diff --git a/config/qcoder-powerpack.json b/config/qcoder-powerpack.json index 44196a2..1b2b18a 100644 --- a/config/qcoder-powerpack.json +++ b/config/qcoder-powerpack.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "checkedAt": "2026-08-09T13:32:30-05:00", + "checkedAt": "2026-08-15T15:10:32-05:00", "policy": { "allowedLicenses": ["MIT", "Apache-2.0"], "defaultNetwork": "deny", @@ -13,7 +13,7 @@ "id": "qwen-code", "repository": "QwenLM/qwen-code", "source": "https://github.com/QwenLM/qwen-code", - "commit": "55e20db328248436ae65743986906ff1fbc5ea58", + "commit": "3119d53e4d922f1f906535f6f70c155ea44df875", "branch": "main", "license": "Apache-2.0", "licensePath": "LICENSE", @@ -49,7 +49,7 @@ "id": "serena", "repository": "oraios/serena", "source": "https://github.com/oraios/serena", - "commit": "946ad9817875cbf46b308423296c33eb65e3e728", + "commit": "93ec043105f5ee4f5ff64ea0158041500d2cdc65", "branch": "main", "license": "MIT", "licensePath": "LICENSE", @@ -67,7 +67,7 @@ "id": "ast-grep", "repository": "ast-grep/ast-grep", "source": "https://github.com/ast-grep/ast-grep", - "commit": "e8c70a7c7a6f8b73827e507b65201da8cea0ab79", + "commit": "55ff25956754931189d84672cefdf9bb5c7d362c", "branch": "main", "license": "MIT", "licensePath": "LICENSE", @@ -93,7 +93,7 @@ "id": "goose", "repository": "aaif-goose/goose", "source": "https://github.com/aaif-goose/goose", - "commit": "064244e6bddf641876676f054a006b7da1da5182", + "commit": "3810898a7447ec3299be72e223d3570a7aabf0ab", "branch": "main", "license": "Apache-2.0", "licensePath": "LICENSE", @@ -105,7 +105,7 @@ "id": "openhands-agent-sdk", "repository": "OpenHands/software-agent-sdk", "source": "https://github.com/OpenHands/software-agent-sdk", - "commit": "684ea6a07041b8d049813e375675821a57fdf5ed", + "commit": "23ee276f1c68f08123349d103754380f627d20c8", "branch": "main", "license": "MIT", "licensePath": "LICENSE", @@ -134,7 +134,7 @@ "id": "browser-use", "repository": "browser-use/browser-use", "source": "https://github.com/browser-use/browser-use", - "commit": "32601887cfbc9f4f1e3cad3e2b678e56aeaeaae4", + "commit": "f3298c559aabb327a61cf6a9caef5ea3462f45de", "branch": "main", "license": "MIT", "licensePath": "LICENSE", @@ -164,7 +164,7 @@ "id": "spec-kit", "repository": "github/spec-kit", "source": "https://github.com/github/spec-kit", - "commit": "684b3d8e05263a7c1948d3d0699ab1cb4f77c3d5", + "commit": "bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c", "branch": "main", "license": "MIT", "licensePath": "LICENSE", @@ -196,7 +196,7 @@ "id": "pr-agent", "repository": "qodo-ai/pr-agent", "source": "https://github.com/qodo-ai/pr-agent", - "commit": "064a305c8aac1543edf63b5a6baadcdd942831ac", + "commit": "7550d0aebb81c2210f4cb7bf040778d969df297b", "branch": "main", "license": "MIT", "licensePath": "LICENSE", @@ -208,7 +208,7 @@ "id": "superpowers", "repository": "obra/superpowers", "source": "https://github.com/obra/superpowers", - "commit": "44c9b2d6e889982ac18c27d05a19fefe335194e1", + "commit": "b36e0829c6d0140e93cfef2ca599b1b07d4a7797", "branch": "main", "license": "MIT", "licensePath": "LICENSE", @@ -224,7 +224,7 @@ "id": "nuclei", "repository": "projectdiscovery/nuclei", "source": "https://github.com/projectdiscovery/nuclei", - "commit": "dfdfa5fd65503a3884f2098a1c9d4d5f28bf1756", + "commit": "265b3a3dec374741614e342f813c10f8b38d2bb7", "branch": "dev", "license": "MIT", "licensePath": "LICENSE.md", @@ -240,7 +240,7 @@ "id": "garak", "repository": "NVIDIA/garak", "source": "https://github.com/NVIDIA/garak", - "commit": "cafbe992780df70015de7295ca026b70c4629ada", + "commit": "bb1cc47a0cd6ae49971598b879914fbdc04227d0", "branch": "main", "license": "Apache-2.0", "licensePath": "LICENSE", @@ -257,7 +257,7 @@ "id": "promptfoo", "repository": "promptfoo/promptfoo", "source": "https://github.com/promptfoo/promptfoo", - "commit": "49c0f6d77496c022c6d32e362522993bb0d72d42", + "commit": "fded938b65a81e12070a66e90ca4ad2d42a8062e", "branch": "main", "license": "MIT", "licensePath": "LICENSE", diff --git a/docs/UPSTREAM_REVIEW_20260815.md b/docs/UPSTREAM_REVIEW_20260815.md new file mode 100644 index 0000000..9fa8604 --- /dev/null +++ b/docs/UPSTREAM_REVIEW_20260815.md @@ -0,0 +1,60 @@ +# QCoder upstream review — 2026-08-15 + +This review covers every upstream head change detected by +`node scripts/validate-powerpack.mjs --online` before the manifest pins were +advanced. GitHub's compare and contents APIs were queried against each exact +old/new commit pair. + +## Decision boundary + +- All 12 target commits are linear descendants of their recorded pins + (`status=ahead`, `behind_by=0`). +- Every license file at the exact target commit has the same SHA-256 digest as + the manifest's reviewed MIT or Apache-2.0 license. +- This change advances provenance commits only. Exact installable package + versions are unchanged, so no new upstream source is installed or executed. +- QCoder, SOL, workspace, network, credential, and authorized-security gates + remain authoritative. A repository pin grants no runtime authority. +- GitHub's compare response caps file details at 300 paths. The Qwen Code and + Goose file counts below therefore mean `300+`; their risk classification also + uses commit subjects and posture, not a claim of exhaustive file inspection. + +## Reviewed changes + +| Upstream | Posture | Commits | Files | License | Risk and decision | +| ------------------------------ | ---------: | ------: | ----: | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `QwenLM/qwen-code` | integrated | 180 | 300+ | Apache-2.0 unchanged | Elevated source churn across CLI, SDK, browser, channels, review tooling, and CI. Accept as a provenance head only; keep `@qwen-code/qwen-code@0.21.8` exact and preserve QCoder/SOL controls. | +| `oraios/serena` | integrated | 12 | 18 | MIT unchanged | Low-moderate: dependency cleanup, Dart notification handling, and prompt synchronization. Accept provenance head; keep `serena-agent==1.6.1` exact and the bounded tool allowlist. | +| `ast-grep/ast-grep` | integrated | 7 | 7 | MIT unchanged | Low-moderate: dependency bumps, embedded-language outline support, and broken-pipe behavior. Accept provenance head; keep `@ast-grep/cli@0.45.1` exact. | +| `aaif-goose/goose` | reference | 76 | 300+ | Apache-2.0 unchanged | Moderate: OAuth transport, MCP registration, agent-loop, and adversary-inspection changes. Accept as non-executing reference material only. | +| `OpenHands/software-agent-sdk` | reference | 29 | 98 | MIT unchanged | Moderate: shell AST/security semantics, routed-model metadata, profile validation, and automation callbacks. Accept as non-executing reference material only. | +| `browser-use/browser-use` | reference | 22 | 34 | MIT unchanged | Low-moderate: MCP server and generated-skill changes plus dependency maintenance. Accept as non-executing reference material only. | +| `github/spec-kit` | reference | 60 | 126 | MIT unchanged | Moderate: workflow validation, catalog additions, and release changes. Accept as non-executing spec-pattern reference only. | +| `qodo-ai/pr-agent` | reference | 6 | 19 | MIT unchanged | Low: documentation corrections, reasoning fallback, and model support. Accept as non-executing review-pattern reference only. | +| `obra/superpowers` | reference | 1 | 40 | MIT unchanged | Moderate: a broad v6.3.0 release adds agent integrations and workflow changes. Accept as non-executing workflow reference only. | +| `projectdiscovery/nuclei` | sidecar | 11 | 13 | MIT unchanged | Moderate: raw request semantics, proxy behavior, parser state, and Go dependencies. Accept provenance head; execution remains a separately authorized sidecar action. | +| `NVIDIA/garak` | sidecar | 36 | 25 | Apache-2.0 unchanged | Low-moderate: detector robustness, analysis metrics, and plugin cache changes. Accept provenance head; keep `garak==0.16.0` exact and separately authorized. | +| `promptfoo/promptfoo` | reference | 62 | 234 | MIT unchanged | Moderate: MCP client, dependency/lockfile, examples, and CI changes. Accept as reference only; installation remains withheld by the existing high-transitive-audit policy. | + +## Exact reviewed targets + +```text +qwen-code 3119d53e4d922f1f906535f6f70c155ea44df875 +serena 93ec043105f5ee4f5ff64ea0158041500d2cdc65 +ast-grep 55ff25956754931189d84672cefdf9bb5c7d362c +goose 3810898a7447ec3299be72e223d3570a7aabf0ab +openhands-agent-sdk 23ee276f1c68f08123349d103754380f627d20c8 +browser-use f3298c559aabb327a61cf6a9caef5ea3462f45de +spec-kit bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c +pr-agent 7550d0aebb81c2210f4cb7bf040778d969df297b +superpowers b36e0829c6d0140e93cfef2ca599b1b07d4a7797 +nuclei 265b3a3dec374741614e342f813c10f8b38d2bb7 +garak bb1cc47a0cd6ae49971598b879914fbdc04227d0 +promptfoo fded938b65a81e12070a66e90ca4ad2d42a8062e +``` + +## Verification + +The updated manifest must pass the offline validator, the online drift/license +validator, both npm audits, the full regression suite, and the complete release +verification before publication. diff --git a/scripts/autonomy-tick.mjs b/scripts/autonomy-tick.mjs index 0d588a8..76477c6 100644 --- a/scripts/autonomy-tick.mjs +++ b/scripts/autonomy-tick.mjs @@ -111,7 +111,7 @@ function main() { const summary = { schemaVersion: 1, checkedAt: new Date().toISOString(), - repository: "ECHO-OMEGA-PRIME/echo-qcoder", + repository: "echoomegaprime/echo-qcoder", ...summarizeChecks(checks), }; mkdirSync(dirname(options.output), { recursive: true }); diff --git a/scripts/tests/autonomy-tick.test.mjs b/scripts/tests/autonomy-tick.test.mjs index 028356b..232f0b8 100644 --- a/scripts/tests/autonomy-tick.test.mjs +++ b/scripts/tests/autonomy-tick.test.mjs @@ -53,6 +53,12 @@ test("scheduled workflow reconciles one persistent autonomy issue", () => { assert.match(dependabot, /package-ecosystem: "github-actions"/u); }); +test("autonomy evidence identifies the canonical repository", () => { + const tick = readFileSync(resolve(root, "scripts/autonomy-tick.mjs"), "utf8"); + assert.match(tick, /repository: "echoomegaprime\/echo-qcoder"/u); + assert.doesNotMatch(tick, /repository: "ECHO-OMEGA-PRIME\/echo-qcoder"/u); +}); + test("HAMMER fallback installs a six-hour bounded task with issue reconciliation", () => { const installer = readFileSync(resolve(root, "scripts/install-autonomy-task.ps1"), "utf8"); const runner = readFileSync(resolve(root, "scripts/run-autonomy-tick.ps1"), "utf8");