v3.15.6: measured-only coverage, quality and learning; stores stay in your project

What's New

AQE's coverage, quality and learning data now come only from real
measurements, and its stores stay inside your project. aqe init, hooks learn, code index and the DAST scanner also got fixes. Every change was
reviewed adversarially in two or three rounds before merge.

Fixed

• Honest coverage (#1010, #1012, #1014, #1015, #1018, #1027):
  • aqe ci uses the same verdict as aqe coverage. A target missing from
    the report is UNMEASURED, never 0%. lcov.info is read. Metrics a
    report never collected (for example branch data) show as n/a and are left
    out of the threshold. Estimates are labelled and never gated.
  • "Line" % is real line coverage, not istanbul statements. It matches the
    test tool's own summary for vitest (v8 and istanbul), jest and nyc.
  • Uncollected metrics are stored as null everywhere (coverage:latest,
    history, per-file), so there are no more fake "low branch coverage"
    findings or fake deltas. Trend deltas only compare against measured
    baselines.
  • Each test run records its pass rate and coverage together, under one run
    id. Coverage from a failing run can't pass the quality gate next to an
    older pass rate.
  • Estimates and unmeasured runs no longer reach learning: coverage
    sessions, pattern usage, experience capture or gap vectors.
  • The coverage tracker no longer writes all-zero records.
• Honest quality metrics (#1002, #1011, #1021):
  • Files that can't be read or parsed no longer get invented values
    (complexity 10, maintainability 70, 0% duplication). Generated, binary and
    .d.ts files are excluded with a reason, and real parse failures make a
    metric partial.
  • Valid files such as Next.js [...slug].tsx routes, deep SvelteKit paths
    and in-root dot-folders are no longer rejected. Reads inside the project
    are checked by real path and are free of check-then-read races.
  • MCP quality_assess honours target and sourceFiles.
  • Unmeasured scores stay out of learning, saved reports and the results
    index.
• Store isolation and data integrity (#1006, #998, #1007, #991,
  #913, #1026):
  • AQE never adopts or creates a store in /tmp or other shared system
    folders. A folder with no project marker uses a stable private store under
    your user cache folder (~/.cache/agentic-qe/scratch/…).
    aqe init refuses to run in a shared temp folder.
  • The MCP result cache is keyed per project. Tools that run tests or
    measure the source tree (coverage, quality, defects, code index) are no
    longer cached.
  • Saved reports no longer overwrite each other, and regenerated test files
    are updated in place.
  • A malformed schedule entry no longer deletes schedules.json. Bad
    entries are disabled with a reason or quarantined.
• Init and CLI (#1017, #981, #999, #980, #1023):
  • aqe init no longer adds eval fixtures that your own test runner
    collects. Existing installs are cleaned up, but only for files that still
    match what AQE shipped; edited files are kept.
  • aqe hooks learn works without an embedder: patterns are stored
    text-only and get indexed later by learning backfill-embeddings.
  • code index skips .agentic-qe/, .claude/ and lockfiles, and MCP
    code_index returns the same project metrics as the CLI.
  • The DAST scanner and the shared HTTP client time out on stalled or
    trickling responses instead of hanging.
• Regression baseline (#1028): the regression monitor builds its
  baseline only from measured evidence. It no longer stores hardcoded
  figures.

Changed

• aqe coverage exits 3 when the target is unmeasured, including when no
  report exists and only a static estimate is available. JSON output gains
  measured, estimated and coverageMethod.
• aqe ci: an UNMEASURED coverage phase is a warning. It does not fail the
  pipeline by itself; an enforced quality gate does.
• Coverage persistence is fail-closed. Programmatic callers of the coverage
  analysis API must pass measured: true for results to be stored.
• Coverage history written by 3.15.5 without a measured stamp drops out of
  trend views.
• Saved report file names have a new, unique format.

Known issues

• Five of the seven quality-gate metrics still have no command that records
  them (#1009).
• Windows paths are unit-tested only, not run on Windows (#971, #982).
• Background workers still store invented figures (#1043); duration
  comparisons are noisy under machine load (#1044).
• Remaining follow-ups: #1020, #1022, #1024, #1025, #1029,
  #1030, #1031.

Getting Started

npx agentic-qe init --auto

See CHANGELOG for full details.