n\nExpected: FAIL — `baseline.json` does not exist yet.\n\n- [ ] **Step 6.5: Generate `baseline.json` once**\n\n```bash\nnode --import tsx scripts/run-determinism-replay.mjs --write-baseline\n```\n\nThe script imports `replaySeed` + `REPLAY_SEEDS`, computes one digest\nper seed, writes the map to `tests/determinism/baseline.json`.\n\n- [ ] **Step 6.6: Re-run the test (green)**\n\n```bash\nnpx vitest run tests/determinism/replay.bench.ts\n```\n\nExpected: PASS for all 8 seeds.\n\n- [ ] **Step 6.7: Run twice in the same shell to confirm stability**\n\n```bash\nfor i in 1 2 3; do npx vitest run tests/determinism/replay.bench.ts; done\n```\n\nExpected: PASS PASS PASS. Any flake means the harness is non-\ndeterministic — fix `replay.ts` rather than weakening the assertion.\n\n- [ ] **Step 6.8: Wire scripts**\n\n```json\n// package.json — add to \"scripts\":\n\"determinism:replay\": \"vitest run tests/determinism/replay.bench.ts\",\n\"determinism:baseline\": \"node --import tsx scripts/run-determinism-replay.mjs --write-baseline\"\n```\n\n- [ ] **Step 6.9: Workflow**\n\n```yaml\n# .github/workflows/determinism.yml\nname: Determinism replay\n\non:\n schedule:\n - cron: '0 5 * * 1' # Mondays 05:00 UTC, before CodeQL\n push:\n branches: [develop]\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n replay:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run determinism:replay\n```\n\n> **Why also on `push: develop`?** Catching a determinism violation\n> *between* the weekly run is worth one ~1-minute job per merge.\n\n- [ ] **Step 6.10: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/determinism.yml\nnpm run verify\n```\n\n- [ ] **Step 6.11: Commit**\n\n```bash\ngit add tests/determinism/ scripts/run-determinism-replay.mjs \\\n .github/workflows/determinism.yml package.json\ngit commit -m \"test(determinism): hash-pinned replay across 8 seeds\"\n```\n\n---\n\n## Chunk 5: Mutation testing (row 7)\n\nRationale: existing coverage delta proves *lines ran*. Mutation testing\nproves *tests would fail if the line changed*. Pairs with the existing\ncoverage PR comment to close the \"test asserts nothing\" loophole.\n\n### Task 7: Stryker weekly run\n\n**Files:**\n- Create: `stryker.config.mjs`\n- Create: `.github/workflows/mutation.yml`\n- Modify: `package.json` (devDeps + scripts)\n- Modify: `.gitignore`\n\n- [ ] **Step 7.1: Add devDeps**\n\n```bash\nnpm install --save-dev --save-exact \\\n @stryker-mutator/core@latest \\\n @stryker-mutator/vitest-runner@latest\n```\n\nPin exact versions in `package.json`. Update lockfile.\n\n- [ ] **Step 7.2: Write `stryker.config.mjs`**\n\n```js\n// stryker.config.mjs\n/** @type {import('@stryker-mutator/api/core').PartialStrykerOptions} */\nexport default {\n testRunner: 'vitest',\n reporters: ['progress', 'clear-text', 'html', 'dashboard'],\n coverageAnalysis: 'perTest',\n // Mutate library source only. Skip integrations + tooling.\n mutate: [\n 'src/**/*.ts',\n '!src/**/*.test.ts',\n '!src/**/index.ts',\n '!src/integrations/**',\n '!src/**/internal/**', // already covered transitively via callers\n ],\n thresholds: { high: 80, low: 60, break: 55 },\n htmlReporter: { fileName: 'reports/mutation/mutation.html' },\n timeoutMS: 15_000,\n concurrency: 4,\n};\n```\n\n> Threshold seed values are placeholders — the first run produces the\n> baseline. After that run lands, replace `break: 55` with `current\n> score - 2` so future regressions fail the job but normal noise does\n> not. Capture the baseline number in the row's commit message.\n\n- [ ] **Step 7.3: Add scripts to `package.json`**\n\n```json\n\"mutation\": \"stryker run\",\n\"mutation:report\": \"open reports/mutation/mutation.html\"\n```\n\n- [ ] **Step 7.4: Update `.gitignore`**\n\n```\nreports/mutation/\n.stryker-tmp/\n```\n\n- [ ] **Step 7.5: Run locally to capture the baseline score**\n\n```bash\nnpm run mutation\n```\n\nExpected: prints a score (e.g. \"Mutation score: 73.4%\"). This is the\nbaseline. **Update `stryker.config.mjs` `thresholds.break`** to\n`floor(score) - 2` and re-run to confirm green.\n\n> Local run on full suite is slow (~15-30 min). If it exceeds 45 min,\n> trim `mutate` further (e.g. exclude `src/persistence/` for the first\n> pass) and document the carve-out in the row's commit message.\n\n- [ ] **Step 7.6: Workflow**\n\n```yaml\n# .github/workflows/mutation.yml\nname: Mutation testing\n\non:\n schedule:\n - cron: '0 7 * * 1' # Mondays 07:00 UTC, after CodeQL + determinism\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n stryker:\n runs-on: ubuntu-latest\n timeout-minutes: 60\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run mutation\n - uses: actions/upload-artifact@ # v5.0.0\n if: always()\n with:\n name: mutation-report\n path: reports/mutation/\n if-no-files-found: error\n retention-days: 30\n```\n\n- [ ] **Step 7.7: actionlint + verify**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/mutation.yml\nnpm run verify\n```\n\n> `npm run verify` does NOT include `npm run mutation` — too slow for\n> the pre-PR gate. Mutation runs only on the weekly schedule.\n\n- [ ] **Step 7.8: Commit**\n\n```bash\ngit add stryker.config.mjs .github/workflows/mutation.yml \\\n package.json package-lock.json .gitignore\ngit commit -m \"test(mutation): weekly Stryker run on develop (baseline N%)\"\n```\n\n---\n\n## Chunk 6: Demo Playwright smoke (row 8)\n\nRationale: existing CI builds the demo (`demo-build` job) but never\nruns it. A headless click-through across the golden path catches\nruntime regressions that typecheck + bundle don't (tfjs backend probe,\n`base` URL handling, vite HTML transform regressions — see\n`MEMORY.md → feedback_vite_html_transform`).\n\n### Task 8: Playwright golden-path smoke\n\n**Files:**\n- Create: `examples/nurture-pet/playwright.config.ts`\n- Create: `examples/nurture-pet/tests/smoke/golden-path.spec.ts`\n- Create: `.github/workflows/demo-smoke.yml`\n- Modify: `examples/nurture-pet/package.json` — devDep + script\n- Modify: `.gitignore`\n\n- [ ] **Step 8.1: Add Playwright to the demo**\n\n```bash\ncd examples/nurture-pet\nnpm install --save-dev --save-exact @playwright/test@latest\nnpx playwright install --with-deps chromium\ncd -\n```\n\nPin `@playwright/test` in `examples/nurture-pet/package.json`. Do NOT\nadd it to the root `package.json` — the demo manages its own deps\n(`MEMORY.md` notes the `file:../..` EISDIR pitfall on Windows).\n\n- [ ] **Step 8.2: `examples/nurture-pet/playwright.config.ts`**\n\n```ts\nimport { defineConfig, devices } from '@playwright/test';\n\nexport default defineConfig({\n testDir: './tests/smoke',\n fullyParallel: false, // single demo instance, single worker\n forbidOnly: !!process.env.CI,\n retries: process.env.CI ? 1 : 0,\n workers: 1,\n reporter: process.env.CI ? [['github'], ['html']] : 'list',\n use: {\n baseURL: 'http://127.0.0.1:4173',\n trace: 'retain-on-failure',\n screenshot: 'only-on-failure',\n },\n webServer: {\n command: 'npm run preview -- --host 127.0.0.1 --port 4173',\n url: 'http://127.0.0.1:4173',\n reuseExistingServer: !process.env.CI,\n timeout: 60_000,\n },\n projects: [\n { name: 'chromium', use: { ...devices['Desktop Chrome'] } },\n ],\n});\n```\n\n- [ ] **Step 8.3: Write `tests/smoke/golden-path.spec.ts`**\n\n```ts\nimport { test, expect } from '@playwright/test';\n\ntest('golden path: feed → pet → sleep updates HUD without console errors', async ({\n page,\n}) => {\n const consoleErrors: string[] = [];\n page.on('pageerror', (e) => consoleErrors.push(e.message));\n page.on('console', (msg) => {\n if (msg.type() === 'error') consoleErrors.push(msg.text());\n });\n\n await page.goto('/');\n await expect(page.getByRole('heading', { level: 1 })).toBeVisible();\n\n // Replace selectors with the actual demo controls — discoverable via\n // `npm run dev` + DevTools. Keep this spec tied to user-facing roles\n // (button names, ARIA labels) not implementation classes.\n await page.getByRole('button', { name: /feed/i }).click();\n await page.getByRole('button', { name: /pet/i }).click();\n await page.getByRole('button', { name: /sleep/i }).click();\n\n // HUD assertion — pick one stable observable (e.g. \"Hunger\" stat\n // text changes). Adapt during step 8.4.\n await expect(page.getByTestId('hud-needs')).toContainText(/Hunger/);\n\n expect(consoleErrors).toEqual([]);\n});\n```\n\n- [ ] **Step 8.4: Run locally to wire selectors**\n\n```bash\ncd examples/nurture-pet\nnpm run build && npm run preview &\nPREVIEW_PID=$!\nnpx playwright test --headed --project=chromium\nkill $PREVIEW_PID\ncd -\n```\n\nIterate on selectors until the spec passes. **If the demo lacks stable\ntestids on the HUD, add them in this same row** (not a separate PR;\nthe smoke depends on them).\n\n- [ ] **Step 8.5: Add script to `examples/nurture-pet/package.json`**\n\n```json\n\"smoke\": \"playwright test\"\n```\n\n- [ ] **Step 8.6: Update `.gitignore`**\n\n```\nexamples/nurture-pet/playwright-report/\nexamples/nurture-pet/test-results/\n```\n\n- [ ] **Step 8.7: Workflow**\n\n```yaml\n# .github/workflows/demo-smoke.yml\nname: Demo smoke\n\non:\n schedule:\n - cron: '30 3 * * *' # Daily 03:30 UTC\n pull_request:\n paths:\n - 'examples/nurture-pet/**'\n - 'src/**' # library changes can break demo at runtime\n - '.github/workflows/demo-smoke.yml'\n workflow_dispatch:\n\npermissions:\n contents: read\n\njobs:\n smoke:\n runs-on: ubuntu-latest\n timeout-minutes: 15\n steps:\n - uses: actions/checkout@ # v6.0.2\n - uses: actions/setup-node@ # v6.4.0\n with: { node-version: 22, cache: npm }\n - run: npm ci\n - run: npm run build\n - name: Install demo deps\n working-directory: examples/nurture-pet\n run: npm ci --no-audit --no-fund\n - name: Install Playwright browsers\n working-directory: examples/nurture-pet\n run: npx playwright install --with-deps chromium\n - name: Build demo\n working-directory: examples/nurture-pet\n run: npm run build\n - name: Smoke (Playwright)\n working-directory: examples/nurture-pet\n run: npm run smoke\n - uses: actions/upload-artifact@ # v5.0.0\n if: failure()\n with:\n name: playwright-report\n path: examples/nurture-pet/playwright-report/\n retention-days: 14\n```\n\n- [ ] **Step 8.8: actionlint + verify (root) + smoke run (demo)**\n\n```bash\ndocker run --rm -v \"$PWD\":/repo -w /repo rhysd/actionlint:latest -color .github/workflows/demo-smoke.yml\nnpm run verify\n( cd examples/nurture-pet && npm run smoke )\n```\n\n- [ ] **Step 8.9: Commit**\n\n```bash\ngit add examples/nurture-pet/playwright.config.ts \\\n examples/nurture-pet/tests/ \\\n examples/nurture-pet/package.json \\\n examples/nurture-pet/package-lock.json \\\n .github/workflows/demo-smoke.yml \\\n .gitignore\ngit commit -m \"test(demo): nightly Playwright smoke on golden path\"\n```\n\n---\n\n## Chunk 7: Final wiring (rows 9–10)\n\n### Task 9: Doc updates\n\n**Files:**\n- Modify: `CONTRIBUTING.md`\n- Modify: `README.md`\n\n- [ ] **Step 9.1: `CONTRIBUTING.md`**\n\nAdd a brief \"Quality automation\" subsection under the existing dev-loop\nsection. List `npm run mutation`, `npm run determinism:replay`, and\n`( cd examples/nurture-pet && npm run smoke )` with one-line purposes.\n\n- [ ] **Step 9.2: `README.md`**\n\nAdd one bullet under the existing Quality / CI section linking to:\n- `docs/metrics/bundle-trend.jsonl`\n- `docs/dep-triage-bot/README.md`\n- `docs/actions-bump-bot/README.md`\n- `docs/plan-recon-bot/README.md`\n\nNo screenshots, no badges. Keep it terse.\n\n- [ ] **Step 9.3: Commit**\n\n```bash\ngit add CONTRIBUTING.md README.md\ngit commit -m \"docs: link new quality-automation surfaces\"\n```\n\n---\n\n### Task Final: Flip PR to ready-for-review\n\n- [ ] **Final.1: Run the full gate one more time**\n\n```bash\nnpm run verify\n( cd examples/nurture-pet && npm run smoke )\nnpm run determinism:replay\n```\n\nMutation is **not** in this gate — too slow. Owner can spot-check by\nrunning `npm run mutation` if desired.\n\n- [ ] **Final.2: Confirm every checkbox above is ticked**\n\n```bash\ngrep -E '^- \\[ \\]' docs/plans/2026-04-26-quality-automation-routines.md\n```\n\nExpected: no output (zero unchecked boxes).\n\n- [ ] **Final.3: Mark PR ready**\n\n```bash\ngh pr ready \n```\n\n- [ ] **Final.4: Optional — add a Codex re-review trigger**\n\n```bash\ngh pr comment --body \"@codex review\"\n```\n\nStandard pattern from `MEMORY.md → feedback_pr_codex_polling.md`. If\nfindings come back, address per\n`MEMORY.md → feedback_codex_signal_endpoints.md`.\n\n---\n\n## Risk register (read once before starting)\n\n- **Stryker runtime explosion.** If the suite balloons past 45 min on a\n single runner, drop `concurrency` to match the runner's vCPU count\n and / or split the `mutate` glob across two workflow jobs (e.g.\n `src/agent/**` vs. everything else). Don't lower the threshold to\n paper over slowness.\n- **Determinism baseline drift.** Any legitimate library change that\n alters trace contents (new event type, reordered tick stage)\n invalidates `baseline.json`. Treat that as an explicit re-baseline\n step in the same PR that changes behavior — never bypass the\n assertion. Add a `determinism:baseline` script comment in\n `package.json` calling this out.\n- **Playwright flake.** The demo loads tfjs which probes WebGL → WASM →\n CPU on startup. In CI on Ubuntu, expect WASM. Allow `retries: 1`\n but never higher; >1 retries hides real flakes.\n- **Bot-pushed develop commits.** Row 5 pushes a metrics row directly\n to `develop` from a workflow. If branch protection blocks this\n (likely), pivot to PR-bot path documented in step 5.7. Don't\n weaken protection.\n- **Action SHA churn.** Every new workflow added in this PR uses pinned\n SHAs. After this PR merges, the next `actions-bump-bot` run will\n attempt to bump them. That's expected — review that bump PR like any\n other.\n- **One PR, one branch.** Owner explicitly approved bundling all eight\n rows on this branch. Project default (`one PR, one concern`) does\n not apply here. If a reviewer flags split-required, point them to\n this plan section.\n\n---\n\n## When to mark this plan shipped\n\nMove this file to `docs/archive/plans/2026-04-26-quality-automation-routines.md`\nvia `git mv` in the **same commit** that flips the PR to merged (or in\na follow-up `chore(docs)` commit on `develop` if that's not feasible).\nPer `MEMORY.md → feedback_docs_alongside_pr.md`.\n","base_ref","head_ref","pull_request_info",[1433],{"_1077":45,"_45":1428},[1930,1931,1932],[],{"_1082":1083,"_45":1084,"_1085":1086},{"_1056":1921},{"_311":1920},{"_311":1468},{"_278":279,"_270":280,"_281":282,"_283":57,"_284":15,"_285":15,"_286":287,"_288":289,"_290":291,"_292":126,"_293":294,"_295":296,"_297":298,"_299":-5,"_300":-5,"_301":1467,"_303":304,"_305":306,"_307":308,"_309":31},{"_41":122,"_189":190,"_191":192,"_193":15,"_194":195,"_196":197,"_198":1456,"_200":-5,"_201":-5,"_202":1457,"_204":195,"_205":195,"_206":1458,"_208":1459,"_210":1460,"_212":-5,"_213":214,"_215":216,"_217":218,"_219":1461,"_53":-5,"_118":221,"_222":1462,"_224":1463,"_226":227,"_228":15,"_229":15},{"_132":1449},[1444,1445,1446,1447,1448],{"_146":168,"_148":149,"_150":151,"_152":164,"_154":167,"_156":157,"_158":31,"_160":-5},{"_146":166,"_148":149,"_150":151,"_152":162,"_154":167,"_156":157,"_158":31,"_160":-5},{"_146":163,"_148":149,"_150":151,"_152":164,"_154":165,"_156":157,"_158":31,"_160":-5},{"_146":161,"_148":149,"_150":151,"_152":162,"_154":155,"_156":157,"_158":31,"_160":-5},{"_146":147,"_148":149,"_150":151,"_152":153,"_154":155,"_156":157,"_158":159,"_160":-5},[1450,1451,1452],{"_173":1455,"_175":186},{"_173":1454,"_175":182},{"_173":1453,"_175":176},{"_177":178,"_91":179,"_118":180},{"_177":183,"_91":179,"_118":184},{"_177":187,"_91":179,"_118":188},{"_272":273,"_274":67,"_275":-5,"_276":-5,"_277":-5},[233],{"_233":1464},{},{},[],{"_232":57},{"_230":57,"_231":195},{"_41":235,"_177":236,"_237":1465,"_239":192,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":62,"_251":15,"_252":57,"_253":15,"_254":15,"_255":57,"_256":57,"_257":-5,"_158":258,"_259":-5,"_53":1466},{"_264":265,"_41":266,"_91":267,"_268":269,"_270":271},{"_261":57,"_262":57,"_263":57},{"_264":265,"_177":265,"_310":-5,"_268":269,"_41":266},[1469,1470,1471,1472,1473,1474,1475,1476,1477,1478,1479,1480,1481,1482,1483,1484,1485,1486,1487,1488,1489,1490,1491,1492,1493,1494,1495,1496,1497,1498,1499,1500,1501,1502,1503,1504,1505,1506,1507,1508,1509,1510,1511,1512,1513,1514,1515,1516,1517,1518,1519,1520,1521,1522,1523,1524,1525,1526,1527,1528,1529,1530,1531,1532,1533,1534,1535,1536,1537,1538,1539,1540,1541,1542,1543,1544,1545,1546,1547,1548,1549,1550,1551,1552,1553,1554,1555,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1567,1568,1569,1570,1571,1572,1573,1574,1575],{"_152":1034,"_421":1916},{"_152":434,"_421":1912},{"_152":434,"_421":1907},{"_152":430,"_421":1904},{"_152":1010,"_421":1901},{"_152":434,"_421":1897},{"_152":448,"_421":1892},{"_152":448,"_421":1888},{"_152":434,"_421":1885},{"_152":434,"_421":1883},{"_152":448,"_421":1879},{"_152":434,"_421":1877},{"_152":448,"_421":1873},{"_152":434,"_421":1870},{"_152":434,"_421":1868},{"_152":448,"_421":1864},{"_152":434,"_421":1862},{"_152":448,"_421":1858},{"_152":434,"_421":1855},{"_152":434,"_421":1853},{"_152":448,"_421":1849},{"_152":434,"_421":1847},{"_152":448,"_421":1843},{"_152":434,"_421":1840},{"_152":434,"_421":1838},{"_152":448,"_421":1834},{"_152":434,"_421":1832},{"_152":448,"_421":1828},{"_152":434,"_421":1825},{"_152":434,"_421":1823},{"_152":448,"_421":1819},{"_152":434,"_421":1817},{"_152":448,"_421":1813},{"_152":434,"_421":1810},{"_152":434,"_421":1808},{"_152":448,"_421":1800},{"_152":434,"_421":1798},{"_152":448,"_421":1794},{"_152":434,"_421":1791},{"_152":434,"_421":1789},{"_152":448,"_421":1785},{"_152":434,"_421":1783},{"_152":448,"_421":1779},{"_152":434,"_421":1776},{"_152":434,"_421":1774},{"_152":448,"_421":1770},{"_152":434,"_421":1768},{"_152":448,"_421":1764},{"_152":434,"_421":1761},{"_152":434,"_421":1759},{"_152":448,"_421":1752},{"_152":434,"_421":1750},{"_152":448,"_421":1746},{"_152":434,"_421":1743},{"_152":434,"_421":1741},{"_152":448,"_421":1737},{"_152":434,"_421":1735},{"_152":448,"_421":1731},{"_152":434,"_421":1728},{"_152":434,"_421":1726},{"_152":448,"_421":1722},{"_152":434,"_421":1720},{"_152":448,"_421":1716},{"_152":434,"_421":1713},{"_152":434,"_421":1711},{"_152":434,"_421":1709},{"_152":448,"_421":1705},{"_152":434,"_421":1702},{"_152":434,"_421":1700},{"_152":448,"_421":1696},{"_152":434,"_421":1694},{"_152":448,"_421":1690},{"_152":434,"_421":1687},{"_152":434,"_421":1685},{"_152":448,"_421":1681},{"_152":434,"_421":1679},{"_152":448,"_421":1675},{"_152":434,"_421":1672},{"_152":434,"_421":1670},{"_152":448,"_421":1666},{"_152":434,"_421":1664},{"_152":448,"_421":1660},{"_152":434,"_421":1657},{"_152":434,"_421":1655},{"_152":448,"_421":1651},{"_152":434,"_421":1649},{"_152":448,"_421":1645},{"_152":434,"_421":1642},{"_152":434,"_421":1640},{"_152":448,"_421":1636},{"_152":434,"_421":1634},{"_152":448,"_421":1630},{"_152":434,"_421":1627},{"_152":434,"_421":1625},{"_152":448,"_421":1618},{"_152":434,"_421":1616},{"_152":448,"_421":1612},{"_152":434,"_421":1609},{"_152":434,"_421":1607},{"_152":448,"_421":1596},{"_152":434,"_421":1594},{"_152":448,"_421":1590},{"_152":434,"_421":1587},{"_152":448,"_421":1585},{"_152":434,"_421":1581},{"_152":430,"_421":1579},{"_152":420,"_421":1576},{"_423":424,"_86":1577},{"_102":-5,"_41":426,"_427":1578,"_429":112},[],{"_429":1580,"_423":424},{"_91":433},{"_436":1582,"_423":424,"_438":426},{"_439":1583,"_441":-5,"_41":-5,"_442":443,"_95":92,"_91":444},[1584],{"_45":446,"_91":447},{"_436":1586,"_423":424,"_438":426},{"_41":451,"_442":443,"_45":446,"_91":452},{"_436":1588,"_423":424,"_438":426},{"_439":-5,"_455":456,"_41":-5,"_457":1589,"_91":459},[],{"_436":1591,"_423":424,"_438":426},{"_439":1592,"_41":463,"_457":1593,"_91":459},[],[],{"_436":1595,"_423":424,"_438":426},{"_467":468,"_469":470,"_91":471},{"_436":1597,"_423":424,"_438":426},{"_474":475,"_476":477,"_478":1598,"_480":481,"_482":31,"_483":31,"_41":468,"_484":485,"_486":487,"_429":112,"_91":488},[1599,1600,1601,1602,1603,1604,1605,1606],{"_476":515,"_177":516,"_160":517,"_91":500},{"_476":512,"_177":513,"_160":514,"_91":500},{"_476":510,"_177":502,"_160":511,"_91":500},{"_476":508,"_177":498,"_160":509,"_91":500},{"_476":506,"_177":502,"_160":507,"_91":500},{"_476":504,"_177":498,"_160":505,"_91":500},{"_476":501,"_177":502,"_160":503,"_91":500},{"_476":497,"_177":498,"_160":499,"_91":500},{"_436":1608,"_423":424,"_438":426},{"_520":521,"_467":468,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1610,"_423":424,"_438":426},{"_439":-5,"_455":527,"_41":-5,"_457":1611,"_91":459},[],{"_436":1613,"_423":424,"_438":426},{"_439":1614,"_41":532,"_457":1615,"_91":459},[],[],{"_436":1617,"_423":424,"_438":426},{"_467":536,"_469":537,"_91":471},{"_436":1619,"_423":424,"_438":426},{"_520":1620,"_482":306,"_102":-5,"_41":536,"_541":-5,"_542":1621,"_544":545,"_429":112,"_546":545,"_91":547},{"_286":552,"_288":553},{"_548":-5,"_439":1622,"_550":1623},[1624],{"_286":552,"_288":553},{"_91":45,"_45":555},{"_436":1626,"_423":424,"_438":426},{"_520":537,"_467":536,"_41":-5,"_177":558,"_523":-5,"_91":524},{"_436":1628,"_423":424,"_438":426},{"_439":-5,"_455":561,"_41":-5,"_457":1629,"_91":459},[],{"_436":1631,"_423":424,"_438":426},{"_439":1632,"_41":566,"_457":1633,"_91":459},[],[],{"_436":1635,"_423":424,"_438":426},{"_467":570,"_469":571,"_91":471},{"_436":1637,"_423":424,"_438":426},{"_474":574,"_476":575,"_478":1638,"_480":481,"_482":31,"_483":31,"_41":570,"_484":577,"_486":487,"_429":112,"_91":488},[1639],{"_476":579,"_91":580},{"_436":1641,"_423":424,"_438":426},{"_520":583,"_467":570,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1643,"_423":424,"_438":426},{"_439":-5,"_455":586,"_41":-5,"_457":1644,"_91":459},[],{"_436":1646,"_423":424,"_438":426},{"_439":1647,"_41":591,"_457":1648,"_91":459},[],[],{"_436":1650,"_423":424,"_438":426},{"_467":595,"_469":596,"_91":471},{"_436":1652,"_423":424,"_438":426},{"_474":599,"_476":600,"_478":1653,"_480":481,"_482":602,"_483":31,"_41":595,"_484":603,"_486":487,"_429":112,"_91":488},[1654],{"_476":605,"_91":580},{"_436":1656,"_423":424,"_438":426},{"_520":608,"_467":595,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1658,"_423":424,"_438":426},{"_439":-5,"_455":611,"_41":-5,"_457":1659,"_91":459},[],{"_436":1661,"_423":424,"_438":426},{"_439":1662,"_41":616,"_457":1663,"_91":459},[],[],{"_436":1665,"_423":424,"_438":426},{"_467":620,"_469":621,"_91":471},{"_436":1667,"_423":424,"_438":426},{"_474":624,"_476":625,"_478":1668,"_480":481,"_482":31,"_483":31,"_41":620,"_484":627,"_486":487,"_429":112,"_91":488},[1669],{"_476":629,"_91":580},{"_436":1671,"_423":424,"_438":426},{"_520":632,"_467":620,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1673,"_423":424,"_438":426},{"_439":-5,"_455":635,"_41":-5,"_457":1674,"_91":459},[],{"_436":1676,"_423":424,"_438":426},{"_439":1677,"_41":640,"_457":1678,"_91":459},[],[],{"_436":1680,"_423":424,"_438":426},{"_467":644,"_469":645,"_91":471},{"_436":1682,"_423":424,"_438":426},{"_474":648,"_476":649,"_478":1683,"_480":481,"_482":31,"_483":651,"_41":644,"_484":652,"_486":487,"_429":653,"_91":488},[1684],{"_476":655,"_91":580},{"_436":1686,"_423":424,"_438":426},{"_520":658,"_467":644,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1688,"_423":424,"_438":426},{"_439":-5,"_455":661,"_41":-5,"_457":1689,"_91":459},[],{"_436":1691,"_423":424,"_438":426},{"_439":1692,"_41":666,"_457":1693,"_91":459},[],[],{"_436":1695,"_423":424,"_438":426},{"_467":670,"_469":671,"_91":471},{"_436":1697,"_423":424,"_438":426},{"_474":674,"_476":675,"_478":1698,"_480":481,"_482":677,"_483":31,"_41":678,"_484":679,"_486":487,"_429":112,"_91":488},[1699],{"_476":681,"_91":580},{"_436":1701,"_423":424,"_438":426},{"_520":684,"_467":670,"_41":-5,"_177":685,"_523":-5,"_91":524},{"_436":1703,"_423":424,"_438":426},{"_439":-5,"_455":688,"_41":-5,"_457":1704,"_91":459},[],{"_436":1706,"_423":424,"_438":426},{"_439":1707,"_41":693,"_457":1708,"_91":459},[],[],{"_436":1710,"_423":424,"_438":426},{"_467":678,"_469":697,"_91":471},{"_436":1712,"_423":424,"_438":426},{"_520":700,"_467":678,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1714,"_423":424,"_438":426},{"_439":-5,"_455":703,"_41":-5,"_457":1715,"_91":459},[],{"_436":1717,"_423":424,"_438":426},{"_439":1718,"_41":708,"_457":1719,"_91":459},[],[],{"_436":1721,"_423":424,"_438":426},{"_467":712,"_469":713,"_91":471},{"_436":1723,"_423":424,"_438":426},{"_474":716,"_476":717,"_478":1724,"_480":481,"_482":719,"_483":31,"_41":712,"_484":720,"_486":487,"_429":112,"_91":488},[1725],{"_476":722,"_91":580},{"_436":1727,"_423":424,"_438":426},{"_520":725,"_467":712,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1729,"_423":424,"_438":426},{"_439":-5,"_455":728,"_41":-5,"_457":1730,"_91":459},[],{"_436":1732,"_423":424,"_438":426},{"_439":1733,"_41":733,"_457":1734,"_91":459},[],[],{"_436":1736,"_423":424,"_438":426},{"_467":737,"_469":738,"_91":471},{"_436":1738,"_423":424,"_438":426},{"_474":-5,"_476":741,"_478":1739,"_480":481,"_482":31,"_483":31,"_41":737,"_484":743,"_486":487,"_429":112,"_91":488},[1740],{"_476":745,"_91":580},{"_436":1742,"_423":424,"_438":426},{"_520":748,"_467":737,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1744,"_423":424,"_438":426},{"_439":-5,"_455":751,"_41":-5,"_457":1745,"_91":459},[],{"_436":1747,"_423":424,"_438":426},{"_439":1748,"_41":756,"_457":1749,"_91":459},[],[],{"_436":1751,"_423":424,"_438":426},{"_467":760,"_469":761,"_91":471},{"_436":1753,"_423":424,"_438":426},{"_474":764,"_476":765,"_478":1754,"_480":481,"_482":31,"_483":31,"_41":760,"_484":767,"_486":487,"_429":112,"_91":488},[1755,1756,1757,1758],{"_476":778,"_177":502,"_160":779,"_91":500},{"_476":776,"_177":498,"_160":777,"_91":500},{"_476":774,"_177":502,"_160":775,"_91":500},{"_476":772,"_177":498,"_160":773,"_91":500},{"_436":1760,"_423":424,"_438":426},{"_520":782,"_467":760,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1762,"_423":424,"_438":426},{"_439":-5,"_455":785,"_41":-5,"_457":1763,"_91":459},[],{"_436":1765,"_423":424,"_438":426},{"_439":1766,"_41":790,"_457":1767,"_91":459},[],[],{"_436":1769,"_423":424,"_438":426},{"_467":794,"_469":795,"_91":471},{"_436":1771,"_423":424,"_438":426},{"_474":798,"_476":799,"_478":1772,"_480":481,"_482":801,"_483":31,"_41":794,"_484":802,"_486":487,"_429":112,"_91":488},[1773],{"_476":804,"_91":580},{"_436":1775,"_423":424,"_438":426},{"_520":807,"_467":794,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1777,"_423":424,"_438":426},{"_439":-5,"_455":810,"_41":-5,"_457":1778,"_91":459},[],{"_436":1780,"_423":424,"_438":426},{"_439":1781,"_41":815,"_457":1782,"_91":459},[],[],{"_436":1784,"_423":424,"_438":426},{"_467":819,"_469":820,"_91":471},{"_436":1786,"_423":424,"_438":426},{"_474":823,"_476":824,"_478":1787,"_480":481,"_482":31,"_483":651,"_41":819,"_484":826,"_486":487,"_429":653,"_91":488},[1788],{"_476":828,"_91":580},{"_436":1790,"_423":424,"_438":426},{"_520":831,"_467":819,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1792,"_423":424,"_438":426},{"_439":-5,"_455":834,"_41":-5,"_457":1793,"_91":459},[],{"_436":1795,"_423":424,"_438":426},{"_439":1796,"_41":839,"_457":1797,"_91":459},[],[],{"_436":1799,"_423":424,"_438":426},{"_467":843,"_469":844,"_91":471},{"_436":1801,"_423":424,"_438":426},{"_474":847,"_476":848,"_478":1802,"_480":481,"_482":31,"_483":31,"_41":843,"_484":850,"_486":487,"_429":112,"_91":488},[1803,1804,1805,1806,1807],{"_476":864,"_160":865,"_91":866},{"_476":861,"_177":862,"_160":863,"_91":500},{"_476":860,"_177":513,"_160":514,"_91":500},{"_476":859,"_177":857,"_160":857,"_91":500},{"_476":856,"_177":857,"_160":858,"_91":500},{"_436":1809,"_423":424,"_438":426},{"_520":869,"_467":843,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1811,"_423":424,"_438":426},{"_439":-5,"_455":872,"_41":-5,"_457":1812,"_91":459},[],{"_436":1814,"_423":424,"_438":426},{"_439":1815,"_41":877,"_457":1816,"_91":459},[],[],{"_436":1818,"_423":424,"_438":426},{"_467":881,"_469":882,"_91":471},{"_436":1820,"_423":424,"_438":426},{"_474":885,"_476":886,"_478":1821,"_480":481,"_482":31,"_483":31,"_41":881,"_484":888,"_486":487,"_429":112,"_91":488},[1822],{"_476":890,"_91":580},{"_436":1824,"_423":424,"_438":426},{"_520":893,"_467":881,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1826,"_423":424,"_438":426},{"_439":-5,"_455":896,"_41":-5,"_457":1827,"_91":459},[],{"_436":1829,"_423":424,"_438":426},{"_439":1830,"_41":901,"_457":1831,"_91":459},[],[],{"_436":1833,"_423":424,"_438":426},{"_467":905,"_469":906,"_91":471},{"_436":1835,"_423":424,"_438":426},{"_474":-5,"_476":625,"_478":1836,"_480":481,"_482":31,"_483":31,"_41":905,"_484":910,"_486":487,"_429":112,"_91":488},[1837],{"_476":629,"_91":580},{"_436":1839,"_423":424,"_438":426},{"_520":632,"_467":905,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1841,"_423":424,"_438":426},{"_439":-5,"_455":916,"_41":-5,"_457":1842,"_91":459},[],{"_436":1844,"_423":424,"_438":426},{"_439":1845,"_41":921,"_457":1846,"_91":459},[],[],{"_436":1848,"_423":424,"_438":426},{"_467":925,"_469":926,"_91":471},{"_436":1850,"_423":424,"_438":426},{"_474":929,"_476":930,"_478":1851,"_480":481,"_482":31,"_483":31,"_41":925,"_484":932,"_486":487,"_429":112,"_91":488},[1852],{"_476":934,"_160":-5,"_91":866},{"_436":1854,"_423":424,"_438":426},{"_520":937,"_467":925,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1856,"_423":424,"_438":426},{"_439":-5,"_455":940,"_41":-5,"_457":1857,"_91":459},[],{"_436":1859,"_423":424,"_438":426},{"_439":1860,"_41":945,"_457":1861,"_91":459},[],[],{"_436":1863,"_423":424,"_438":426},{"_467":949,"_469":950,"_91":471},{"_436":1865,"_423":424,"_438":426},{"_474":953,"_476":954,"_478":1866,"_480":481,"_482":31,"_483":31,"_41":949,"_484":956,"_486":487,"_429":112,"_91":488},[1867],{"_476":958,"_91":580},{"_436":1869,"_423":424,"_438":426},{"_520":961,"_467":949,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1871,"_423":424,"_438":426},{"_439":-5,"_455":964,"_41":-5,"_457":1872,"_91":459},[],{"_436":1874,"_423":424,"_438":426},{"_439":1875,"_41":969,"_457":1876,"_91":459},[],[],{"_436":1878,"_423":424,"_438":426},{"_467":973,"_469":974,"_91":471},{"_436":1880,"_423":424,"_438":426},{"_474":977,"_476":978,"_478":1881,"_480":481,"_482":980,"_483":31,"_41":973,"_484":981,"_486":487,"_429":112,"_91":488},[1882],{"_476":983,"_91":580},{"_436":1884,"_423":424,"_438":426},{"_520":986,"_467":973,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":1886,"_423":424,"_438":426},{"_439":-5,"_455":989,"_41":-5,"_457":1887,"_91":459},[],{"_436":1889,"_423":424,"_438":426},{"_439":1890,"_41":994,"_457":1891,"_91":459},[],[],{"_436":1893,"_423":424,"_438":426},{"_439":1894,"_41":999,"_91":1000},[1895],{"_45":1002,"_1003":1896,"_91":45},[],{"_436":1898,"_423":424,"_438":426},{"_439":1899,"_441":-5,"_41":-5,"_442":-5,"_95":301,"_91":444},[1900],{"_45":1002,"_91":1009},{"_423":424,"_86":1902},{"_102":-5,"_41":426,"_427":1903,"_429":1014},[],{"_429":1905,"_423":424},{"_1017":1906,"_91":1019},[],{"_436":1908,"_423":424,"_438":1022},{"_439":1909,"_441":-5,"_41":-5,"_442":-5,"_95":301,"_91":444},[1910,1911],{"_45":1027,"_91":1009},{"_45":1026,"_91":1009},{"_436":1913,"_423":424,"_438":1022},{"_439":1914,"_441":-5,"_41":-5,"_442":-5,"_95":1031,"_91":444},[1915],{"_45":1033,"_91":1009},{"_1036":1917},{"_1038":-5,"_1039":-5,"_1040":1041,"_1042":1043,"_480":481,"_1044":15,"_1045":-5,"_1046":-5,"_41":424,"_1047":1048,"_177":-5,"_160":1049,"_1050":195,"_486":1051,"_429":1918,"_76":1919,"_1054":1043},{"_91":433},[],[],[1922],{"_41":1059,"_1060":1923,"_1062":1063,"_1064":1063,"_439":1924,"_429":1066,"_441":-5,"_1067":31,"_1068":1925,"_1070":1071,"_1072":-5},{"_95":301,"_177":-5,"_1068":1929},{"_1077":45,"_1078":1928},{"_1073":1926},{"_1075":1927},[],[1080],{},{"_91":444,"_95":92,"_439":1969},{"_91":1115,"_1116":1936},{"_91":1090,"_1091":552,"_1092":1093,"_1094":1933,"_1096":-5},{"_91":1094,"_1097":481,"_127":128,"_1098":-5,"_300":1099,"_1100":1934,"_1102":1103,"_1104":1105,"_1106":1107,"_1108":1109,"_1110":1935},{"_1112":1113,"_1114":-5},[],[1937,1938,1939,1940,1941,1942,1943,1944],{"_160":517,"_1126":-5,"_1127":1966,"_1129":-5},{"_160":514,"_1126":-5,"_1127":1963,"_1129":-5},{"_160":511,"_1126":-5,"_1127":1960,"_1129":-5},{"_160":509,"_1126":-5,"_1127":1957,"_1129":-5},{"_160":507,"_1126":-5,"_1127":1954,"_1129":-5},{"_160":505,"_1126":-5,"_1127":1951,"_1129":-5},{"_160":503,"_1126":-5,"_1127":1948,"_1129":-5},{"_160":499,"_1126":-5,"_1127":1945,"_1129":-5},[1946],{"_1131":1132,"_1133":1134,"_439":1947,"_1136":57},[1137,195,1138,195,1139,195,1140,1141,1142,1143,195,1144,195,1145,1146,1147,1148,1149,195,1150,195,1151],[1949],{"_1131":1132,"_1133":1154,"_439":1950,"_1136":57},[1156,195,1157,195,1158,195,1159,195,1160,1161,195,1162,195,1163,195,1164,195,1165,1166,1167,1168,1169,1170,1171,195,1172,195,1173,1174,1175,1176,195,1177,195,1178,1179,1180,1181,195,1182,195,1183,1184,1185],[1952],{"_1131":1132,"_1133":1188,"_439":1953,"_1136":57},[1190,195,1191,195,1139,195,1140,1141,1192,1143,195,1193,195,1194,1195,1196,195,1197,195,1198,1199],[1955],{"_1131":1132,"_1133":1202,"_439":1956,"_1136":57},[1204,195,1205,195,1158,195,1159,195,1206,1207,1208,195,1162,195,1209,195,1210,1211,1212,195,1213,195,1214,195,1215,1216,1217,1218,1219,195,1172,195,1220,1221,1222,1223,195,1177,195,1224,1225,1226,1227,195,1182,195,1228,195,1229,1230,1231],[1958],{"_1131":1132,"_1133":1234,"_439":1959,"_1136":57},[1236,195,1237,1238,195,1139,195,1140,1141,1239,1240,195,1241,195,1242,1243,195,1244,1245,195,1246,195,1247,1248,1249,1250],[1961],{"_1131":1132,"_1133":1253,"_439":1962,"_1136":57},[1255,195,1256,1257,1258,195,1259,1260,195,1158,195,1159,195,1261,1262,195,1162,195,1263,1264,195,1265,195,1266,1267,1268,1269,1270,1267,1268,1271,1272,1273,1274,1275,1276,1277,1278,195,1172,195,1279,1280,1281,1282,195,1177,195,1283,1284,1285,195,1286,1287,1288,1289,195,1182,195,1290,195,1291,1292,1293,195,1294,195,1295,1296,1297,1298],[1964],{"_1131":1132,"_1133":1301,"_439":1965,"_1136":57},[1303,1304,1305,1306,1307,195,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1322,1323,1324,1325,1326,1327,1328,1329,1330,1331,1332,195,1333,1311,1334,1313,1314,1315,1316,1317,1318,1335,1326,1327,1328,1329,1330,1331,1332,1320,1321,1336,1322,1337,1325,195,1338,1339,1340,1312,1313,1314,1315,1316,1317,1318,1335,1320,1321,1341,1322,1342,1325,1326,1343,1328,1329],[1967],{"_1131":1132,"_1133":1346,"_439":1968,"_1136":57},[1348,195,1349,1350,1351,1352,1351,1353,1354,195,1355,1356,1357,195,1358,1359,1360,1361,195,1362,1363,1364,1365,1366,1367,1368,1369,1370,1371,1372,1373,1374,1375,1376,1373,1377],[1970,1971,1972,1973,1974,1975,1976,1977,1978,1979,1980,1981,1982,1983],{"_1077":45,"_45":1400},{"_1077":1394,"_160":517,"_1131":1132,"_1133":1346},{"_1077":45,"_45":1399},{"_1077":1394,"_160":514,"_1131":304,"_1133":1398},{"_1077":45,"_45":1397},{"_1077":1394,"_160":511,"_1131":1132,"_1133":1253},{"_1077":1394,"_160":509,"_1131":1132,"_1133":1234},{"_1077":45,"_45":1396},{"_1077":1394,"_160":507,"_1131":1132,"_1133":1202},{"_1077":1394,"_160":505,"_1131":1132,"_1133":1188},{"_1077":45,"_45":1395},{"_1077":1394,"_160":503,"_1131":1132,"_1133":1154},{"_1077":1394,"_160":499,"_1131":1132,"_1133":1134},{"_1077":45,"_45":1393},[2480,2481,2482],[],{"_1082":1083,"_45":1084,"_1085":1086},{"_1056":2471},{"_311":2470},{"_311":2018},{"_278":279,"_270":280,"_281":282,"_283":57,"_284":15,"_285":15,"_286":287,"_288":289,"_290":291,"_292":126,"_293":294,"_295":296,"_297":298,"_299":-5,"_300":-5,"_301":2017,"_303":304,"_305":306,"_307":308,"_309":31},{"_41":122,"_189":190,"_191":192,"_193":15,"_194":195,"_196":197,"_198":2006,"_200":-5,"_201":-5,"_202":2007,"_204":195,"_205":195,"_206":2008,"_208":2009,"_210":2010,"_212":-5,"_213":214,"_215":216,"_217":218,"_219":2011,"_53":-5,"_118":221,"_222":2012,"_224":2013,"_226":227,"_228":15,"_229":15},{"_132":1999},[1994,1995,1996,1997,1998],{"_146":168,"_148":149,"_150":151,"_152":164,"_154":167,"_156":157,"_158":31,"_160":-5},{"_146":166,"_148":149,"_150":151,"_152":162,"_154":167,"_156":157,"_158":31,"_160":-5},{"_146":163,"_148":149,"_150":151,"_152":164,"_154":165,"_156":157,"_158":31,"_160":-5},{"_146":161,"_148":149,"_150":151,"_152":162,"_154":155,"_156":157,"_158":31,"_160":-5},{"_146":147,"_148":149,"_150":151,"_152":153,"_154":155,"_156":157,"_158":159,"_160":-5},[2000,2001,2002],{"_173":2005,"_175":186},{"_173":2004,"_175":182},{"_173":2003,"_175":176},{"_177":178,"_91":179,"_118":180},{"_177":183,"_91":179,"_118":184},{"_177":187,"_91":179,"_118":188},{"_272":273,"_274":67,"_275":-5,"_276":-5,"_277":-5},[233],{"_233":2014},{},{},[],{"_232":57},{"_230":57,"_231":195},{"_41":235,"_177":236,"_237":2015,"_239":192,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":62,"_251":15,"_252":57,"_253":15,"_254":15,"_255":57,"_256":57,"_257":-5,"_158":258,"_259":-5,"_53":2016},{"_264":265,"_41":266,"_91":267,"_268":269,"_270":271},{"_261":57,"_262":57,"_263":57},{"_264":265,"_177":265,"_310":-5,"_268":269,"_41":266},[2019,2020,2021,2022,2023,2024,2025,2026,2027,2028,2029,2030,2031,2032,2033,2034,2035,2036,2037,2038,2039,2040,2041,2042,2043,2044,2045,2046,2047,2048,2049,2050,2051,2052,2053,2054,2055,2056,2057,2058,2059,2060,2061,2062,2063,2064,2065,2066,2067,2068,2069,2070,2071,2072,2073,2074,2075,2076,2077,2078,2079,2080,2081,2082,2083,2084,2085,2086,2087,2088,2089,2090,2091,2092,2093,2094,2095,2096,2097,2098,2099,2100,2101,2102,2103,2104,2105,2106,2107,2108,2109,2110,2111,2112,2113,2114,2115,2116,2117,2118,2119,2120,2121,2122,2123,2124,2125],{"_152":1034,"_421":2466},{"_152":434,"_421":2462},{"_152":434,"_421":2457},{"_152":430,"_421":2454},{"_152":1010,"_421":2451},{"_152":434,"_421":2447},{"_152":448,"_421":2442},{"_152":448,"_421":2438},{"_152":434,"_421":2435},{"_152":434,"_421":2433},{"_152":448,"_421":2429},{"_152":434,"_421":2427},{"_152":448,"_421":2423},{"_152":434,"_421":2420},{"_152":434,"_421":2418},{"_152":448,"_421":2414},{"_152":434,"_421":2412},{"_152":448,"_421":2408},{"_152":434,"_421":2405},{"_152":434,"_421":2403},{"_152":448,"_421":2399},{"_152":434,"_421":2397},{"_152":448,"_421":2393},{"_152":434,"_421":2390},{"_152":434,"_421":2388},{"_152":448,"_421":2384},{"_152":434,"_421":2382},{"_152":448,"_421":2378},{"_152":434,"_421":2375},{"_152":434,"_421":2373},{"_152":448,"_421":2369},{"_152":434,"_421":2367},{"_152":448,"_421":2363},{"_152":434,"_421":2360},{"_152":434,"_421":2358},{"_152":448,"_421":2350},{"_152":434,"_421":2348},{"_152":448,"_421":2344},{"_152":434,"_421":2341},{"_152":434,"_421":2339},{"_152":448,"_421":2335},{"_152":434,"_421":2333},{"_152":448,"_421":2329},{"_152":434,"_421":2326},{"_152":434,"_421":2324},{"_152":448,"_421":2320},{"_152":434,"_421":2318},{"_152":448,"_421":2314},{"_152":434,"_421":2311},{"_152":434,"_421":2309},{"_152":448,"_421":2302},{"_152":434,"_421":2300},{"_152":448,"_421":2296},{"_152":434,"_421":2293},{"_152":434,"_421":2291},{"_152":448,"_421":2287},{"_152":434,"_421":2285},{"_152":448,"_421":2281},{"_152":434,"_421":2278},{"_152":434,"_421":2276},{"_152":448,"_421":2272},{"_152":434,"_421":2270},{"_152":448,"_421":2266},{"_152":434,"_421":2263},{"_152":434,"_421":2261},{"_152":434,"_421":2259},{"_152":448,"_421":2255},{"_152":434,"_421":2252},{"_152":434,"_421":2250},{"_152":448,"_421":2246},{"_152":434,"_421":2244},{"_152":448,"_421":2240},{"_152":434,"_421":2237},{"_152":434,"_421":2235},{"_152":448,"_421":2231},{"_152":434,"_421":2229},{"_152":448,"_421":2225},{"_152":434,"_421":2222},{"_152":434,"_421":2220},{"_152":448,"_421":2216},{"_152":434,"_421":2214},{"_152":448,"_421":2210},{"_152":434,"_421":2207},{"_152":434,"_421":2205},{"_152":448,"_421":2201},{"_152":434,"_421":2199},{"_152":448,"_421":2195},{"_152":434,"_421":2192},{"_152":434,"_421":2190},{"_152":448,"_421":2186},{"_152":434,"_421":2184},{"_152":448,"_421":2180},{"_152":434,"_421":2177},{"_152":434,"_421":2175},{"_152":448,"_421":2168},{"_152":434,"_421":2166},{"_152":448,"_421":2162},{"_152":434,"_421":2159},{"_152":434,"_421":2157},{"_152":448,"_421":2146},{"_152":434,"_421":2144},{"_152":448,"_421":2140},{"_152":434,"_421":2137},{"_152":448,"_421":2135},{"_152":434,"_421":2131},{"_152":430,"_421":2129},{"_152":420,"_421":2126},{"_423":424,"_86":2127},{"_102":-5,"_41":426,"_427":2128,"_429":112},[],{"_429":2130,"_423":424},{"_91":433},{"_436":2132,"_423":424,"_438":426},{"_439":2133,"_441":-5,"_41":-5,"_442":443,"_95":92,"_91":444},[2134],{"_45":446,"_91":447},{"_436":2136,"_423":424,"_438":426},{"_41":451,"_442":443,"_45":446,"_91":452},{"_436":2138,"_423":424,"_438":426},{"_439":-5,"_455":456,"_41":-5,"_457":2139,"_91":459},[],{"_436":2141,"_423":424,"_438":426},{"_439":2142,"_41":463,"_457":2143,"_91":459},[],[],{"_436":2145,"_423":424,"_438":426},{"_467":468,"_469":470,"_91":471},{"_436":2147,"_423":424,"_438":426},{"_474":475,"_476":477,"_478":2148,"_480":481,"_482":31,"_483":31,"_41":468,"_484":485,"_486":487,"_429":112,"_91":488},[2149,2150,2151,2152,2153,2154,2155,2156],{"_476":515,"_177":516,"_160":517,"_91":500},{"_476":512,"_177":513,"_160":514,"_91":500},{"_476":510,"_177":502,"_160":511,"_91":500},{"_476":508,"_177":498,"_160":509,"_91":500},{"_476":506,"_177":502,"_160":507,"_91":500},{"_476":504,"_177":498,"_160":505,"_91":500},{"_476":501,"_177":502,"_160":503,"_91":500},{"_476":497,"_177":498,"_160":499,"_91":500},{"_436":2158,"_423":424,"_438":426},{"_520":521,"_467":468,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2160,"_423":424,"_438":426},{"_439":-5,"_455":527,"_41":-5,"_457":2161,"_91":459},[],{"_436":2163,"_423":424,"_438":426},{"_439":2164,"_41":532,"_457":2165,"_91":459},[],[],{"_436":2167,"_423":424,"_438":426},{"_467":536,"_469":537,"_91":471},{"_436":2169,"_423":424,"_438":426},{"_520":2170,"_482":306,"_102":-5,"_41":536,"_541":-5,"_542":2171,"_544":545,"_429":112,"_546":545,"_91":547},{"_286":552,"_288":553},{"_548":-5,"_439":2172,"_550":2173},[2174],{"_286":552,"_288":553},{"_91":45,"_45":555},{"_436":2176,"_423":424,"_438":426},{"_520":537,"_467":536,"_41":-5,"_177":558,"_523":-5,"_91":524},{"_436":2178,"_423":424,"_438":426},{"_439":-5,"_455":561,"_41":-5,"_457":2179,"_91":459},[],{"_436":2181,"_423":424,"_438":426},{"_439":2182,"_41":566,"_457":2183,"_91":459},[],[],{"_436":2185,"_423":424,"_438":426},{"_467":570,"_469":571,"_91":471},{"_436":2187,"_423":424,"_438":426},{"_474":574,"_476":575,"_478":2188,"_480":481,"_482":31,"_483":31,"_41":570,"_484":577,"_486":487,"_429":112,"_91":488},[2189],{"_476":579,"_91":580},{"_436":2191,"_423":424,"_438":426},{"_520":583,"_467":570,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2193,"_423":424,"_438":426},{"_439":-5,"_455":586,"_41":-5,"_457":2194,"_91":459},[],{"_436":2196,"_423":424,"_438":426},{"_439":2197,"_41":591,"_457":2198,"_91":459},[],[],{"_436":2200,"_423":424,"_438":426},{"_467":595,"_469":596,"_91":471},{"_436":2202,"_423":424,"_438":426},{"_474":599,"_476":600,"_478":2203,"_480":481,"_482":602,"_483":31,"_41":595,"_484":603,"_486":487,"_429":112,"_91":488},[2204],{"_476":605,"_91":580},{"_436":2206,"_423":424,"_438":426},{"_520":608,"_467":595,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2208,"_423":424,"_438":426},{"_439":-5,"_455":611,"_41":-5,"_457":2209,"_91":459},[],{"_436":2211,"_423":424,"_438":426},{"_439":2212,"_41":616,"_457":2213,"_91":459},[],[],{"_436":2215,"_423":424,"_438":426},{"_467":620,"_469":621,"_91":471},{"_436":2217,"_423":424,"_438":426},{"_474":624,"_476":625,"_478":2218,"_480":481,"_482":31,"_483":31,"_41":620,"_484":627,"_486":487,"_429":112,"_91":488},[2219],{"_476":629,"_91":580},{"_436":2221,"_423":424,"_438":426},{"_520":632,"_467":620,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2223,"_423":424,"_438":426},{"_439":-5,"_455":635,"_41":-5,"_457":2224,"_91":459},[],{"_436":2226,"_423":424,"_438":426},{"_439":2227,"_41":640,"_457":2228,"_91":459},[],[],{"_436":2230,"_423":424,"_438":426},{"_467":644,"_469":645,"_91":471},{"_436":2232,"_423":424,"_438":426},{"_474":648,"_476":649,"_478":2233,"_480":481,"_482":31,"_483":651,"_41":644,"_484":652,"_486":487,"_429":653,"_91":488},[2234],{"_476":655,"_91":580},{"_436":2236,"_423":424,"_438":426},{"_520":658,"_467":644,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2238,"_423":424,"_438":426},{"_439":-5,"_455":661,"_41":-5,"_457":2239,"_91":459},[],{"_436":2241,"_423":424,"_438":426},{"_439":2242,"_41":666,"_457":2243,"_91":459},[],[],{"_436":2245,"_423":424,"_438":426},{"_467":670,"_469":671,"_91":471},{"_436":2247,"_423":424,"_438":426},{"_474":674,"_476":675,"_478":2248,"_480":481,"_482":677,"_483":31,"_41":678,"_484":679,"_486":487,"_429":112,"_91":488},[2249],{"_476":681,"_91":580},{"_436":2251,"_423":424,"_438":426},{"_520":684,"_467":670,"_41":-5,"_177":685,"_523":-5,"_91":524},{"_436":2253,"_423":424,"_438":426},{"_439":-5,"_455":688,"_41":-5,"_457":2254,"_91":459},[],{"_436":2256,"_423":424,"_438":426},{"_439":2257,"_41":693,"_457":2258,"_91":459},[],[],{"_436":2260,"_423":424,"_438":426},{"_467":678,"_469":697,"_91":471},{"_436":2262,"_423":424,"_438":426},{"_520":700,"_467":678,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2264,"_423":424,"_438":426},{"_439":-5,"_455":703,"_41":-5,"_457":2265,"_91":459},[],{"_436":2267,"_423":424,"_438":426},{"_439":2268,"_41":708,"_457":2269,"_91":459},[],[],{"_436":2271,"_423":424,"_438":426},{"_467":712,"_469":713,"_91":471},{"_436":2273,"_423":424,"_438":426},{"_474":716,"_476":717,"_478":2274,"_480":481,"_482":719,"_483":31,"_41":712,"_484":720,"_486":487,"_429":112,"_91":488},[2275],{"_476":722,"_91":580},{"_436":2277,"_423":424,"_438":426},{"_520":725,"_467":712,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2279,"_423":424,"_438":426},{"_439":-5,"_455":728,"_41":-5,"_457":2280,"_91":459},[],{"_436":2282,"_423":424,"_438":426},{"_439":2283,"_41":733,"_457":2284,"_91":459},[],[],{"_436":2286,"_423":424,"_438":426},{"_467":737,"_469":738,"_91":471},{"_436":2288,"_423":424,"_438":426},{"_474":-5,"_476":741,"_478":2289,"_480":481,"_482":31,"_483":31,"_41":737,"_484":743,"_486":487,"_429":112,"_91":488},[2290],{"_476":745,"_91":580},{"_436":2292,"_423":424,"_438":426},{"_520":748,"_467":737,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2294,"_423":424,"_438":426},{"_439":-5,"_455":751,"_41":-5,"_457":2295,"_91":459},[],{"_436":2297,"_423":424,"_438":426},{"_439":2298,"_41":756,"_457":2299,"_91":459},[],[],{"_436":2301,"_423":424,"_438":426},{"_467":760,"_469":761,"_91":471},{"_436":2303,"_423":424,"_438":426},{"_474":764,"_476":765,"_478":2304,"_480":481,"_482":31,"_483":31,"_41":760,"_484":767,"_486":487,"_429":112,"_91":488},[2305,2306,2307,2308],{"_476":778,"_177":502,"_160":779,"_91":500},{"_476":776,"_177":498,"_160":777,"_91":500},{"_476":774,"_177":502,"_160":775,"_91":500},{"_476":772,"_177":498,"_160":773,"_91":500},{"_436":2310,"_423":424,"_438":426},{"_520":782,"_467":760,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2312,"_423":424,"_438":426},{"_439":-5,"_455":785,"_41":-5,"_457":2313,"_91":459},[],{"_436":2315,"_423":424,"_438":426},{"_439":2316,"_41":790,"_457":2317,"_91":459},[],[],{"_436":2319,"_423":424,"_438":426},{"_467":794,"_469":795,"_91":471},{"_436":2321,"_423":424,"_438":426},{"_474":798,"_476":799,"_478":2322,"_480":481,"_482":801,"_483":31,"_41":794,"_484":802,"_486":487,"_429":112,"_91":488},[2323],{"_476":804,"_91":580},{"_436":2325,"_423":424,"_438":426},{"_520":807,"_467":794,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2327,"_423":424,"_438":426},{"_439":-5,"_455":810,"_41":-5,"_457":2328,"_91":459},[],{"_436":2330,"_423":424,"_438":426},{"_439":2331,"_41":815,"_457":2332,"_91":459},[],[],{"_436":2334,"_423":424,"_438":426},{"_467":819,"_469":820,"_91":471},{"_436":2336,"_423":424,"_438":426},{"_474":823,"_476":824,"_478":2337,"_480":481,"_482":31,"_483":651,"_41":819,"_484":826,"_486":487,"_429":653,"_91":488},[2338],{"_476":828,"_91":580},{"_436":2340,"_423":424,"_438":426},{"_520":831,"_467":819,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2342,"_423":424,"_438":426},{"_439":-5,"_455":834,"_41":-5,"_457":2343,"_91":459},[],{"_436":2345,"_423":424,"_438":426},{"_439":2346,"_41":839,"_457":2347,"_91":459},[],[],{"_436":2349,"_423":424,"_438":426},{"_467":843,"_469":844,"_91":471},{"_436":2351,"_423":424,"_438":426},{"_474":847,"_476":848,"_478":2352,"_480":481,"_482":31,"_483":31,"_41":843,"_484":850,"_486":487,"_429":112,"_91":488},[2353,2354,2355,2356,2357],{"_476":864,"_160":865,"_91":866},{"_476":861,"_177":862,"_160":863,"_91":500},{"_476":860,"_177":513,"_160":514,"_91":500},{"_476":859,"_177":857,"_160":857,"_91":500},{"_476":856,"_177":857,"_160":858,"_91":500},{"_436":2359,"_423":424,"_438":426},{"_520":869,"_467":843,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2361,"_423":424,"_438":426},{"_439":-5,"_455":872,"_41":-5,"_457":2362,"_91":459},[],{"_436":2364,"_423":424,"_438":426},{"_439":2365,"_41":877,"_457":2366,"_91":459},[],[],{"_436":2368,"_423":424,"_438":426},{"_467":881,"_469":882,"_91":471},{"_436":2370,"_423":424,"_438":426},{"_474":885,"_476":886,"_478":2371,"_480":481,"_482":31,"_483":31,"_41":881,"_484":888,"_486":487,"_429":112,"_91":488},[2372],{"_476":890,"_91":580},{"_436":2374,"_423":424,"_438":426},{"_520":893,"_467":881,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2376,"_423":424,"_438":426},{"_439":-5,"_455":896,"_41":-5,"_457":2377,"_91":459},[],{"_436":2379,"_423":424,"_438":426},{"_439":2380,"_41":901,"_457":2381,"_91":459},[],[],{"_436":2383,"_423":424,"_438":426},{"_467":905,"_469":906,"_91":471},{"_436":2385,"_423":424,"_438":426},{"_474":-5,"_476":625,"_478":2386,"_480":481,"_482":31,"_483":31,"_41":905,"_484":910,"_486":487,"_429":112,"_91":488},[2387],{"_476":629,"_91":580},{"_436":2389,"_423":424,"_438":426},{"_520":632,"_467":905,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2391,"_423":424,"_438":426},{"_439":-5,"_455":916,"_41":-5,"_457":2392,"_91":459},[],{"_436":2394,"_423":424,"_438":426},{"_439":2395,"_41":921,"_457":2396,"_91":459},[],[],{"_436":2398,"_423":424,"_438":426},{"_467":925,"_469":926,"_91":471},{"_436":2400,"_423":424,"_438":426},{"_474":929,"_476":930,"_478":2401,"_480":481,"_482":31,"_483":31,"_41":925,"_484":932,"_486":487,"_429":112,"_91":488},[2402],{"_476":934,"_160":-5,"_91":866},{"_436":2404,"_423":424,"_438":426},{"_520":937,"_467":925,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2406,"_423":424,"_438":426},{"_439":-5,"_455":940,"_41":-5,"_457":2407,"_91":459},[],{"_436":2409,"_423":424,"_438":426},{"_439":2410,"_41":945,"_457":2411,"_91":459},[],[],{"_436":2413,"_423":424,"_438":426},{"_467":949,"_469":950,"_91":471},{"_436":2415,"_423":424,"_438":426},{"_474":953,"_476":954,"_478":2416,"_480":481,"_482":31,"_483":31,"_41":949,"_484":956,"_486":487,"_429":112,"_91":488},[2417],{"_476":958,"_91":580},{"_436":2419,"_423":424,"_438":426},{"_520":961,"_467":949,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2421,"_423":424,"_438":426},{"_439":-5,"_455":964,"_41":-5,"_457":2422,"_91":459},[],{"_436":2424,"_423":424,"_438":426},{"_439":2425,"_41":969,"_457":2426,"_91":459},[],[],{"_436":2428,"_423":424,"_438":426},{"_467":973,"_469":974,"_91":471},{"_436":2430,"_423":424,"_438":426},{"_474":977,"_476":978,"_478":2431,"_480":481,"_482":980,"_483":31,"_41":973,"_484":981,"_486":487,"_429":112,"_91":488},[2432],{"_476":983,"_91":580},{"_436":2434,"_423":424,"_438":426},{"_520":986,"_467":973,"_41":-5,"_177":522,"_523":-5,"_91":524},{"_436":2436,"_423":424,"_438":426},{"_439":-5,"_455":989,"_41":-5,"_457":2437,"_91":459},[],{"_436":2439,"_423":424,"_438":426},{"_439":2440,"_41":994,"_457":2441,"_91":459},[],[],{"_436":2443,"_423":424,"_438":426},{"_439":2444,"_41":999,"_91":1000},[2445],{"_45":1002,"_1003":2446,"_91":45},[],{"_436":2448,"_423":424,"_438":426},{"_439":2449,"_441":-5,"_41":-5,"_442":-5,"_95":301,"_91":444},[2450],{"_45":1002,"_91":1009},{"_423":424,"_86":2452},{"_102":-5,"_41":426,"_427":2453,"_429":1014},[],{"_429":2455,"_423":424},{"_1017":2456,"_91":1019},[],{"_436":2458,"_423":424,"_438":1022},{"_439":2459,"_441":-5,"_41":-5,"_442":-5,"_95":301,"_91":444},[2460,2461],{"_45":1027,"_91":1009},{"_45":1026,"_91":1009},{"_436":2463,"_423":424,"_438":1022},{"_439":2464,"_441":-5,"_41":-5,"_442":-5,"_95":1031,"_91":444},[2465],{"_45":1033,"_91":1009},{"_1036":2467},{"_1038":-5,"_1039":-5,"_1040":1041,"_1042":1043,"_480":481,"_1044":15,"_1045":-5,"_1046":-5,"_41":424,"_1047":1048,"_177":-5,"_160":1049,"_1050":195,"_486":1051,"_429":2468,"_76":2469,"_1054":1043},{"_91":433},[],[],[2472],{"_41":1059,"_1060":2473,"_1062":1063,"_1064":1063,"_439":2474,"_429":1066,"_441":-5,"_1067":31,"_1068":2475,"_1070":1071,"_1072":-5},{"_95":301,"_177":-5,"_1068":2479},{"_1077":45,"_1078":2478},{"_1073":2476},{"_1075":2477},[],[1080],{},{"_91":444,"_95":92,"_439":2519},{"_91":1115,"_1116":2486},{"_91":1090,"_1091":552,"_1092":1093,"_1094":2483,"_1096":-5},{"_91":1094,"_1097":481,"_127":128,"_1098":-5,"_300":1099,"_1100":2484,"_1102":1103,"_1104":1105,"_1106":1107,"_1108":1109,"_1110":2485},{"_1112":1113,"_1114":-5},[],[2487,2488,2489,2490,2491,2492,2493,2494],{"_160":517,"_1126":-5,"_1127":2516,"_1129":-5},{"_160":514,"_1126":-5,"_1127":2513,"_1129":-5},{"_160":511,"_1126":-5,"_1127":2510,"_1129":-5},{"_160":509,"_1126":-5,"_1127":2507,"_1129":-5},{"_160":507,"_1126":-5,"_1127":2504,"_1129":-5},{"_160":505,"_1126":-5,"_1127":2501,"_1129":-5},{"_160":503,"_1126":-5,"_1127":2498,"_1129":-5},{"_160":499,"_1126":-5,"_1127":2495,"_1129":-5},[2496],{"_1131":1132,"_1133":1134,"_439":2497,"_1136":57},[1137,195,1138,195,1139,195,1140,1141,1142,1143,195,1144,195,1145,1146,1147,1148,1149,195,1150,195,1151],[2499],{"_1131":1132,"_1133":1154,"_439":2500,"_1136":57},[1156,195,1157,195,1158,195,1159,195,1160,1161,195,1162,195,1163,195,1164,195,1165,1166,1167,1168,1169,1170,1171,195,1172,195,1173,1174,1175,1176,195,1177,195,1178,1179,1180,1181,195,1182,195,1183,1184,1185],[2502],{"_1131":1132,"_1133":1188,"_439":2503,"_1136":57},[1190,195,1191,195,1139,195,1140,1141,1192,1143,195,1193,195,1194,1195,1196,195,1197,195,1198,1199],[2505],{"_1131":1132,"_1133":1202,"_439":2506,"_1136":57},[1204,195,1205,195,1158,195,1159,195,1206,1207,1208,195,1162,195,1209,195,1210,1211,1212,195,1213,195,1214,195,1215,1216,1217,1218,1219,195,1172,195,1220,1221,1222,1223,195,1177,195,1224,1225,1226,1227,195,1182,195,1228,195,1229,1230,1231],[2508],{"_1131":1132,"_1133":1234,"_439":2509,"_1136":57},[1236,195,1237,1238,195,1139,195,1140,1141,1239,1240,195,1241,195,1242,1243,195,1244,1245,195,1246,195,1247,1248,1249,1250],[2511],{"_1131":1132,"_1133":1253,"_439":2512,"_1136":57},[1255,195,1256,1257,1258,195,1259,1260,195,1158,195,1159,195,1261,1262,195,1162,195,1263,1264,195,1265,195,1266,1267,1268,1269,1270,1267,1268,1271,1272,1273,1274,1275,1276,1277,1278,195,1172,195,1279,1280,1281,1282,195,1177,195,1283,1284,1285,195,1286,1287,1288,1289,195,1182,195,1290,195,1291,1292,1293,195,1294,195,1295,1296,1297,1298],[2514],{"_1131":1132,"_1133":1301,"_439":2515,"_1136":57},[1303,1304,1305,1306,1307,195,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1322,1323,1324,1325,1326,1327,1328,1329,1330,1331,1332,195,1333,1311,1334,1313,1314,1315,1316,1317,1318,1335,1326,1327,1328,1329,1330,1331,1332,1320,1321,1336,1322,1337,1325,195,1338,1339,1340,1312,1313,1314,1315,1316,1317,1318,1335,1320,1321,1341,1322,1342,1325,1326,1343,1328,1329],[2517],{"_1131":1132,"_1133":1346,"_439":2518,"_1136":57},[1348,195,1349,1350,1351,1352,1351,1353,1354,195,1355,1356,1357,195,1358,1359,1360,1361,195,1362,1363,1364,1365,1366,1367,1368,1369,1370,1371,1372,1373,1374,1375,1376,1373,1377],[2520,2521,2522,2523,2524,2525,2526,2527,2528,2529,2530,2531,2532,2533],{"_1077":45,"_45":1400},{"_1077":1394,"_160":517,"_1131":1132,"_1133":1346},{"_1077":45,"_45":1399},{"_1077":1394,"_160":514,"_1131":304,"_1133":1398},{"_1077":45,"_45":1397},{"_1077":1394,"_160":511,"_1131":1132,"_1133":1253},{"_1077":1394,"_160":509,"_1131":1132,"_1133":1234},{"_1077":45,"_45":1396},{"_1077":1394,"_160":507,"_1131":1132,"_1133":1202},{"_1077":1394,"_160":505,"_1131":1132,"_1133":1188},{"_1077":45,"_45":1395},{"_1077":1394,"_160":503,"_1131":1132,"_1133":1154},{"_1077":1394,"_160":499,"_1131":1132,"_1133":1134},{"_1077":45,"_45":1393},[2536,2537],{"_1410":1411,"_239":192,"_1412":279,"_250":-5,"_1097":233,"_1413":-5,"_1414":-5,"_1415":1416,"_1417":-5,"_1418":1419,"_1420":-5,"_1421":15,"_1422":57,"_1423":52,"_1424":15},{"_91":444,"_95":301,"_439":2538},{"_286":1427,"_288":1428,"_1429":294,"_1430":128,"_297":-5,"_91":1431},[2539],{"_1077":45,"_45":1428},"task_e_69edfd839498832fb98ac3d0f2d91e7a",1777204611.580552,"Github Mention: chore(quality): add quality-automation routines (CodeQL, mutation, Playwright, …)","has_generated_title","has_unread_turn","denormalized_metadata",{"_2571":31,"_2572":2573,"_2574":-5,"_2575":-5,"_2565":2576,"_2577":-5,"_2578":-5,"_2579":-5,"_2580":-5},"task_status_display",{"_2559":2560,"_2561":192,"_129":126,"_2562":-5,"_2563":1090},"creator_workspace","external_pull_requests",[2552],{"_41":2553,"_2554":82,"_2555":2556,"_2557":128},"github-1214362243-130","assistant_turn_id","pull_request",{"_278":279,"_270":280,"_281":282,"_283":57,"_284":15,"_285":15,"_286":287,"_288":289,"_290":291,"_292":126,"_293":294,"_295":296,"_297":298,"_299":-5,"_300":-5,"_301":2558,"_303":304,"_305":306,"_307":308,"_309":31},"codex_updated_sha",{"_264":265,"_177":265,"_310":-5,"_268":269,"_41":266},"latest_turn_status_display",{"_2564":82,"_111":112,"_2565":2566,"_93":2567,"_2568":-5,"_2569":-5,"_2570":1090,"_113":-5},"environment_label","fix_task_id","initial_intent","turn_id","diff_stats",{"_1102":1103,"_1104":1105,"_1106":1107},[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_1102":-5,"_1104":-5,"_1106":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","dd",{"_2592":2593,"_2594":2595},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","statsigGateEvaluationsPromise",["P",2591],"traceId","12890593427704704913","traceTime",1778980079624]