10.3.20260727

SHAFT 10.3.20260727

Auto-generated release notes are included below. Users upgrading from
SHAFT_ENGINE should read the
modular SHAFT upgrade guide.

SHAFT Pilot adds deterministic Capture, TestNG generation, Doctor diagnosis,
reviewed repair proposals, and MCP interoperability. AI is optional, disabled
by default, and direct OpenAI, Anthropic, Gemini, or Ollama access requires
explicit enablement and consent. Microsoft/GitHub Copilot integrates through
MCP rather than a generic provider API-key adapter.

See the SHAFT Pilot guide
for installation, configuration, privacy, troubleshooting, and usage examples.

What's Changed

• Revert global -Xmx1024m Surefire cap that OOMs E2E and Local E2E nightlies by @MohabMohie in #4009
• Fix #3996: FlutterIntegration TouchActions.swipeElementIntoView issues flutter: scrollTillVisible by @MohabMohie in #4010
• Skill corpus: cut the always-on metadata tax and fix three routing/accuracy defects by @MohabMohie in #4008
• Dedup owner-binding orchestrator rules: chaos-engine.md -> act-as-fable by @MohabMohie in #4013
• Fix(mcp): capture_api_start networkOptions schema wrongly requires all 6 fields by @MohabMohie in #4012
• Harness: reconcile canonical settings.json with deployed ~/.claude values by @MohabMohie in #4015
• Fix: chain recorded accessible name onto ROLE-strategy capture locators by @MohabMohie in #4011
• Memory: shaft-mcp BOM import ordering silently beats reactor/sibling pins (selenium, netty, postgresql) by @MohabMohie in #4020
• Fix two of three Live Tools Nightly E2E leads (#3988) by @MohabMohie in #4022
• Fix #4001 (item 1) + #4004: FlutterAndroidDriver/FlutterIOSDriver construction and loud scroll-to-end guard by @MohabMohie in #4023
• Reconcile locator-strategy guidance across the skill corpus by @MohabMohie in #4031
• Deprecate appium_flutterfinder_java; migrate FlutterTest.java to native java-client Flutter API by @MohabMohie in #4033
• Fix: close 12 open Dependabot alerts in shaft-mcp (netty + postgresql) by @MohabMohie in #4019
• Memory: record 3 gotchas (scanner patch fragility, TestNG -Dtest=A+B, XML comment --) by @MohabMohie in #4036
• Fix: measure real locator uniqueness for ROLE/LABEL capture-recorder candidates by @MohabMohie in #4035
• Fix #4006: exclude Playwright E2E classes from Grid-job GLOBAL_TESTING_SCOPE by @MohabMohie in #4039
• Fix #4038: exclude LazyLoadingFixtureLiveTest from Grid-job GLOBAL_TESTING_SCOPE by @MohabMohie in #4043
• Enforce POM in generated code + flip SMART_LOCATOR severity to ERROR by @MohabMohie in #4042
• Fix: retry local Safari session creation after clearing a stale pairing (#1548) by @MohabMohie in #4041
• Fix(mcp): annotate CaptureCodegenStartRequest fields with @ToolParam descriptions by @MohabMohie in #4050
• Fix #4040: propagate throttle-test properties onto the background thread by @MohabMohie in #4051
• Fix #4032: drop appium_flutterfinder_java dependency by @MohabMohie in #4049
• Fix #4026: server-side ACCESSIBLE_NAME backfill + in-page XPath emitter by @MohabMohie in #4052
• Fix #4048: harvest guidance from spec-kit / humanizer / taste-skill (SHAFT_ENGINE half) by @MohabMohie in #4058
• Fix #3991: shorten over-length gotcha memory filename by @MohabMohie in #4059
• Fix #4002: HealingManager opts out of AppiumBy.FlutterBy locators by @MohabMohie in #4055
• Fix #4014: pin the excludeAssets<->includeAssetTypes polarity inversion by @MohabMohie in #4056
• Fix #4007: force UTF-8 stdout in extract_allure_failures.py by @MohabMohie in #4060
• Fix #4044: enforce Smart Locator/POM guardrail ERRORs at the MCP boundary by @MohabMohie in #4061
• Memory: record four session gotchas (thread-local Properties, worktree node_modules, guardrail enforcement, shared .m2 cache) by @MohabMohie in #4063
• Fix #4053: clarify bridges are read as files, not Skill-invocable by @MohabMohie in #4065
• Fix #4057: wire enabled/captureRequestBodies/captureResponseBodies through network capture by @MohabMohie in #4064
• Test: reproduce #4046 Guided Workflows Live E2E hang (disabled, no fix) by @MohabMohie in #4068
• Fix #4021: decouple the panel gate fixture from HealerService's repositoryRoot check by @MohabMohie in #4062
• Remove orphaned unitTestSuite.xml by @MohabMohie in #4069
• Fix #4066: bound CaptureManager.invoke() so a recorder hang cannot hang the MCP tool call forever by @MohabMohie in #4073
• Memory: record four gotchas from #4021, #4046, #4066, #4014, #4057 by @MohabMohie in #4075
• Fix reentrant WebDriver call inside CDP Fetch interception callback (#4046) by @MohabMohie in #4076
• Fix #4081: bound every CI workflow job with timeout-minutes by @MohabMohie in #4082
• Fix #4084: reconcile orchestrator concurrency cap to 2-4, strengthen plan/architecture duty by @MohabMohie in #4085
• Memory: npx cache is a second, unpatched @aictx/memory copy by @MohabMohie in #4087
• Fix #4078: detect Cucumber-over-TestNG runs from suite classes, not the call stack by @MohabMohie in #4089
• Fix #4088: validate the PATH-resolved memory CLI, not an npx-cached copy by @MohabMohie in #4093
• Fix #4077: stop acceptNetworkEvent() reentrant getWindowHandle() inside the CDP Fetch callback by @MohabMohie in #4092
• Fix #4080: cover both auto-close mechanisms in work-github playbook by @MohabMohie in #4096
• Fix #4037: stop silent no-op when remote Grid session lacks CDP access for basic-auth by @MohabMohie in #4095
• Fix #4074: bound JunitExtension retry re-execution timeout by @MohabMohie in #4094
• Fix #4072: skip Gemini thought parts and surface finishReason in parseStructuredPayload by @MohabMohie in #4099
• Fix #4101: remove false branch-naming auto-close claim from playbook by @MohabMohie in #4102
• Fix #4046: fix GuidedWorkflowLiveE2ETest's premature-stop race in the API capture wait gate by @MohabMohie in #4100
• Close the archive output stream when unpacking fails by @Mochxd in #4098
• Fix #4079: fail zero-scenario Cucumber CI jobs instead of reporting green by @MohabMohie in #4106
• Fix #4105: guard post-test-report's find call against an absent allure-results directory by @MohabMohie in #4109
• Fix #4103: forbid delegate CI-watch, add five Learning Loop entries by @MohabMohie in #4108
• Fix #4037: stop pre-registering AddHasAuthentication, let Augmenter sequence it correctly by @MohabMohie in #4104
• Fix #4107: distinguish Gemini output-truncation from malformed JSON by @MohabMohie in #4111
• Fix #4071: delete redundant cucumber_testSuite.xml, add orphaned-suite-XML CI guard by @MohabMohie in #4112
• Fix #4114: make the 20-minute stall watch two-sided by @MohabMohie in #4120
• Memory: record six gotchas from the #4086 orchestration run by @MohabMohie in #4122
• Fix #4121: reclaim byte headroom in act-as-fable SKILL.md by @MohabMohie in #4123
• Fix #4115: add targeted workflow_dispatch inputs to the E2E workflows by @MohabMohie in #4124
• Fix #4116, #4118: incremental Learning Loop recording and a stall watch that covers local commands by @MohabMohie in #4125
• Fix #4067: reclaim AGENTS.md byte headroom by moving the routing bridge list out of the budget glob by @MohabMohie in #4129
• Memory: record six gotchas from the crash-recovery session (git config zeroing, squash-merge, Windows worktrees, validator split, byte-cap cycle, shared stash) by @MohabMohie in #4131
• Fix #4083: make a delegate's refusal of orchestration commands structural, not discretionary by @MohabMohie in #4128
• Fix #4110: unblock memory cross-links whose derived relation id exceeds the filename-length check by @MohabMohie in #4133
• Fix #4090: keep network-event window attribution correct across tab switches by @MohabMohie in #4132
• Fix #4119, #4097: correct the zero-scenario guard's module path and settle the BrowserStack Cucumber job by @MohabMohie in #4135
• Fix #4091: detect Cucumber runners declared via packages, methods, or a child suite-file by @MohabMohie in #4134
• Fix #4127: reclaim real headroom in act-as-fable SKILL.md via #4067's split by @MohabMohie in #4140
• Fix screenshot helper failure reporter class by @Mochxd in #4139
• Fix #4113: stop Gemini structured responses truncating at the output-token ceiling by @MohabMohie in #4136
• Record two session gotchas: Bash colon-mangling and CI guard-replay technique by @MohabMohie in #4141
• Fix #4138: replace dead output-budget preflight check with a real warning by @MohabMohie in #4143
• Guard.py: shared git stash + worktree add guardrails, plus a live R3 alias false-positive fix by @MohabMohie in #4148
• Add CI guard for negated closing-keyword references in PR bodies by @MohabMohie in #4144
• Document events.jsonl GitHub false-positive CONFLICTING (#4137) by @MohabMohie in #4149
• Guard.py R3: stop multi-word GUI-verb denylist matching quoted prose by @MohabMohie in #4151
• Catch new memory secret-scanner openai_api_key landmines before they land by @MohabMohie in #4150
• Record 3 memory gotchas: quote-blind auto-close, auto-merge arm-race, events.jsonl presence/false-conflict by @MohabMohie in #4153
• Guard R3: quoted /c payload no longer bypasses the shell-open denylist by @MohabMohie in #4155
• Record gotcha: GitHub Actions && precedence trap in gate conditions by @MohabMohie in #4158
• Extend the autoclose guard to commit messages and re-run it on edited PR bodies by @MohabMohie in #4157
• Add a budgeted deterministic re-suggestion ladder (inert, unwired) by @MohabMohie in #4162
• IntelliJ plugin: setup panel greeting no longer contradicts Done badge on reopen by @MohabMohie in #4167
• Fix AssistantLocalAgentRunner stream reader discarding buffered output on IOException by @MohabMohie in #4169
• Recorder tab's Check status now reports the real active/idle answer by @MohabMohie in #4170
• Add fingerprint-seeding seam so SHAFT Heal history can be written without a live driver by @MohabMohie in #4173
• IntelliJ plugin: assistant raw output uses the IDE's editor font by @MohabMohie in #4176
• Record two gotchas from the issue 4163 investigation by @MohabMohie in #4177
• Collapse prerequisites row immediately after Recheck by @MohabMohie in #4178
• Consolidate capture-status parsing helpers onto AssistantMarkdown by @MohabMohie in #4180
• Record shaft-intellij -Werror/modelToView compile gotcha by @MohabMohie in #4186
• Record two memory objects from the issue 4172 healing-seeding session by @MohabMohie in #4187
• Wire shaft-capture into the healing fingerprint-seeding seam (issue 4172) by @MohabMohie in #4185
• Install text fonts on the intellij-verify CI runner (defensive, not root-cause) by @MohabMohie in #4189
• IntelliJ plugin: welcome bubble truncation and dead EditorColorsManager guard fixes by @MohabMohie in #4184
• Use IDE editor font in ShaftMcpSetupPanel instead of hardcoded Font.MONOSPACED by @MohabMohie in #4192
• shaft-intellij: correct widthCappedWidget() insets docs, add narrow-width panel coverage (#4191) by @MohabMohie in #4193
• Wire the always-on deterministic re-suggestion ladder into resolve() (issue 4027) by @MohabMohie in #4195
• Name the failing stage and recorded step in codegen failures (issue 4029) by @MohabMohie in #4196
• Add fluent wait/gesture/camera API over java-client's Flutter driver (#4017) by @MohabMohie in #4198
• Stage generated test source until compile/replay pass, never overwrite it early by @MohabMohie in #4201
• Add Flutter demo-app + emulator E2E pipeline to e2eTests.yml by @MohabMohie in #4200
• Add test for activateInjectedImage negative branch coverage by @MohabMohie in #4205
• Fix fingerprint-seeding fidelity gaps: recorder attributes, fallback-chain seeding by @MohabMohie in #4207
• Wire low-trust ladder outcomes to a reviewable Doctor advisory proposal by @MohabMohie in #4208
• Recover a cancelled/killed local-agent run's terminal answer by @MohabMohie in #4204
• Snapshot/restore generated test-data JSON on failed compile/replay (issue 4202) by @MohabMohie in #4213
• Fix advisory locator proposal picking an ineligible top-scored candidate by @MohabMohie in #4212
• Fix #4206: delete the staged generated source on the exception path too by @MohabMohie in #4216
• [Docs] Update stale hardcoded '89-tool' prose references to '90-tool' by @MohabMohie in #4218
• Record Area A (plugin initial setup) audit outcome: no defects found by @MohabMohie in #4221
• Add typed FlutterDriverOptions arm to OptionsManager by @MohabMohie in #4219
• shaft-intellij: pending-answer indicator on Cancelled/Killed bubbles by @MohabMohie in #4222
• Gate codegen success on a real replay pass, not a skipped one by @MohabMohie in #4224
• Fix false-positive data-file restore on promotion-write failure by @MohabMohie in #4226
• Persist visibilityRequired on HealingReport for exact advisory eligibility mirror by @MohabMohie in #4227
• Print UNCONFIRMED banner after the JSON dump in capture generate by @MohabMohie in #4229
• Gate ApiCaptureGenerator success on a real replay pass, not a skipped one by @MohabMohie in #4228
• Report Playwright replay honestly when actions are skipped for redaction by @MohabMohie in #4231
• shaft-intellij: fix tool approval prompt text silently clipped at ordinary width by @MohabMohie in #4232
• Record shaft-mcp container-smoke Docker Hub pull-timeout gotcha by @MohabMohie in #4235
• memory: record #4234 investigation (PreferredHeightRow non-issue) by @MohabMohie in #4236
• fix(intellij): stop recommending Smart Locators in Assistant prompts (#4239 P0.1) by @MohabMohie in #4240
• Fix mobile codegen/replay to report honest success (#4239 P0.2) by @MohabMohie in #4241
• Fix NPE in AssistantTranscriptView when EditorColorsManager service is unavailable by @MohabMohie in #4238
• shaft-mcp: capture_generate_replay/capture_start tool-schema fixes (issue #4239 P0.3/P0.4) by @MohabMohie in #4243
• fix(intellij): stop recommending Smart Locators in two more Assistant prompts by @MohabMohie in #4245
• Fix LiveChatToolE2ESupport leaking a fake Application into the Gradle test JVM by @MohabMohie in #4244
• Wire commit-message autoclose scanning into pr-gate.yml by @MohabMohie in #4246
• recorder: self-verify ROLE candidates and extend XPath fallback (#4239 P1.0a/P1.0b) by @MohabMohie in #4248
• refactor(mcp,capture): extract guardrail rules into shaft-capture library (P1.2) by @MohabMohie in #4249
• Shorten overlong .memory decision record id (issue #4247) by @MohabMohie in #4250
• Reduce NPath complexity of GeneratedCodeGuardrails.isSuspiciousSecretLiteral by @MohabMohie in #4251
• capture: make locator policy a real gate, hard ban non-ARIA fallback (issue #4239 P1.1/P1.3/P1.4a/P1.5) by @MohabMohie in #4252
• memory: record LambdaTest nightly-cron wontfix decision (#3934) by @MohabMohie in #4253
• memory: record crash-orphaned-branch verification gotcha by @MohabMohie in #4255
• Split AssistantCommand prompt constants into local-agent/cloud variants (#4239 P2.2) by @MohabMohie in #4257
• Stop telling the tool-incapable cloud-chat model to call MCP tools (#4256) by @MohabMohie in #4259
• Consolidate the harness into a single act-as-mohab orchestrator skill (#4260) by @MohabMohie in #4261
• memory: record git-reset-in-shared-worktree gotcha from #4262 concurrent work by @MohabMohie in #4266
• Stop telling cloud-chat codegen to call MCP tools it can't invoke (#4258) by @MohabMohie in #4267
• mcp: surface honest ladder-rejection reason from Playwright manual-recording codegen (#4262 P1) by @MohabMohie in #4265
• mcp: deliver shaft-skills policy via MCP server instructions (#4239 P2.1) by @MohabMohie in #4254
• memory: flag assistantcommandtest-exact-match-mcp-usage-hint gotcha as stale by @MohabMohie in #4268
• capture: locatorExpression honors rung-2 replayXpath for ID/NAME/CSS/TEST_ID (fixes #4264) by @MohabMohie in #4276
• intellij: update stale 2-tier locator-policy prompts to the 3-tier order (#4275) by @MohabMohie in #4282
• memory: record gotcha from #4271/#4277 -- delegated verification fabrication by @MohabMohie in #4283
• capture: unified deterministic locator scoring/ranking algorithm (#4271) by @MohabMohie in #4277
• memory: record gotcha from #4271/#4277 -- Maven -pl test stale cache by @MohabMohie in #4284
• mcp: BrowserService's locatorCode routes ID/TEST_ID/CSS/NAME through LocatorPolicy by @MohabMohie in #4286
• memory: gotcha hygiene cleanup -- merge duplicates, supersede dead-tool entries, retire one narrow diary by @MohabMohie in #4285
• Fix targetless iframe locator guardrail violation and add shaft-capture to CI unit-test matrix by @MohabMohie in #4288
• Compute real live-DOM locator evidence for manual Playwright MCP recording (#4273) by @MohabMohie in #4289
• shaft-mcp: self-verified replayXpath for NAME/XPATH manual Playwright recordings (#4262) by @MohabMohie in #4292
• shaft-mcp: warn immediately on CSS-strategy Playwright locator recordings (#4291) by @MohabMohie in #4293

Full Changelog: 10.3.20260722...10.3.20260727