Measurable precision-first bug hunting protocol

* loop: setup task definition

* loop: seal completion gate

* loop: add progress ledger

* loop: add iteration journal

* loop: add one-shot precision patch payload

* loop: add persistent precision gate

* loop: setup - precision-first bug hunting

* loop: iteration 2 - record schema strict-mode failure

* loop: retry precision patch payload 1

* loop: retry precision patch payload 2

* loop: retry precision patch 2

* loop: iteration 3 - record patch transport failure

* loop: add patch transport part 00

* loop: add patch transport part 01

* loop: add patch transport part 02

* loop: add patch transport part 03

* loop: add patch transport part 04

* loop: add patch transport part 05

* loop: retry chunked precision patch 1

* loop: iteration 4 - record regression gate failures

* loop: update patch transport part 00

* loop: update patch transport part 01

* loop: update patch transport part 02

* loop: add exact patch segment 020

* loop: add exact patch segment 021

* loop: add exact patch segment 022

* loop: update patch transport part 03

* loop: add exact remaining patch segments

* loop: retry precision regressions 1

* loop: iteration 5 - record final test syntax failure

* loop: add final exact patch transport

* loop: retry final precision test 1

* loop: iteration 6 - precision-first bug hunting

* loop: iteration 8 - record green draft PR

* loop: iteration 9 - correct final verification count

* loop: iteration 10 - begin deep adversarial cross-check

* loop: iteration 10 - record deep adversarial audit start

* loop: iteration 11 - add failing deep precision regressions

* loop: iteration 11 - record nine reproduced deep defects

* loop: iteration 12 - centralize source detection and token chunks

* loop: iteration 12 - complete shared source semantics

* loop: prepare deep precision patch runner

* loop: apply deep precision hardening

* loop: apply deep precision hardening

* loop: apply deep precision hardening

* loop: iteration 12 - deep precision hardening

* loop: iteration 13 - trigger final PR head verification

* loop: iteration 14 - record final green PR checks

* loop: iteration 15 - reopen resume integrity audit

* loop: iteration 15 - record post-hardening resume audit

* loop: iteration 16 - add resume and coverage regressions

* loop: iteration 16 - fix coverage regression harness

* loop: iteration 16 - record resume integrity failures

* loop: prepare resume integrity patch runner

* loop: apply resume integrity hardening

* loop: iteration 17 - resume integrity hardening

* loop: iteration 18 - trigger final 193-test PR verification

* loop: iteration 19 - close final green ledger

* loop: setup — measurable world-class protocol

* loop: iteration 1 - preserve completed precision loop

* tooling: export source snapshot

* tooling: source snapshot

* tooling: export split source snapshot

* tooling: split source snapshot

* tooling: export wrapped source snapshot

* tooling: export wrapped source snapshot v2

* tooling: wrapped source snapshot

* tooling: upload source artifact

* tooling: upload dependencies

* loop: apply measurable world-class protocol

* tooling: upload implementation snapshot

* loop: apply measurable world-class protocol

* tooling: upload implementation snapshot

* loop: apply measurable world-class protocol

* loop: iteration 3 - record green implementation gate

* loop: apply measurable world-class protocol

* loop: apply measurable world-class protocol

* loop: iteration 4 - measurable world-class protocol

* ci: enforce benchmark quality gate

* tooling: remove temporary implementation workflow

* loop: iteration 5 - mark implementation integrated

* loop: iteration 5 - begin final PR-head verification

* loop: iteration 6 - close final verification item

* loop: iteration 6 - close measurable world-class loop

* loop: iteration 7 - clean temporary transport and reverify

* loop: iteration 8 - close cleaned world-class loop

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: codexstar69

.github/workflows/ci.yml

@@ -33,6 +33,10 @@ jobs:
       - name: Run tests
         run: pnpm test
 
+      - name: Run benchmark quality gate
+        if: matrix.node-version == 24
+        run: pnpm benchmark:gate
+
       - name: Run preflight check
         run: node scripts/run-bug-hunter.cjs preflight --skill-dir .
 

.github/workflows/loop-check.yml

@@ -0,0 +1,37 @@
+name: Precision protocol gate
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 10.28.1
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify sealed check hash
+        run: |
+          actual="$(sha256sum .loop/check.sh | awk '{print $1}')"
+          expected="$(sed -n 's/^SHA-256: `\([a-f0-9]*\)`$/\1/p' .loop/task.md)"
+          test -n "$expected"
+          test "$actual" = "$expected"
+
+      - name: Run sealed gate
+        run: bash .loop/check.sh

.loop-history/precision-first-2026-08-17/check.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+required_files=(
+  scripts/source-config.cjs
+  scripts/tests/precision-protocol.test.cjs
+  docs/precision-protocol.md
+)
+
+for file in "${required_files[@]}"; do
+  if [[ ! -f "$file" ]]; then
+    echo "ASSERTION FAILED: required precision-protocol file is missing: $file" >&2
+    exit 1
+  fi
+done
+
+pnpm check:generated
+pnpm test
+node scripts/run-bug-hunter.cjs preflight --skill-dir .
+pnpm verify:package
+
+echo "LOOP CHECK PASSED: precision protocol, generated assets, tests, preflight, and package inventory are valid."

.loop-history/precision-first-2026-08-17/journal.md

@@ -0,0 +1,97 @@
+# Journal
+
+## Iteration 0 — repository audit — complete
+
+Reviewed the orchestration scripts, schemas, role skills, tests, CI, and package inventory. Confirmed four correctness defects and two efficiency/protocol gaps:
+
+- `bug-hunter-state.cjs` alphabetically sorts caller-provided files, discarding triage risk order.
+- `code-index.cjs` supports fewer source extensions than `triage.cjs`, weakening delta scope for supported languages.
+- `chunk-scheduler.cjs` ignores missing files and can mark a chunk done without scanning its assigned scope.
+- `findings.schema.json` does not enforce non-empty cross-references or security STRIDE/CWE evidence.
+- `run-bug-hunter.cjs` uses a fixed default chunk count rather than a source-token budget.
+- Skeptic hard-excludes every rate-limit finding while Hunter explicitly searches for exploitable auth-rate-limit failures.
+
+## Iteration 1 — loop setup — expected failing gate
+
+Created the sealed completion check. On the setup tree it must fail with the assertion that `scripts/source-config.cjs` is missing. The one-shot patch workflow verifies this expected failure before applying changes.
+
+## Iteration 2 — schema generation — failed
+
+The setup assertion failed exactly as expected and the complete patch payload applied cleanly. Ajv then rejected the generated findings schema in strict mode because the conditional CWE `pattern` did not repeat its string `type`. The payload was corrected to use `{ "type": "string", "pattern": "^CWE-[0-9]+$" }`; the sealed check remains unchanged.
+
+## Iteration 3 — patch transport — failed
+
+The corrected payload was uploaded as one long compressed Base64 line, but GitHub Actions detected a gzip CRC/length mismatch before executing it. No repository source changes were applied. The transport is being replaced with ordered 1.8 KB parts that are locally concatenated, decoded, decompressed, and byte-compared before publication.
+
+## Iteration 4 — regression gate — failed
+
+The chunked patch transport and SHA check passed, the patch applied, and generated assets were current. The actual sealed check failed with four regressions: a newline-escaping SyntaxError in the new test, two existing security fixtures missing newly required STRIDE/CWE fields, and one resume fixture emitting an empty cross-reference list. The workflow also lacked `pipefail`, so its step metadata incorrectly reported success. The next retry fixes all four fixtures and makes pipeline failure propagation explicit.
+
+## Iteration 5 — precision protocol test — failed
+
+The exact reconstructed patcher passed its SHA-256 and syntax checks. All production changes and all 175 pre-existing tests passed. The sole remaining failure was a malformed regular expression in the new protocol regression test: the slash in `OTP/reset` was not preserved through the patcher's template literal. The patcher now emits an escaped slash, and the sealed gate remains unchanged.
+
+## Iteration 5 — precision protocol implementation — pending verification
+
+Applied the centralized source catalog, order preservation, adaptive source-token chunks, fail-closed missing-scope handling, security evidence schema, progressive example loading, qualified rate-limit analysis, documentation, and regression tests. Generated artifacts and the sealed gate run next.
+
+## Iteration 7 — sealed completion gate — passed
+
+The sealed `.loop/check.sh` exited 0: generated assets were current, all 181 tests passed, preflight passed, and package inventory passed.
+
+## Iteration 8 — draft PR validation — passed
+
+Opened draft PR #2. The PR-triggered sealed precision gate passed, Node 22 CI passed, and Node 24 CI passed including package inventory verification.
+
+## Iteration 9 — verification count correction — complete
+
+Corrected the stale test-count note from 176 to the final executed total of 181. No production or test code changed.
+
+## Iteration 10 — deep adversarial cross-check — in progress
+
+Reopened the completed implementation for an end-to-end audit rather than relying on the green test suite. The new pass traces discovery, delta selection, chunk construction, hash evidence, retries/resume, Referee authorization, and Fixer scope. Candidate defects will be reproduced with focused regression tests before any production patch is accepted.
+
+## Iteration 11 — nine deep defects reproduced — failed as expected
+
+Added nine adversarial regression probes. The sealed check preserved all 181 prior passes and failed the nine new tests, confirming: code-index/delta order loss; mixed-size chunks exceeding the declared source-token budget; shebang/test/minified discovery drift; findings accepted outside assigned scope; worker-time source mutation reported as complete; weaker duplicate evidence overwriting stronger security evidence while STRIDE/CWE are dropped; non-cryptographic large-file cache keys; Fixer scope authorizing manual-review items; and symlink paths escaping the repository scope. Production patches must make these tests pass without editing the sealed check.
+
+## Iteration 12 — deep precision hardening — passed
+
+The nine adversarial regressions now pass. The sealed check exited 0 with all
+190 tests passing, generated assets current, preflight successful, and package
+inventory valid. Scope is realpath-contained, findings are chunk-bound, worker
+source mutation fails closed, token budgets are enforced per concrete chunk,
+evidence merges preserve security metadata, large files use SHA-256, and Fixer
+authorization excludes manual-review and report-only findings.
+
+## Iteration 13 — final PR-head verification — in progress
+
+The verified hardening commit was created by GitHub Actions, whose workflow token cannot recursively trigger pull-request workflows. This ledger-only commit intentionally triggers the Node 22/24 CI matrix and the sealed precision gate on the exact hardened tree.
+
+## Iteration 14 — final PR-head verification — passed
+
+On head `8088a10928bea6e2257bff8f33fb51788eb89608`, the PR-triggered sealed precision gate passed, Node 22 CI passed, and Node 24 CI passed including package inventory, executable-bit, version, and help checks. This append-only entry records the verified result and triggers one final unchanged-code check on the completed loop ledger.
+
+## Iteration 15 — post-hardening resume audit — in progress
+
+A final static review found that a source mutation correctly fails the current chunk but can become the new baseline after `--resume` because the original pre-worker hash is overwritten or discarded on failure. The same review found that chunk status can still label a pending file as done in coverage, and the root-containment predicate rejects valid in-repository names beginning with `..`. Focused regressions will be added before patching these three edge cases.
+
+## Iteration 16 — post-hardening regressions — failed as expected
+
+The new tests preserved all 190 prior passes and failed exactly three assertions: a clean worker executed successfully after resuming source drift; a done chunk with a pending file produced `COMPLETE`; and `normalizeRunFiles` rejected an in-repository `..valid-source.js`. The test harness itself was corrected and rerun before accepting the coverage failure. Production changes now target only these confirmed behaviors.
+
+## Iteration 17 — resume integrity hardening — passed
+
+The three post-hardening regressions pass and the sealed check exited 0 with
+all 193 tests passing. Per-run source baselines now survive failed attempts,
+resumed drift is rejected before worker dispatch, coverage completion requires
+per-file done evidence, and valid in-repository names beginning with `..` no
+longer collide with the parent-directory escape check.
+
+## Iteration 18 — final 193-test PR-head verification — in progress
+
+The verified resume-hardening commit `0a293c4361ab46da24daaacd68bdda0432afedec` was created by GitHub Actions, so this append-only human-authored ledger commit triggers the pull-request Node 22/24 matrix and sealed precision gate on the exact 193-test hardened tree.
+
+## Iteration 19 — final 193-test PR-head verification — passed
+
+On head `4a767fecbea7bb2d43e477e08f5e4d774bd16231`, the PR-triggered sealed precision gate passed, Node 22 CI passed, and Node 24 CI passed including generated-asset checks, preflight, package inventory, executable-bit, version, and help verification. Every ledger item is complete; this atomic ledger-close commit changes no production or test code.

.loop-history/precision-first-2026-08-17/progress.md

@@ -0,0 +1,24 @@
+# Progress
+
+- [x] Centralize supported source extensions and align triage with code-index.
+- [x] Preserve risk-prioritized file order through state initialization and expansion.
+- [x] Add adaptive source-token chunk sizing with an explicit override.
+- [x] Fail closed when assigned files disappear and keep coverage truthful.
+- [x] Tighten findings schema for non-empty cross-references and security evidence.
+- [x] Remove the Hunter/Skeptic rate-limit contradiction and make examples conditional.
+- [x] Add precision-protocol documentation and regression tests.
+- [x] Regenerate validators and pass the sealed loop check.
+- [x] Open a draft PR and confirm GitHub Actions passes.
+- [x] Audit scope integrity from discovery through Referee and Fixer authorization.
+- [x] Preserve risk order through delta selection and low-confidence expansion.
+- [x] Enforce the source-token budget on every actual chunk, including mixed-size inputs.
+- [x] Align extensionless shebang discovery with indexing and dependency expansion.
+- [x] Audit state, hash-cache, retry, resume, and failure semantics for stale or false coverage.
+- [x] Add adversarial regression tests for every confirmed deep-audit defect.
+- [x] Re-run the sealed gate and confirm all PR-triggered CI checks pass.
+- [x] Preserve the original pre-worker source hash across failed retries and resume.
+- [x] Reject resumed chunks when assigned source content drifted after a failed worker.
+- [x] Ensure chunk status alone can never report a pending file as completed coverage.
+- [x] Accept valid in-repository paths whose basename starts with two dots while still rejecting escapes.
+- [x] Add regression tests for the post-hardening resume and coverage edge cases.
+- [x] Re-run the sealed gate and final PR-triggered CI checks.

.loop-history/precision-first-2026-08-17/task.md

@@ -0,0 +1,22 @@
+# Task: precision-first Bug Hunter optimization
+
+Improve Bug Hunter so it catches real behavioral and security bugs with less wasted context, faster deterministic scoping, and stricter evidence validation.
+
+## Done criterion
+
+The task is done only when the sealed `.loop/check.sh` exits 0 after all of the following are true:
+
+1. Source-language discovery is centralized so triage and code-index cannot silently drift.
+2. Risk-prioritized input order survives state initialization and delta expansion.
+3. Worker chunk sizing adapts to a bounded source-token budget unless the caller explicitly overrides it.
+4. Missing files fail the scan closed instead of being reported as completed coverage.
+5. Security findings require concrete STRIDE/CWE evidence and non-empty cross-references.
+6. Skeptic guidance no longer auto-dismisses exploitable authentication or abuse-rate-limit failures.
+7. Calibration examples load only when useful instead of on every chunk.
+8. Regression tests, generated validators, preflight, and package inventory all pass.
+
+## Sealed check
+
+SHA-256: `6076d770c0ef7af821af66ac0a9559225fd4bea4bec9442cbf6352cd11091f0a`
+
+This file and `.loop/check.sh` are immutable after setup.

.loop/check.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+required_files=(
+  scripts/benchmark-suite.cjs
+  scripts/adaptive-policy.cjs
+  scripts/hybrid-verifier.cjs
+  scripts/evidence-cache.cjs
+  scripts/retrieval-planner.cjs
+  scripts/tests/world-class-protocol.test.cjs
+  docs/world-class-protocol.md
+  schemas/benchmark-report.schema.json
+  schemas/adaptive-plan.schema.json
+  schemas/verification-report.schema.json
+  schemas/retrieval-plan.schema.json
+  evals/benchmark/public-manifest.json
+  evals/benchmark/private-labels.json
+  evals/benchmark/golden-runs.json
+  evals/benchmark/triage-sample.json
+  evals/benchmark/verification-plan.json
+  evals/benchmark/index-sample.json
+  evals/benchmark/hypotheses-sample.json
+)
+
+for file in "${required_files[@]}"; do
+  if [[ ! -f "$file" ]]; then
+    echo "ASSERTION FAILED: required world-class protocol file is missing: $file" >&2
+    exit 1
+  fi
+done
+
+pnpm check:generated
+pnpm test
+
+rm -rf .bug-hunter/world-class-check
+mkdir -p .bug-hunter/world-class-check
+
+node scripts/benchmark-suite.cjs validate-public \
+  --manifest evals/benchmark/public-manifest.json
+node scripts/benchmark-suite.cjs score \
+  --manifest evals/benchmark/public-manifest.json \
+  --labels evals/benchmark/private-labels.json \
+  --runs evals/benchmark/golden-runs.json \
+  --output .bug-hunter/world-class-check/benchmark-report.json
+node scripts/schema-validate.cjs benchmark-report \
+  .bug-hunter/world-class-check/benchmark-report.json
+
+node scripts/adaptive-policy.cjs plan \
+  --triage evals/benchmark/triage-sample.json \
+  --benchmark .bug-hunter/world-class-check/benchmark-report.json \
+  --profile auto \
+  --security true \
+  --output .bug-hunter/world-class-check/adaptive-plan.json
+node scripts/schema-validate.cjs adaptive-plan \
+  .bug-hunter/world-class-check/adaptive-plan.json
+
+node scripts/hybrid-verifier.cjs run \
+  --repo-root . \
+  --plan evals/benchmark/verification-plan.json \
+  --output .bug-hunter/world-class-check/verification-report.json
+node scripts/schema-validate.cjs verification-report \
+  .bug-hunter/world-class-check/verification-report.json
+
+node scripts/retrieval-planner.cjs plan \
+  --index evals/benchmark/index-sample.json \
+  --hypotheses evals/benchmark/hypotheses-sample.json \
+  --max-tokens 12000 \
+  --max-files 5 \
+  --output .bug-hunter/world-class-check/retrieval-plan.json
+node scripts/schema-validate.cjs retrieval-plan \
+  .bug-hunter/world-class-check/retrieval-plan.json
+
+node scripts/run-bug-hunter.cjs preflight --skill-dir .
+pnpm verify:package
+
+echo "LOOP CHECK PASSED: benchmark quality, adaptive policy, hybrid verification, content-addressed evidence reuse, retrieval planning, schemas, tests, preflight, and package inventory are valid."